, 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0xff], @random="2a97e74a12af", [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x7, r0, 0x1}) readlinkat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/125, 0x7d) sendmsg$nl_route(r0, &(0x7f0000663000)={&(0x7f0000b1dff4)={0x10}, 0xc, &(0x7f00007b0000)={&(0x7f0000077000)=@ipv6_getaddr={0x18, 0x16, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, []}, 0x18}, 0x1}, 0x0) [ 95.008357] binder: 14604:14609 got new transaction with bad transaction stack, transaction 311 has target 14604:0 [ 95.018988] binder: 14604:14609 transaction failed 29201/-71, size 0-0 line 2875 [ 95.023267] binder: release 14593:14608 transaction 308 out, still active [ 95.033559] binder: unexpected work type, 4, not freed [ 95.038872] binder: undelivered TRANSACTION_COMPLETE [ 95.044487] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.056884] binder: release 14604:14609 transaction 311 out, still active [ 95.063978] binder: unexpected work type, 4, not freed [ 95.069313] binder: undelivered TRANSACTION_COMPLETE [ 95.074442] binder: undelivered TRANSACTION_ERROR: 29201 [ 95.079988] binder: send failed reply for transaction 308, target dead [ 95.086692] binder: send failed reply for transaction 311, target dead [ 95.101580] binder: 14621:14633 transaction failed 29189/-22, size 40-8 line 2848 [ 95.117397] binder: 14627:14630 got new transaction with bad transaction stack, transaction 317 has target 14627:0 [ 95.128093] binder: 14627:14630 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:04 executing program 3: r0 = socket(0x11, 0x2, 0x0) setsockopt(r0, 0x107, 0x1, &(0x7f0000dfaff0)="010000000000060000071a00009139cc", 0x10) close(r0) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0) 2018/03/02 11:09:04 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:04 executing program 2: socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000340)={'bpq0\x00', 0x7b58}) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000680)='r', 0x1, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff9) request_key(&(0x7f0000000100)='cifs.spnego\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000180)='user\x00', 0xfffffffffffffffe) r2 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r3 = request_key(&(0x7f0000000380)="77fbeea223dee444ab5e0b74064c63fe3390c49554f7a64c3d3a1f214a2915276ee3642f0da7802762965c050502859acdfc7a335ffbeb784acf0aaf4382c931cd284769e5b5769cf95cc2817cc9b95c9a58e8a32855c7b7eb8cafab39fa332e67ec541ec6aa34bf9f328ae8df9be84a25487cd7019713f5edc9b1c52d7d3ce994faf5074603fbfe140676776cfecd4a60b8889e40fa40ca46cfc608f141f957b59ebdd048f60518aae07b73fbb5229603a9d808d6323b731aa82562b6a292cbcdb6d3ad72db1c76e8420ed8d18d9b42fb0e5ae61b262d0a118d1c96d202e808b495fb3d76d7fd908e5749baab9b7856c574e792e6f30d63a9b99c68d7053e13fad2cdae79106512eb04644412dc8761d074fec3238f210e6b0aa7bae8f6ca40a75a1f629a922cedc8e7445b0222b27b8d09e338330ebd223230fcdfdf85a548687b0a0151898ed8158d52d68244afcd44e36edb529b00dc2d29dc5483d98ea18d8040494ce2228844a03dd8cb28b250e103fdd0a932b8e85291", &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000002c0)='/*proc\x00', 0xfffffffffffffffb) keyctl$unlink(0x9, r3, r2) keyctl$set_timeout(0xf, r1, 0x20001000) 2018/03/02 11:09:04 executing program 6: r0 = getpgrp(0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) rt_tgsigqueueinfo(r0, r1, 0x1d, &(0x7f00004ca000)={0x0, 0x0, 0x1}) r2 = socket$nfc_raw(0x27, 0x3, 0x0) r3 = signalfd4(r2, &(0x7f0000000000)={0xfffffffffffffdb0}, 0x8, 0x80800) read(r3, &(0x7f0000b0a000)=""/128, 0x80) 2018/03/02 11:09:04 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:04 executing program 5: r0 = socket$inet6(0xa, 0x4, 0x0) fcntl$dupfd(r0, 0x404, 0xffffffffffffffff) 2018/03/02 11:09:04 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x12) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f00009be000), 0x4) 2018/03/02 11:09:04 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f00000004c0)=[{&(0x7f0000000280)="ce71cd27aaac01b56619e8bfb0acd35ae6ad0c3cbeef233c2030bba788d3bc8a4fd37f72abd4c29c3abe08937913c230838f5336e18b5c39d3b227ac677f1b9b31993cfd039c7b5efce6475e1927cef562194a87ee6eb7c904f20f8c28f12eaf3c19df0ba620ef6b460e3df6d68f2a2f2ff78a3b9e3a1f83379fb8a230fc63b5f79e9f4e45d12828bb8dc69e03f50cb1759cf183d9fc7369b71bdc1b4664071386418bd78ee5990f85c06efb4f5768f5ddd44f5c70572b16cce312a2eea8622e", 0xc0}, {&(0x7f0000000080)="f2912b34f73819fef5fcd0a3d0fdbfd2b950acc7d07848a5fe8d5cda709f4f8d83772f1c7f1d59c1830d7178583c94a30129834f9529b0e31d72e3e9bb561d506686ccae709711d119e182dfadbd6ef5c9f66b9ddee1f98dad5f761a9942e96d2f6a8033e1495a46f530f17e089341ee3070a9fb8c", 0x75}, {&(0x7f0000000340)="fda30ff0313a0980d8767879781b6d5d9620431b309dddbd29610cfca6d92f1026d13fca80034a5fc1efb80bd33f44a40b9c724ad388492fc62a75bfe007c53d56f8021706bf77461fe23eb105218d97584c57382169e075ad841d8d2d3cc1ee4bd3e14d1c14ea76b50ef94956955ddc1639f5ca5939691398808f694595f122b5efd601a818e0eab338740bee5435238d4c371d92d62993f246c9fec581a57b128aa76c86f2de95e8", 0xa9}, {&(0x7f0000000400)="251899934acb286571feb2aacb4ab8efac82886bb0cc7d5a0a8d4b01ac4c18c6605446fdbb452e25800dd9349481e6743cf1b039f24c3f61cfa63baeb1ac01c5fef60b011c54de32064a04ebfbbd86bb238189d9f637b61069198ded7f9644f0cafb7e3a9b2f5767b33dd2f7ae49d221b8e96949c571c0a598ddf06b4e8b510bb8fe5b4049f8e581eb9ddaeaf86cfeada72f0f5f755fb22546075dd71cae39d64a817c428445ea7116da3642079a56c4ca0d", 0xb2}], 0x4, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="009f5df0364fb7c80cc2e4065cb826465054e62443968f1024c26d1c6ec824c122f8c8cfffa23cb3b12aebf76b66db7c695fd66e83e4d08ddb06aa62bdaa971b7f8a1196b339e7d5d110e9c5202f2f4c17efeab47566e76e1420ad9e96f16d7dc0b6e57d3ee76b98c68f461bae181edec5407108c57d99ea735e1e11ae13d56100123e0491b7af5712302f680659c177f5d66424ae7dfd090cc169257ba32ec76570d1d66c994dad43f88cb26fb54e0d982873f9d46bd2c3d2838367e4a2d8392cfb2a6b34526bec9372bcd6fd1bd3a96fb874c537d1f76791944b070d29f078"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x5, &(0x7f0000000240)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x17, &(0x7f0000000200)={r2, r3/1000+30000}, 0x8) [ 95.156256] binder: release 14627:14630 transaction 317 out, still active [ 95.163340] binder: unexpected work type, 4, not freed [ 95.165555] binder: 14621:14633 transaction failed 29189/-22, size 40-8 line 2848 [ 95.168657] binder: undelivered TRANSACTION_COMPLETE [ 95.168669] binder: undelivered TRANSACTION_ERROR: 29201 [ 95.168709] binder: send failed reply for transaction 317, target dead [ 95.193733] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.199454] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:04 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="8ad13bc6e44241ecd886c52aee887495e9d06fdc0e5e68045969922446cea20df9a40243da611370f077b318cad452f3446783f442dd1af20cc0f60c0086ddee10ff5887301146008c1d830b1e97b0e48481c8dd4b2cbee9fe92", 0x5a) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x53719987f95d7688) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000180)=ANY=[@ANYRES32=0x0, @ANYBLOB="4d0000003fde31b6b732879730442ff12f4eaf312c52b0363acb37b28e5592a51cc205164af44006356e3c0d547128221112daf7b9162b2a7f82ac2ecf22fed5bc5c3de57c686ef6b9f957b4e1a7d685c5"], &(0x7f00000000c0)=0x55) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000200)={r2, 0x9}, 0x8) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000280)=@add_del={0x2, &(0x7f0000000240)='vcan0\x00', 0x6}) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000002c0)={r1, r1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000dc1000), 0x0) [ 95.226709] audit: type=1400 audit(1519988944.594:123): avc: denied { create } for pid=14652 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_scsitransport_socket permissive=1 [ 95.260563] binder: 14644:14651 got new transaction with bad transaction stack, transaction 323 has target 14644:0 2018/03/02 11:09:04 executing program 4: pipe(&(0x7f0000000280)={0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000ff5000)={0xffffffffffffffff, 0xffffffffffffffff}) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='security.selinux\x00', &(0x7f0000000080)=""/216, 0xd8) recvmsg(r2, &(0x7f0000b0bfc8)={&(0x7f0000df6a59)=@ax25, 0x10, &(0x7f0000000000)=[], 0x0, &(0x7f000048cf31)=""/180, 0xb4}, 0x2) sendmsg$unix(r1, &(0x7f0000000fc8)={&(0x7f0000238ff8)=@abs, 0x8, &(0x7f0000008000)=[], 0x0, &(0x7f0000965000)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) 2018/03/02 11:09:04 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0x0, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) [ 95.271195] binder: 14644:14651 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:04 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0x0, 0x0, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) [ 95.302339] binder_alloc: 14644: binder_alloc_buf size 2316750164561231920 failed, no address space [ 95.311788] binder_alloc: allocated: 48 (num: 1 largest: 48), free: 12240 (num: 1 largest: 12240) [ 95.320911] binder: 14653:14668 transaction failed 29201/-28, size 40-2316750164561231880 line 2963 [ 95.329008] binder: release 14644:14651 transaction 323 out, still active [ 95.337190] binder: unexpected work type, 4, not freed [ 95.342497] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:04 executing program 6: r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r0, 0x0, 0x0) socketpair$ax25(0x3, 0x3, 0xcc, &(0x7f0000000040)) add_key$user(&(0x7f0000000300)='user\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000200)='p', 0x1, r0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x10001, 0x0) ioctl$sock_ipx_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={"debc0a91377fda1b57dc06ca59a347dc", {0x4, 0x3f, 0x3, "72507b7d7f71", 0x2}}) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000240)=0x114, 0x4) 2018/03/02 11:09:04 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, {0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x0, [0x0, 0x0, 0x8001]}, 0x5c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x60, &(0x7f0000000000), 0xffffffffffffffb7) r2 = fcntl$dupfd(r1, 0x406, r0) symlinkat(&(0x7f00000000c0)='./file0\x00', r2, &(0x7f0000000100)='./file0\x00') openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) 2018/03/02 11:09:04 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:04 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000380)=@filter={'filter\x00', 0xe, 0x4, 0x31c, 0xffffffff, 0x0, 0x110, 0x0, 0xffffffff, 0xffffffff, 0x288, 0x288, 0x288, 0xffffffff, 0x4, &(0x7f0000000340), {[{{@uncond, 0x0, 0xb0, 0x110, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x1000, [0x4, 0x10001, 0x7, 0x101, 0x80000001, 0xa5], 0x6, 0x31e, 0x40}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x8, [0x6, 0x80, 0x800, 0x2af, 0xfffffffffffffe01, 0x6e2], 0x0, 0x800, 0xffff}, {0x39a, [0x100000000, 0x7, 0x9, 0x3, 0x8, 0xfff], 0x9, 0x9a, 0x7f}}}}, {{@ip={@loopback=0x7f000001, @dev={0xac, 0x14, 0x14}, 0x0, 0x0, 'bridge0\x00', 'gretap0\x00'}, 0x0, 0x70, 0x94, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}, {{@ip={@remote={0xac, 0x14, 0x14, 0xbb}, @remote={0xac, 0x14, 0x14, 0xbb}, 0x0, 0x0, 'ip6tnl0\x00', 'ip6gretap0\x00'}, 0x0, 0xc0, 0xe4, 0x0, {}, [@common=@addrtype={0x2c, 'addrtype\x00', 0x0, {0x10, 0x8}}, @common=@inet=@socket3={0x24, 'socket\x00', 0x3, 0x2}]}, @REJECT={0x24, 'REJECT\x00'}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x378) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00009a2ff0)={0x2, 0x4e23, @empty}, 0x10) [ 95.347645] binder: undelivered TRANSACTION_ERROR: 29201 [ 95.353182] binder: send failed reply for transaction 323, target dead [ 95.373541] binder: 14653:14690 transaction failed 29189/-22, size 40-2316750164561231880 line 2848 [ 95.412145] binder_alloc: 14693: binder_alloc_buf, no vma [ 95.414822] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.417890] binder: 14693:14695 transaction failed 29189/-3, size 40-8 line 2963 [ 95.429788] Cannot find set identified by id 4096 to match [ 95.437882] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:04 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000aef9f9)={{0x80}, "706f7274310000004000000000000000000000d600fffffff00000000000000000000000000000000000000700", 0xfffffffff7fffffd, 0x3}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x800, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f0000000100)={0x0, 0x9, 0x4, &(0x7f00000000c0)}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) r3 = getpgrp(0xffffffffffffffff) fcntl$setownex(r1, 0xf, &(0x7f0000000180)={0x3, r3}) connect$packet(r1, &(0x7f0000000140)={0x11, 0x15, r2, 0x1, 0x8, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x14) r4 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x5, 0x20000) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000385f58)={{0x80}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfbfffffffffffffd}) setsockopt$netrom_NETROM_IDLE(r4, 0x103, 0x7, &(0x7f0000000200)=0x7f, 0x4) 2018/03/02 11:09:04 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0x0, 0x0, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:04 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f00005ebfec)={0x1, 0xa, 0x1, 0x5, 0x14}, 0x2c) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x8) ioctl$TIOCNXCL(r1, 0x540d) ioctl$int_out(r0, 0x20000002, &(0x7f0000000040)) 2018/03/02 11:09:04 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x40000, 0x0) getsockopt$netlink(r1, 0x10e, 0x1, &(0x7f00000000c0)=""/216, &(0x7f00000001c0)=0xd8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000300)={0x0, 0x0}) mq_notify(r1, &(0x7f0000000340)={0x0, 0x3c, 0x5, @tid=r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x14, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="09631040", @ANYRES64=r2, @ANYBLOB="6b20af988150ae26e76ecaf91139ec572247d445920e2c1fc7ccb1738229d6fca9891d8c6b12e1cde71ccde23b5ca9871312a9332aca37e7491005a0a3fb806afcad8dce6f53a61ae13b0c77e954787e34b6d8a39ee29b79442889c256229180bfc83f60242e1eb8a23b506e94f04714cf9ed029807a1ade524385469b5f611781bca997df55cef6585c9b84e0c45727d67ee1897869a66a90a4a34e9a9ec64d1fe2d1d70b253f2754daa350e3b61b7d13d03ce57a9c8b60"], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:04 executing program 6: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffd) request_key(&(0x7f0000000180)="646e735f7265736f6c76657200a4fe45471ebd75ba447e9b877710745096abd0db97f3112140e9f581850748635ee6f24aa2df6c5bacca672a70540e8e44118468e48b7750b0e5a236bb71403c9b0784b7c9bca5cfce7765f6d51217d7215163d4f157c391e96ca59ea49088c785798ec57d541d8262c9662e33df93c9e9fd84fae8a798ded2dafc92acb6b2b3087945b14b2e746ec4c7717dcbba549b2f2dfa507adca049506b6b49e9efce6ca373e2a3702fdf96518be89c7704320806a14c02653effdf8cd7f49d83363d1c82e8d1", &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000000c0)='\x00', r0) 2018/03/02 11:09:04 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f00000004c0)=[{&(0x7f0000000280)="ce71cd27aaac01b56619e8bfb0acd35ae6ad0c3cbeef233c2030bba788d3bc8a4fd37f72abd4c29c3abe08937913c230838f5336e18b5c39d3b227ac677f1b9b31993cfd039c7b5efce6475e1927cef562194a87ee6eb7c904f20f8c28f12eaf3c19df0ba620ef6b460e3df6d68f2a2f2ff78a3b9e3a1f83379fb8a230fc63b5f79e9f4e45d12828bb8dc69e03f50cb1759cf183d9fc7369b71bdc1b4664071386418bd78ee5990f85c06efb4f5768f5ddd44f5c70572b16cce312a2eea8622e", 0xc0}, {&(0x7f0000000080)="f2912b34f73819fef5fcd0a3d0fdbfd2b950acc7d07848a5fe8d5cda709f4f8d83772f1c7f1d59c1830d7178583c94a30129834f9529b0e31d72e3e9bb561d506686ccae709711d119e182dfadbd6ef5c9f66b9ddee1f98dad5f761a9942e96d2f6a8033e1495a46f530f17e089341ee3070a9fb8c", 0x75}, {&(0x7f0000000340)="fda30ff0313a0980d8767879781b6d5d9620431b309dddbd29610cfca6d92f1026d13fca80034a5fc1efb80bd33f44a40b9c724ad388492fc62a75bfe007c53d56f8021706bf77461fe23eb105218d97584c57382169e075ad841d8d2d3cc1ee4bd3e14d1c14ea76b50ef94956955ddc1639f5ca5939691398808f694595f122b5efd601a818e0eab338740bee5435238d4c371d92d62993f246c9fec581a57b128aa76c86f2de95e8", 0xa9}, {&(0x7f0000000400)="251899934acb286571feb2aacb4ab8efac82886bb0cc7d5a0a8d4b01ac4c18c6605446fdbb452e25800dd9349481e6743cf1b039f24c3f61cfa63baeb1ac01c5fef60b011c54de32064a04ebfbbd86bb238189d9f637b61069198ded7f9644f0cafb7e3a9b2f5767b33dd2f7ae49d221b8e96949c571c0a598ddf06b4e8b510bb8fe5b4049f8e581eb9ddaeaf86cfeada72f0f5f755fb22546075dd71cae39d64a817c428445ea7116da3642079a56c4ca0d", 0xb2}], 0x4, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="009f5df0364fb7c80cc2e4065cb826465054e62443968f1024c26d1c6ec824c122f8c8cfffa23cb3b12aebf76b66db7c695fd66e83e4d08ddb06aa62bdaa971b7f8a1196b339e7d5d110e9c5202f2f4c17efeab47566e76e1420ad9e96f16d7dc0b6e57d3ee76b98c68f461bae181edec5407108c57d99ea735e1e11ae13d56100123e0491b7af5712302f680659c177f5d66424ae7dfd090cc169257ba32ec76570d1d66c994dad43f88cb26fb54e0d982873f9d46bd2c3d2838367e4a2d8392cfb2a6b34526bec9372bcd6fd1bd3a96fb874c537d1f76791944b070d29f078"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x5, &(0x7f0000000240)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x17, &(0x7f0000000200)={r2, r3/1000+30000}, 0x8) 2018/03/02 11:09:04 executing program 2: io_setup(0x401, &(0x7f0000fa5000)=0x0) io_getevents(r0, 0x2, 0x2, &(0x7f0000af2fc0)=[{}, {}], &(0x7f0000fa5ff0)={0x0, 0xfffffffffffff000}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) ptrace$getregs(0xc, r1, 0x4ad, &(0x7f0000000100)=""/61) io_destroy(r0) 2018/03/02 11:09:04 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 95.460067] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.472828] Cannot find set identified by id 4096 to match 2018/03/02 11:09:04 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) [ 95.513611] binder_alloc: 14712: binder_alloc_buf, no vma [ 95.514999] binder: 14711:14718 BC_ACQUIRE_DONE u0000000000000000 no match [ 95.519372] binder: 14709:14719 transaction failed 29189/-3, size 40-2316750164561231880 line 2963 [ 95.536540] binder_alloc: 14712: binder_alloc_buf, no vma [ 95.542296] binder: 14712:14717 transaction failed 29189/-3, size 40-8 line 2963 2018/03/02 11:09:04 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:04 executing program 1: io_setup(0x7f, &(0x7f0000000040)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="812a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="bbd6e9dc870522feaab162ae1d8980b476a5d93e00d26ce6000000ca536cdd0f70b47771c18ea02e0505aea40ccf4ff05012d72ad8a5ddc28fb596f77e39e3c71d22c62662b91fce805339bf22b59f316ee039610f4faf18d34fb5d5c4026eaa46201d865de0734cde2248"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:04 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f00000004c0)=[{&(0x7f0000000280)="ce71cd27aaac01b56619e8bfb0acd35ae6ad0c3cbeef233c2030bba788d3bc8a4fd37f72abd4c29c3abe08937913c230838f5336e18b5c39d3b227ac677f1b9b31993cfd039c7b5efce6475e1927cef562194a87ee6eb7c904f20f8c28f12eaf3c19df0ba620ef6b460e3df6d68f2a2f2ff78a3b9e3a1f83379fb8a230fc63b5f79e9f4e45d12828bb8dc69e03f50cb1759cf183d9fc7369b71bdc1b4664071386418bd78ee5990f85c06efb4f5768f5ddd44f5c70572b16cce312a2eea8622e", 0xc0}, {&(0x7f0000000080)="f2912b34f73819fef5fcd0a3d0fdbfd2b950acc7d07848a5fe8d5cda709f4f8d83772f1c7f1d59c1830d7178583c94a30129834f9529b0e31d72e3e9bb561d506686ccae709711d119e182dfadbd6ef5c9f66b9ddee1f98dad5f761a9942e96d2f6a8033e1495a46f530f17e089341ee3070a9fb8c", 0x75}, {&(0x7f0000000340)="fda30ff0313a0980d8767879781b6d5d9620431b309dddbd29610cfca6d92f1026d13fca80034a5fc1efb80bd33f44a40b9c724ad388492fc62a75bfe007c53d56f8021706bf77461fe23eb105218d97584c57382169e075ad841d8d2d3cc1ee4bd3e14d1c14ea76b50ef94956955ddc1639f5ca5939691398808f694595f122b5efd601a818e0eab338740bee5435238d4c371d92d62993f246c9fec581a57b128aa76c86f2de95e8", 0xa9}, {&(0x7f0000000400)="251899934acb286571feb2aacb4ab8efac82886bb0cc7d5a0a8d4b01ac4c18c6605446fdbb452e25800dd9349481e6743cf1b039f24c3f61cfa63baeb1ac01c5fef60b011c54de32064a04ebfbbd86bb238189d9f637b61069198ded7f9644f0cafb7e3a9b2f5767b33dd2f7ae49d221b8e96949c571c0a598ddf06b4e8b510bb8fe5b4049f8e581eb9ddaeaf86cfeada72f0f5f755fb22546075dd71cae39d64a817c428445ea7116da3642079a56c4ca0d", 0xb2}], 0x4, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="009f5df0364fb7c80cc2e4065cb826465054e62443968f1024c26d1c6ec824c122f8c8cfffa23cb3b12aebf76b66db7c695fd66e83e4d08ddb06aa62bdaa971b7f8a1196b339e7d5d110e9c5202f2f4c17efeab47566e76e1420ad9e96f16d7dc0b6e57d3ee76b98c68f461bae181edec5407108c57d99ea735e1e11ae13d56100123e0491b7af5712302f680659c177f5d66424ae7dfd090cc169257ba32ec76570d1d66c994dad43f88cb26fb54e0d982873f9d46bd2c3d2838367e4a2d8392cfb2a6b34526bec9372bcd6fd1bd3a96fb874c537d1f76791944b070d29f078"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x5, &(0x7f0000000240)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x17, &(0x7f0000000200)={r2, r3/1000+30000}, 0x8) 2018/03/02 11:09:04 executing program 6: r0 = syz_open_pts(0xffffffffffffff9c, 0x1) ioctl$KIOCSOUND(r0, 0x4b2f, 0x8000) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0xffffffffffffffff) mount(&(0x7f0000907ff8)='./file0\x00', &(0x7f0000058ffd)='./file0\x00', &(0x7f0000c77ffa)="646178000365", 0x0, &(0x7f0000de9000)) 2018/03/02 11:09:04 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}, [0x6, 0x180, 0x7, 0x3, 0x3d7, 0x6, 0x6, 0x7fffffff, 0x1, 0x3, 0xfffffffffffffff7, 0x100, 0xfffffffffffffff9, 0x0, 0xffffffffffff3413]}, &(0x7f00000001c0)=0x108) ioctl$VT_ACTIVATE(r2, 0x5606, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000200)={r3, 0xffffffffffff8000}, 0x8) mmap$binder(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x811, r1, 0x0) pause() 2018/03/02 11:09:04 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f00005ebff8)=0x3f) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0xc000, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r3, 0x408c5333, &(0x7f0000000180)={0x4, 0x400, 0x4770, 'queue0\x00', 0x7fff}) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f0000000080)={0x3, r2}) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r1, 0xf, &(0x7f0000704000)={0x0, r0}) recvmsg(r2, &(0x7f000095cfc8)={&(0x7f0000893ff8)=@sco, 0x8, &(0x7f00000a4fb0)=[], 0x0, &(0x7f0000b30000)}, 0x0) dup2(r1, r2) tkill(r0, 0x15) getpeername$inet(r3, &(0x7f0000000100)={0x0, 0x0, @broadcast}, &(0x7f0000000140)=0x10) 2018/03/02 11:09:04 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:04 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x0) io_setup(0x20, &(0x7f00000000c0)) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000040)=@hopopts={0x0, 0x1, [], [@ra={0x5, 0x2, 0x708c5c55}, @jumbo={0xc2, 0x4, 0x30000}]}, 0x18) sendmmsg(r0, &(0x7f0000002e80)=[{{&(0x7f0000000100)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0x58, &(0x7f0000000080)=[{&(0x7f0000000180)="c4d2468e0ae87bc3adebec23f94c9a18c5f8009ff826f582bc57f760fd78bf63ed496a209ac2a36d89d6f237e317a357997507961964b2ac846a81910440a43c27c9", 0x42}, {&(0x7f0000000200)="17307ca8a093304b486574306a09bef43821f185a118595ecc3f3d9ec641447a316e6ae2b18437d6b2165b7ce1534ca82d139d3fc07fc21dd8013457be5b5e0f679d704e25b90e4f13b2941ff62eabb688639f", 0x53}], 0x2, &(0x7f0000000280)=[{0x100c, 0x119, 0x80000001, "d79cc72874eb329acc7f4aa6426a0123e60e6ea24f8beea9d0875c1706717ed2952ef3c0a53bdc7ab504ae1abce04e585c09fefbcd5e3461788ada2b4e1b33a2fe48352042703c0dd445c32ad93909846b2f2a6d76e382a523b1f59d9c11d19d3cd0a31a8ecf913d3265ed9dc993e738c9327ae07383533dbc8c4814a732cc4ac62cbc878fa9ef530a6580af4e816a8e02a9a3f712208b543fc568ab4fff503090dd2c0717af61273e7af98407becf809e736199ebe42def3bf9f5aff74bc1dcc6c1e35547ab47e485d6cbe3b0de53e28b3ea716a5a604516cf10be280c0906df2ce10eaf036ba8cadcbe7ecf91a6569e1418df9013a70b6abf7c333796df25055b4e24ef44e8cc21748214469190c3602b8857923fbbf7be125e4779111100aec2d9b4b32ea7e9530c59dd67ff53e4fefefd65de38df0950fc8c98a9b09ea5e349d925f279080b3106a353176eb2da57a9e488b690bcdde491c2028d3938df3ac3fdca8627bb1c627d8a4f52bf8f2e7c62823ecb2a000a0a97007dadf62f9e4363e22ea05d5a356e7d69462bb2cac0a6250bd483f1ab557cb0880d0b940e5fb5655e50fcfbaaf4d6ae3ae31b964f0cdac12f899aac04df26a034c3f1211a74b444c5e4ebde431c70800f1f64ff071b75f8219dab644230647721f36034aa1f74f14149a4e88bea8a8056613799a25431a7638917cf4765ec9d595c03f114be21181d5be45499fe4e615008127b18ee4d5f6cd3cacc18ec961de8a66bf9b887618b43cbc50d5111bf7c378301fbf24ad49adad5e690bebb2ecee21fbe6e792ae9d15a8e4adf64084b506f67541236d8a30ce8a201add25def8a29e22749a0e044142c6bc769ca69a5e93c26392d5b773011be12b335025824e84f0aa67a9ca8716b9e9c8288f1ab5a5588bc3ba2eba55ed3439ef483a371ce0c202e27eefceaa529870ffb97b28899d8e335909c3c4512b80c25bf2515fd2ff5f814b438b022c9d502c86683cfd7f5857a016d3f949707dbf2dd1d11022ed53501599281b3b38e31c0aa884a5982e6bc7216eb76dd9a3a0f20c27bbd9ddfe6d11b1b613c9cab520467e5041dd1bb5d9c2599c7f0f91e955731bc0a37239dbdedcc4f8cde88e54a6b94c14e8f3a513a02cc13a45127e14b5bfcbe16355277e0c03a5f8f1b02c167c59989d952398997ed4db1a164b5073f02b0ea91f1daceb7b783970e23373c23f131c7f6fa79f3d261ae7083c81d010bcc6bce9b7361788bf420b5474a2dfa4a19d661416b1e55548eb5a6f9fa5f9ba77ec17cc5618252a7d6fe226cda58deff380936180c9ed478616f378cdab9449499a24da0b865a71a5bdb606ed97b67190072824d6a41787aba355ad433673c954c13ddf2769dda7f05f318078ccde7fae9fa932a775660ac4e8b3d0c6d4259e88a1644ac339fd6337eb97dbae9d692ff88502dbe26a2747e21b436a1b039777c819df28108ed085b825026bad265ad536b4c1d8a4d53a42dcd0d214e93f9fedd6bf9402590cfaec86c063c484e60ace29ca5a196a21fdd08373161e9317f3478db5eb14920b82616e13941a2c612e62f5c5e954f3be0293007cfa6122711749b90c50c940fd71001bb080a7a4c5f7e9c4f8830cbfc9510f4b38732b14995028524efbcf1f0164d14469e74057325396cf1fd1c4c2969dda3174e423493a2fbdbd7da0ae3ea5a7e6ea25396813dcafd68b0f579a76b221b805682049dba50ab78d72335c74fb27660b9c4dbc570dbd89823e89656f421f82ff7b23ecae3322cbb4e88ff26cde9247ccc6cb32bf947f7836f9a11dc6ebc39bf16a45a19e73ee94b0bbe0f52c413d26a7636687f51d2f34c7f59f48650d0e29dd593cd665f796d894638693e8c7c28d92f16afa2f25778309e16718a7f13a66b4a82e1a325e89aac035f215f2471f6ae2352929e85dcd148d0b052df2aec15b24c8af1329be4b83d610868dc62c9ae06fc575c749b0c5bd02052038bde611112ddceac5ba22daada88fdae661e7475e13f03165db40b0cc82eaec90f3b79ae2a51f84fd8ca7a643c1dec9f0e16f8119536ae4c656bdfd6ed1dafc1056dee2ce00d22e75e9e4ec6c9c47f90ed18e3ae0fb10bd95ecbb49ac54f386490e59516f51650ced6250c734759a0ae07e946d9df1e1a1f0913c22164b48490fbb5a26195ec03e99dd53ddc9135ad3aca4215c6858a871323854e57f9cd8dfb79944c8e9c9fc10a9bd69e684f605d4c6b242b4ff880ed9b4a3437745773e962d094fd1867646c130cf55c300246e2b2a51a55571524b83ddb79b8d822fc311d47f198e018625a0442d7fd5952d6d3415bcc3347a8127335d398493823797e82b62006e76b041d95e06e99e9c7c96077a44b7d297d190a16fabc4f0037702a945075eb7cbd12a0fc47ccf883e826dfe7e9c751909f53a3ab05fba099b09ab32bcaee40382954dcb06386e06b77b21a33d0ec7dffe7e8079d23be1cdb1652054b9d7229e85196e3bd12e3de49bfa50c3a64b722b96d839a6631fb5e69754465fcd761b6e9e11d605eb2bc1f9e093ecf788b46341113e972852758d2969d86af54a5fc5da61d179f24dd7420c72f1cf3554b2c0aad38517b968b77af269c37f6a4309d1c4b47aacfb88e8c60f2b2d0730030c9b979d4c417881c44fcefafac58bf115144047db97ec2251a62f3d3e10b83d15bd3f3665edac96625db49d8acdb59922cbec11d3bdfd9955d05c28e5bd2bd1f2258e01681a3c09837e6da77de4aeaf6b7e1e873f00abd3cd346eb13969179b8c27c99900fb54f72249e31549879af12c5ed13ed1a54e646eab3edfac9038f9e949c473470a1515b7fd2c08bc9c5a60231fd80dda694533f5158f76414006b5a01f81b1764ad31712de096686e7e1b65de654d1b65c37320ac6f9a8751d37413df835c209f59d5ca92930cbba90fd4d66973141e36c0d123761f9c6b1d279c7d899a6d5728e0fde0821ef6166781943ad042ffc3991041bb87faf6803cd60e9d8766eb6951c9d8dc40bdc5b737716ec5d33b4f55d8bda56d5a218e155cd723012727d99ef4dc924773625cb161dc75182dea6093376976aff48e2aaa25f9467dbd7ca741fad72a0dccc15d4667beb3421c3ac0448294a0b5e477f9116a90e0054c1f070d2c3de636e5bb79e744a3e97b51b294fbfa0408176f7df10827e9c57b460d95365050287e8022d767795bc9af957bf75b520691cff559aa89fc4169e18f6b7aa9d7cd8f0f8e5180679ea850e1457ea52db850e4fe69a1c8bd385657d2c77ef4a0bf00d97ed14620353a8d9e525417acb10d4fcd5caafe0abed5dcd0b144695b0c25d3f48f404135fe6058b50ea761fbf43ae603e1becbdeab12a1e64b5d99a0836dff424d19f1704af639bd60547147f8c9b07c84fbeeb6f476b00cb509f44f38d86de4fe3ff0cf04c4b17d2f5ecd44f13e29aa16784a9179b4b727a122db22b20ecde4ee5f1b2a52a0da39d39a08b44211b355b66ecf743db977ef8cfb861f946c1ab0f5a2c417957a19a24149508cc07bfe62f099e98f6ae2c885454f4518e3c6c36a2de2a9469de3818bf22a071ad10639f5758442a1334a366afc08859278ff129ec9a6cfd188d4d73821d367df6ab494fa6256697527091861136ddf1ea4e2f7c3199c9af66136e7692dcfeb6c1ef59557b422cf40e948ca1c32fe9b4c1d525eab3d3f6b89d4847bef02bed5370190791345e837b549fedbb2b706b28950916c5721c255243d192e17c4b0aaa50646d12feebcb478d21e6a4d8cf3a091d752af7b0f27f89a50045b8676381e027609a9915b1ddc5bdc2c512f06b9cc246de22c0a2c257e5108fb58e1f7f4229ecbc250897ce945ab6728af67b13a7572160bea8fa6642476bbbf284dc2b84aebf85201780b2720e9746cad2ad97922ef819d1e45e662f6aaf13767e0b32fbfd8405d3d635ebc0d437c972a0f497ec15915a83037c246e19918f1fd788726c8da251dafd883419fe13c19b4ec8430ea74fba89acbe01dd050b9cae293b2d5f2db08a8eb1f22979da32e5afc52bf2b5511bc7f2e13d7e6fa26ca350279b1bee5e69e23f41ea096d9f58625ee6d7e6e397f1ecf2f8891a7789f53f24fcd0835abd031a1866ac0c39b126c836100ef43a54b541710400134dce9b35fbccc919490519f272ffc260d32b7603cd51cdadf931a3859fe38d1ac43cacc34e16fc678b5b05f53e60dc8f8041963aae1a44f81a4a60ccb14ad936e69909190d61fcc22727e4bc6887f8b851b28ed6bbbdd47b6f773b46636ffa7fbe635be25e9cc89a6be141dab3734be2104605fa86f19138e5261e71e422bb279d65ff446c0fd995233136ad90de6a681cb1f4290e18a741d465d363fdea57b5769356b55cc0635d4cdaae0ea0b8b65c9ad3b43825027d2f7eee6a1cc1318f1dbee2b86afe6fe8cc6462627f664a3982a983d60f0affe7247416ee5b0c2cdc5706862ca6d5e0040e63da433a3c981eefb1c9fa86c53632ad74440c33964a0075bca0c4953fc8ec0caafc440f96ed472c075b6227d7befbb3ce0bdb3fdd26d2b8197173bec2bd7cba01694baa16d442109519dc9a7e7a86678f20651cbab07d01e1c312291b2a654fa36bafcddeb035a47d73baf0bde63037cc459d0eb319797742f7b2d48f2221565c97d7d6df7821d8457b2620f44e08645cb2c0639b5535a2c720d6ba89a570d362d1e343797bf1508153d8893be82281ec4492f5568b45adaf876de6aeea432bef93eaf47a7d9ccac30dda20870a58f58b44f380f3ff1fe5c749e72ab73035782d03f43ef3f61c50f2f5ac2b0bf206d4e2f6bce583e26ea79b3a12f6e7927253b11668c9589560f6561a48c8f49e2312b5b394cce6fb99fbf5bd66a9af006492db25cf9be489737950ee86745b6abba15dc6c336f0d46bb7cf73ffb24e72d9ea1237ee1b81c72f405871d3d1a599a45f52f2563da39feeb99a8a5900964efee125923b7d8266bdb7b3088c4939291f9fa359ac20d2dfc3827318a8b6bc87ff7a3ce6370f0d767a4da3b9fa7f255ccf1a88ff1c77ba6c93e515f23e7437f1b593bf62a7fec477e4b6e45e5b84d5ce9e8a1ec29d948d53b1d7e98a6de5eb37ab4aa9d001fa7c4e43965f3e5e28a48266b3a32bd94d6475fd5a2d1fef38bd4fa5c4d7cd1fa6f33ee12f2ccc436d1c48691b9f4c74d861ae1dbab6f13a183ae588290518a34dc4ed4a8a598f64200f8ed346b9857965b3b04ad689accfa58957fb70ec64c235859c5734cfa9f58cac2d30e281454290cc73a7325c095984e343361f03bf4529802a56143aa68209b236964e010093fb475d1e36c78418a9b2a9a70839952c93d5c18f9f8394111e37c8fc722531c5d2c883dc7a58779dcb122636c99ce768430e190ccaded5407f75b83acd8618251435e02e93be1678bc3da216d084d3aa324bfc7c29fff18cbdefbe5845b4247e62af4179c679f68876af3a1d42f5cd8f7c44c3f82f4ba47a2acc1c6e778f46dfb513f5c5868e1212ed4ac5d9c34a7a02b9c6854d42d65440e487c5b301769731bafb29e1a94f0287cd138c1ccbec8290ee5352ff9e0d8e7b75015d66746e970df9d8099af912c676120b52bac3daa379f4e3507b0ee364cd57b0e14d87b4dfe4b534a4821e7db7d3acbce2a65ee675843586e9c4992708346477e9171815c0a5c80cefd2f24f4c9d699c2489486569c9ec90a75475500f4d0c47d6bb5dbbce61138e6fbd845ce93ec11f9b5bd898f5ccaa5b3bfc2c69deebf936cdc7938f5f1e591779d0db3edd88"}], 0x100c, 0x84}, 0xd08}, {{&(0x7f00000012c0)=@un=@abs={0x0, 0x0, 0x4e23}, 0x8, &(0x7f00000024c0)=[{&(0x7f0000001300)="58f2230ced9f7ed7efa201c96cf92cce063fc2a0cedac19ba2ed625c08466b48f45b37b2cb97ab5dc755ec2b8e4369408892374a1adf61c367f2bc255a6b633515c977d53d5873631e96f531e0dfc608aa865c9bb2173a8d8a171d42052ae8297b7467adaca70f456f928a471ca0fa3770ee1b9572065deeb4f1dd69e0aba92dd39d8aa655a52455d385d8f416d4aeebc124f0f525fd46aa5b4de5e4a4a37a8b62216e49ff121d31b90d6ab5567a2b81b46dacf8706b43cddfce7d9ddb7ede2120b5d6634346a8c17e03e7b0e6a38d2d5275ebef507edc1dda85991e036e5835c263cf3c6dedcb53d5899f846d8e0a81c0e73bc5889da34d99707a04fb9be70c1e3a9ac6feea3bfdef6de51061d939abc5772aeb0860c5af9dc16a84a6e751a36cd252e8d79876a904e5fb7b68d224418873d0efec991dc483db8bcc5a21017fb845cfd960eb63346d9a3db9a1836a54c1d2b8352e820c97e2814537aaa759bc91213697b8f40d071d075ce13a34758da3a540831b2437552524a67f0da22e0c4a5e39e06e3550d8f06db863b72381fd6db7244f5a561cbc868e8102d6c023b0738e387d11f1eac93b49a137e342b10807d722cbb07480b53fb2e57450508cf2f8c678ffb33445e747d3b1ce19ea6142ee7765b8b0cafa87a633388b3204204401ff32cd96ae6552a1100c82e29c96616a27dab85486038bf99d958f565fdd571e2a845f4fd0030d178501225870ecf7592a8270825ba6095f03fc55cee63623ea8796c647e0f8ba7c471da681d2502f8f65081faf6b27d5c75dfc754b431102ca17662092399f92f72ab8f0ede1279368d59bb1dbc9af3e45bc6c776fb837c247e5dfa5d4ac5afc3ae34ab230d77660fc53c204717990b0f57f646427a67d69e8db580c1ac782feab115034c276e2b79e81a854c0d0f8b8caad9212ce1a5897c6e58d62a8cdba3b537cc062e19cc8ce37d029ea944b7e74e1588ba662cc6b2c7d6e85cf73c0baf047c9fa02144a87fde0135cea051022f9d8253c9279c21835df781eba5ed520ce0d7e284f60e0f0e169f1f458cadc59c09f87f4b0255c28f883d871dacb71b7bc996353eb0982e191c4ca23f4ca929ee2dc9423dda036910cac308ec5b62a1c240d46b3e2f85b148998d576e64423fed23f15652014da0812935fa1760d7bbefd5e67e26a0356c5d2ea05dcefbd36873803722eb38bd5ed45ce039c9a9c17c79eac2acccd50a964fd3a71d0e7059a5cf8bda468f099827ae2324e3b999ce7229495f0facc374ce805ddb9cb45a5388b05d936deaa56c4f69bfc6e5b09402405665207673496386e1a6a7f1bbbe5b4659cbc98b46a093b5959f06d67e2dfa2529c7c3d3ac6dbd7590fd2bdf1a0f4aa15df15ed4907a44357d25b1af4cb2055e913679188f4b5fbc086ed04c778107a92a65d8f80ff0f8391646fa26f0649b4a5940941bed8f3d6652fd0a6a4214f4c26f76f7fd7a43b9574da583dcad6281079e5b68d633cc70279808411e83f90b1b2c25846d2e5e718a01588cba20c95aa75a0e24c9748bdaa3b723a6d17f6fc1006b89bf4f638cae0ade4fc6e652bbfc1449ebe0595872478cc477050741ff5422126a1a87f9ab487cc4e84d03717c8fe54d83fda4be9c3eab20a483b6eeb04c4bdeaf292664610484eb21d43d95e7e44cb832f9226cb8b7d585e71982037d3ef624a23be7fd7edcdfbb6ff4925f06840b19f7f074be541809b56adb372d85c7052471be0a2616c584142eb2ac90b6876a8c1f165210c7e87faf654046fb49c190eb3c1faa4560e0e92876b7a667046cbb6e5231df1629bd752c934998c0352c82986ed95e721a45f03e29d557518e2093c6ec16981ecefc39255edb528cfe74b09520af320dcffdf3758f8a2cb4714b080c041819532c6d7fa0a077d236ce9ef6a1527d7fdbda5e5a2be4bab48e367b4cda01cefe0ffbaac7272af206330be5ea42033e1e235beb6847877fe162a4a12662f6d558a78f6c8106523fbb77c3bc7d194eea5fa5fc3ccfd4569eab17b66c3c11c51d4fc699dd61a38b8fa339794057ccef65e45b2a079c326620d32bc4e9a8e0f74ef8ccf8051cb3527d0302b8ac4386e44e7f8e567bc62cda5e84c0fc07f04e73816add9ad545d1ffbb66f6f43f37c82f7cf0f78d17423f764af0eb0d8a18060bb282f3a8f7d28fc0686364c25ab67737ed788fb9ef53143369b7c6ca6a464a5c4275bc2f8fe6fd5a08ef669c2f7e9515c0a71262f4696ee6fe1814825d05f71e392e7d5d7bf65245cc01adcc1a757dd4fc280a4b6573b6aac76836d208f837356e6aff0940a147264f0cd972f8eab3c1ff3931c942e86caaf79f68c4037435aae961ea9383736088a603da7dcfdd4bf753f3a719196de9830c5084c26b067b4e086eeb70aff3f37b381e0ae8c6d7c5d10480dc6494aba17a71d26f258d9a43bd38be56a2b6dc03377d62d28ff6fc130b7f48a40564c9f50065ee8f929de9d78488fd1bccf19c7ab0913d451d37d69f67a9e5dbe22fc077b63d515eeb30e77ac141e9b9af529d3948f85e7e1a03beba31e3aff1c088b3328452b769f8cd64be77bcabcca7b394bdef6a974d8dcf8ec80866689c71b3a415aff6a9a5ee06bb9dab77d17efad2a3ceaf2df961d623383206b87e9f5e36946d19fc33061a8788c7afb41241b7c08207003397ad5354a1571093e07545097edb2c8da08afa06cfc6ca6a1e082df27837480d748ddd84a894e4dce721d89708f2fab56a752585dbd16400a7200498ba1e6165332f13b90c68f8bde43939dadbe8be3fb644862590d984cf047c772bcbd69370a4ee451fcf9d71cb6c1a420b0e637318e01773a669f2e85416c800967b1c34bbeda23c0fa728b1e43ef9489cc5f3196bb8f3a159599bbcb7607fa943d35bf75966ca9f330dd6d0a5ad13c14b94f35a2c241367b2e4a6093aa0a7f6ed3c15af876570163c4448fce73af2486de07f1c742b83457e1e025973440371b78593d116ed9de515ceeb0aac6f5e864d021a19a008f6fbee2933f499ac279730c664d57d60f550c0feb0a52833cc311ae4c570b7fa5217a99efda9964010053bf6c8e41be44cba78abe587717c710c97615f35501206dae37bb6de134a34adcee94ecf0c63369f9af3b0cd8c0af285885f54d5d9ac05380bf041d763bcfd79eb220237bb19294d60d962d8cdf0cdcf6f9876ce22e968e1b9557a76d3a60f9db56b970986f35dd740f25146ec0b3fd17e7ffe288530a00d428ae53110cfbf994c80412b376691ba791f2aa03d83d51454e55dddd9b89c583986bb1f8f0c4fca9d4ecc70ccfeb41a53c5f01541deb61cc0e23c8b9e16f80df013d8d1e9f307f3d4e8a10059b948cb2c1d85ac4f4f2633423f4bd12265c8cedc80803cf4561eb113865b12681e12faaa986b17948b7ca04a634ab79ce759c2b57f666d40f4db7fc5d8d42018058821a671a7640222c1c3b941a6bf8dc1c2436606475d68f07753a066008d2ec1e82a0315827f5cb2a87b423bf34af2127dbe1862a364dfddc2b3179f5f986d86ff69d96300d5b7d901f6e8b64e8fd84613300d37a3cce6c62ec047a6d07442a0c6fd8a5e3a475e057e9696b8664c73fc18d3b3225661fe0c1fd89b8cd1635ba4446919ab83a31559f98a75254e70d18bfcb75b42a3e9a4ba0b00e02b78de72b7fdac27c6f8867ba94e5ac8f0c1e550d4625a7456be543c19ef4c87ed16f869405307b528c5bd00e34b94c9d8020cc94d6aa224b7ca3d1ccef86a169e269537fd050bdcb36135da08175a4616e077468b75d5ef409195c83c8269ec6012d21d0cfd86170e7c5da8433d496044e5485b9b4af63fa8db1aa815a489595d22cdad1bb6e8024110e3bcc786c465ca7fa09625bdc653371a2c2b7449d931a71170abf7734eacd907db98ac0edda7dd101792cf9ea908c70ca725d7ee3dfda19a5a6424f08bdbe2bf254957d2c62196dc3086598baa69413c4d8192a34d8fe57762afaa8bb3d763efe26cf0819827f052ab0f60dc40695b72e75002c3d4ac775d099a0ac95d90be2b61ea72796a9956f9abc7eba9b6f1923ddc2c7b4703b6500a48d8beabb35cc59d9a5f7bfb6dcc86059c29094d95929a59e67cc08c88250af339735b07d3b15f6807b0f1d34d5f646c005dc4453e8287d2f03229d2a4991297ad660a95d9abef65e3748e49534c28ebb0f9151afda9efd06650a047123201553f0194666713b5551a69ce48e6b8952e453365da8378827e1549cb88aa5ab0ecd7beb920586ebe5eaeb79824944c8c5eae67f5ba38be134658c0742bd4a67bfd281d1ae1352aa03b1ec9e79b978fa461282c2668569223302825c0bb832c22240af27e738ecffbb088f03a0df589832069751d68a4168ac8cfb03fb3a9378788c0220ecaa5a36a313ac06209ac9afaf7354fad3ac695447b02381942b11179cb4c4c8ed924152bd99be1ab11edbc1c9c7e34f1826ed5b3279b966f4496fa9de961406d726741164d7f30764af1bd638bc4b56002532665491cb1cc02c378c832eec85b706cf58b0e4e9980749ba55af7e871d8650a205a33a20d53dac140531144f14c2cc0166f9ce1499c4500ea340e1e8c6c468b2eedf271d952386f84ef3a56324871a746d9b8582d5125deb14b283363348f1fa9005426eb39f211045f6e7bbb558bc1373a70eeabfdbd8c199bc448b3681120edf5bae3247e60f4e4a2620e33d30e6aa7b306fcffac85115d9bd2ba30a034c6c5da17dc0d4a034f9c9af3dc50e85c058d2e56616bcf1d5b7647af1b8fb0a7c37cb0115702beaff75e35556b5a302916b95479b45a0adf6457edaa5195d839426541796b3e84e891d3238f4c28c0a569c2c595948c28077c875d48e8d21cbddbb2c40dad82044af7691a6d15cf8ecda31141c7238f2b26ac1a62640ada6202620f33573ac9d0843afbafa3d0972d9bb1dfcdf4832e08c1974755ff4a5e4ee1bf6a705619a1c6246a0bdd7d7169844007ea86e5b373bcaf87c3f0ef982a8776f43f19c9fa81f005bee158e89e3df90e3aff1ee3c8b5249d4e49e0105790c65325a10790c19ee30fef8d6ecac5ed29cf24e6330024b17d55199a02f7a5641e6676fd25d840c87846efc23a7391636108a3852488cf7431ee4fdbfb495bd21b111a28c38716d58793c3c7636fbc3660f5c273b7cedb3eae462fabbf5d7181c296cb39f97c9f85058e0b967bf89cc01957094e25da79954c7a6215039cf4598174bbe49b8555d43fc13f04001d7ae7acc26145e40ece0f8ba0e5e2605fbcb30a5552e78c440f4cc1ec3815d5beb089a396279dd8df38d5ebce4057882dd8d2298c717507599af2729fbc3520b73fa7c0a622d5a7ff868ffcb7e1dd97a232d17be7766d2393977f7670185006dfa7e39af47c7f3d68538b068bbb19e9316a7693032e8532b0f12c8ff5ed915b350193bd9669954df8ea6dd3e3ea239b7d473223b4fe02d8b4d976e9dcd9f8d46939ede5b5ad50b57df5a1ee47082afa7de6c5f280b1a3d95b64096642e2af3a7704b15ddc584499a223049303ad5f9bbc23144791d3b83e9ae3599fa33ad21dbd8144903d3e8e40e66c3c1a26eba76936394d04d02cd355f1d7b3a88c170d18dffdecb586f1da3b0cf124e18b4776a32b9d3b8f704f11573b018caf830f1b47cbb9ecec110ea75140ae0a2c363425b0374488b2f60b6917440dcdce7d9163d6d446a977835f371aabd5b2f9ef27097e19995c65ac58f6d345718adae420fc4aad71b1af1ef8b8245722c2a6128a8ac401b", 0x1000}, {&(0x7f0000002300)="60cf3bfd67832341f31875abdb9d8980254e2ec89c5eef9ee274d3380958340756cf0e9eb579aa0924dffc7911ce6db822b9f84f89c28861671a0dae86c83b154d9f4c71abfffe5b7ad28511398bbdfc42d7fc087921098a6b48cc2bf8207cb04838d6fe55b41161472911c2a61a94ce37c7816b8534c60aeb93d4dd9b3219fab172a645681bee482f9f9262b0aa99a45a865516c256609a1f868024674a20", 0x9f}, {&(0x7f00000023c0)="fbfb55141d278b8a552aae66f620e2151e3f6d03279bfc2df2ebe68b94d7c83a75af813e0c5b39837ccb02e5cf75defbc34214380d94a48309294f0db2dc81e3377eacc6070158438f32726f8f1362ec6e24cf5a1550d3bb0d6814bf7507c06f1f6850c3393f4beee286039849b6da01daadc8f1f5e1e025f991f78969c022473c9fa4614b85199aa5c7dfac04d53e6a842a8d971e78768741b8769c3fe52c2f888b328800b9ef63ec1b7ba80402eb5d159322f7e3b067162b711928e0f4ee2f2b2b28188ce909e8445e7f7c125c5617e18cb58cfc924f9fe963c997", 0xdc}], 0x3, &(0x7f0000002500)=[{0x98, 0x105, 0x80000, "211a7039117554867efd24c339d2b8b24f39401c09c1af74c3eacd03edc5c849792794b360fe5561449678456758c6604ee670973a99ff51a1281c38c19530db14c7bf9fdeda9c2359bee802cdfea73df35e6579a0c3e1c9f9a231b4481d65f4dbb74fec7d35f101da2e7bd956190cbbf9652b42480b66de84988072df4904acc1e4cf5e44c9d059957c"}, {0xe4, 0x88, 0xa3, "e53ab86b2109cdd2c9b93c36fe3bf30138583aad4961bd7b240b0b3da87841cb2f04f9f15ee5b0cb27b89606634eb759d71bbb0bd1a4b52b1b180b985c964aa362ba9913faa51b25a37f8bd74db7b2601a3c5ef3c786072acc7dbb7d67d8b019b3252580422e3605b62f9c63749804d25f8916677ecf427e0a7ee538a7e3ac4f5f14a0f829fd231eb3a53ec388c4fe194c99ac7d3c0bd68e590d947572481163a8362b5f9a4a89a6af82d822f4000566726081bd275de342ac2904b8affad9998f4d4268c2dad74afd9d399fa308ff1efa4936e0bc"}, {0x88, 0x88, 0x100000001, "5a30ec57ef4ca264e06f376a5f5b4b245d29a54c87bf1b6f0d3cf0934c79a7267f3e80dbd389b7de5f7f7a332359edbfd1a97ccca42f9d7156d2e38c44b01775e46fd6e674516215bfb33e7dac388ca4b89e29c94b743584863421abc5d85678c8f7840bce0be40019fe9f0f30a54c24a43c676104ef87fb4a9c1083"}], 0x204, 0x800}, 0x1000}, {{0x0, 0x0, &(0x7f00000029c0)=[{&(0x7f0000002740)="72459a296caeef843750b31860a7ad8cf8e813ffb37e3001e71548f07e8932e1f69a61e1abe597ad74a7c3ef0dad8a34df1757ec68b9ec4878c5d495c9f5e0779d6c14f284a4687b8ac3e1eb97dcd94699e5a1b90e3dd5848a558d764300471b374a1f28e90b4eee16cb3f8d8513a903afec73e0c012c1ce6f0c21adc0e75717b11c0dadf5626dd1bb7582d034b4fb2b40be1ddaf796e424afcbce69bf81b19fe850b753ec5781c2a2973fc4d657b5859d73d9999df9b1a19ba21ffe5977bad74aae9adb30", 0xc5}, {&(0x7f0000002840)="66e64a05624da77c217baca3a8ef80970a9622c149be547e8833f6057b231d1f49228c016773e7e6b04a3c2887127a325e5da8896bd2c150b586d30fbf54b7b02ce3042564128f2f2cd0afee", 0x4c}, {&(0x7f00000028c0)="37def37d28ae98c92cce6623fe4b61b70c554cbcf3e6eda5a9a44aed8ff6f72b4f47514688a2690b32510ac0b6640e9ec9d429a76b8d5a9df4c25e321bd4eca29e578ea10b0610229c9309e2fc5939bde09c5e9af2d35db8c20ac6016ff202d4386a638f0ef53db0a4c74f", 0x6b}, {&(0x7f0000002940)="7538ded95f5b7aed492c834e4065ab278f56bf590aa4fd1b10cd59db637d0362b31edf5e0945a56cf22b4c022ddba4a0ffb22c85e7ce040a59199b215552bf3d17e298bbf4fbd77b5e1890a8df5ebd63f09c4bac897d533d3a5204b288ec59e50cfff414dec0b0e3aa81652d61ba78c7437f22", 0x73}], 0x4, &(0x7f0000002a00)=[{0x8c, 0x184, 0x2, "608275d14cdbdb294cb808441823991317bfd6ca9c2003ca7977c7274fe36b4d5c269f0fef7c1c467423ce4db20387cfc424b730d44cd0c8c2f1d1a6c3a2e9fcc09b4450f383b9a88c91f0077dee1b43171a8672712a05aac1a166beb934a3cd45409a92228ede542366b7d0298bf1f6fc0cb8eee28474e3e252e6eba4"}, {0xec, 0x6, 0x6, "0b52fe02eb3ad8a766995fddf2cb22d7204e83122264c5ded1c01913fa27d59568de07a7aa3322fc62a41cc15bb5e2939b33e3362b931e6426c3c9e9bd7b74fe9a4497df2d4524043f331dd7f55a896407f8281effe8bf907bcb10e6feb97e45f2d60d6f06ffddc8aa77bf0496d9398d8c7f4c690217cc4a0b301a2fd7a30c3ef509c236e2d4d7e4d90416fd7c2673e77dfa27a630c31b62d134ee47ee2330826a092cc71e4449ca900ef64ca7371a869fde9032774dd6e6fa8d4ae841d779f7d9d12f35d9b8560dde1283d21676af502c42135f5340bc04c12a026bd2369f"}, {0xc0, 0x10d, 0x5, "787986a0b78dedec9286364d8a3d57b4190d3b9e775ad087fc8a359190565a7dec2fbd2c67adbc09343d44995dcaa8fda7c6f4ca42ada92006e4c2f8f9a5adbcb152b576a06eee2a433d3d05f8bbded9a2f7147d856e909cf8365a1fd418c59e2228de030d8f824883f5956677b46cfbb154b504515125ac6d3f4e6bb70a21d040095d7b6002a3674a6a7ce02b5d959f629f1edffa7eab986c2ff371eb0ae247b5bf7210494f235d5737279721f1e7afb9"}], 0x238, 0x1}, 0x5}, {{&(0x7f0000002c40)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x4, 0x1, 0x2, 0x2}}, 0x26, &(0x7f0000002dc0)=[{&(0x7f0000002c80)="5c4e86201e818b3f94f8a462528a7a78fb1ca36b645617d9ead9356e56a31ea9a2d6fb807956d741b881c068f5a2e62bb0bb3a458abd1c4e61", 0x39}, {&(0x7f0000002cc0)="ed5a0c663a4ca12ebf2c1f8d50f19fcde0b277d5f43fac10b12b5fdd75e52e6f19f1fa74044e10dfc01865c63ee6484ed4e193cbc4d5a6fa6dc92efbf5c896c8847b886068c176879c37ba8226b6ad090808ea560b916d825c9cfbffd7925ec7d32bd552d4644810321d1f2bd11e1cf7159ec55a68aa4e9b6c66df85471ff1554533b912ddb5d72c8a941934b4f3a0c229bd0c55e12e51a37c3b66ca3ec9dd0943d429438bfb12a10ea09da4d6a8cff272bd935acd146330566fda1a6fa0a4c49914844ab6b3620d2c23137fc86de3103e1b2a4db7703f235d04f886a13c111f174acf85", 0xe4}], 0x2, &(0x7f0000002e00)=[{0x74, 0x10e, 0x7fff, "f0c1ac4b70c11a444b0965ce8d5fb8dbee9581775e2708112c844b6637a2e65ee533de966f265985cc0b32102308167d31dfbae85493edcdb5ec8ae0e0b7640f6e212683d77fa6cb4afdf6a7ef5ec1d4749820b8b1682c30ba536b53a9e1a40422f3e331efbe"}], 0x74, 0x4080}, 0x4}], 0x4, 0x4000000) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)) [ 95.564430] binder: 14711:14729 BC_ACQUIRE_DONE u0000000000000000 no match [ 95.576538] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.587658] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:05 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000016ffc)=0xfffff7fffffffffd, 0x4) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000100)=0x1004, 0x4) bind$inet(r0, &(0x7f0000008ff0)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x361000, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000280)={'erspan0\x00', @ifru_settings={0x6, 0x4, @fr_pvc=&(0x7f0000000240)={0x5}}}) keyctl$session_to_parent(0x12) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x3) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) recvfrom$ax25(r3, &(0x7f0000000140)=""/113, 0x71, 0x12060, &(0x7f00000001c0)={0x3, {"c8bc07769bc8b0"}, 0xb6d}, 0x10) getdents(r3, &(0x7f0000000080)=""/104, 0x68) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000340)={'irlan0\x00', @ifru_settings={0x2, 0xfffffffffffeffff, @cisco=&(0x7f0000000300)={0x2, 0x1}}}) listen(r0, 0x0) r4 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, r4) listen(r1, 0x0) [ 95.638734] binder_alloc: binder_alloc_mmap_handler: 14736 20000000-20003000 already mapped failed -16 [ 95.673817] binder_alloc: 14741: binder_alloc_buf, no vma [ 95.679607] binder_alloc: 14741: binder_alloc_buf, no vma [ 95.679643] binder: 14741:14750 transaction failed 29189/-3, size 40-8 line 2963 [ 95.685264] binder: 14734:14746 transaction failed 29189/-3, size 40-2316750164561231880 line 2963 [ 95.699863] binder: 14741:14752 got transaction to invalid handle [ 95.702234] binder_alloc: 14741: binder_alloc_buf, no vma [ 95.708315] binder: 14741:14752 transaction failed 29201/-22, size 0-0 line 2848 [ 95.721858] binder: 14738:14747 transaction failed 29189/-3, size 40-8 line 2963 2018/03/02 11:09:05 executing program 6: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f000075bff7)='/dev/rtc\x00', 0xfffffffffffffffc, 0x0) ioctl$LOOP_CLR_FD(r0, 0x40247007) 2018/03/02 11:09:05 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:05 executing program 3: r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/create\x00', 0x2, 0x0) fcntl$notify(r0, 0x402, 0xa) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x3, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4}, r1, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_dccp(0x2, 0x6, 0x0) bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @multicast2=0xe0000002}, 0x10) r3 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x2, 0x0) syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x41, 0x4000) close(r3) 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f"}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:05 executing program 4: mkdir(&(0x7f0000a39ff8)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0/file0/file0\x00', 0x20) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/39, 0x27) mount(&(0x7f0000000180)='./file0/file0/file0\x00', &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='cgroup\x00', 0x0, &(0x7f00000001c0)='_') mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200)='ext4\x00', 0x202840, 0x0) [ 95.734512] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.737729] binder: 14738:14762 transaction failed 29189/-22, size 40-8 line 2848 [ 95.740117] binder: undelivered TRANSACTION_ERROR: 29201 [ 95.758255] binder_alloc: binder_alloc_mmap_handler: 14736 20000000-20002000 already mapped failed -16 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f"}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:05 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) ptrace$setregset(0x4205, r0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)="93f72911834389f7bb03a8419eba3dce21d980bb62ccb15039e294a59068797a0ad4ca7afe4c79266cb969ab70", 0x2d}) r1 = perf_event_open(&(0x7f0000001f88)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000fff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f1f000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000009c0)='/dev/vcs#\x00', 0xffffffff, 0x100) accept4$vsock_stream(r2, &(0x7f0000000a00)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10, 0x80000) modify_ldt$write(0x1, &(0x7f0000000100)={0xfffffffffffffffc, 0x20001000, 0xffffffff, 0x8, 0x6, 0x3, 0x9, 0xc0d9, 0xffffffff, 0xee}, 0x10) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0x0, r1, 0x3) 2018/03/02 11:09:05 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000d11000)=0x3fb, 0x4) bind$inet6(r1, &(0x7f0000fe8fe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) listen(r1, 0x0) listen(r0, 0x0) [ 95.795346] binder_alloc: 14765: binder_alloc_buf, no vma [ 95.801099] binder: 14765:14767 transaction failed 29189/-3, size 40-8 line 2963 [ 95.811130] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.834751] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.840356] binder: undelivered TRANSACTION_ERROR: 29189 [ 95.860473] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x258, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f"}}}}, {{{0x5, 0x20, 0x203, 'irlan0\x00', 'gre0\x00', 'vlan0\x00', 'lo\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xc8, 0xf8, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}}]}]}, 0x2a8) 2018/03/02 11:09:05 executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x2000, 0x0) timerfd_gettime(r1, &(0x7f0000000040)) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000180), 0x8) r2 = dup2(r1, r0) membarrier(0x20, 0x0) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x81) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000080)={0x1, 0x4, 0x0, 0x101, 0x3f, 0x1, 0x3, 0x1ff, 0x0}, &(0x7f00000000c0)=0x20) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000100)={r3, 0xbaf}, &(0x7f0000000140)=0xc) 2018/03/02 11:09:05 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setlease(r0, 0x400, 0x1) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) tee(r1, r0, 0xf2, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x81, 0x1) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x4) r3 = dup(r0) bind$rds(r3, &(0x7f0000000080)={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) 2018/03/02 11:09:05 executing program 4: ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f00004c8000)) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x44900, 0x0) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f00000000c0)=0x4, 0x2) fcntl$setpipe(r0, 0x407, 0x4) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ptrace$getsig(0x4202, r2, 0x1, &(0x7f0000000040)) bind$netlink(r0, &(0x7f0000705ff4)={0x10, 0x0, 0xffffffffffffffff, 0x400000000006}, 0xc) bind$netlink(r0, &(0x7f0000ffdff4)={0x10, 0x0, 0xfffffffffffffffd}, 0xc) 2018/03/02 11:09:05 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:05 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000065fc8)={&(0x7f0000791000)={0x10}, 0xc, &(0x7f0000df6000)={&(0x7f0000000040)=ANY=[@ANYBLOB="24000000170afdffffffffffffffffff0000000010000100000000800000000000000000509eeab066087bea684be7fba673b8eee5b0a658dfe16cbd001160dac258d2687f1ba2da6c3be5f6467807584ac709c76b6808ab57b505f7ff5123cdc674ba1625bab28dcac85ad2ff2021223eaf28b0c6b6775bc4d074ecadb6eed6a2cd628ecffe11892d2fd21e7d2eddbb18027c71838f3e0a64d6bf2678d627d36f"], 0x24}, 0x1}, 0x0) dup(0xffffffffffffffff) dup(0xffffffffffffffff) close(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}}, 0x8c) 2018/03/02 11:09:05 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = fcntl$getown(r0, 0x9) prlimit64(r1, 0x0, &(0x7f0000000100)={0x0, 0x400000}, &(0x7f00009d8ff0)) getsockopt$inet_tcp_buf(r0, 0x6, 0x0, &(0x7f0000000040)=""/98, &(0x7f00000000c0)=0x62) signalfd(0xffffffffffffffff, &(0x7f00008e6ff8), 0x8) 2018/03/02 11:09:05 executing program 6: r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x400400, 0x4) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000080)=0x9a7, 0x4) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) sendfile(r0, r2, &(0x7f00005b3000), 0x585) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x8}) 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x2a8) [ 96.276910] QAT: Invalid ioctl 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x2a8) [ 96.307580] binder_alloc: 14791: binder_alloc_buf, no vma [ 96.313323] binder: 14791:14796 transaction failed 29189/-3, size 40-8 line 2963 [ 96.326217] kernel msg: ebtables bug: please report to author: Wrong len argument [ 96.327583] SELinux: failed to load policy [ 96.339069] QAT: Invalid ioctl [ 96.342785] binder_alloc: 14791: binder_alloc_buf, no vma [ 96.348527] binder: 14787:14799 transaction failed 29189/-3, size 40-8 line 2963 2018/03/02 11:09:05 executing program 2: r0 = socket(0x1000000010, 0x803, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000200)={0x0, 0x3}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000280)={r1, 0x4}, &(0x7f00000002c0)=0x8) connect$nfc_raw(r0, &(0x7f00000001c0)={0x27, 0x39a, 0x5, 0x3}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000000)={{{@in=@dev, @in6=@mcast1}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) sendmsg$nl_route(r0, &(0x7f000022b000)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f0000f75ff0)={&(0x7f0000000180)=@ipv4_newroute={0x24, 0x18, 0x211, 0xffffffffffffffff, 0xffffffffffffffff, {0x2}, [@RTA_PREFSRC={0x8, 0x7, @loopback=0x7f000001}]}, 0x24}, 0x1}, 0x0) 2018/03/02 11:09:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0xffffffffffffffff, 0x2}, 0xc) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x40) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000140)={0x0, 0x8, 0x4, &(0x7f0000000100)}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x20001, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) r3 = fcntl$getown(r0, 0x9) prctl$setptracer(0x59616d61, r3) getsockopt$netlink(r0, 0x10e, 0x9, &(0x7f0000bd6fec)=""/20, &(0x7f0000b54000)=0x3) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000180)={0x1, 0x2, 0x5, 0x1, 0xb3}) 2018/03/02 11:09:05 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000180)=[{&(0x7f0000001f8d)="390000001300090468fe0000810000400700004003000000450001070000001419001a000100020007000012020000080001010c00f41ee400", 0x39}], 0x1) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x500, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x917}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000100)={0x400, 0xdbd4, 0x2, 0x2, 0x2, 0x4, 0xbb, 0x4, r2}, 0x20) [ 96.362131] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:05 executing program 3: r0 = socket$inet6(0xa, 0x8000a, 0x73) setsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000000)=@routing={0x62, 0x10, 0x0, 0x1, 0x0, [@remote={0xfe, 0x80, [], 0xbb}, @remote={0xfe, 0x80, [], 0xbb}, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0xd}}, @loopback={0x0, 0x1}, @mcast1={0xff, 0x1, [], 0x1}, @dev={0xfe, 0x80, [], 0xc}, @dev={0xfe, 0x80, [], 0x13}, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}]}, 0x88) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x4, 0x20080000000000, 0x9, 0x1549, 0x98, 0x9, 0xfffffffffffff001, {0x0, @in6={{0xa, 0x4e21, 0x5, @mcast1={0xff, 0x1, [], 0x1}, 0x6}}, 0x0, 0x1, 0x8, 0x9, 0xdb}}, &(0x7f0000000180)=0xb8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000280)={r1, @in6={{0xa, 0x4e21, 0x2f, @empty}}}, 0x8c) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000e99ffc)=0xfffffffffffffffd, 0x4) 2018/03/02 11:09:05 executing program 4: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000ae1000)='/dev/cuse\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0x1, 0x32, 0xffffffffffffffff, 0x0) name_to_handle_at(r0, &(0x7f0000908000)='./file0\x00', &(0x7f0000e77000)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\t\x00'], &(0x7f0000fd1000), 0x1400) 2018/03/02 11:09:05 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 96.403993] binder: 14787:14799 transaction failed 29189/-22, size 40-8 line 2848 [ 96.428477] audit: type=1400 audit(1519988945.795:124): avc: denied { create } for pid=14822 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 2018/03/02 11:09:05 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x2a8) 2018/03/02 11:09:05 executing program 2: r0 = syz_open_dev$dspn(&(0x7f0000006000)='/dev/dsp#\x00', 0x1, 0x2) read(r0, &(0x7f0000000000)=""/24, 0x18) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000140)={0x0, 0xaf6, 0x3ff, 0x0, 0xf09, 0x6, 0x7ff, 0x4, {0x0, @in6={{0xa, 0x4e22, 0x7, @mcast2={0xff, 0x2, [], 0x1}, 0xa31}}, 0x2, 0xc573, 0x9, 0x94, 0x3}}, &(0x7f0000000200)=0xb8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000240)={r1, @in={{0x2, 0x4e20, @empty}}, 0x800, 0x0, 0xfffffffffffffffc, 0xe196, 0x6f}, &(0x7f0000000300)=0xa0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000040)) ioctl$int_in(r0, 0x8000008010500c, &(0x7f0000003ff8)) 2018/03/02 11:09:05 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x40000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) [ 96.437441] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:05 executing program 4: mkdir(&(0x7f0000cb3ff8)='./file0\x00', 0x0) chroot(&(0x7f000009a000)='./file0\x00') mount(&(0x7f00005b9ff8)='./file0\x00', &(0x7f0000edaff8)='./file0\x00', &(0x7f0000d9fffa)='msdos\x00', 0x1002, 0x0) chdir(&(0x7f0000cd2ff8)='./file0\x00') umount2(&(0x7f0000e28000)='..', 0x2) symlink(&(0x7f0000ed6ffe)='..', &(0x7f0000000040)='../file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00003e5000)='./file0\x00', 0x410002, 0x0) llistxattr(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)=""/120, 0x78) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000140)=""/26) getxattr(&(0x7f0000000000)='..', &(0x7f0000000080)=@random={'security.', '{\x00'}, &(0x7f00000000c0)=""/121, 0x79) creat(&(0x7f0000000240)='../file0\x00', 0x4) [ 96.476221] binder_alloc: 14823: binder_alloc_buf, no vma [ 96.481958] binder: 14823:14828 transaction failed 29189/-3, size 40-8 line 2963 [ 96.492296] kernel msg: ebtables bug: please report to author: Wrong len argument [ 96.500508] binder: 14823:14833 got transaction to invalid handle [ 96.505101] binder: 14838:14841 transaction failed 29189/-22, size 40-8 line 2848 [ 96.506848] binder: 14823:14833 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:05 executing program 5: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r1 = memfd_create(&(0x7f00000000c0)="70726f63ae6d696d655f74797065776c616e316e6f64657600", 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x5011, r1, 0x0) lsetxattr(&(0x7f0000bc4705)='./file0\x00', &(0x7f00003f2ff7)=@known='user.syz\x00', &(0x7f0000046ff7)='vmnet0*:\x00', 0x9, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000040)=0xfffffecf) 2018/03/02 11:09:05 executing program 6: r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x10) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0x0) keyctl$restrict_keyring(0x1d, r2, &(0x7f0000000100)='syzkaller\x00', &(0x7f0000000140)="7d27757365723a2165746830277070703194232f2473656375726974796e6f6465766e6f6465765c216b657972696e676d696d655f74797065262447504c245d6e6f64657600") ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) clock_nanosleep(0x9, 0xfffffffffffffffc, &(0x7f0000007ff0)={0x0, 0x1c9c380}, &(0x7f0000002ff0)) 2018/03/02 11:09:05 executing program 0 (fault-call:1 fault-nth:0): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x2a8) [ 96.529089] audit: type=1400 audit(1519988945.840:125): avc: denied { bind } for pid=14822 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 [ 96.550582] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendmsg(r0, &(0x7f0000003300)={&(0x7f0000000240)=ANY=[@ANYBLOB="0a004e2000000000fe8000000000000000000000000000aa08000000c687e9c5d9fdaafadaffffffffffffffde7de058634f1bb4f684990bc026baea50742a4b6453f6336205d6c33aeb9aca6158d9e2ddf4c320539bfa6590e1396f2da04e808452f592ae68196ad7c5ffe927ab560b8b57bcb398bc8adaf818d686d4ac40269a9c57d568fe51f2745c930399e7b285147fb831d2d6a21c86fce1cca261a8f929695fe76773b5d7aece0bcd5a98f32114984aca13f01bc8b42b9061cedfc4fd6ec78eb1784237000000000000000000000000000000000000000000000000000000"], 0x1, &(0x7f0000003280)=[], 0x0, &(0x7f00000032c0)=[]}, 0x0) listen(r0, 0xcb) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0x5f, "000738e65db3d67a87324242b251df65f600c061a5a5f05349725bfc4b7e5a694062e426a9e41de84d607e0812fd9e5667c6e2675424f2c0ff46d0faa9baf491320e2bda3fe0f88e5db4fd920e42ef658f8e9e2b06939ca5aaa284d6d50276"}, &(0x7f0000000180)=0x67) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000001c0)={0x10001, 0x8001, 0x1, 0xfb, 0x3, 0x4, 0xfffffffffffffffa, 0x11, r1}, 0x20) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x5, 0x101400) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000000c0)={0x7a}, 0x4) getpeername$packet(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000340)=0x14) connect$packet(r2, &(0x7f0000000380)={0x11, 0x7, r3, 0x1, 0x1, 0x6, @empty}, 0x14) accept4$inet6(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, @mcast2}, &(0x7f0000000040)=0xffffffffffffff4b, 0x0) 2018/03/02 11:09:06 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:06 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x7fffffff, 0x100) ioctl$KDENABIO(r0, 0x4b36) keyctl$dh_compute(0x17, &(0x7f000018eff4), &(0x7f00009ddf22)=""/222, 0xde, &(0x7f0000573000)={&(0x7f00006d2000)={'digest_null-generic\x00'}, &(0x7f0000421fc5)}) 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000001ed72a180000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000052000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085fe000fdffffff"]}, 0x1b0) 2018/03/02 11:09:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x4, &(0x7f0000000500)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) io_destroy(r0) socketpair$inet(0x2, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000080)=ANY=[@ANYBLOB="ff0f00000000000002004e24ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000002004e247f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e220000004b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e217f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e2200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000002004e24ac149d534f1c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x450) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:06 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000000)={'filter\x00'}, &(0x7f00000003c0)=0x44) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000440)=@broute={'broute\x00', 0x20, 0x2, 0x308, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000080], 0x0, &(0x7f0000000580), &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000400000000000000000000000000000000000010000001100000000000000000073797a6b612c6c25720800000000061869693000000000000000006e723000000000000000000000000000726f7365300000000000000000000000000000000000000000000000ffffffffffff0000000000000000e0000000e00000005001000069703600000000000000000000000000000000000000000000000000000000004c00000000000000000000000000ffffac1414bb0000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000004e464c4f470000000000000000000000000000000000000000000000000000004c0000000000000000000000000000005f2cdd1e79421fb5666362dc23841e5002bcf845ea1049d0629a0f851ecdc3d8d30781a0e8a5a98930770273ebcc6c5a4715c126b463a3e12ad74637ab9dcb54000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000001000000feffffff00000000000079616d3000000000000000000000000067726530000000000000000000000000726f736530000000000000000000000073697430000000000000000000000000994750bf49ef0000000000000180c2000000000000000000000070000000b8000000280100006c6f6700000000000000000000000000000000000000000000000000000000002400000000a78ab29985b2da4323ad38c3784a77cd8ea3373211d685a321bdd1178e2b00000000006e666c6f670000000000000000000000000000000000000000000000000000004c0000000000000000000000000000009eaa1e5134f2e9f51d1f593b5912e8e2cf3b532376680eb296c5ec538beb3d9c1f62dbc9e4266170b9fb8d4bc218a8e80f293f11c1cc46668805850df8f252d8"]}, 0x353) 2018/03/02 11:09:06 executing program 4: r0 = socket$inet(0x2, 0x805, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000b5f000)="070704002a", 0x5) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x7a083, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x3) getsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)=""/164, &(0x7f00000000c0)=0xa4) 2018/03/02 11:09:06 executing program 5: r0 = socket(0x0, 0x4, 0x0) ioctl$sock_ifreq(r0, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', @ifru_ivalue=0x7683}) [ 96.592707] binder: undelivered TRANSACTION_ERROR: 29189 [ 96.598323] binder: undelivered TRANSACTION_ERROR: 29201 [ 96.603745] kernel msg: ebtables bug: please report to author: Wrong len argument [ 96.628824] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x101000, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) 2018/03/02 11:09:06 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x4, 0x80) pipe(&(0x7f0000000280)={0xffffffffffffffff}) renameat2(r0, &(0x7f0000000240)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x3) inotify_init1(0x0) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000001c0)={0x8}, 0x4) unshare(0x8000400) pselect6(0x40, &(0x7f0000000000), &(0x7f0000000040)={0x20}, &(0x7f0000000080), &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100), 0x8}) [ 96.675722] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 96.687636] kernel msg: ebtables bug: please report to author: Wrong len argument [ 96.694794] binder: 14864:14875 transaction failed 29189/-22, size 40-8 line 2848 [ 96.706994] kernel msg: ebtables bug: please report to author: Wrong len argument [ 96.741615] binder: 14868:14884 transaction failed 29189/-22, size 40-8 line 2848 [ 96.746590] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f000012e000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x4e23, @empty}, 0x10) sendto$inet(r1, &(0x7f00004eef09)="96", 0x1, 0x0, &(0x7f0000848ff0)={0x2, 0x4e20, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) sendto$inet(r1, &(0x7f0000386fa0)='\x00', 0x1, 0x1, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000266ffc), 0x4) shutdown(r1, 0x1) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000000)=0x401) setsockopt$inet_opts(r0, 0x0, 0x0, &(0x7f0000000080)="fb2b2ca7cf33ffa7e0d52bc2ba654dc94913456da49b595724d67577dff6f144f41b362a43df2e3df95254fa83a8ff7b39ddc084eb614b0c6484d9a3b34a3db416cf16a17b0b8955e55951c8234f384e6fc0503883fec0d95d1e7994b3dcfebe31c4154fc4150940ed0bd9a6f1ffb45aebc9ea0ca6e824f6e8d628e478443232f5c3153d6cfd7e7fd0e9a5b1c40b5d4f08df1bbe469a4e6a9e9e0e6c08d0a1b83ee00187f0bd04f76939d5b918e49d0c6777dcfa5834a89e735ad300b2a269193d25399623e7cc0772021928a4f605b0fe09d3dec846936f", 0xd8) recvfrom$inet6(r1, &(0x7f000034e000)=""/239, 0xef, 0x0, &(0x7f0000276fe4)={0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, 0x1c) prctl$getreaper(0x2d, &(0x7f0000000040)) recvmsg(r1, &(0x7f00006f7fc8)={&(0x7f0000cb8ff0)=@ipx, 0x10, &(0x7f00003e2000)=[{&(0x7f000042cf4c)=""/180, 0xb4}], 0x1, &(0x7f0000451000)=""/47, 0x2f}, 0x0) 2018/03/02 11:09:06 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000061dff7)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x400, 0x4db00c608ef50b0f) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40186417, &(0x7f0000000040)={0x2, 0x8001, 0x6, 0x3000000000, 0x8, 0x4}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x3b, 0x400200) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000fc3f98)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @adapter}]}) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000e65ff8)={0x0, 0x5}) 2018/03/02 11:09:06 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:06 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$l2tp(0x18, 0x1, 0x1) munlockall() r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) connect$l2tp(r1, &(0x7f0000e92000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x2, 0x0, 0x4}}, 0x2e) close(r0) pipe2(&(0x7f0000000040), 0x80800) 2018/03/02 11:09:06 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x6) clock_getres(0x5, &(0x7f0000000000)) connect$inet6(r0, &(0x7f0000013fe4)={0xa, 0x4e20, 0x40, @ipv4={[], [0xff, 0xff], @empty}, 0x80000000}, 0x5) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = creat(&(0x7f0000000ac0)='./file0\x00', 0x80) utimensat(r2, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40)={{}, {0x0, 0x2710}}, 0x100) writev(r1, &(0x7f0000d23ff0)=[{&(0x7f0000067000)="2900000020001980013d7524100a0021020008001700002a00e8ffff0800020003ee000095645aff22", 0x29}], 0x1) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000080)=0x0) r4 = getpgid(0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@dev, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xe8) sendmsg$nl_generic(r1, &(0x7f0000000a80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000200)=ANY=[@ANYBLOB="280800001b00000029bd7000fbdbdf250400000014003100000000006d696d655f747970650000003402400018004c0000000000ff01000000000000000000000000000108006e0000000000e4006f0000000000b01c77c5beb7ab6ffa995c0ee6ad887b98c0b1099083a56ce73555b553df92d2fc8cf3f0b2d85efd945af55545859c3ff59a4668245deaa30508d70e48a7b8b0d4e59a8cd3a55ff9888aca1e334485ab88ac445cd40165cae601b117122542edc6231dbe1eb8cb1cb23d572ccef1e98bab7f1f7ba50fe7e816389c0caffee12b3284af3c90de653685c5ce707325e3a07065283b2f65349cfc49884ceca18187e42046d029019ff90de42824af6d79c6d0f012235a55d37083abff5f601992c5825b515f6302069b894d8a9c0b99f7fd065094883b5566ec658000000c00840000000000", @ANYRES32=r3, @ANYBLOB="282a958e50c2f8969ade2391ee4eb18f6bc81e945062445e68a6c8b2670f9cd271f7ce16121332e252c938682ce3ff0e5659cdddad9e01c1bb59568cdab48ce1260a7d12fa156a2116b5c22d4d1209d2fe763cc5c23a2cb9f30a9cd291542dcf8ddba736c6fdd751f0f7360d5bde3c44b32c626e8543f5fe097b72f433534ef580097dad57e08b6ce0c5219663305a7135e88a0968228d17ab5821aec6b39704cee06d117c4a6652cd7c60222534e2cd443106e032b3950ffb85b1228ffdad0a7737669fd208546e1b19b7f7fa7e130881d461d6148926480a4a0fcc001e961273f902958efd4d07f684a58d282884e65e10175b166ac73a1c7813e46e0b8a1f628f72e05adeb9cf99ad917eaec05b4eea15f4d20cf9f8841de700ba7800000070033a000c007700000000005d00000036d46dc195dc8ee69873472ccd6dce527104c006aa1e38aa179b7dc4affa106c7bd8d12a18711cfa4d8a17b8a07257a37eb2c147428bee8ade73882fb15fbe885b817adc7a421392f9070bf54082cfe9eebb53d0f1c7ad434bc68f1aec4c7ad1d504220b396839317f7d8f43b93c0727a37efe80a84f3d62220125f2bd04f7aaafa17dc6ec0b3593e4575749cef8d6b3ce193e7c3e423b04374528502a7e8774eac1289fe010b7af1431d34201470ed5859a29750286e36582e61fe535fe62754326e9da2925720d334bb298e2fb8b0e0b4679b2dd7cf0b24312fceba72acfccf2f30265ee316b5bad4b2f87978e81e907550177cdb0d18eeb9c1a22fa6eefab937225a578f8d832e732676dea5ffb70ce606afffacc662f25f3160153b5c969e52fd4b3c6fbd994135f8e1da25ac98a6096e190b14bb0ce7620473b090b8e4e93b8395a049c82ac8143e441115293eaa7c079516aebc7e5b99342438a4245472e857da8d34ec8d8892f576d91879831701d433a38a8bb43527ee6f6fb313f508fd5d61fcb3dc937ebf09556e8a1e6aed9a4294fe9bf46c6dd8cc3f7df2e400d71cf8c38bb0eb5f27f30b5eb67390c588bd03a81ec989f3a3b648f5eb92ea649f0299a8ab145eff89b309b512ff1a4480f0e0c00710000000000", @ANYRES32=r4, @ANYBLOB="0c00040000000000", @ANYRES32=r5, @ANYBLOB="e922197f137cd3bbf70b04880f334952faa28a6272e0dfd9068a618a3e468a04ace59a00474717a68a229edcefaba00c57133a8a5b83028ad8f656a53f4ee348862cee5f38140eb8e10fa9b8416187033ad278e5bf557f844f60e9de33f3b3266195b58f034cf24dbe28bf6fcb8d878440c4e86a58c24ae23a3d88c2c073e4c4d58a74aef386921ac360fd3ec6f9e94aae1eb16a1cc2281bb8bb48f1cb3b065f5bace69b8211fe397cd083819ecfdfccab87c06c5c1791f40a6c006a27e2f4776cb701382c27f13f66fcadb36ae2b5a0284500d06f6a351a449ed70e9583f9de232bd99fd239a74bea8c005e0000000000ac0d4acb0c9ab14e1e0351238b1f935cfabf695071095195d1e5999b1b4b5e663f68eda5f82e043f4f3aa81544dd08add0dc25be5bca9dcd73872aeeb5d378d88e03ac364912e5cfe90b77432f61a2f7bb7362d90301a6a727342aeafd6b819ade0acb87335d590781ea2994ef70253274558db6e983492c4f0d58e6c927b44a7ff8e87b004c022e0008002b000000000008013a00000000007fea473dcd8cbf704554c382a26c22a610d684cf49a3e6ef2be3b1977ce1501e4c5a27ff373a3d0f589ecd35d42e4214bcae7960da6d68e94189bbfdc85e313977ea56d24af710e7e77f480f5e6a2d5e1ed4720fbdd503591aad44093484a69d739f922b9139e3a99004991a068e8749ed593eb6b2ead9c10343b092ebfcbb9784c981c9376d7b500a8777fbb1ebe5437a7b20f58d4f649c6a39e5d548e232877725571ee24ebe5e8279ff903882ff15de0b4f880107c038eb095e88c517ec6d5a8e5113d4208400ae5ae9877f3f61e217b5347b8e91fb88a4553567a173e5d46b96985c93aec2b591c70f8f06e99f601344a4eb4429dc6d7a35f64331000000c886747f1b58ef3ece180b3f21dc1e803fe1724a779f05a42f9ad448d1025601da0389ab31de5875f278d5fe55a5a0bfe9d9e1ac40fb22a7681be9af7012b705d430923e3664e217dcc71bd6c1285c70ff70d3a18068a87a03a9a764c71ab31f2959dbd26b6abb9edb2bac7d860407283b437f5ed719fa5005a8968d24728ef271cf4db6236aeb11ee2a35eff8e7a96e01f17d6e4cc074bc924050c2f4d9fd75fe18b829046ea4e031bfd8a1df997200a59a6ccc450c2ae9d11e19302edba79464baf7545acf9117adbd52f32a6d5f3386c3699c00d6b5847fb11dc0cb7859973ecb64ca1390313f40595b96844d300c8650b83efd59a1ecb9896c8a87d44ce62097e1dc0ffa45d7c9f1c5f27172ea9cf2cd4999a03f9d7ae3a06b6875180039000000000000000000000000000000ffffe000000100000010006400000000000800000000000000"], 0x828}, 0x1, 0x0, 0x0, 0x8844}, 0x0) 2018/03/02 11:09:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB="ff0700eaff0000004f016ec15a7f994dae237aa96fccab04000939ec82ef98f2ffb79d390800e97c7d", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000000000000000f5ffff20491e618f8be19a34419886d1900d85dea079eca196e5f10b4e86b3b582aaf049ad24b4fcb5f38f310cac0657558af1a93ac989f70cc8812d8328cd"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:06 executing program 0: socket$inet(0x2, 0xffffffffffffffff, 0xffffffffffffffff) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000080)={0x0, r0}) getsockname$packet(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000200)=0x14) 2018/03/02 11:09:06 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r0, &(0x7f0000c41000), 0x0, 0xfffffefffffffffe, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x10000000000018, &(0x7f00000bc000), &(0x7f0000000040)=0x70ba334aacb35eb0) [ 96.786626] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 96.799947] binder: undelivered TRANSACTION_ERROR: 29189 [ 96.804294] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:06 executing program 5: r0 = memfd_create(&(0x7f000003affa)="706f73fb00000000000000566f6573737b0000", 0x0) pwrite64(r0, &(0x7f000003bfff)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) lseek(r0, 0x4000000000000000, 0x7) sendfile(r0, r0, &(0x7f000003c000), 0x1000) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000004000)='./file0\x00') bind$unix(r0, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e21}, 0x8) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/5) 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200, 0x0) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f00000003c0)=0x7, &(0x7f0000000400)=0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f0000000480)={0xad0a, 0x0, 0x0, 0x7}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0106434, &(0x7f0000000300)={0x3ff, r2, 0x10000, 0x1}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000340)={'ip_vti0\x00', @ifru_names='syzkaller0\x00'}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x10101) accept4$netrom(r1, &(0x7f00000002c0)=@ax25, &(0x7f0000000440)=0x10, 0x800) getdents(r3, &(0x7f0000000200)=""/176, 0xb0) 2018/03/02 11:09:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f000066aff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x80, 0x0) mq_notify(r1, &(0x7f00000015c0)={0x0, 0x0, 0x0, @tid}) inotify_init() [ 96.857371] netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'. [ 96.869472] binder: 14898:14912 transaction failed 29189/-22, size 40-8 line 2848 [ 96.885610] binder: 14909:14916 transaction failed 29189/-22, size 40-8 line 2848 [ 96.887654] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pig=14917 comm=syz-executor3 2018/03/02 11:09:06 executing program 6: r0 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x2, 0x40000) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x20) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000002b80), 0x10145) recvmmsg(r1, &(0x7f0000002ac0)=[{{&(0x7f0000000000)=@nfc, 0x10, &(0x7f0000001480)=[{&(0x7f0000000040)=""/5, 0x5}, {&(0x7f0000000080)}, {&(0x7f00000000c0)=""/252, 0xfc}, {&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/43, 0x2b}, {&(0x7f0000001200)=""/195, 0xc3}, {&(0x7f0000001300)=""/200, 0xc8}, {&(0x7f0000001400)=""/116, 0x74}], 0x8, 0x0, 0x0, 0xffffffff}, 0x101}, {{&(0x7f00000014c0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x10, &(0x7f00000018c0)=[{&(0x7f0000001500)=""/212, 0xd4}, {&(0x7f0000001600)=""/185, 0xb9}, {&(0x7f00000016c0)=""/168, 0xa8}, {&(0x7f0000001780)=""/57, 0x39}, {&(0x7f00000017c0)=""/26, 0x1a}, {&(0x7f0000001800)=""/19, 0x13}, {&(0x7f0000001840)=""/108, 0x6c}], 0x7, &(0x7f0000001900)=""/97, 0x61, 0x7}, 0x6}, {{&(0x7f0000001980)=@alg, 0x58, &(0x7f0000002200)=[{&(0x7f0000001a00)=""/235, 0xeb}, {&(0x7f0000001b00)=""/210, 0xd2}, {&(0x7f0000001c00)=""/133, 0x85}, {&(0x7f0000001cc0)=""/47, 0x2f}, {&(0x7f0000001d00)=""/233, 0xe9}, {&(0x7f0000001e00)=""/207, 0xcf}, {&(0x7f0000001f00)=""/247, 0xf7}, {&(0x7f0000002000)=""/198, 0xc6}, {&(0x7f0000002100)=""/202, 0xca}], 0x9, &(0x7f0000002280)=""/205, 0xcd, 0x4a}, 0x10001}, {{&(0x7f0000002380)=@alg, 0x58, &(0x7f0000002540)=[{&(0x7f0000002400)=""/210, 0xd2}, {&(0x7f0000002500)=""/5, 0x5}], 0x2, &(0x7f0000002580)=""/156, 0x9c, 0x7ff}, 0x6a7c}, {{&(0x7f0000002640)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x3a, &(0x7f0000002940)=[{&(0x7f0000002680)}, {&(0x7f00000026c0)=""/109, 0x6d}, {&(0x7f0000002740)=""/206, 0xce}, {&(0x7f0000002bc0)=""/4096, 0x1000}, {&(0x7f0000002840)=""/204, 0xcc}], 0x5, 0x0, 0x0, 0x7}, 0x1}, {{0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f0000002980)=""/255, 0xff}], 0x1, &(0x7f0000003bc0)=""/222, 0xde, 0x1}, 0xf9}], 0x6, 0x20, &(0x7f0000003cc0)={0x0, 0x989680}) getsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000003d00), &(0x7f0000003d40)=0x4) 2018/03/02 11:09:06 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2008}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7fffffff80000000, 0x42000) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) [ 96.933881] netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'. [ 96.960770] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 96.967119] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 2: syz_emit_ethernet(0x1, &(0x7f00000016c0)=ANY=[@ANYRES32=0x0], 0x0) 2018/03/02 11:09:06 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:06 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000106000/0x3000)=nil, 0x3000, 0x6, 0x14d011, r0, 0x0) futex(&(0x7f0000000ffc), 0x81, 0x0, &(0x7f0000000ff8), &(0x7f0000000040), 0x3) [ 96.976790] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=27 sclass=netlink_route_socket pig=14926 comm=syz-executor3 [ 96.984202] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.010141] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 97.018395] binder: 14928:14931 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:06 executing program 4: r0 = socket$inet(0x2, 0x4, 0x7) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x2b4, 0xffffffff, 0x0, 0x94, 0x154, 0xffffffff, 0xffffffff, 0x220, 0x220, 0x220, 0xffffffff, 0x4, &(0x7f0000566fc0), {[{{@uncond, 0x0, 0x70, 0x94, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}, {{@uncond, 0x0, 0x9c, 0xc0, 0x0, {}, [@common=@addrtype={0x2c, 'addrtype\x00'}]}, @REJECT={0x24, 'REJECT\x00'}}, {{@uncond, 0x0, 0x9c, 0xcc, 0x0, {}, [@common=@addrtype={0x2c, 'addrtype\x00'}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x310) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f0000000380)) 2018/03/02 11:09:06 executing program 5: r0 = socket(0x40000000015, 0x5, 0x0) socket(0x8, 0x0, 0x731) connect$inet(r0, &(0x7f0000a7aff0)={0x2, 0x4e20, @empty}, 0x10) 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0x5a3) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000023000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000008000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x2000, 0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0x1) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @empty, @remote}, &(0x7f0000000040)=0xc) 2018/03/02 11:09:06 executing program 2: r0 = socket$inet(0x10, 0x3, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) sendto$unix(r1, &(0x7f0000000080)="62e712fbde8243a69880ff404be4e3b7fef852227eb303453ae7a71bee045c74f6be89949e6071e89d77bc63fc9b5eb9404d5f15c87200cedd5aabfdfc01229a55d7440eb61191434113f30d4e966efcaf4d53ee2d1c33d4d0d75249ca72b90321c3a30133dfde4048b112368bf31b9f81ff739cdef7542cef8db120993d6f9575a805a005e7ad4bf6f9b461549dcbf12a4ac938e9382c3670b348f06690e9539bd9bb3af5fd7f9c4ada41cce307643b7d2d1cd5745522ea0b5d0859bcd877826d551c6bb53b3bf34e271ce02d93c69793fc4bb265d837fadf0da6256537e3b9b73ca5ef354e7a4e8a", 0xe9, 0x8040, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x8) ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f0000000440)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) write$sndseq(r1, &(0x7f0000000600)=[{0x1, 0x200, 0x800, 0x1, @tick=0x3ff, {0x4, 0x3}, {0x3ff}, @raw32={[0x1, 0xfd9, 0x3]}}, {0xffff, 0x5871, 0x1, 0x0, @tick=0x34, {0x6, 0x55}, {0x1, 0x8}, @control={0x4ac, 0xd7, 0x3}}, {0x2, 0x4, 0x400, 0x9, @tick=0x6b1, {0x7fffffff, 0x8001}, {0x7f, 0x5}, @raw32={[0x9, 0x40, 0xd76]}}, {0x0, 0x9, 0x426, 0x1, @time={0x77359400}, {0x9, 0xfffffffff638d576}, {0xd, 0x1}, @time=@time={r2, r3+10000000}}, {0x3, 0x0, 0x10001, 0x5c9, @tick=0xffffffff, {0x101, 0x4}, {0x4, 0x3}, @raw8={"7552b120b5ad3af952d29903"}}, {0x8000, 0xfffffffffffffff7, 0xfffffffffffffffd, 0xa4, @tick=0x800, {0x3, 0x800}, {0x7, 0x1}, @addr={0xff}}, {0x94e3, 0x0, 0x1, 0x7, @tick=0x401, {0x51, 0x6}, {0x0, 0x1}, @time=@tick=0x10001}], 0xc4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23, @rand_addr=0xc532}, 0x10) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f00000002c0)=ANY=[@ANYBLOB="06000000040000000500000000000000000200000000000009000000430000000009f3ffffe6000000020000000009000000000000000000000900000000000000020000000000000000000080000000004b000000000000005a000000000000010100c4ba1d1a82a000000000000000000000000091ddc615d1ad720b"]) [ 97.042689] binder: 14928:14942 transaction failed 29189/-22, size 40-8 line 2848 [ 97.052675] binder: 14936:14943 transaction failed 29189/-22, size 40-8 line 2848 [ 97.081670] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.087254] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.104242] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x5, 0x1c1000) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000200)={0x2, 0x2}) syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0xaa4, 0x10080) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_DMA(r1, 0xc0286429, &(0x7f00000001c0)={r2, 0x4, &(0x7f00000000c0)=[0x10000, 0x2fa, 0x0, 0x0], &(0x7f0000000100)=[0x5614cd7, 0x400, 0x80000001, 0x8, 0x10001, 0x8, 0x100000000, 0x3, 0x28dc, 0x4], 0x4, 0x8, 0x8001, &(0x7f0000000140)=[0xfffffffffffffffd, 0x7f, 0x100, 0x7, 0xd03, 0x0, 0x1000, 0x7ff], &(0x7f0000000180)=[0x1, 0x3, 0x8, 0x400, 0x3ff, 0x4]}) 2018/03/02 11:09:06 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x4e20, @dev={0xac, 0x14}}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x400000) ioctl$sock_netrom_TIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000eb3ff8)={r1}, &(0x7f0000940000)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}, &(0x7f0000000040)=0x20) 2018/03/02 11:09:06 executing program 6: r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x4, 0x600) connect$ipx(r0, &(0x7f0000000040)={0x4, 0x6, 0x4, "25e378422008", 0x9}, 0x10) r1 = socket(0x200000000010, 0x2, 0xfffffffffffffffd) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) sendmsg$nl_route(r1, &(0x7f0000001300)={&(0x7f0000001000)={0x10}, 0xc, &(0x7f00000012c0)={&(0x7f00000010c0)=@ipv6_newroute={0x24, 0x18, 0x21, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14, 0x8001}]}, 0x24}, 0x1}, 0x0) 2018/03/02 11:09:06 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:06 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80}, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)="571d7d91290d61beff7145763f7a95674c9b61c6e58ba229941a083257dfdd9d4037ad6480bbf0fd", 0x28}], 0x1}, 0x0) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_ipx_SIOCAIPXITFCRT(r1, 0x89e0, &(0x7f0000000080)=0x8) 2018/03/02 11:09:06 executing program 2: openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/member\x00', 0x2, 0x0) r0 = socket$nfc_llcp(0x27, 0x0, 0x1) mmap(&(0x7f00005cc000/0x1000)=nil, 0x1000, 0x0, 0x31, r0, 0x0) r1 = dup(0xffffffffffffffff) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f00000002c0)={0x0, 0x4, 0x8, 0x69ff969a}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000340)={r2, 0x7ff}, &(0x7f0000000380)=0x8) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000003c0)) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)={r2, 0x100, 0x2, [0x4c01, 0x1ffc00000000000]}, &(0x7f0000000140)=0xc) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x6, 0x200, 0x8, 0x9, r2}, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000480)={r2, 0x8}, &(0x7f00000004c0)=0x8) fadvise64(r1, 0x0, 0x7ff, 0x7) r4 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r4, &(0x7f0000000280)='.request_key_auth\x00', &(0x7f0000000400)='mime_typeY\x00') syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x68, 0x1) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000080)={0x9, 0x0, 0x1, 0x1ff, 0x101, 0x400, 0x126, 0x19b9928f}, &(0x7f00000000c0)=0x20) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@int=0x40, 0x4) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00000005c0)={r3, @in6={{0xa, 0x4e23, 0xfffffffffffffffa, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x4}}}, 0xfffffffffffffe3a) 2018/03/02 11:09:06 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x4, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x1}, {r0}, {}], 0x3, &(0x7f0000000100)={0x77359400}, &(0x7f0000000140), 0x8) 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0xd94) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000001000000000000000000000ffffffff0003000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c30000000000000000000000069703600000000000000000000f500000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000400000000000000e7ffffff0b000000c9c37eaa085f0000fdffffff"]}, 0x1a0) 2018/03/02 11:09:06 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00009f3fa8)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(camellia-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000)="0a0775b0d5e383e5b3b60ced5c54dbb729", 0x11) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x5f, 0x280802) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000040)={0x0, 0x0, []}) [ 97.186662] binder: 14967:14970 transaction failed 29189/-22, size 40-8 line 2848 [ 97.197310] binder: 14967:14970 ioctl c0086420 20000080 returned -22 [ 97.210092] binder: 14967:14970 transaction failed 29189/-22, size 40-8 line 2848 [ 97.220612] sctp: [Deprecated]: syz-executor2 (pid 14975) Use of int in max_burst socket option deprecated. [ 97.220612] Use struct sctp_assoc_value instead 2018/03/02 11:09:06 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x42c, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc6e, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000fb1fee)='/dev/input/event#\x00', 0x20, 0x200000000) r1 = accept4$llc(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000080)=0x10, 0x800) r2 = gettid() ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f00000000c0)=r2) ioctl$EVIOCSKEYCODE_V2(r0, 0x80284504, &(0x7f0000ed2fd8)={0x7, 0x0, 0x0, 0x0, "fe7798d653b409805822558600002cde00004c203c3f03940200391f648b4046"}) 2018/03/02 11:09:06 executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x8}}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r1) ioctl$KVM_S390_INTERRUPT_CPU(r2, 0x4010ae94, &(0x7f0000000080)={0x292, 0x3, 0x9}) io_setup(0x8, &(0x7f0000000000)=0x0) io_destroy(r3) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000000c0)=0x9, 0x4) r4 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$RDS_GET_MR(r2, 0x114, 0x2, &(0x7f0000000240)={{&(0x7f0000000100)=""/250, 0xfa}, &(0x7f0000000200), 0x1}, 0x20) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) [ 97.238106] binder: 14967:14970 ioctl c0086420 20000080 returned -22 [ 97.259056] sctp: [Deprecated]: syz-executor2 (pid 14979) Use of int in max_burst socket option deprecated. [ 97.259056] Use struct sctp_assoc_value instead [ 97.266577] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) fstat(r0, &(0x7f0000000200)) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00000002c0)={0x0, 0x40, 0x10, 0x6, 0x7}, &(0x7f0000000300)=0x18) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000340)={r1, 0xb5}, 0x8) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380)='/dev/audio\x00', 0x3, 0x0) getpeername$ipx(r2, &(0x7f00000003c0), &(0x7f0000000400)=0x10) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000280)) 2018/03/02 11:09:06 executing program 2: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast1={0xff, 0x1, [], 0x1}, 0x3, 0x0, 0x3}, 0x20) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/enforce\x00', 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/rfkill\x00', 0x0, 0x0) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vga_arbiter\x00', 0x0, 0x0) io_submit(0x0, 0x0, &(0x7f0000000680)=[]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000075afd0)={0x4c, 0x0, &(0x7f000092b000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR64=&(0x7f0000bd1fb8)=ANY=[], @ANYPTR64=&(0x7f0000a81fe8)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f000005af7e)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 97.298256] binder: 14982:14983 got transaction to invalid handle [ 97.304640] binder: 14982:14983 transaction failed 29201/-22, size 0-0 line 2848 [ 97.319971] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.327656] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 97.344881] binder_alloc: 14982: binder_alloc_buf failed to map pages in userspace, no vma [ 97.353490] binder: 14993:14995 transaction failed 29189/-3, size 40-8 line 2963 [ 97.364990] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.386996] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 97.402360] binder: release 15002:15007 transaction 363 out, still active [ 97.409416] binder: undelivered TRANSACTION_COMPLETE [ 97.410161] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.423123] binder_alloc: binder_alloc_mmap_handler: 15002 20000000-20002000 already mapped failed -16 [ 97.426076] binder: BINDER_SET_CONTEXT_MGR already set [ 97.438054] binder: 15002:15010 ioctl 40046207 0 returned -16 [ 97.445876] binder_alloc: 15002: binder_alloc_buf, no vma 2018/03/02 11:09:06 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_tables_targets\x00') readv(r0, &(0x7f0000008f60)=[{&(0x7f0000003000)=""/1353, 0x549}], 0x1) socketpair$inet(0x2, 0x7, 0x8, &(0x7f0000000040)) 2018/03/02 11:09:06 executing program 4: syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x9, 0xe01) r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x7, 0x200102) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000080)=0x80, 0x4) r1 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0) write$selinux_validatetrans(r1, &(0x7f0000000100)={'system_u:object_r:ld_so_ts0', 0x20, "73797374656d5f753a6f626a6563745f723a64627573645f657865635f8e3a7330", 0x20, 0x38, 0x30, 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023\x00'}, 0x6f) 2018/03/02 11:09:06 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = gettid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000200)={r3, r0}) 2018/03/02 11:09:06 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000000000)=""/250) r1 = syz_open_dev$sndmidi(&(0x7f0000000100)='/dev/snd/midiC#D#\x00', 0x8000, 0x40) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x80000000, @mcast1={0xff, 0x1, [], 0x1}, 0x733}}, 0x5, 0x7}, &(0x7f0000000200)=0x98) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f00000004c0)={0x3, [0xabe, 0xfffffffffffffffb, 0xf2]}) ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f00000002c0)) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000240)={r2, 0x3}, &(0x7f0000000280)=0x8) uselib(&(0x7f0000000480)='./file0\x00') 2018/03/02 11:09:06 executing program 2: r0 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r0, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f00000000c0)="ab", 0x1}]) 2018/03/02 11:09:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2b, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="7f44d934d900c5f9f680ecbdb0c98486ed8aa6b6546a6e6ef4c71d77439906e984d84825e57a0a7e50e4f6fd495f3fbf3bc5626d25e46752d47a5e"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:06 executing program 6: r0 = syz_open_dev$sndctrl(&(0x7f0000004fed)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x9, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80000, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80585414, &(0x7f0000000040)=""/73) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc1205531, &(0x7f0000003ffc)) [ 97.451483] binder: 15002:15010 transaction failed 29189/-3, size 0-0 line 2963 [ 97.464279] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.469816] binder: send failed reply for transaction 363, target dead [ 97.507067] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 97.507835] binder: 15017:15021 transaction failed 29189/-22, size 40-8 line 2848 [ 97.521649] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 97.529136] kauditd_printk_skb: 1 callbacks suppressed 2018/03/02 11:09:06 executing program 6: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x420205) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f00008a4000)={{0x8, 0xffff}, {0xf, 0xa2de}, 0x7, 0xfffffffffffffff7}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x7ff, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000000c0)) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000001c0)=0x0) process_vm_writev(r2, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/14, 0xe}, {&(0x7f0000000240)=""/124, 0x7c}], 0x2, &(0x7f0000000300)=[], 0x0, 0x0) fadvise64(r1, 0x400000, 0x5, 0x1) connect$llc(r1, &(0x7f0000000100)={0x1a, 0xf5, 0x80, 0xc3e6, 0x1ff, 0x0, @link_local={0x1, 0x80, 0xc2}}, 0x10) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000080)) ioctl$sock_bt_cmtp_CMTPCONNDEL(r1, 0x400443c9, &(0x7f0000000300)={{0x1, 0x6, 0x6, 0x96, 0x6, 0x3}, 0x100000001}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000140)={{0x2, 0x80}, {0x1ad36fa, 0x6}, 0x100000000, 0x54e6f78352a45818, 0x4}) 2018/03/02 11:09:06 executing program 4: r0 = memfd_create(&(0x7f00008de000)='\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20002) r2 = dup2(r1, r0) epoll_create1(0x80000) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000041000)={0x0, 0x0, 0x0, 'queue0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x007\x00'}) write$evdev(r0, &(0x7f0000a88f58)=[{{0x0, 0x2710}}, {}, {{0x77359400}}, {}], 0x40) write$evdev(r2, &(0x7f0000000040)=[{{0x0, 0x2710}}, {{0x77359400}}], 0x20) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000080)={0x3, 0x1, 'client1\x00', 0x4, "222b8aa29b8e4a23", "6ffc56a0d101f62c6bed6d08dedb9c7c4272848bb0db45f681515c068a5f68e2", 0x5b, 0x1000}) 2018/03/02 11:09:06 executing program 5: readv(0xffffffffffffffff, &(0x7f0000000280)=[], 0x0) 2018/03/02 11:09:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x4, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r0, 0x40086424, &(0x7f00000000c0)={r1, 0x1}) io_destroy(0x0) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r0, 0x40086408, &(0x7f0000000100)={0xffffffff00000000}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000140)={0x0, 0x21, 0x1, r0}) 2018/03/02 11:09:06 executing program 0: r0 = socket$inet(0x2, 0x7, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 97.529143] audit: type=1400 audit(1519988946.893:127): avc: denied { validate_trans } for pid=15012 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1 [ 97.532199] binder: 15015:15022 got transaction to invalid handle [ 97.565004] binder: 15015:15022 transaction failed 29201/-22, size 0-0 line 2848 [ 97.578067] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:06 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:06 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xdb30, 0x200000) flock(r0, 0x8) r1 = syz_open_dev$sg(&(0x7f0000713ff7)='/dev/sg#\x00', 0x0, 0x8009) write(r1, &(0x7f0000b0f000)="00000000000000060001b2fffffffffffffffcffed5ed2bc7002cebc9b97ae0000000800000000001b00", 0x2a) 2018/03/02 11:09:07 executing program 3: r0 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x3, 0x115000) sendto$llc(r0, &(0x7f0000000340)="04f2b62576cf2f25f230b1f09b3da78f7d01959bbb9f7d6afb859f3adb7d67b20a212990940a9264a537eded63760b8adf162e54c8fe20a428c46a0a65bccd92254033e40989a30ffe4c28eb9ac67f595a03cec74c5f578b17cdff970b2d640f83b2bbbb916ed7834e7e736c5b7b3229668c07a230f5b680e926aa9b20902df9b932c17d68ff736d4b35af8dd73aa41e789d8ebaee6e5d2f3418bd8eb159fe8a75abd9ce0a0b06920bbd29a4a38ec40e094bb19245923397df2d74bbb09806f6afde492743050873d802848fa0f7a23bce11f1c2a24de57c5f3415435f2a7f5850c96e", 0xe3, 0x10, &(0x7f0000000180)={0x1a, 0x1a, 0x0, 0x1000, 0x800, 0x7b6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x10) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) r2 = dup(r1) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000200)={0x0, {{0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}}, 0x1, 0x1, [{{0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}}]}, 0x110) 2018/03/02 11:09:07 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc004240a, &(0x7f0000000040)={0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) prctl$seccomp(0x16, 0x1, &(0x7f0000000080)={0x0, &(0x7f0000000040)=[]}) r1 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x7f, 0x400) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x1d, 0x6}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000001c0)={0x5ea000000000, 0x3ff, 0x8, 0x8, 0x7fffffff, 0xffff, 0x2, 0xd3a, r2}, 0x20) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000100)) getdents64(r1, &(0x7f0000000200)=""/73, 0x49) [ 97.613587] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.650083] binder: 15043:15045 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:07 executing program 3: r0 = open(&(0x7f0000053000)='./file0\x00', 0x43, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = open(&(0x7f000000cff8)='./file0\x00', 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x0) fcntl$setlease(r1, 0x400, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000000)={'nat\x00', 0x2, [{}, {}]}, 0x48) 2018/03/02 11:09:07 executing program 6: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000cd9ff4)='/dev/rfkill\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f000084fffc)) fallocate(r0, 0x2, 0xaae, 0x100000000) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000cba000)='/dev/rfkill\x00', 0x0, 0x0) dup3(r1, r0, 0x0) [ 97.665918] binder: 15043:15045 transaction failed 29189/-22, size 40-8 line 2848 [ 97.671159] binder: 15057:15062 got transaction to invalid handle [ 97.679989] binder: 15057:15062 transaction failed 29201/-22, size 0-0 line 2848 [ 97.698803] audit: type=1326 audit(1519988947.066:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15056 comm="syz-executor4" exe="/root/syz-executor4" sig=9 arch=40000003 syscall=240 compat=1 ip=0xf7f84c99 code=0x0 [ 97.705515] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.732748] binder: undelivered TRANSACTION_ERROR: 29189 [ 97.755238] binder: undelivered TRANSACTION_ERROR: 29201 [ 97.763892] audit: type=1326 audit(1519988947.131:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15056 comm="syz-executor4" exe="/root/syz-executor4" sig=9 arch=40000003 syscall=240 compat=1 ip=0xf7f84c99 code=0x0 2018/03/02 11:09:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff}) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000640)={'ipvs\x00'}, &(0x7f00000006c0)=0xfffffffffffffd49) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x200, 0x2) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000400)={0x6, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0063404000000b0000000000000000000000000000000000000010bf442392bf5ee6654e1c00000000000000000000280100000000000008000000000000007bf35eaeaf9dd223753ea9ce6d036cc1696a4d79e394e27425ab8be4e5b5925a48c856c57f9a28c76723e0368d107e0aab61a447eae3d88255541c1ef459816dddd6f3c4247c09bb3bdcc923d6d8fb5ff7d5428449c63807d297e3c8fb0c006c7cac33d33885e95ffc7d37f1c6f1a9789ffdb74cf56d66fa91cfd5dfa7b0ac647982e800f34e9c5b561454edf0350fdf6c32960bfd174bd15c70c95698ae1159ac7bca3ca53d0ea0c4ba227115eafb9627cfe09eac1f46fe3a540afed9226c34520bc6ac632f202f5fd78a181d5e4681f463d638618e89f3b0406a294ff95ebf0dc53e12089486d176fe619d816af4b957a8cdb03bdc1d03001e726a07874d1eedb62740befaff885710671facdf6d1a93ffe63389d23231889d215cb6fe4fa753eb00000000000000000000000000000000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:17 executing program 0: r0 = socket$inet(0x2, 0x5, 0xf0f) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:17 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:17 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0xa1fc, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000100)={0x60dd, 0x9, 0xfa14, 0x1, 0x3, 0xeaa, 0xfffffffffffff800, 0x76b, 0xc, 0x8}) r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x2440, 0x10) pread64(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x0) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000080)=0x573) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) inotify_add_watch(r1, &(0x7f0000000200)='./file0/file0\x00', 0x82) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0x6, 0x1}, &(0x7f0000000180)=0xc) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000001c0)={r3, 0x8, 0x10}, 0xa) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000240)=""/194) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) 2018/03/02 11:09:17 executing program 3: r0 = socket$inet6(0xa, 0x803, 0x8) io_setup(0x3, &(0x7f0000000040)=0x0) io_setup(0x5ab, &(0x7f0000000080)) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000)="bb", 0x1}]) 2018/03/02 11:09:17 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb3ad}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000040)={0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}) 2018/03/02 11:09:17 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x3, 0x40) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40042406, &(0x7f0000000040)='\x00') mkdir(&(0x7f00008d4000)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f00000db000)='ramfs\x00', 0x0, &(0x7f000000a000)) r1 = open(&(0x7f0000061000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000050545)='./file0\x00', 0x0) mkdirat(r1, &(0x7f000006eff2)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000064ff8)='./file0/file0\x00') 2018/03/02 11:09:17 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = eventfd2(0x0, 0x0) io_setup(0xa3c, &(0x7f0000409000)=0x0) ppoll(&(0x7f0000374000)=[], 0x0, &(0x7f0000b10000)={0x77359400}, &(0x7f0000ed6ff8), 0x8) io_submit(r2, 0x2, &(0x7f0000000240)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000140)}]) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000000)={0x2, r0}) ioctl$KDSETMODE(r3, 0x4b3a, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000040)={{0xa, 0x4e24, 0x401, @dev={0xfe, 0x80, [], 0x17}, 0x7f}, {0xa, 0x4e20, 0x80000001, @loopback={0x0, 0x1}, 0xffffffff00000000}, 0x8, [0x8001, 0x61, 0xe16, 0x3f, 0x10001, 0x1, 0x3, 0x5]}, 0x5c) 2018/03/02 11:09:17 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000f50080c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) 2018/03/02 11:09:17 executing program 3: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x81}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={r1}, 0x8) syz_emit_ethernet(0x6e, &(0x7f0000101000)={@random="cd390b081bf2", @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "02290f", 0x38, 0x3a, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x32, 0x0, @loopback={0x0, 0x1}, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}, [], "802a08000000006b"}}}}}}}, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x20000, 0x12) 2018/03/02 11:09:17 executing program 6: r0 = socket$inet(0x2, 0x5, 0x2) sendmmsg(r0, &(0x7f0000006780)=[{{&(0x7f0000000340)=@in={0x2, 0x4e20, @empty}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000380)="5e23a269ea6f9439a717bc09b42d1aa293de72738da728c4327e67d30cd1a650427bcc932641b2d912bdaf02b42ff7a4fbd9177bb717374062b23d9f1c011ce5a5655500bc4186c2f2e43067a73ddea91210ce3fdf9d8c37190f", 0x5a}, {&(0x7f0000000240)="a014bbaa8cefc54d81c3f7863658f4433d38a7716fdbd234879975738cf7e2460034cda966e7921c863a067bc0dd2b4a0ad05cca217cfd64d5c71397a9515b3d2900d649f8f2982843e7", 0x4a}], 0x2, &(0x7f0000000940)=[], 0x0, 0x801}}, {{&(0x7f0000000300)=@ax25={0x3, {"d162919bab73ac"}}, 0x10, &(0x7f0000006600)=[], 0x0, &(0x7f0000006680)=[]}}], 0x976, 0x0) clock_getres(0x7, &(0x7f0000000180)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2000, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000140)) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x40}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000000c0)={r2, 0x1, 0x2, [0x7f, 0x2]}, &(0x7f0000000100)=0xc) [ 108.037653] binder: 15075:15089 got transaction to invalid handle [ 108.043995] binder: 15075:15089 transaction failed 29201/-22, size 28-4966055936 line 2848 [ 108.056631] binder: 15078:15088 got transaction to invalid handle [ 108.062991] binder: 15078:15088 transaction failed 29201/-22, size 0-0 line 2848 [ 108.068148] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 108.078258] binder: 15075:15100 got transaction to invalid handle [ 108.084995] binder: 15075:15100 transaction failed 29201/-22, size 28-4966055936 line 2848 [ 108.099143] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.122284] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:17 executing program 0: r0 = socket$inet(0x2, 0x1, 0x3) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:17 executing program 6: r0 = socket$inet(0x2, 0x3, 0x4) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x6, 0x80) accept4$packet(0xffffffffffffff9c, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000240)=0x14, 0x800) bind$bt_hci(r1, &(0x7f0000000280)={0x1f, r2, 0x2}, 0xc) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) ioctl$TIOCMBIC(r3, 0x5417, &(0x7f00000000c0)=0xffffffff) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) ioctl$TIOCCONS(r3, 0x541d) sendmmsg(r0, &(0x7f0000000100)=[], 0x800000000000415, 0x20000003ffc) 2018/03/02 11:09:17 executing program 5: r0 = socket$inet(0x2, 0x805, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@multicast2, @in=@remote}}, {{@in6=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000040)=0xe8) syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x1) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000575000), 0x8) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000005c0)=@filter={'filter\x00', 0xe, 0x1, 0x358, [0x0, 0x20000240, 0x20000270, 0x20000568], 0x0, &(0x7f0000000200), &(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000000000000a000000600564756d6d793000000000000000000000627071300000000000000000000000006970646470300000000000000000000067726574617030000000000000000000000000000000ffffffff0000000000000000003affff00ff00009c0200009c020000c80200006270660000000000000000000000000000000000000000000000000000000000080200002500000001000108c3000000030016020100000003008f0852280000010001010800000002000900c800000000043f01ff0f000006002a01ff0f0000000000810000000003000803040000002b000000000100000400000424c13800ff0100020100000026df5c04020000000200fefd01000000040009ffba03000000000300000100000104ff0304000000800005ff0100000081000209010000000000bdff00000000800000d8750b0000ff0307fafffffeff090000020800000004000701590000000100000100000000040006010200000004000099c0ffffff000205000101000002000102fcffffff09004008040000000008ff004000000089bd0301ff0700000800070304000000ff01092207000000ff0007007f0000000800a309f7fffffffeffeafd000000000800ff010100000006003f07ff010000020002ff0400000001008a07000001000200000006000000d3ff910109000000000005ff000000800100ff50050000000400008c030000001b24030002000000070007ff00100000010003097f000000d6568105760000000000080700000000040002800000008006000409a6090000090003ff0500000003000104fb000000010006070100000007008109060000000800d8ff1c0b00007f0003ff06000000040007040800000000000604000100000700014020000000f8ff0106fcffffff07000500fbffffffa70000006d61726b0000000000000000000000000000000000000000000000000000000008000000e0ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000fcffffff00000000"]}, 0x3a8) sendto$inet(r0, &(0x7f0000000000)="a7", 0x1, 0x0, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14}}, 0x10) 2018/03/02 11:09:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x200000002, 0x78, 0xc568, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x200, 0x100) 2018/03/02 11:09:17 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) r2 = syz_open_dev$sndpcmp(&(0x7f00000003c0)='/dev/snd/pcmC#D#p\x00', 0x9, 0x460000) ioctl$KVM_SMI(r2, 0xaeb7) perf_event_open(&(0x7f00000002c0)={0x2, 0x78, 0x5, 0x4, 0x5, 0x6, 0x0, 0x9de, 0x21, 0x9, 0x20000000000, 0x8, 0x7, 0x770, 0xfffffffffffffff7, 0x7, 0x94a, 0x40000, 0x4, 0x0, 0x2, 0x820000000000000, 0x8, 0x4, 0x0, 0x1ff, 0xffffffff, 0x4, 0x95e, 0x6, 0x5, 0x900000, 0x647, 0x6, 0x8, 0x196, 0x9, 0x3f, 0x0, 0x4, 0x2, @perf_bp={&(0x7f0000000280), 0x6}, 0x4000, 0x8, 0x81, 0x1, 0xa11, 0x9, 0x4}, r1, 0x8001, r0, 0xf) request_key(&(0x7f00000001c0)='id_legacy\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a}, &(0x7f0000000240)='\x00', 0xfffffffffffffffe) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000180)=0xe8) r4 = getgid() syz_fuse_mount(&(0x7f0000000040)='./file0\x00', 0xc000, r3, r4, 0x3f, 0x80000) 2018/03/02 11:09:17 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:17 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000001fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x20000, 0x0) ioctl(r0, 0x40044103, &(0x7f0000008ffe)) 2018/03/02 11:09:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB="ff"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) [ 108.182305] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.213133] kernel msg: ebtables bug: please report to author: Wrong len argument [ 108.221765] binder: 15119:15122 got transaction to invalid handle 2018/03/02 11:09:17 executing program 6: 2018/03/02 11:09:17 executing program 4: 2018/03/02 11:09:17 executing program 0: r0 = socket$inet(0x2, 0xfffffffffffffbfc, 0x6) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f00000000c0)) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000010000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff885e32c1ed1a036a89fcd3ca80477f671e96d436322d1216692c3afddfebba6e44588ec36febc9826be3f17a79a4315304445668f141177554e5855a6479ef18c401e20084751e5c3c0b07409733d03115f4cd8ad740389243661dfd06ab8ac8e292fd4d186cd003a89b534a0ca44c5f153db84a5e4b55b73649"]}, 0x227) 2018/03/02 11:09:17 executing program 5: [ 108.228180] binder: 15119:15122 transaction failed 29201/-22, size 0-0 line 2848 [ 108.237192] kernel msg: ebtables bug: please report to author: Wrong len argument [ 108.262139] binder_alloc: 15119: binder_alloc_buf failed to map pages in userspace, no vma [ 108.270734] binder: 15124:15136 transaction failed 29189/-3, size 40-8 line 2963 2018/03/02 11:09:17 executing program 2: 2018/03/02 11:09:17 executing program 4: 2018/03/02 11:09:17 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x200000000044042) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x800) 2018/03/02 11:09:17 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:17 executing program 6: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f000042d000)=ANY=[@ANYBLOB="00020201000000000000000000"], 0x1) sendto$inet6(r0, &(0x7f0000000000)="72f9d541e40ff74418482c2ca1361c9426be4ba0b92fdbb8407ad8cc4517ab89f31af57da3186a9a8a37db4719939a9067b427514d85e64164def708f3c53c48e62e855547680a8634a2137e666c2a1e8c47572b5ec30861c480a4f96a6f3f125895347c72e862258ee5543b177cf08587dc79db6fc978beb0de3fa5aebaabe98444202423e4", 0x86, 0x800, &(0x7f00000000c0)={0xa, 0x4e22, 0x5, @dev={0xfe, 0x80, [], 0xf}, 0x1e1}, 0x1c) 2018/03/02 11:09:17 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x200000000044042) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x800) [ 108.301709] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.373933] binder: 15148:15154 got transaction to invalid handle [ 108.376193] binder: undelivered TRANSACTION_ERROR: 29189 [ 108.380293] binder: 15148:15154 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:17 executing program 4: perf_event_open(&(0x7f0000b5a000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) recvmmsg(r1, &(0x7f00000048c0)=[{{&(0x7f0000004140)=@un=@abs, 0x8, &(0x7f00000043c0)=[{&(0x7f0000004300)=""/144, 0x90}], 0x1, &(0x7f0000004400)=""/248, 0xf8}}, {{0x0, 0x0, &(0x7f0000004880)=[{&(0x7f00000047c0)=""/179, 0xb3}], 0x1}}], 0x2, 0x10000002, &(0x7f0000000700)={0x77359400}) 2018/03/02 11:09:17 executing program 2: perf_event_open(&(0x7f0000bba000)={0x2, 0x78, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00000fbfc8)={&(0x7f0000975ff4)={0x10}, 0xc, &(0x7f00000b1000)={&(0x7f00007cc000)=ANY=[@ANYBLOB="24000000100006000056b700000000090000000000000000000000000000000000000000"], 0x24}, 0x1}, 0x0) 2018/03/02 11:09:17 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = syz_open_dev$dspn(&(0x7f0000000740)='/dev/dsp#\x00', 0x3, 0x200000) recvmsg$kcm(r1, &(0x7f0000000e00)={&(0x7f0000000780)=@pptp={0x0, 0x0, {0x0, @multicast1}}, 0x20, &(0x7f0000000d40)=[{&(0x7f00000007c0)=""/56, 0x38}, {&(0x7f0000000800)=""/212, 0xd4}, {&(0x7f0000000900)=""/70, 0x46}, {&(0x7f0000000980)=""/199, 0xc7}, {&(0x7f0000000a80)=""/101, 0x65}, {&(0x7f0000000b00)=""/134, 0x86}, {&(0x7f0000000bc0)=""/65, 0x41}, {&(0x7f0000000c40)=""/160, 0xa0}, {&(0x7f0000000d00)=""/9, 0x9}], 0x9, &(0x7f0000000dc0)=""/16, 0x10, 0xfffffffffffffff7}, 0x10040) 2018/03/02 11:09:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x99, 0x2) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f0000000140)=""/20) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="85316285f46e1773739f45000000000000cda272a5b7b984b2b1409020606076d80b5108cf84807a8865e1e11af1122d5b6053402d9d137803b62cc8252a1f9d6a7d7feaf49bc386d0c88f3b313ffcec53ed95beb88e5af837b199e2efb542a59a3e4c1c", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:17 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000880)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000000e00000004000000d0040000fffffffff0020000f0020000f0020000ffffffffffffffff000400000004000000040000ffffffff04000000", @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f80120020000000000000000000000000000000000000000000000005001686173686c696d69740000000000000000000000000000000000000000026772653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006609972114dab5b100000000040000000000000000000000000000000000000003000000fdffffff000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000000ffffac1414bb0000000000000000000000000000000000000000000000000000000000000000626f6e643000000000000000000000007663616e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d000000000000000000000000000000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000fe800000000000000000000000000000fe80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006970365f767469300000000000000000677265746170300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80010010000000000000000000000000000000000000000000000004000636f6e6e6c696d69740000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000280052454a45435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x2) 2018/03/02 11:09:17 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x2f, &(0x7f0000bbd000), &(0x7f0000000040)=0xc27b0481ee435669) 2018/03/02 11:09:17 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:17 executing program 5: writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000100)="ba3da9bd033f425d42b0cb175c96649e168e215b0f75172dd4ea42ddd650ae7090cb6c53", 0x24}], 0x1) fstat(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000000)='./file0\x00', r0, r1) 2018/03/02 11:09:17 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) recvmsg(r0, &(0x7f0000002300)={&(0x7f0000000040)=@pptp={0x0, 0x0, {0x0, @dev}}, 0x20, &(0x7f0000002280)=[{&(0x7f0000000080)=""/107, 0x6b}, {&(0x7f0000000100)=""/107, 0x6b}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)=""/19, 0x13}, {&(0x7f00000011c0)=""/4096, 0x1000}, {&(0x7f00000021c0)=""/175, 0xaf}], 0x6, &(0x7f00000022c0)=""/21, 0x15, 0x2}, 0x100) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000758ffc)) 2018/03/02 11:09:17 executing program 3: futex(&(0x7f000000cffc)=0x1, 0x7, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x6, 0x4000) timer_create(0x7, &(0x7f0000000080)={0x0, 0xf, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)=0x0) timer_gettime(r0, &(0x7f0000000140)) futex(&(0x7f000000cffc)=0xfffffffffffffffc, 0x400000008, 0x0, &(0x7f0000000000), &(0x7f0000aba000), 0x0) 2018/03/02 11:09:17 executing program 6: mmap(&(0x7f0000000000/0x9d7000)=nil, 0x9d7000, 0x0, 0x55071, 0xffffffffffffffff, 0x0) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f000068bfec)) 2018/03/02 11:09:17 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2400, 0x0) [ 108.423838] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.455801] binder: 15165:15171 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:17 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = syz_open_dev$dspn(&(0x7f0000000740)='/dev/dsp#\x00', 0x3, 0x200000) recvmsg$kcm(r1, &(0x7f0000000e00)={&(0x7f0000000780)=@pptp={0x0, 0x0, {0x0, @multicast1}}, 0x20, &(0x7f0000000d40)=[{&(0x7f00000007c0)=""/56, 0x38}, {&(0x7f0000000800)=""/212, 0xd4}, {&(0x7f0000000900)=""/70, 0x46}, {&(0x7f0000000980)=""/199, 0xc7}, {&(0x7f0000000a80)=""/101, 0x65}, {&(0x7f0000000b00)=""/134, 0x86}, {&(0x7f0000000bc0)=""/65, 0x41}, {&(0x7f0000000c40)=""/160, 0xa0}, {&(0x7f0000000d00)=""/9, 0x9}], 0x9, &(0x7f0000000dc0)=""/16, 0x10, 0xfffffffffffffff7}, 0x10040) 2018/03/02 11:09:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000100", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) [ 108.499844] binder: 15174:15180 got transaction with invalid offset (0, min 0 max 0) or object. [ 108.503535] netlink: 16 bytes leftover after parsing attributes in process `syz-executor2'. [ 108.512852] binder: undelivered TRANSACTION_ERROR: 29189 [ 108.527480] binder: 15174:15188 got transaction to invalid handle [ 108.533807] binder: 15174:15188 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:17 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) prctl$getreaper(0x2f, &(0x7f0000000040)) 2018/03/02 11:09:17 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = syz_open_dev$dspn(&(0x7f0000000740)='/dev/dsp#\x00', 0x3, 0x200000) recvmsg$kcm(r1, &(0x7f0000000e00)={&(0x7f0000000780)=@pptp={0x0, 0x0, {0x0, @multicast1}}, 0x20, &(0x7f0000000d40)=[{&(0x7f00000007c0)=""/56, 0x38}, {&(0x7f0000000800)=""/212, 0xd4}, {&(0x7f0000000900)=""/70, 0x46}, {&(0x7f0000000980)=""/199, 0xc7}, {&(0x7f0000000a80)=""/101, 0x65}, {&(0x7f0000000b00)=""/134, 0x86}, {&(0x7f0000000bc0)=""/65, 0x41}, {&(0x7f0000000c40)=""/160, 0xa0}, {&(0x7f0000000d00)=""/9, 0x9}], 0x9, &(0x7f0000000dc0)=""/16, 0x10, 0xfffffffffffffff7}, 0x10040) 2018/03/02 11:09:17 executing program 3: get_mempolicy(&(0x7f0000000040), &(0x7f0000000000), 0x7, &(0x7f0000000000/0x2000)=nil, 0xb) pipe(&(0x7f0000000140)) [ 108.543367] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 108.551930] binder: 15174:15180 transaction failed 29201/-22, size 0-8 line 3026 [ 108.554639] netlink: 16 bytes leftover after parsing attributes in process `syz-executor2'. [ 108.574148] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:18 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00003a6ff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r1, &(0x7f000043d000)=[{&(0x7f0000bdb000)="ee", 0x1}], 0x1) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) writev(r1, &(0x7f0000001080)=[{&(0x7f0000000080)="9b", 0x1}], 0x1) recvmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000984000)=[], 0x0, &(0x7f0000019000)}, 0x40000022) recvfrom$unix(r1, &(0x7f00000000c0)=""/140, 0x8c, 0x2000, 0x0, 0x0) 2018/03/02 11:09:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40000, 0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000040)={{{@in=@broadcast, @in6=@loopback}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000498000)={&(0x7f0000c40ff4)={0x10}, 0xc, &(0x7f00002e5ff0)={&(0x7f000081eea0)={0x18, 0x0, 0x1, 0x800000001, 0x0, 0x0, {}, [@nested={0x4, 0x2000000000000002, []}]}, 0x18}, 0x1}, 0x0) 2018/03/02 11:09:18 executing program 6: mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='./control\x00', 0x830000fe) r1 = open(&(0x7f0000000000)='./control\x00', 0x0, 0x0) inotify_add_watch(r1, &(0x7f0000000140)='./control\x00', 0x100) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read(r0, &(0x7f00000000c0)=""/16, 0x10) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)=0x0) sched_setattr(r2, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0xeb2a, 0x29c2}, 0x0) [ 108.634626] binder: release 15190:15205 transaction 385 out, still active [ 108.641662] binder: unexpected work type, 4, not freed [ 108.646987] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:18 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000200)=@req={0x50, &(0x7f0000000000)={'ip6gre0\x00', @ifru_map={0x100000001, 0xfffffffffffffff8, 0x5, 0x0, 0x0, 0x5}}}) pipe(&(0x7f0000000240)={0xffffffffffffffff}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)=@pic={0x1, 0x9, 0xfff, 0x7f, 0x3, 0x1, 0x5, 0x3ff0000, 0x40, 0xffffffffffffffff, 0x60000000, 0x1, 0x5, 0x3, 0x7ff, 0x7c00000000}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = syz_open_dev$dspn(&(0x7f0000000740)='/dev/dsp#\x00', 0x3, 0x200000) recvmsg$kcm(r1, &(0x7f0000000e00)={&(0x7f0000000780)=@pptp={0x0, 0x0, {0x0, @multicast1}}, 0x20, &(0x7f0000000d40)=[{&(0x7f00000007c0)=""/56, 0x38}, {&(0x7f0000000800)=""/212, 0xd4}, {&(0x7f0000000900)=""/70, 0x46}, {&(0x7f0000000980)=""/199, 0xc7}, {&(0x7f0000000a80)=""/101, 0x65}, {&(0x7f0000000b00)=""/134, 0x86}, {&(0x7f0000000bc0)=""/65, 0x41}, {&(0x7f0000000c40)=""/160, 0xa0}, {&(0x7f0000000d00)=""/9, 0x9}], 0x9, &(0x7f0000000dc0)=""/16, 0x10, 0xfffffffffffffff7}, 0x10040) 2018/03/02 11:09:18 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:18 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xffff, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0063404000000000000000004fbc8ab738c4b79800000000000000361700000000000008000000000000000008000000dfef484bf50cfdadf5c5c5b53100000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYBLOB="a22a2baab93df25e38df738b3ee1e7721ebb5c3077387a2d2bd6a8e322b8b8bed838206c18d8cb97c7ccc9f17c1619f909ce793edd86d45c27db80239752baaf38e3c90890d08df884cf5a5ef511dbf89087395eaa7de3b1eb7f9ecb8e069c889472c1ae49cfa23df7a481977523f291da5ae901905288c1a18c14b0fb2d8089cde07858a517e2240c0ee48355d91b9f604959475f856ff46dba8f7373367dde44d777c0a3fc7784723097b969d8a131fca9018e9ccda4d4d02a6ddd208c20e256191104089697abd52b9ce8b79d7a44c6320ba77ec4f50bd46e0da4ad18c070fd8a97547fb5be8d283da26097b299ef85d44c30f717cf76868513d6a7e0a643cff25f6d5c63a0009c50491bc0fb27ea920da7ab94add8b5e408a702c76f20e35e72a8f2ef30c7d526628742c5126dfa6372766c890169443982ccd2beee8de8b44d7a630ea38ce557bbda448cfe6bf12aa232ddabf5aaac5d4bcf293dd2a9c5dec39dd4586db4000225d5a54870c18444e3172e73194a511931f857f2732d38b207d0512a0d0c48adc63c34e1d83332ca384fec2f9f4c0a2b7f840c25050ab0b504d96e7bc3a35bf425b4530bd35fbf58d92eb19bba4b227877fc77e674ad4e1afa9dcfe481c98a75b1eddc954cc7153c2ce212b380b09c468ec40994be64d08ec92dc10a070c053e7fcf8bcdde9c6c4ab4bc005dedeb451c8c97044c8b4c7c38fda1a61d5b3d684beefeaec86867caec074ad70c6eedaedd0dd459c7a41d5abd0ff5e881175085d217543acea8de6e80107fb8fac3d351c546691a7b5420693b4362beb87f0e67f22e489188f09024e7ce69b066fcc8d97847b3b04056f30e1b554ceb1a9d54e28bd0d60d0a2444c8813bf4150cd29be0d6ab08f85e012f99bc64502f073eb0111ee323756e0b6d36062b45add8fe6a34232ee9d4869c876c159341dfbcbc97d0da86de791e00fd9b37ee6383eb5f758edb93f14259a85bf4311a8878813ef742c6f90f719ad90687a904fc2d226c426b168a62e80915d695f6b585872996a4bcaa2b111ae3b05ec419e8118c477afc7ac0cef243c14bbde044c27560fcd4715e75b34501dceebd49253a8c3d74c2300e92b8cb1e3ae94abde4fe0c536ea31ac3d979f58cf741e9e38cc8b774ac772324f4dfbb02538e18dbf81864ff6db950fb8f67a601cc1443a63e877459d687f595ec0505ef722f335f16463bc51306fc6429c26273ab6740851cc200e199f35338eb33d39d7c2b08a33a292ee345d3a7c1425eedcd0accfb920c33d1d9317083ea94eab6e263fcf42183808f545164e4c2effe7276d2f28db10e4771edd46769f51baaaf1b4cc7c6db5ed5c2bbf19f5f77b3b1393ab31b2ca0d84848fc92cb8f1074bf5101e5c811b98f7955263b2eb5f03153be44c03c47a0ce45a1b42675a1d03c2e37361fed6114c9f2568c50ead6f0a07421fe16210a16ba7273101a47f7ead5722b2b76893cd843c20a70be3d4ca6bf7f95616a01fe87eac610bfd31e3f60519e838a4b5b1278adb98ac17bb97d62a4c46b89e0f0fb6390b518c1ec59fe6c88266bf38d19907ba3df2e91b514f04083ebb3ce58d9f92066611e473401b5da71fd1b2918c9c2fd9511ab82f8e9792650406ea1465b9a88b3bae228a619256d07ac7869212b3637d56ef289593fd77519dc7b3ed2f320dbefed30f550193d5d09a3aeb3cdc501a8075a338c8b284af4c5f2b7ba409190471753eacf8e8c7f3622bca9973be2b5e90428784f3a43ddadf49734bf0d52fe18e4d5272d24a662d81e1b2744e048a95d340f245e71bd467b561aa856371d8898022c7642ebc578b28491b77ba672163b3043ebf54f128abde4e5e4c5047c11e6dd3ff02cdc01a9633022689e764197f43d704e3a5577dbe98c63b8663aaa202b61be46d13c78333d3096072dd59ed13f26061515965eb77320ce2748e14a62b5b62f1da254e62282f94f09edb7a397de1f73b48cea4fc48f53678a136b02ac4fc64c8558f91c0d6d050b42c22f5f3793a118ba4fe1f715b4d5aead457d65d174be49c8c8114ed4c47b1ecced6d065337222ab244fb4d7e671f6b175a1b0e4b1d6b083ccc80de613528998f34e64834cb71453630a3364dc2951089b4633775c11cd602a9c0be2d7197aa7998bb01738298742a7992096852d69192f9376efab7a5a6fdf9c5dab261250635f51dfdf8e76ec5e868e14b3d2c63bdcb6a96d312ef84793f7dc0de22ff7d35e6c98d1635a16032662b5a91f1dbb7ee6629dabee2653ade2574aff6481818c399d8549bbeea1eb84b97bb1269d4b151951d4fdfb48bb29917305d8d498de64bf99dd21e22a677c09fdbdfa18ce2028eb074efb52a82a4303287ab2ab0152dd7f1d56e7e7b5909500e0112767eb131719423b22bc3c848b9daa6a9e0649ddb41a13b5e0de17554ecdb7edd018f58af2fec24c76726ba994071e745b127f0653b952f23dd0ce02f168a34b5f904b176963ad68f80d1e885546edc49c9a3556f0d79abdf996e4a300e5f5be99834464e13e84b8cdcdd636fc9697a92d06671f6854460bf38170112d83288220fcf7853ddc07686ae450f3a599576f4618160e80c54064d4bbd1718fdc87ac09e8c1796b1f4f41c8c2e1a7787608bd2bd6a10f7de334771831c16755f3d9632f6729e32c119d1f5dd34c11695fa375d34c5ed6569cd3b90651be4cf9e8f6642e74b2d72ca11fe1ae404ffe667ec7cdd8904bc056b2c27b586aa67f2f26a88ff87143c78e63e2c7f8fa9dc184f224a7945b4ae48389e6ac1836be9ce5ece70056054846b03898385c1c397a4718f3064ff8489a7b91da4c75e45462d4dcc5c360a407b57ef4e0132cf2cd32db56f8450c3660abdb8586a35c613720040a350d45e7e79031d53f710b10e2d94f8d771aabe5caf651a015552df14008d220e65c8103785dd0ddf5f6e0a5682094ea5b2678445f711e312a6bfba79b755718939ac4224167172c0b83ec20ddaed1aa68938ee0f23c1104ab0f5900fc78ea100f3943a1041a189d86ab66b3bc1bd72580271e55797a468b637cfeec5a387fefddc829a6128aa31d4640fa355a05d0e1b504565e7c86259949f15508564324c93470ecf64bbaa6b9407e698ebe44617671a7f479f2d0012bf93c73e79c89464e7dd5de21a6500dd56ed49750f1d83e58e2cfe4fee3ad065a15ca1a8683a57444d6ed1f0e28718582e0c59f2e1ea765fd57887e6206e5249c4bc7fad2935243bb681facf75987b52db0b95f88e5c2cdae64d3038fb59baa558b204f226621a7077b4733a160cdf523ec8bc7999ad40ff095416ef009dc0723c023c7beb869993835aab6c36bc8e4cbaa12790a3ff0bc34ed2024f989324ea1ea052ac0d3de94d7690216d355e37a95cd68dd3f37e90f81c93c3faab06c6e6e997a3cd6c4d9aeffb7a12405eab7565de3de614fefffc1c75f23d04fb4935ff3821afcdba6d9d2689dceed17c7d7a574db12c436afdec93d7650579e05c9addb3058b02ae614383ad9a10f2e6d1ee1ae3b570fcff8f5d8f9b441222cf7fcfcd19e7536559debb124cd0134a7c6105e264bb40a6a84ea244c12af8d6ace7f2457fe493045ad3dce0e8d5ff9b2299559175444b28894285468530c7af7dbdd019bc9d8f01e25dbafb4becae84bd675c4429dd73c889cbd4a9a0dbb4f8c3bec5fcf6062701bfc6fb0d5c3f5e566a588c0f746fd2694e183b0917d31e1276f374e7b6f0683b03a33faf13223080c99cb078e12f5261d9a236c1be214e7d1c9a7838feaeb6a1d381a09f5de4a3fb808913a64558a2fa50769c3fa262ff5838708f870c9df760cb537085552135611b6cbcf6b876e4bda7a88844afc1cafef53d8dc40843423b0af99eed866ca015bb81e572476970c6c46cd39c861f8068898b39a551b2a3359f868e5b6b1edf734b7ab1a332298aa806b7edd7629135fb12dfba9a82790bc60adb9b368cd0f95d925653864c657c7fe9a1ea44fb681d9ec822ab14243d82c4f11ea66c24e313e1157e9b270706129f1e65424927493b9cbf8dcdfda1cb86db03e110211872cb977fdc16f40950f808ec3526d185e3267ec5bda151cbf31cfc9f7353f28a12a293aaf24650f24ce9f797307e26fc435a2cda8442082ae62179c4f313ad76325b658afcedb700bb27504f1480aaf373d3a39841fb50a982d48d80ea0a1f9a4dce3514c6bc4a29332e9a60d717be575871cdf44057da970b22f1fa90f5ffd5d12f005c2ce6ea9b951736b99bf1bb804a664b1b8168cf0aeb37dd145e5bce17995fde13fff018e238c7a2359ba2034ea822dabd8079e9c4e1f64516a4dd76b35063b1788d36084baebc76c3f66e739b9249d9b92c34078cd8682be02d2498df0b5a036fb73c8fc9943982544ead42b13605e360e44cb50e5a6c6c7eda778f193b93b8fdc47031b9e1712e2aa526d24c1048787f722196d89c5452dbc8160fa6857e48171a4e1695171ca53f24b9d92351c220517b0c02ed824dcb55522bc913aac8179436c96be69dafab44989cb3882a2a1f2350f8e3bd28bde6164a22dde951ca3efb245070bf7bec23a6bbf322f3b960452889ad733a926e323e9f862ae088d93a6aa5b83909e96cfc943151b420234e4b9ad564e5985137ebb75a3a4e9f2346e6d52f28ad28ace58753b09efd3116f1984fa386fdb6da9893f6a621f824830a3e4779773260a99e9ded9ee88d387e4e58ef06523e4c8ee9c76f62e4f5df3ba7045b9f9f7c70fd9f2c97b4c9abb75f73e48ea95c8e416dcad908e3a9186090aa515d12877ede980272236bb2d9204f36a697b85ff2aac4a87c09c5dcb3a2466edacfd3f96efb551c3df3c60d1177c323476bc32e735318dc0dc4e591ddbc3632d79eeda2130900216c30989b53134f4787a561346a366c79b28c55bab42554c2a9fb3a440133b630a91b3d1ba8c00fcf8ffc9d761c63db788b96faae7d35954c0b386ed9a0bf238a0662bcc6826e3bb5b3beacaee3202b6230efa7dec7e67b89d948888c65a0bfa186ff38042dc273c7de27d17fd130fc3a65725dcf384b004b055f0bedaf30e575f86a0d6579509551ff7e9e540e3d839b992ee39dbd5e677eab84d5f0edd463c4a362611d64404687c386c36eaa67a7dab38af383e144173d87e37fc13fc609100075abe7f7c1836b67d1d7fc4c60d4de191601e265298301af33cec1aba1673b6b7278387745ec1f270703da85466380fc6b185eec1dd2c793fea852f8088d9a315b71274214c21993bbeaa2b06e756d9f47a727b58ea608444c1592ed4ba79ba358b22806c56ecc411b1cd01d9e88090c72314dc22d3e58e7a94bb30c347f81b7af4fd3d1cff7b69e864571c7220deedf588e86da2d365249ea87179480cfd6a7c98b5b67f2109bad29406b4a8d5ea6b8d12215ee7f8cb2c30378413f4d1c1fe1216580c2f1ac46748e0c7f27419f17b398f037450229d0bba437d85ef7a97f2fca7f97bee1adb31980e9bb893f0b4e7bfe9db0bd88862d5df2af7197574c2f2e6428f1b4f836af8d2b697c78195f9c06a696a30c7bcbc1b3e049095cf5fe71cbb7ff8e1be478dbf1b5850c0d398a2fabce566e18b3ecf17bc6a67f4a82e59018b034c4154c91b6563c5b369466d266a315058a88d3be1376a54268804971e8900bf9804705c54d9ffdac083db2f423a4683466ca4c33489b14148acc72bac6fcd27f43c5855086c4aad8be0724108c459d412d900701ce548b28587ac844791f77f4e1992974bef7aa1ef14d01fa8163fc84"], 0x0, 0x0, &(0x7f0000009000)}) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000001240)={0xffffffffffffffff}) ioctl$sock_proto_private(r1, 0x89ef, &(0x7f0000000080)="4ea56dc4cf7aaedc3a54d65afe0945212d7567287dbac0ec24b01f31dc06b1406b6e73d6f9342806737627a1af309415a3901434641dec00b8fac49860294179955739da164faaf305ccdf2d0bd5ace9fdf4ce55e4fce6a0e0c36eb82c3bf55ad6c800af771a049ab8996dac07c6554a03fbb56388481032aa617d293083acdab73268086d36868e645a62ecf49ae34977cc59ed642598d467789af1c08723a93858779e12890edc70840fabe42133d37ce741d682a2ac1d324b93") 2018/03/02 11:09:18 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x200000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000180)={0x8, 0x1, 0x3, 0x6, 0x8, 0x1f}) futex(&(0x7f0000000040)=0x4, 0x3, 0x4, &(0x7f000000b000)={0x77359400}, &(0x7f0000048000)=0xd0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x10000, 0x2000) r2 = fcntl$getown(r0, 0x9) getresuid(&(0x7f00000001c0)=0x0, &(0x7f0000000200), &(0x7f0000000240)) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0186405, &(0x7f0000000280)={0x2, 0x80000000, r2, 0x5, r3, 0x8d, 0x3f, 0x4}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x7) times(&(0x7f0000000100)) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000000000)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) 2018/03/02 11:09:18 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000100", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:18 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000140)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000040)='ns/user\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000100)='ns/user\x00') ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000180)={0x3, r1}) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000080)={[{0xfffffffffffffffa, 0xff, 0x80, 0xa809, 0x8000, 0x6, 0x5, 0x6, 0x0, 0x2, 0x10000, 0x8, 0xfffffffffffffe01}, {0x5, 0x9b, 0xf75, 0x6, 0x1, 0x2f, 0x0, 0x8, 0xdbc6, 0xfffffffffffffb17, 0xfffffffffffffffd, 0x9, 0xde74}, {0x80, 0x17, 0x7fffffff, 0x8c, 0xb, 0x5, 0x800000000000003, 0x4, 0x5, 0x1, 0x1, 0x0, 0x101}], 0x8}) 2018/03/02 11:09:18 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f00000b2000)=0xffffffffffffffff, 0x4) sendto$inet(r0, &(0x7f00005c9000), 0x4ab, 0x800000020000000, &(0x7f0000303000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000001280)='/dev/mixer\x00', 0x101000, 0x0) bind$rds(r1, &(0x7f00000012c0)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) r2 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/create\x00', 0x2, 0x0) write$selinux_create(r2, &(0x7f0000000080)=@access={'system_u:object_r:dhcpd_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x31}, 0x3c) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000965fec)={0x0, 0x800000000000852b, 0xffff}, 0x14) writev(r0, &(0x7f0000793fa0)=[{&(0x7f0000dfa000)="06", 0x1}], 0x1) [ 108.679192] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.684763] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.690305] binder: send failed reply for transaction 385, target dead 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) syz_open_dev$dspn(&(0x7f0000000740)='/dev/dsp#\x00', 0x3, 0x200000) [ 108.754105] binder: 15224:15232 transaction failed 29189/-22, size 40-8 line 2848 [ 108.755198] binder: 15225:15236 transaction failed 29189/-22, size 0-5424849492224507912 line 2848 [ 108.762627] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 108.790635] binder: 15225:15236 transaction failed 29189/-22, size 0-5424849492224507912 line 2848 2018/03/02 11:09:18 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x18000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a45323, &(0x7f00000010c0)={{0x4, 0x373e87cb}, 'port0\x00', 0x60, 0x20000, 0x8, 0x2e, 0x1, 0x8, 0x22d8bee4, 0x0, 0x0, 0x5}) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f00002ac000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c97ff8)=0x8001) flock(r2, 0x8) r4 = socket$packet(0x11, 0x3, 0x300) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) close(r4) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000000)=0x200000000) pread64(r3, &(0x7f00000000c0)=""/4096, 0x1000, 0x0) ioctl$PPPIOCGFLAGS(r5, 0x8004745a, &(0x7f0000001340)) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000d7c000)={0x0, r5}) close(r3) io_setup(0xfffffffffffffffb, &(0x7f0000001180)=0x0) r7 = dup2(r3, r0) ioctl$VHOST_SET_VRING_ENDIAN(r7, 0x4008af13, &(0x7f0000001380)={0x0, 0x5}) io_cancel(r6, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0xb, 0x4, r2, &(0x7f00000011c0)="5c71cb33c268ffa6b8a16047bd0a28ee8e2ad018d76dd90785e5a7fed44ef2137bf46b6cd6b0e3819f021a5664eb8506dc90d59d65a3c850c0acedf9a82c0cd6f57f9be3a9f2a4f35c52865bb2619dda28d313c6af6a60e783e809fb59d6a1b47d63070674bfccbe6baef9045878c17530c8a4908516fde388b099bdc3d095c809239e6a39fe6c9eac4fcbd0e46bc19cb1718de1132f4ecaaad52194df7df79a6b958f743922f8add7d0246357099631fd35f8e13a0ba94bf5cafc2c02319b181a9669a148b3beb927b9ab31d79a984023eebaa6764c8f76fb75f10f780660e62d111db5395cac94b76cd921860eb675b3", 0xf1, 0x80, 0x0, 0x0, r7}, &(0x7f0000001300)) 2018/03/02 11:09:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x4000000000000, 0x40002) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000000)={0x4, [0x7, 0x9, 0x478a, 0x10000]}, &(0x7f0000000040)=0xc) ioctl(r0, 0x5382, &(0x7f0000ca7000)) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 108.799714] binder: undelivered TRANSACTION_ERROR: 29189 [ 108.809889] binder: 15223:15239 got transaction with invalid offset (0, min 0 max 0) or object. [ 108.822190] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 108.827686] binder: 15223:15239 transaction failed 29201/-22, size 0-8 line 3026 [ 108.840309] binder: undelivered TRANSACTION_ERROR: 29189 [ 108.850430] binder: undelivered TRANSACTION_ERROR: 29189 [ 108.854505] binder: 15223:15235 got transaction to invalid handle [ 108.862317] binder: 15223:15235 transaction failed 29201/-22, size 0-0 line 2848 [ 108.875896] binder: undelivered TRANSACTION_ERROR: 29201 [ 108.881436] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:18 executing program 6: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="13b000bafc0001779bfb546644fce6fb7cf8e7b1be017464efddd6405358ab509d57e63ffaa9a7d5830000c01d00be382d6d0c8d85cfc0f2055ab1624a70e419192ab270a06e21ad4b433c8e09f69ef18628608b8087000000000000000000000000002c5edb91c28ef0e349b8011ccd1da95bea783c40c32d7c9d4275cfd8260266013b5e02bf980d97cb68e420fccd689421a66bcb5c559bff71ac029f2b5d4b9eb0ff2fc826de2317d3b0d3c81dea32cb9ea69d368dc43f79244af6aa6a119b11ff6cde1bcd3092dfd14b02323bd22555e109c4ef953354310a733f4994c5696b136e90b09cc49b531db2a797ff4e12e956bf82079801988b1c3b553fee2f80a377c73decd7bfcad6d69be9c3ad905a0212388b80f2894db1158da3413da72cf38843c63e76089c0f5938ca46abf2b10afaaf4fc15e613a8ef9b1c817ea0840512f8fb559a13fdab5de749636712a0b1c4b71718d1183d2d2308ac974756d6dddcbc75594553ec37638c95ca326e248e9202e516866e701a67de264d97dbef2a9e5b614e2edb87c7478a35e000c5ffbe07fc9fff92bdb29ebda732077aa8d0defce6a85e8792fe1fedc9531e8ce6978c9893a8bd17236e27f73e3d6942e2ed9bc6c5ae6494a3a04199408a5677d160a7005bb4fece1a051f942ca8f2c41da14fb94a28934b6133fe33bfe"], 0x10}, 0x1}, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000080)={'gre0\x00', 0x1}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x101000, 0x0) epoll_wait(r1, &(0x7f0000000040)=[{}], 0x1, 0x7) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0086426, &(0x7f00000004c0)={0x8, &(0x7f0000000200)=[{}, {0x0}, {}, {}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_LOCK(r1, 0x4008642a, &(0x7f0000000500)={r2, 0x2}) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000000c0)={0x0, 0x6e, "512fb6336b96911c218966b48ac9c62677df677ed5727587753dd469342f7f6b7680a30a7ac3959bf40bbec14a7d4314faf64d5fff0975cbfdead43e58fd37f31fab7cc6df2fa630a9ca3fd72d62ac6f42ff942236bb5036252845cbd2dee9dabf3f483251448cc2cb15af8c674c"}, &(0x7f0000000140)=0x76) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180)={r3, 0xfffffffffffeffff}, &(0x7f00000001c0)=0x8) 2018/03/02 11:09:18 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f00000042c0)=[{{&(0x7f0000000040)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x14, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/24, 0x18}], 0x1, &(0x7f0000000100)=""/253, 0xfd, 0x3f}, 0xde}, {{&(0x7f0000000200)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast2}}}, 0x3a, &(0x7f0000000580)=[{&(0x7f0000000300)=""/252, 0xfc}, {&(0x7f0000000400)=""/167, 0xa7}, {&(0x7f0000000240)=""/6, 0x6}, {&(0x7f00000004c0)=""/186, 0xba}, {&(0x7f0000000280)=""/15, 0xf}], 0x5, &(0x7f00000005c0)=""/159, 0x9f, 0x200}}, {{&(0x7f00000009c0)=ANY=[@ANYBLOB="9e39cf002e2ced930849d7fd013100", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x10, &(0x7f0000001c00)=[{&(0x7f00000006c0)=""/215, 0xd7}, {&(0x7f00000007c0)=""/33, 0x21}, {&(0x7f0000000800)=""/180, 0xb4}, {&(0x7f00000008c0)=""/207, 0xcf}, {&(0x7f00000009c0)}, {&(0x7f0000000a00)=""/192, 0xc0}, {&(0x7f0000000ac0)=""/4096, 0x1000}, {&(0x7f0000001ac0)=""/231, 0xe7}, {&(0x7f0000001bc0)=""/30, 0x1e}], 0x9, &(0x7f0000001c80)=""/105, 0x69, 0x8}}, {{&(0x7f0000001d00)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @multicast1}}}, 0x2e, &(0x7f0000004180)=[{&(0x7f0000001d40)=""/47, 0x2f}, {&(0x7f0000001d80)=""/203, 0xcb}, {&(0x7f0000001e80)=""/214, 0xd6}, {&(0x7f0000001f80)=""/68, 0x44}, {&(0x7f0000002000)=""/40, 0x25}, {&(0x7f0000002040)=""/183, 0xb7}, {&(0x7f0000002100)=""/94, 0x5e}, {&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000003180)=""/4096, 0x1000}], 0x9, &(0x7f0000004200)=""/131, 0x83, 0xd0b}, 0x100000001}], 0x4, 0x62, &(0x7f0000004340)={0x0, 0x1c9c380}) sendto$llc(r0, &(0x7f0000004380)="e118fb09b89cadf42c1e316331d03ef713b4738b6bff75dda6635175b3d899f2224dd80c172abf55f9b7fdfa471d78362e7632eb554dd9f66c64e56f9bf5f4ab695d83cdd580965d10cd503361608bc6bffa7534c688c73e183d823591626dbe", 0x60, 0x20000004, &(0x7f0000004400)={0x1a, 0x0, 0x3, 0x6, 0x841, 0x100, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x10) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000680)='/selinux/access\x00', 0x2, 0x0) perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x78, 0x1e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f00001c6000)='/dev/input/mice\x00', 0x0, 0x20000a0845) r1 = socket$inet(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000002c0)={'tunl0\x00', @ifru_flags}) 2018/03/02 11:09:18 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="013e310000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x80000) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000003c0)={0x0, @local, @multicast2}, &(0x7f0000000400)=0xc) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000fb9ffc), 0xbe) 2018/03/02 11:09:18 executing program 4: setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = creat(&(0x7f0000000400)='./file1\x00', 0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e20, 0x3ff, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x3f}}, [0x40, 0x8000, 0x7, 0x1, 0x80000001, 0xfffffffffffff800, 0xea9, 0x695, 0x3, 0x9, 0x78ed, 0x80000000, 0x80000001, 0x2, 0x6]}, &(0x7f0000000380)=0x108) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000580)={r2, 0x1, 0x7f}, 0x8) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f00000003c0)={0xffffffffffffff81, 0x7fffffff8}) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="4a0555bd2da6ee72998fab42b8d8e6b8ecf85c08ab35abf38cb5aa5272a06de28633c1f96ee77721342d50d26d0dff974e7ece298c08afe87e82eb845ec7df9aa021b1b358492b7c2caabe2647cd12b1a8ed9a47b8c7cfdb1ee29c4cf9e1b73df69325a3fbfc0b01eb8a9410c7d4b798110348b31d598ef8dd4298df9c4904de4d119bf2f7f10222c9f33b7ac9ea20bc9c69ba6ef7401c33c2cd61a7ec35b378d4a8632e73d3d299d1e381bff5edf0cf500a2bf8eb2799275a32a8e94953a08b313fd0ce8ff9996cf3546d617079e80c17c970443fcd973af323f0", 0xdb}, {&(0x7f0000000000)="3694e8cfff3d94d4fa8dcfdafea1657e4b430769870b96b2c2fcb6e59a", 0x1d}, {&(0x7f0000000300)="3209d6c769c7b821a3d3fd2e40212a17bbab252ffc97762f2a003a4ed504f7a8b0d52fadc96cbd67368764b1b1950fe0b8845e22ec4e5a7beffaf4e0c0ac720f4c2ec7ac166c402550acf98c732ce1e656f19cde86886ae1b5fbe3", 0x5b}], 0x3, 0x0) 2018/03/02 11:09:18 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x6}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={r1, @in6={{0xa, 0x4e24, 0x3, @loopback={0x0, 0x1}, 0x8}}, 0x1}, 0x98) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f000064b760)={{{@in6=@dev={0xfe, 0x80}, @in=@broadcast=0xffffffff}}, {{@in6=@mcast2={0xff, 0x2, [], 0x1}}, 0x0, @in6=@dev={0xfe, 0x80}}}, 0xe8) 2018/03/02 11:09:18 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:18 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001aff8)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x1, 0x8000f, 0x2, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$llc(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, &(0x7f0000000180)=0x10) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg(r0, &(0x7f0000019fc8)={0x0, 0x0, &(0x7f000001a000)=[], 0x0, &(0x7f000001b000)}, 0x2) writev(r1, &(0x7f0000bf3fa0)=[{&(0x7f0000dee3d3)="96", 0x1}], 0x1) fcntl$setflags(r1, 0x2, 0x1) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 5: mprotect(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x1000002) timer_create(0x0, &(0x7f0000009ff9)={0x0, 0x0, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000000)) 2018/03/02 11:09:18 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000c4c000)=0x1, 0x4) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000080)=""/143) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) [ 108.991180] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 109.003579] binder: 15258:15270 transaction failed 29189/-22, size 40-8 line 2848 [ 109.018968] binder: 15264:15271 got transaction with invalid offset (0, min 0 max 0) or object. 2018/03/02 11:09:18 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) fadvise64(r1, 0x0, 0x20, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0106434, &(0x7f0000000200)={0x200, 0x0, 0x10003, 0xffffffff00000001}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40086437, &(0x7f0000000240)={r2, 0xc1}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x80, 0x0) recvfrom$inet(r0, &(0x7f0000000280)=""/4096, 0x1000, 0x0, 0x0, 0x0) ioctl$void(r3, 0xc0045c79) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000002540)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000010000000000000000000000e2cea49224f90000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0020000736e6174007f90a10ada32e31b000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff2e84a25b94134c6313a4bfdf026f426ed442de58693bd6edd44d368d72c0a2bc212b9b4b90d740e8d301ac2bcbe3f15d56a28ee0737cd802030c12409db3728494e373e79b88202a2e520a606d4a70f6eb550db11f908ce79182e2b548a601faa1b9104345cb7331b3ee0e6057b1042479f579267a5617b595b41e0933"]}, 0x233) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000001280)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc008641d, &(0x7f00000022c0)={r4, &(0x7f00000012c0)=""/4096}) r5 = memfd_create(&(0x7f0000002300)='/dev/ppp\x00', 0x3) fcntl$F_SET_RW_HINT(r5, 0x40c, &(0x7f0000000140)) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000005080)={0x0, @rand_addr, @remote}, &(0x7f00000050c0)=0xc) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)=0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={0x3, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x4e22, @multicast1=0xe0000001}, {0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}, 0x0, 0x20, 0xbe, 0x6eff, 0x4, &(0x7f0000000080)='ip6gretap0\x00', 0xfffffffffffff0bb, 0x39f7, 0x20}) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@dev={0xfe, 0x80, [], 0x10}, @in6=@ipv4={[], [0xff, 0xff], @empty}, 0x4e24, 0x31, 0x4e23, 0xffffffffffffff40, 0x2, 0xa0, 0xa0, 0x0, r6, r7}, {0x7, 0x2, 0x100000001, 0x4, 0x38, 0x90, 0x9, 0x80}, {0x800, 0x8001, 0x8, 0x9}, 0x1, 0x6e6bbc, 0x3, 0x0, 0x2, 0x3}, {{@in6=@empty, 0x4d4, 0x32}, 0x2, @in=@broadcast=0xffffffff, 0x3506, 0x1, 0xca0b8ef5a1981eaf, 0x603, 0x8001, 0x3, 0x7}}, 0xe8) 2018/03/02 11:09:18 executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000000)={0x2f3, [0x8, 0x100000001, 0x8]}, 0xa) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) fcntl$setstatus(r0, 0x4, 0x400) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x501, 0x0) ioctl$KDDELIO(r2, 0x4b35, 0x80000000) [ 109.041911] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 109.047327] binder: 15264:15271 transaction failed 29201/-22, size 0-8 line 3026 [ 109.057475] binder: 15264:15288 got transaction to invalid handle [ 109.063894] binder: 15264:15288 transaction failed 29201/-22, size 0-0 line 2848 [ 109.078725] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:18 executing program 3: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x0, 0x1b071, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000b2000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$int_in(r0, 0x5473, &(0x7f0000000080)=0x100000000) [ 109.107877] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.108973] kernel msg: ebtables bug: please report to author: Wrong len argument [ 109.113424] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.126753] binder: 15304:15306 transaction failed 29189/-22, size 40-8 line 2848 [ 109.141794] binder: 15304:15312 transaction failed 29189/-22, size 40-8 line 2848 [ 109.168428] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.173989] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.184897] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/03/02 11:09:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000080)="ba0000000000000000", 0x0) r1 = socket(0x11, 0x10000000803, 0x0) r2 = open(&(0x7f000000cff8)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r2, 0x400, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000abd000)={0x0, 0xfffffffffffffffc, 0x7f, 0x0, 0x80000001, 0x1, 0x9, 0xffffffffffffffff, {0x0, @in={{0x2, 0x4e21, @empty}}, 0xedd8, 0xc9a3, 0x4910, 0x3, 0x4}}, &(0x7f0000a56ffc)=0xb8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f00001bb000)=r3, 0x4) ioctl$TIOCNXCL(r2, 0x540d) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000dbcfc8)={0x0, 0x0, &(0x7f0000fa3ff0)=[], 0x0, &(0x7f0000e33000)=[@rights={0x1ba, 0x1, 0x1, [r1]}], 0x18}, 0x0) r4 = mq_open(&(0x7f0000000ffb)='eth0\x00', 0x42, 0x0, &(0x7f0000213000)={0x0, 0x6, 0x4, 0x9, 0xfffffffffffffffd, 0x0, 0x0, 0x3}) mq_timedsend(r4, &(0x7f0000258000)="c44d91c2b60db2a704214983ebfaa804804a8af9f798403b0ba1fdc90e40ad1dd54bdaeba4649974f75e5b7bb7f540ce35d61a0fd928a57c09d2d33d8cd054de8e2a9e4e1c0cbe94578e7c145d52a5628d7be6b9b933f829db653bf8e402f2f59dce7fbb1d9f68572099a12ea8886ad3df43abc7046f3c24ababb650e6f40f19b2fc218e6a539c592083eb708ce1d5c7912fda07750e985dcd2a8b575ea81a4ab57b551738cbffeebe40132ea749ab0469a060beb5d786e99771218d8e1edec5bb000000012a41d32d96026ff73855ab8e8979a5a3496540ca7bf46e", 0xdc, 0x6, 0x0) mq_notify(r4, &(0x7f0000187000)={0x0, 0x20, 0x0, @tid}) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) uselib(&(0x7f00001b9ff8)='./file0\x00') ioctl$KDENABIO(r4, 0x4b36) mkdir(&(0x7f00002c2000)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f000004d000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, &(0x7f00005af000)) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f00003a3ff8)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r0, 0xc0086421, &(0x7f00000ebff8)={r5, 0x3}) open(&(0x7f00002a6ff8)='./file0\x00', 0x0, 0x0) umount2(&(0x7f0000d85ff8)='./file0\x00', 0x4) r6 = epoll_create(0x2001) bind$inet(r0, &(0x7f0000cf4ff0)={0x2, 0x4e22, @rand_addr=0x100000000}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f0000fa9ff4)={0x10000000}) mq_timedsend(r4, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000001000)) mq_open(&(0x7f000095aff5)='**vboxnet1\x00', 0x80, 0x20, &(0x7f000017bfc0)={0x80, 0x100000000, 0x40008000, 0x6, 0xfff, 0x0, 0x6, 0xffffffffffffff40}) sendfile(r6, r4, 0x0, 0x8) geteuid() 2018/03/02 11:09:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1b, &(0x7f0000000000)=0x1000, 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) connect$ipx(r1, &(0x7f0000000080)={0x4, 0xfffffffffffffffe, 0x38000000, "5bce673248af", 0x7}, 0x10) 2018/03/02 11:09:18 executing program 0: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/enforce\x00', 0x0, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f0000000300)={0x0, 0x7ff, 0x2, &(0x7f00000002c0)}) r1 = socket$inet(0x2, 0x80000, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000a0a7b2daca86d87f00000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) r2 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x4000000000, 0x4002) getsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000200)=""/15, &(0x7f0000000240)=0xf) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x101001, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000340)='bcsf0\x00') 2018/03/02 11:09:18 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:18 executing program 6: ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000003ffc)) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x5, 0x60000) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000040)={{0x119d, 0x8}, {0x1, 0x6}, 0x7, 0x1, 0x3f}) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x188, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 3: perf_event_open(&(0x7f0000223000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000028000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f0000000140)='./control\x00', r0, &(0x7f00000000c0)='./control\x00') name_to_handle_at(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000036000)={0xc, 0x0, "58074ad1"}, &(0x7f0000040000), 0x0) openat(r0, &(0x7f0000000080)='./file0\x00', 0x12000, 0x8) 2018/03/02 11:09:18 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="ccca3f52355746e090989faf55bdec8362926591cb73e171fd2effffff7fae5e3bb0783f"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:18 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00005d5ff3)={0x2, 0x4e20, @rand_addr}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x200000000000a, &(0x7f0000df8ffc)=0x4, 0x4) sendto$inet(r0, &(0x7f0000de1fff)='U', 0x1, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) recvfrom$inet(r0, &(0x7f0000df7000)=""/157, 0x9d, 0x10002, &(0x7f0000df7ff0)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000defffc), 0x4) sendto$inet(r0, &(0x7f0000000140)="aa1f25", 0x3, 0xc040, 0x0, 0x0) sendto$inet(r0, &(0x7f0000b0c000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba5c6a3bf9b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef37f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89f18820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486ec31c40c7f0007a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f08d7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999464e3e37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389ceb934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435013e3c3431c82fc5b3345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc", 0x801, 0xc004, 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x5, 0x2240) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x7f, 0x1, 0x100, 0xcd}, 0x10) recvmsg(r0, &(0x7f0000df6fc8)={&(0x7f0000df6f80)=@generic, 0x80, &(0x7f0000df5000)=[{&(0x7f0000df5f6e)=""/146, 0x92}, {&(0x7f0000df6f74)=""/140, 0x8c}, {&(0x7f0000df5f18)=""/232, 0xe8}, {&(0x7f0000409fa2)=""/94, 0x43}, {&(0x7f00007a7f19)=""/231, 0xe7}, {&(0x7f0000d76f57)=""/169, 0xa9}, {&(0x7f00009e3000)=""/230, 0x312}, {&(0x7f0000923000)=""/37, 0x25}, {&(0x7f0000554fcf)=""/49, 0x31}], 0x9, &(0x7f0000c27ff9)=""/7, 0xffffff89, 0x8000}, 0x40000100) 2018/03/02 11:09:18 executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000498000)={&(0x7f0000d55000)={0x10}, 0xc, &(0x7f00008b7ff0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2400000000010100080000000000000012000020100002000c00010000000000e0000002"], 0x24}, 0x1}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000000), 0x4) personality(0x6) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x401, 0x200) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000080)={0x2, [0x800, 0x1f]}, &(0x7f00000000c0)=0x8) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x188, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 3: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@ipv4={[], [0xff, 0xff], @rand_addr}, @in6=@loopback={0x0, 0x1}, 0x4e20, 0x0, 0x4e20, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback=0x7f000001, 0x0, 0x2b}, 0x2, @in=@empty, 0x0, 0x4, 0x0, 0x401}}, 0xe8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = dup(r0) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f0000000080)={0x9, 0x0, [{0xbfe, 0x0, 0x40}, {0xcd, 0x0, 0x5fc7}, {0x830, 0x0, 0x7fffffff}, {0xbfb, 0x0, 0x7}, {0x9ff}, {0xbef, 0x0, 0x2}, {0xbdd, 0x0, 0x41}, {0x873, 0x0, 0x67df}, {0x2c7, 0x0, 0x81}]}) [ 109.301655] kernel msg: ebtables bug: please report to author: Wrong len argument [ 109.314296] binder: 15319:15324 transaction failed 29189/-22, size 40-8 line 2848 [ 109.323628] binder: 15317:15323 got transaction to invalid handle [ 109.329961] binder: 15317:15323 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:18 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:18 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000040)='\\\x00', 0x3) accept4$packet(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x14, 0x80000) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r1, @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:18 executing program 6: getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001240), &(0x7f0000001280)=0x20) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x40, 0x0) bind(r0, &(0x7f0000000040)=@ethernet={0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xe}}, 0x10) socket(0x0, 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000001c0)=@req3={0x8000000, 0x0, 0x2, 0x7, 0x100000000}, 0x1c) bind(r1, &(0x7f0000d01ff0)=ANY=[], 0x0) sendmmsg(r1, &(0x7f00000079c0)=[{{0x0, 0x0, &(0x7f0000000840)=[], 0x0, &(0x7f00000012c0)=[]}}], 0x1, 0x0) [ 109.366283] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. [ 109.370339] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.383949] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. [ 109.387408] audit: type=1400 audit(1519988958.750:130): avc: denied { setopt } for pid=15341 comm="syz-executor6" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 2018/03/02 11:09:18 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 109.421461] binder: release 15317:15323 transaction 402 out, still active [ 109.428479] binder: undelivered TRANSACTION_COMPLETE [ 109.433642] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.439092] binder: send failed reply for transaction 402, target dead [ 109.442321] kernel msg: ebtables bug: please report to author: bad policy [ 109.462735] binder: 15357:15361 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0x0, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)=ANY=[@ANYBLOB="0202000965ef273d4e6eb9722014c60a000000ffffffffffffffff030006000000000002004e20e0000001000000000000000002000100ffffffff0000000200000000030005000000000002004e20e00000010000000000000000872f"], 0x50}, 0x1}, 0x0) 2018/03/02 11:09:18 executing program 0: r0 = socket$inet(0x2, 0x40000000, 0x8002000003) socketpair(0x3, 0x80a, 0x1, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f00000003c0)) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f00000002c0)=@get={0x1, &(0x7f0000000280)=""/10, 0x2ae4}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000300)={{0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x307, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x10, {0x2, 0x4e21, @rand_addr=0xff}, 'erspan0\x00'}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000480)=[@in6={0xa, 0x4e22, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x3800000000}, @in6={0xa, 0x4e23, 0x8, @ipv4={[], [0xff, 0xff], @rand_addr=0x4}, 0xd32}, @in6={0xa, 0x4e20, 0x7ff, @local={0xfe, 0x80, [], 0xaa}, 0x6816}, @in={0x2, 0x4e20, @multicast2=0xe0000002}, @in={0x2, 0x4e21, @loopback=0x7f000001}], 0x74) sendmsg$unix(r2, &(0x7f0000000ac0)={&(0x7f0000000500)=@abs={0x1, 0x0, 0x4e22}, 0x8, &(0x7f0000000a40)=[{&(0x7f0000000540)="c316deeb21fa", 0x6}, {&(0x7f0000000580)="a7ccc96867cba319303b52ea9136bf4829f5f3bad5382f7470317efcb6df07e430dc5a1381614544490b1ccaf9eb3b79baac57ff663e5742a7356616af9e9259743b696044b7", 0x46}, {&(0x7f0000000600)="4135a6696cd1339503ef937c8858312ae7ad5ec24747521d9987e30303dfeefb9425e2cb5f2bd1970a7eafae6bc286a1ddcd00a11807b4175468", 0x3a}, {&(0x7f0000000640)="e672650a5aae006b23155cb77353cc0c2343ee1e4cd2982e46ed86bfaa466ca8e5fac990b838017bf6208a57429717916fbb85657f", 0x35}, {&(0x7f0000000680)}, {&(0x7f00000006c0)="41bd012b4a29ebee1befda5e443a4a9be136b06d178a7d2c0a78a55bbf03bab588ec76eaba685402a74272693c1792f59bb7b2ff70c57db625425c30e1efd50db1287288a36ecaf0c18a5c55239407b558fa50c25aa0a3809d3ce7eca8ee54cb3c66bf1bc86c5dfeeaab7b6b6a448f295d3cb88bbf872d7b9fca99f0e10030003d", 0x81}, {&(0x7f0000000780)="65cf61ebc1be03dfd2b57aed35fff76d176a00e8b9a4f69fa3c8f0907bd8d89c498af9a20072db8517b2502296dc5f2ee6a0481e6d56574fcb15c8fe435202b0fb55aeb0ec9c4d285ab1e108a30ac0d5d89be2e471949cfcdb535ef467574c574ed638942645e5fde5bb889a7c6ed868600ea8300390c4f900c6f45e505a3e9221646cf04288accc831583f25bfefc6d188b3ad35f486198c0572e00d93f9400497366906f29a6743eaa20733415ad288774c986c470884b8ad071d636ac58c582b607788fffba56", 0xc8}, {&(0x7f0000000880)="d7d4389a0a63657b0e4713f13a266fc48c4608b033aa71d6ac3a4fdfb4fbe8776e48f185abc22a91e91b28dbd1671a01a91ddac5b65810c2a1480f367116fc13667c97744bdcd83dd55f70bec5c6f5b0a19ce781469f3ae0d268b45dbe27dbf5b382c73b2102913d45cfdb30e74bb696af06029dc08f0b41b4ca7fb29aa05be7e0c1e97ecbbd5d525515ee43dff45dc1c791a73564341141fc269c09", 0x9c}, {&(0x7f0000000940)="3281bccac59aed4f47e252c1ed576fcdab437dd0e2ce8b71ef4311ac0ff18c591ee291548922f24911d112d7b2c92a899984b69cfa101550d5afc02045c453bb46c0c2511536f70853157f8ad45d47f246d7d96761bbd4586ef41cae808e0040838c4b68f7c0039b5c9a4777331464390cc88f5915f59c36ae8f66fd6303cc986aaa0e28273f60a1c2fc54d945c8850fbaec3224d0defb957c93e6ebc36a4d3aa431939fb89277b6c9d540586d5293a1f7ece8742dbfe6d37f4707c620fa1a1bea8ab856f5e2d208f9db835206f145aacfca4a7fbf2dfa3dcafd9a43ba87", 0xde}], 0x9, 0x0, 0x0, 0x840}, 0x4000) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x4, 0x10000) accept4$unix(r3, &(0x7f0000000200)=@abs, &(0x7f0000000240)=0x8, 0x800) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000001700)={0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}}, 0x100000001, 0x1}, &(0x7f00000017c0)=0x98) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000001800)={r4, 0x7e, "4b788f9b7b67b1f72bc84611a68f24173166b052abadf84ac9647a28ff00de05529e7f5ecd3ba8b4df5ed842fa8edd90d2048f6c78fde08a17df627c74d0e7575bcb5fb5e43c8b3f7098e8fec34e03bb10f9047ed8b2dd6c7a60762ce155c9d89b78290d91a308e41a833edd92671a9d0c7ba42238e80487016db2735757"}, &(0x7f00000018c0)=0x86) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040)={0x81, 0x2, 0x0, 0x80, 0x3ff, 0xd2, 0x6, 0x1, 0x9, 0x3, 0x67}, 0xb) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000001240)={0x0, 0xfffffffffffff000}, &(0x7f0000001280)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000012c0)={0x0, 0xfe, 0x7fff}, &(0x7f0000001300)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000001340)={0x0, 0x5, 0x6, 0x5, 0x7, 0x2, 0x7, 0x1, 0x0}, &(0x7f0000001380)=0x20) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000001400)={0x0, 0x3c, &(0x7f00000013c0)=[@in={0x2, 0x4e21, @empty}, @in6={0xa, 0x4e23, 0xffffffffffffff98, @dev={0xfe, 0x80, [], 0xd}, 0x100000001}, @in={0x2, 0x4e24, @empty}]}, &(0x7f0000001440)=0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000001480)={0x9, 0x3, 0x8002, 0x0, 0x4, 0xcaa, 0x677, 0x0, 0x0}, &(0x7f00000014c0)=0x20) sendmsg$inet_sctp(r2, &(0x7f0000001640)={&(0x7f0000000680)=@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f00000011c0)=[{&(0x7f0000000b00)="f223b1aad8aefc909fa37b9e122ab6ca93a972a7231238a39e3637da41855333c8dd877ffb6614ac41fd721237627e036641576fe7e0d5a78cd2ee9fbf82ff7400f1843a7b8d59a6bae6eeecb79432b5e2c12f0ea4b429a8628e45df8ca9a5cfb95b2caece7155d6392334661724203f4587000678eb9bc3355325ffc88a8affdfe0e84f90bbea571262b4c1e862c545c49b8cef98aae867bc3fa915288cc402ec3cc3bada6067397e06830a4619aa5c4bb6d80b1508ca4c1057f96cd14ecf5728a8803ecfc0210f38224c4f8e8e1bb85a2189", 0xd3}, {&(0x7f0000000c00)="d1c106298c43dfa515d332baec2d223e123b056aef25ceb319c31e8beec6535f19019d1a97660ef0da7e66da61489ee9d9af554a44206e621eaed499b919624b75967ed63ede5b717bdf1389ba84675aa5d973c5a0c8741f1060831b14941d2e0168b26dd108b3c602e2319d079c3e50a9ca5373492f", 0x76}, {&(0x7f0000000c80)="d4714253f54e46010c358f0aeef730e9dd303c84c0f3b0cb6f7ac496b2d528314e97fd3f8706702c9e532461ab127877c33411cb9ea6e398cc75bdb57f64f712a03d5329687a6c052cb5fa6d6338648209a88a997fe24cb2eabf1e5ec593bf94b2612149df829b9341c1220dd6757726f59a385c8c3965567e008a50abb393b44881e4bb62b548cd29d616ab6fd1dcb68bf11e84f38b33ed9ff80067ca4e40337e5b9bb7c9a61a5562e31900ff6cb8b59edc2d6cc693f8e7ffd29315d0603c4f4848d0fa7c5834865d076e3c1ec46776283ea8efb4a3a31aa26a7850df38b9dfc481d058348a4eb1da64076e026ac60f62cae72f", 0xf4}, {&(0x7f0000000d80)="90430765a608b9209b22f66c2c7d2989f95731a8329ba4d6ee7f0aa8636605a027f4fd9dd433858d0a5b9fa8c3e5f66716c3031218fbcd8c16ad84815fdac60702d6404b9522d4bd4adbf5c69b53220d8dc46d730190a41e237911143e44aea2f5fa5fd36fe05c50eff8b5be8b4cc88e8701dc9222ada4a41f683a821b7d768d510ce917fa45423c8d9c4634dfbf5d93b251f24135de76ab7c1e3e4860c5a4b14503b881e9796031ba3f7bd1b5ba10e324ddd507b54010df76cdf88147d87b84817abc9c61208409b2d1", 0xca}, {&(0x7f0000000e80)="27e344d1a801b14be2eb0f3d318a1e9f71797aba28f5a86c4091896d52f591e099c978931a74dca8930494bedecfb3f63bbd8656c961eddfcef693d11ddfd28155d6f6c12aa944a57f3e6fc81176a15d468dc5c772d20686f377bb13380c2dde411c7f68eb9d8a7c741311e1fe853ab3317e695ec2bc9c76d7b8c341ac270e089d736ee336043ef2b8672b88844cbd2664a2f0615e368fc1e74bc0e512f8ea54683393f5a4012feedd5ed88d39cd29f1434b407959f67ba129d482ccd56d0037c1a284e6b9ef600d79a657bbb450d058007e66412b7ec6b0f7b4426dbd1c5c9172c93f11b672b9b2ef4db2c4b4c3e7066b359c5c960f9df4667ad3", 0xfb}, {&(0x7f0000000f80)="292e19cb265b1618c23cdea93896fc30a86b9858b41daa2726013c9b8e9ea2f17a0c035bd32fc38852cbbe17af626523dee7b0658d55ac81b96ddc0f5e53d4f25d2b4fae0563a1ac2c4407e0ce634b86bcbb00ed1b69eea8297bd8ba509fac175abe7257c3e6fa4ed0d975c3113b2389614bd6ce", 0x74}, {&(0x7f0000001000)="22838d0802cc534ccbc1c3060b0c6509b8109c21a3e5da2389500ff1f5380a3efe273d69e5fb7188c6ab7bb8e9a48d2be9b88fdfc15d8b21af651ca04eba6ed3bae9a29e042263ece2e8d975ecd63ab3573c5d08949cf66199795aef5f1287a986bdfa3af6304d64a296a9176bac228cf30699f2c7409bd266e7ce319ad6216c350b164529934b9da1bd6982735334c3235e72a1c0a10a1ff338aeab499741b3ac2301da3623eb74239977dd4a58b647cffb1968361a11391bc130c36cc8ff", 0xbf}, {&(0x7f00000010c0)="c740d3b43878e01ca49faf9c6a75707a8a57c0231c203ec9a2eade72272989e41b68c8a62865d8161ce6b7e3e432ec12ef5a745ec3c98dd13636fa30ecd27e0ff0f63c19064c7f8e191b42e5a04689da975f369c0760122b9b75b942c892bcd219fd7cef9a78ab4068239046cc2ecc68a86ce2e9", 0x74}, {&(0x7f0000001140)="39993c4cd8ff776a559ebcbe15d239199f5abb92fbe16a39d6bf58741e12183345ea67238ca66b3f987613d9d3e04d5f370dc087638cd3816bdf8afbedf25d5bd5e8ef53d07c0e9d83ea2a955bd9130181e55ed1239ace691610363b0522886bd8d76ee75ac6be93ad1d", 0x6a}], 0x9, &(0x7f0000001500)=[@sndinfo={0x1c, 0x84, 0x2, {0x8b87, 0x800c, 0x20, 0x7f, r5}}, @init={0x14, 0x84, 0x0, {0x4, 0xfffffffffffffffe, 0x0, 0x10000}}, @sndrcv={0x2c, 0x84, 0x1, {0x6, 0x5, 0x204, 0x4, 0x5, 0x0, 0x1, 0x1f, r6}}, @sndinfo={0x1c, 0x84, 0x2, {0x401, 0x1, 0x3, 0x10001, r7}}, @sndinfo={0x1c, 0x84, 0x2, {0x4, 0x8000, 0x4, 0x56, r8}}, @sndrcv={0x2c, 0x84, 0x1, {0x9, 0xfff, 0x8200, 0x2, 0x200, 0x3, 0x70e9, 0x6, r9}}], 0x108, 0x4000000}, 0x24000080) 2018/03/02 11:09:18 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:18 executing program 5: r0 = socket$inet_sctp(0x2, 0x80005, 0x84) getsockopt$inet_buf(r0, 0x0, 0x61, &(0x7f0000b36000)=""/40, &(0x7f0000d60000)=0x28) clock_getres(0x0, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000000), &(0x7f0000000040)=0x4) 2018/03/02 11:09:18 executing program 1: r0 = socket(0x18, 0x0, 0x2) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2}}, 0x14) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x40, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) 2018/03/02 11:09:18 executing program 6: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getflags(r0, 0x9caba6b97cb2c5cf) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') preadv(r1, &(0x7f0000b5cff8)=[{&(0x7f00006f0000)=""/154, 0x9a}], 0x2cc, 0x0) 2018/03/02 11:09:18 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000040)=""/145) rmdir(&(0x7f000015dff6)='./control\x00') r1 = syz_open_procfs(0x0, &(0x7f0000f8cff8)='pagemap\x00') pread64(r1, &(0x7f0000e3e000)=""/8, 0x8, 0x100100) [ 109.474770] binder: 15355:15359 got transaction to invalid handle [ 109.481066] binder: 15355:15359 transaction failed 29201/-22, size 0-0 line 2848 [ 109.484489] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.506680] binder: release 15355:15359 transaction 406 out, still active [ 109.510443] kernel msg: ebtables bug: please report to author: bad policy 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x188, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0x0, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 109.513714] binder: undelivered TRANSACTION_COMPLETE [ 109.525778] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.531255] binder: send failed reply for transaction 406, target dead [ 109.544168] kernel msg: ebtables bug: please report to author: Wrong len argument [ 109.551598] binder: 15374:15384 got new transaction with bad transaction stack, transaction 409 has target 15374:0 [ 109.562465] binder: 15374:15384 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:18 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000200)="6e65743f6b736d00080048c1d093f49e1446bc5892c69901a2b44794cb271cbe8c0ce022c63c6f0ebb95415f9beee09fb43249f4a8458cb8a1d03a1f4659330bfdc326a43a18716e84cb102e392d673eed5a37864647cfa66026ffd44d86f5d45915320a48575449ae090000004ac302234d82200076dfce6e6e7f500fd7d0995f0bae1d0b94cbf332b60d9b5bd58a52c0a23f5e660e9b00000000000000000000000000") perf_event_open(&(0x7f0000223000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x29, 0x0, 0x0) sendfile(r1, r0, &(0x7f0000076ff8), 0xfffffffb) 2018/03/02 11:09:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000016ffc), 0x4) write(0xffffffffffffffff, &(0x7f0000000000)="4a617373d0b964bac2c78b5b32b4c82a847d156054a695107697781f1147c22400a7f5be315ffe7519652249d8d9d34126b37f01a2", 0x35) recvmsg(r0, &(0x7f0000019fc8)={0x0, 0x0, &(0x7f000001a000)=[], 0x0, &(0x7f000001b000)}, 0x2) writev(r1, &(0x7f0000bf3fa0)=[{&(0x7f0000dee3d3)="96", 0x1}], 0x1) 2018/03/02 11:09:18 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f000035d000)={&(0x7f0000000040)=ANY=[@ANYBLOB="02180000100000000000000000000000030006000000000002004e207f0000010000000000000000030005000000000002004e200000000000000000000000000800120000000400000000000000000006000000000000000000000000000000ff010000000000000000ffffe0000001bff511c4b47c8ce76586f225c7db77d574d8ac6441"], 0x80}, 0x1}, 0x0) 2018/03/02 11:09:18 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:18 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r0}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x4, 0x20, 0x81, 0x1}, &(0x7f0000000200)=0x18) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000240)={r2, 0xb8}, &(0x7f0000000280)=0x8) 2018/03/02 11:09:18 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x188, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 109.565532] kernel msg: ebtables bug: please report to author: bad policy [ 109.593086] binder: release 15376:15385 transaction 414 out, still active [ 109.600099] binder: unexpected work type, 4, not freed [ 109.605417] binder: undelivered TRANSACTION_COMPLETE [ 109.619805] binder: release 15374:15384 transaction 409 out, still active [ 109.623233] kernel msg: ebtables bug: please report to author: Wrong len argument [ 109.626786] binder: undelivered TRANSACTION_COMPLETE [ 109.626794] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.626825] binder: send failed reply for transaction 409, target dead [ 109.635822] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 109.639652] binder: send failed reply for transaction 410 to 15376:15385 [ 109.646127] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:19 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000000000)={&(0x7f000002c000)={0x20, 0x23, 0x711, 0x0, 0x0, {0x16}, [@nested={0xc, 0x1, [@typed={0x4, 0x1, @binary}]}]}, 0x20}, 0x1}, 0x0) syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x6, 0xffffffffffffffff) 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x188, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00005f5ffd)='io\x00') bind$alg(r0, &(0x7f0000466000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000980000)={0x0, 0x0, &(0x7f000038f000)=[{&(0x7f0000c90f9a)="94", 0x1}], 0x1, &(0x7f00005f6000)=[]}, 0x8081) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x7, &(0x7f0000000000)='./file0\x00', r3, &(0x7f0000000280)="fe886514663f9e58f719a68b416ead5d6360dcad946e1c249f0de54d9a8f60e020363d97ff3ffc4b52ad90d1fc73eaa36c5d40c617dcbb180f7ae1286281ccb576b2bbd1597f8df6c30b73a3f958aace7ff8dbe13775d9a2f3381c31ea00c5d83e88dc8bc32e4ebd78f091667a26e3866b9ef2c8305718142f731c26227dd33935239afbd73564bce124bca524544364e39ea01a809d96009448693afc5d5bdf8f4a236b5d920340b5bbe1e1e12d2632273780b43eb17f51894665d4d210d7d66270b5578e96fe6f0cf8f33d0f96") sendfile(r2, r1, &(0x7f0000807000), 0x3f) recvmmsg(r2, &(0x7f00000004c0)=[{{&(0x7f0000000000)=ANY=[], 0x0, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/19, 0x13}], 0x1, &(0x7f0000000440)=""/68, 0x44}}], 0x1, 0x0, 0x0) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f00000000c0)) read(r2, &(0x7f0000000100)=""/220, 0xdc) 2018/03/02 11:09:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80}, 0x7}, 0x1c) syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x3, 0x8582) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r0, 0x541b, &(0x7f0000000080)) 2018/03/02 11:09:19 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind(r0, &(0x7f00006d2f80)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x1, 0x1, 0x1, {0xa, 0x4e21, 0x3, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x4}}}, 0x32) [ 109.651779] binder: send failed reply for transaction 414, target dead [ 109.666846] binder: undelivered TRANSACTION_COMPLETE [ 109.686741] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.697834] binder: 15407:15414 got transaction to invalid handle [ 109.704127] binder: 15407:15414 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:19 executing program 6: r0 = getpgid(0x0) sched_setaffinity(r0, 0x8, &(0x7f00009ad000)=0x5) pipe2(&(0x7f0000f61000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) r4 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r4, 0x107, 0x6, &(0x7f0000651000)=""/240, &(0x7f0000ca5ffc)=0xf0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0xfffffffffffffffd, 0xffffffff, 0xfffffffffffffffd, @time={0x77359400}, {0x0, 0x100000000000}, {0x5}, @time=@time={0x77359400}}], 0xffffff6f) fcntl$setpipe(r1, 0x407, 0x0) syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x0, 0x200) ioctl$int_in(r2, 0x5452, &(0x7f0000affff8)=0x7) dup2(r3, r3) 2018/03/02 11:09:19 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_dccp_buf(r0, 0x21, 0xc0, &(0x7f0000000200)=""/233, &(0x7f0000000000)=0xe9) r1 = dup3(r0, r0, 0x80000) setsockopt$inet6_tcp_int(r1, 0x6, 0x7, &(0x7f0000000040)=0x8, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300005000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) 2018/03/02 11:09:19 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x40, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000080)={0x7, 0x1, 0x90000, 'queue1\x00', 0x80000001}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000140)={0x0, 0x73, "d4070cf653e9fbb8ca1b18415b4d7442f0f74b51121e72886f772a934ef05fbf631f47139e99377ca44a822fb3ecbf792c2fbca943358b98a327b1cca733218bfd43fce80e3fdd1644035276b45c397d7972f2087916ccf2072e57fe83c7c6f341fe200a4323a7f82a077acb9035d3992eed8b"}, &(0x7f00000001c0)=0x7b) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000200)={r2, 0x29, 0x1}, 0x8) 2018/03/02 11:09:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00006ac000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f000079efdc)) r1 = syz_open_pts(r0, 0x801) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) dup3(r0, r0, 0x80000000800000) write(r1, &(0x7f00000b5000), 0xfffffed2) 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0x0, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:19 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:19 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_out(r1, 0x5460, &(0x7f0000000040)) flock(r1, 0x2) r2 = perf_event_open(&(0x7f0000220000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$bt_sco(r1, &(0x7f00000000c0)={0x1f, {0x6, 0x40000, 0x800, 0x2, 0x401, 0x8}}, 0x8) flock(r0, 0x1) close(r1) fstat(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@ipv6_getroute={0x24, 0x1a, 0x2, 0x70bd2c, 0x25dfdbfb, {0xa, 0x94, 0x0, 0x1, 0xff, 0x3, 0xff, 0x3, 0x300}, [@RTA_UID={0x8, 0x19, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x8000) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000280)={0xec3b, {{0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}}}, 0x90) 2018/03/02 11:09:19 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000061dff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0xfffffffffffffffd, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000080)={0x0, 0x2, 0x2, &(0x7f0000000040)}) sync() msync(&(0x7f0000950000/0x1000)=nil, 0x1000, 0x4) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x3ff) [ 109.719851] kernel msg: ebtables bug: please report to author: Wrong len argument [ 109.730470] binder: release 15407:15414 transaction 418 out, still active [ 109.737438] binder: undelivered TRANSACTION_COMPLETE [ 109.742576] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.748046] binder: send failed reply for transaction 418, target dead [ 109.794336] binder: 15436:15441 got transaction to invalid handle [ 109.800712] binder: 15436:15441 transaction failed 29201/-22, size 0-0 line 2848 [ 109.809680] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 109.831366] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 109.833256] binder: release 15438:15448 transaction 426 out, still active [ 109.846552] binder: unexpected work type, 4, not freed [ 109.851859] binder: undelivered TRANSACTION_COMPLETE [ 109.871805] binder: release 15438:15448 transaction 423 out, still active [ 109.878956] binder: unexpected work type, 4, not freed [ 109.884280] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:19 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3abf9cd4f020c47d") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:19 executing program 2: r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='./control\x00', 0x60) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x4000, 0x0) ioctl$KVM_SET_TSS_ADDR(r1, 0xae47, 0xd000) connect$bt_sco(r1, &(0x7f0000000080)={0x1f, {0x8, 0x3, 0x7, 0x10000, 0xffffffff}}, 0x8) 2018/03/02 11:09:19 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000000c0)=0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x6) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x40, 0x0) ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f0000000080)={0x3, 0x9}) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0x0, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:19 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x801) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timerfd_settime(r1, 0x1, &(0x7f0000000200)={{r2, r3+10000000}, {0x0, 0x1c9c380}}, &(0x7f0000000240)) 2018/03/02 11:09:19 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000040)={r2, 0x1, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x10) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={r2, 0x1, 0x6, @empty}, 0x10) r3 = dup3(r0, r1, 0x0) ioctl$DRM_IOCTL_CONTROL(r3, 0x40086414, &(0x7f0000000080)={0x0, 0xfffffffffffffff9}) 2018/03/02 11:09:19 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x107d}, 0x2c) syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x8, 0x383000) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x1, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x5, 0x0, 0x7a, 0x0, 0x1}], {0x95}}, &(0x7f000031cff6)='syzkaller\x00', 0x5c6e, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) 2018/03/02 11:09:19 executing program 6: r0 = syz_open_dev$evdev(&(0x7f0000057fee)='/dev/input/event#\x00', 0x0, 0x0) getcwd(&(0x7f0000000040)=""/38, 0x26) ioctl$EVIOCSFF(r0, 0x402c4580, &(0x7f0000000000)={0x51, 0x0, 0x0, {}, {}, @const}) r1 = fcntl$getown(r0, 0x9) socketpair(0x1d, 0x80a, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000080)={0x0, 0x78, 0x3, 0xf2ff, 0x582, 0x400, 0x0, 0x6, 0x100, 0x8, 0x1, 0xffffffff, 0x775a, 0x400, 0x8, 0x9af, 0x1, 0x9, 0x9, 0x0, 0x1, 0x7, 0xa5, 0x7f, 0x8, 0x8, 0x4, 0x0, 0xfffffffffffffffd, 0x3, 0x7, 0x8001, 0x7, 0x0, 0x100000000, 0x81, 0x9, 0x6, 0x0, 0x7fffffff, 0x1, @perf_config_ext={0x5, 0x7}, 0x2008, 0x1000, 0x10001, 0x0, 0x9, 0x80, 0x4af}, r1, 0x7, r2, 0x2) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000140)=""/186) [ 109.895979] binder: release 15436:15441 transaction 421 out, still active [ 109.903052] binder: undelivered TRANSACTION_COMPLETE [ 109.908200] binder: undelivered TRANSACTION_ERROR: 29201 [ 109.913705] binder: send failed reply for transaction 421, target dead [ 109.920395] binder: send failed reply for transaction 423, target dead [ 109.927107] binder: send failed reply for transaction 426, target dead 2018/03/02 11:09:19 executing program 3: capset(&(0x7f0000000040)={0x4000019980330}, &(0x7f0000000080)={0x800000, 0xfffffffffff7ffff}) ioprio_set$pid(0x2, 0x0, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x2, 0x0) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000100)) clock_settime(0x1, &(0x7f0000000000)={0x0, 0x1c9c380}) [ 109.972737] kernel msg: ebtables bug: please report to author: bad policy [ 109.974282] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 109.988143] device bridge0 entered promiscuous mode [ 109.996341] QAT: Invalid ioctl [ 110.001183] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 110.002505] binder: 15461:15474 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:19 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000700)=@filter={'filter\x00', 0xe, 0x4, 0x2bc, 0xffffffff, 0xb0, 0x144, 0x0, 0xffffffff, 0xffffffff, 0x204, 0x204, 0x204, 0xffffffff, 0x4, &(0x7f0000000380), {[{{@uncond, 0x0, 0xc0, 0x100, 0x0, {}, []}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "0006eab66aa1558ab7949b27727c83722cec76b69ffbc79be3c75910a7cd"}}, {{@uncond, 0x0, 0x70, 0x94, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}, {{@uncond, 0x0, 0x70, 0x94, 0x0, {}, [@common=@ah={0x0, 'ah\x00', 0x0, {0x800, 0x8, 0x1}}]}, @REJECT={0x24, 'REJECT\x00'}}], {{[], 0x0, 0x70, 0x94}, {0x18, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0xffffffffffffffb7) [ 110.025681] device bridge0 left promiscuous mode [ 110.034159] binder: 15460:15471 got transaction to invalid handle [ 110.040517] binder: 15460:15471 transaction failed 29201/-22, size 0-0 line 2848 [ 110.059762] QAT: Invalid ioctl [ 110.062593] device bridge0 entered promiscuous mode 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x90, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}]}, 0x208) [ 110.072561] device bridge0 left promiscuous mode [ 110.080839] can: request_module (can-proto-3) failed. [ 110.090977] audit: type=1400 audit(1519988959.459:131): avc: denied { sys_nice } for pid=15485 comm="syz-executor3" capability=23 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 110.099761] binder: release 15460:15471 transaction 431 out, still active 2018/03/02 11:09:19 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x400, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000080)={0x6, r0, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\b\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) [ 110.122468] binder: undelivered TRANSACTION_COMPLETE [ 110.124176] kernel msg: ebtables bug: please report to author: Wrong len argument [ 110.127632] binder: undelivered TRANSACTION_ERROR: 29201 [ 110.127657] binder: send failed reply for transaction 431, target dead [ 110.147914] can: request_module (can-proto-3) failed. 2018/03/02 11:09:19 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:19 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000200)={'filter\x00', 0x7, 0x4, 0x3c0, 0x0, 0x1f8, 0xe8, 0x2dc, 0x2dc, 0x2dc, 0x4, &(0x7f0000000000), {[{{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x2, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}, @loopback=0x7f000001, 0xf, 0x1}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0xb}, @dev={0xac, 0x14, 0x14, 0xe}, 0xff, 0xff000000, @mac=@random="41fb324007be", {[0xff, 0x0, 0x0, 0x0, 0xff, 0xff]}, @empty, {}, 0x1, 0x9, 0x7fff, 0x92b, 0x7, 0x0, 'ipddp0\x00', 'yam0\x00', {}, {0xff}, 0x0, 0x50}, 0xc0, 0xe4}, @unspec=@NFQUEUE0={0x24, 'NFQUEUE\x00', 0x0, {0x8}}}], {{[], 0xc0, 0xe4}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x40c) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000640)=[{0x4}, {0x7, 0x3016ca57}, {0x7, 0x3}, {0x4}, {0x8, 0xffffffffffffffc0}, {0x0, 0x7}, {0x4, 0x7fffffff}, {0x0, 0x6}, {0x8, 0x8}], 0x9) [ 110.179457] binder: undelivered TRANSACTION_ERROR: 29189 [ 110.211119] binder: 15498:15499 got transaction to invalid handle [ 110.217490] binder: 15498:15499 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x90, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}]}, 0x208) 2018/03/02 11:09:19 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f00000002c0)) sendmsg$nl_generic(r0, &(0x7f0000001100)={&(0x7f000000c000)={0x10, 0x34003}, 0xc, &(0x7f0000007ff0)={&(0x7f0000000040)={0x18, 0x2a, 0x301, 0x0, 0x0, {0x3}, [@nested={0x4, 0x0, []}]}, 0x18}, 0x1}, 0x0) inotify_init() ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0186415, &(0x7f0000000100)={&(0x7f0000ff9000/0x4000)=nil, 0x80000001, 0x5, 0x90, &(0x7f0000ffd000/0x1000)=nil}) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000140)={{0xffffffff, 0x5}, {0x1, 0xbe2}, 0x2, 0x4, 0x80}) 2018/03/02 11:09:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000040)={'dummy0\x00', @ifru_flags=0x1000}) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x350, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="71e67a3578d43fc615cdf0311cfc093a52a7d86bd10c9d68573b94531dc9cca9a4cd8c33cc", 0x25) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x0, 0x0, []}, &(0x7f00000001c0)=0x8) recvmsg(r1, &(0x7f000005efe4)={0x0, 0x0, &(0x7f0000304fe0)=[{&(0x7f00001a6000)=""/167, 0xa7}], 0x1, &(0x7f000084bfe8)=""/24, 0x18}, 0x0) 2018/03/02 11:09:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x4) getpgid(0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) sched_rr_get_interval(r0, &(0x7f0000000080)) membarrier(0x20, 0x0) [ 110.235610] binder: 15500:15501 got transaction with invalid offset (34359738368, min 0 max 40) or object. [ 110.251687] binder: release 15498:15499 transaction 434 out, still active [ 110.258709] binder: undelivered TRANSACTION_COMPLETE [ 110.263882] binder: undelivered TRANSACTION_ERROR: 29201 [ 110.265231] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 110.269377] binder: send failed reply for transaction 434, target dead 2018/03/02 11:09:19 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 110.286389] binder: 15500:15501 transaction failed 29201/-22, size 40-8 line 3026 [ 110.294216] kernel msg: ebtables bug: please report to author: Wrong len argument [ 110.310565] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x5, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 110.336974] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:19 executing program 6: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) sched_getattr(r0, &(0x7f0000000080), 0x30, 0x0) mlock(&(0x7f0000ffd000/0x1000)=nil, 0x1000) r1 = syz_open_dev$sndpcmp(&(0x7f0000000300)='/dev/snd/pcmC#D#p\x00', 0x35, 0x10008000) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0xff, 0x2}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000280)={r2, 0x0, 0x0, 0x7, 0xad96, 0xfffffffffffffffd}, &(0x7f00000002c0)=0x14) sigaltstack(&(0x7f000000b000/0x4000)=nil, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f00000003c0), &(0x7f0000000140)=0xffe5) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000340)=@broute={'broute\x00', 0x20, 0x5, 0xea4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000400], 0x0, &(0x7f0000000100), &(0x7f0000000400)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x4, 0x4, 'irlan0\x00', 'bpq0\x00', 'ip6_vti0\x00', 'vcan0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x14}, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x700}}}}]}, {0x0, '\x00', 0x1, 0x0, 0x1, [{{{0x3, 0x2, 0x88a2, 'yam0\x00', 'bridge0\x00', 'syzkaller0\x00', 'lo\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x57dee1a242ee07a2], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0xff, 0x0, 0x0, 0xff], 0x9c, 0x134, 0x15c, [@vlan={'vlan\x00', 0x8, {{0x2, 0x6, 0xf84f, 0x5, 0x2}}}]}, [@common=@NFLOG={'NFLOG\x00', 0x4c, {{0x8, 0x196000000000000, 0x9, 0x0, 0x0, "ce943147b198c4a501da9fc80e575fd63a930aaf4d83bf2b2e074d067994693e052b7d758756b704e6dda35d1fbad187a47186c9d718c7851f017413cdb9771f"}}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x7}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x7, 0x3a, 0x8907, 'vlan0\x00', 'syzkaller1\x00', 'bcsf0\x00', 'vlan0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0xff, 0x0, 0x0, 0x0, 0xff], 0x114, 0x150, 0x178, [@ipvs={'ipvs\x00', 0x28, {{@ipv4=@local={0xac, 0x14, 0x14, 0xaa}, [0xffffffff, 0xff000000, 0xff, 0xff], 0x4e20, 0x29, 0x1, 0x4e20, 0x8, 0xe}}}, @arp={'arp\x00', 0x34, {{0x30e, 0x10, 0x8, @dev={0xac, 0x14, 0x14, 0xc}, 0xffffffff, @multicast2=0xe0000002, 0xffffffff, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x10}, [0x0, 0x0, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], 0x80, 0x8}}}]}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz1\x00', 0x2, 0x1f, 0x7fffffff}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x9}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffc, 0x2, [{{{0x11, 0xc, 0x88f8, 'ip6gretap0\x00', 'bcsh0\x00', 'sit0\x00', 'teql0\x00', @random="b9296eae8fff", [0xff, 0x0, 0x0, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], 0x8f8, 0x950, 0x978, [@time={'time\x00', 0x18, {{0x8, 0x400, 0x9a59, 0x14e9d, 0xb0b}}}, @among={'among\x00', 0x828, {{0x2ab5, 0x7, 0x9, {[0x6, 0xffffffff, 0x4, 0x5, 0x101, 0x40, 0xfffffffffffffffc, 0x7, 0x8, 0x9, 0x8, 0x8, 0x1, 0x82df, 0xfff, 0x5, 0x3, 0xd33, 0x401, 0x5, 0xbb, 0x8000, 0x3, 0xe8c, 0x1, 0x8, 0x1ff, 0x7ff, 0xc9b, 0x100000001, 0x5f0, 0x4, 0x100000001, 0xfffffffffffffff9, 0x3, 0x9, 0x0, 0xfffffffffffffffd, 0x80, 0x400, 0x2, 0x80000001, 0x5, 0x7, 0x2, 0x0, 0x100000001, 0x8, 0x2628, 0x39c, 0x2, 0x2, 0x10000, 0x10000, 0x6, 0x7f, 0x2, 0x6, 0x6, 0x200, 0x4, 0xf17a, 0x300, 0x9, 0x86d, 0x6, 0xb2a, 0x80, 0xfffffffffffffff8, 0xffffffffffffff7f, 0xd5e5, 0x200, 0x0, 0x401, 0x80000001, 0x5, 0x1000, 0x100, 0x756, 0x2, 0x0, 0x0, 0x577, 0x7149, 0xfffffffffffffffa, 0x2, 0x1d7, 0x4, 0x80, 0x7, 0x4, 0x7fff, 0x133fb3eb, 0xd4, 0x9, 0x5, 0x20, 0x3, 0x3f, 0x4, 0x87, 0x1, 0x5, 0xb744, 0x200, 0x100000001, 0x0, 0x3, 0x3f, 0x1, 0x6, 0xc4ef, 0x1ff, 0x1, 0x81, 0x5, 0x81, 0x1, 0x1000, 0x4, 0x8, 0x8, 0x1ff, 0x8, 0x1f, 0x929a, 0x9, 0x6, 0x101, 0xc00000000000000, 0x400, 0xbc7, 0x2, 0x6, 0xffffffffffff7fff, 0x63e7, 0x5, 0x3, 0x2, 0x3, 0x400, 0x100, 0x3, 0x7, 0x1ff, 0x72, 0xfffffffffffff7d5, 0xfffffffffffff801, 0x6, 0xffffffffffffe7c4, 0x75, 0x7, 0x6, 0xffffffff, 0x5, 0x1f, 0x0, 0x4, 0xffffffffffffffff, 0x1, 0x0, 0x400000000000, 0x200000, 0x6, 0xff, 0xfffffffffffffffa, 0x689, 0x40, 0x2, 0xa08, 0xfffffffffffffff8, 0x100000001, 0xff, 0x7, 0x5, 0x637, 0x5, 0xeb4, 0x8c, 0x0, 0x7, 0x7fffffff, 0x7fff, 0x0, 0x4, 0x100, 0x3ffc00000000, 0xe6, 0xbb, 0xdd, 0xffff, 0x3, 0x610000000000000, 0x7, 0x8, 0xfffffffffffeffff, 0x3, 0x6, 0x7fffffff, 0x7, 0x10000, 0x100, 0x9cd9, 0x45, 0x7, 0x8, 0x26, 0x6, 0x8, 0x0, 0xf3dc, 0x7, 0x100000001, 0xffffffff, 0x9, 0x7, 0x8, 0x3d67, 0x2, 0x9, 0x8001, 0x1ff, 0x8, 0x400, 0xffffffffffff4f42, 0x4, 0xffffffff, 0xb89, 0xda62, 0x0, 0xffffffff, 0x1, 0x4, 0x69aadcaa, 0x5, 0x1, 0x100000000, 0x9, 0x4, 0x800, 0x438f, 0x81, 0x0, 0x3, 0x2, 0x7d, 0x3ff, 0x9, 0x40, 0x9, 0x1, 0x1, 0x4, 0x897, 0x0, 0x8000], 0x1, [{[0xfff, 0x5], @broadcast=0xffffffff}]}, {[0xff, 0x9, 0x3, 0x6, 0x0, 0x9, 0x80000001, 0x1, 0x0, 0xe8, 0x1, 0x1, 0x3, 0xf1a, 0x0, 0x80, 0x4, 0x10001, 0x1e, 0xffffffffffffffe1, 0x401, 0x80000000, 0x7, 0x0, 0x4, 0x800, 0x1, 0xfffffffffffffff9, 0x2, 0x1f, 0xdc, 0x800, 0x20, 0x10000, 0xd8f, 0x5, 0xe4, 0x6, 0x8001, 0x80000001, 0x5, 0x673, 0x0, 0x5, 0x9, 0x217, 0x14000000, 0x1000, 0xe8, 0xd54, 0xfe1a, 0xfffffffffffffff3, 0x7, 0x2, 0x8, 0x8, 0x7, 0xfffffffffffffc01, 0x9e0f, 0x1, 0x7ff, 0x80000000, 0x7da8, 0x8, 0x8000, 0x7c9, 0x0, 0x4, 0x6, 0xffff, 0x10, 0x1, 0x100, 0x2, 0x8, 0x64c0000000000000, 0x3, 0x0, 0x3, 0x9, 0x4, 0x0, 0x5, 0x9, 0x8, 0x1, 0x1f, 0xfffffffffffffeff, 0x200, 0x5, 0x1000, 0x1, 0x56f2, 0x3, 0x3a2, 0xfffffffffffffc01, 0x4, 0x1, 0x8, 0x9, 0x400, 0xeedb, 0x47, 0x81, 0xf5, 0x5, 0x1, 0x100000000, 0x80000000, 0x200, 0x400, 0x1, 0x6, 0x80000001, 0x0, 0x2, 0x4218, 0x6, 0x2, 0x8, 0x1, 0x2, 0x1, 0x9, 0xff, 0x100000001, 0x56e, 0x80, 0x1ff, 0x7f, 0x200, 0x4, 0x0, 0x3, 0xfffffffffffff241, 0x10001, 0x8, 0x6, 0xfe0000000, 0xc982, 0x0, 0xf6, 0xffff, 0x2, 0x0, 0x7, 0xb4, 0xc105, 0xbacf, 0x7, 0x40, 0xfffffffffffffff7, 0x6, 0x0, 0x3, 0x7fffffff, 0x100000000, 0x0, 0x7ff, 0x0, 0xff, 0x2a0, 0x5, 0x9, 0x23ae, 0xffffffff, 0x7, 0x9, 0x4, 0x7fffffff, 0xfff, 0x3f, 0x28, 0x7, 0xbc1, 0x3, 0x10000, 0x1000, 0xff, 0x1, 0x401, 0x1, 0x9, 0x3f, 0x3, 0x8001, 0x9, 0x8, 0x5, 0x8, 0x0, 0x3, 0x5, 0x10000, 0x6, 0x3, 0x10000, 0x5, 0x771d, 0x8, 0x3, 0x3, 0x6, 0x6, 0x5, 0x10001, 0x3ff, 0x4, 0x4, 0x80000000, 0x4, 0x1, 0x0, 0x1f, 0x0, 0x7, 0x1, 0x2, 0x0, 0x8, 0x37, 0x1f, 0x3, 0x2, 0x8, 0xef, 0x2, 0x1, 0x7, 0x6, 0x10001, 0x4, 0x100, 0x7, 0xfff, 0x6, 0x1, 0xed, 0xc2f, 0x7ff, 0x80000001, 0x7, 0xb17f, 0x4d8, 0xf3, 0x9, 0x75, 0x7, 0x6, 0xffff, 0x8, 0x0, 0x2, 0x9a58, 0x6, 0x0, 0x400], 0x0, []}}}}]}, [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}, @common=@dnat={'dnat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffd}}}]}, @common=@AUDIT={'AUDIT\x00', 0x4}}, {{{0xb, 0x9, 0x7bac8f8dab902b93, 'ifb0\x00', 'gre0\x00', 'bpq0\x00', 'syz_tun\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0x0, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0xd8, 0xd8, 0x100, [@devgroup={'devgroup\x00', 0x14, {{0x6, 0xc66b, 0x5, 0x3ff, 0x9}}}, @mac={'mac\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2}, 0x1}}}]}, []}, @common=@AUDIT={'AUDIT\x00', 0x4, {{0x2}}}}]}]}, 0xef4) mbind(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x0, &(0x7f000000b000), 0x0, 0x0) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000180)=0x66ce) mlock2(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x1) mbind(&(0x7f000000a000/0x3000)=nil, 0x3000, 0x0, &(0x7f0000000000), 0x1, 0x2) 2018/03/02 11:09:19 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0xcac, &(0x7f0000000040)) io_setup(0x2, &(0x7f0000000080)) io_setup(0x7, &(0x7f00000000c0)) io_setup(0x8, &(0x7f0000000100)) io_setup(0x1ff, &(0x7f0000000140)) io_setup(0x7ff, &(0x7f0000000180)) io_setup(0x4, &(0x7f00000001c0)) io_setup(0x8, &(0x7f0000000200)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) [ 110.379164] binder: 15514:15521 got transaction to invalid handle [ 110.385592] binder: 15514:15521 transaction failed 29201/-22, size 0-0 line 2848 [ 110.386977] kernel msg: ebtables bug: please report to author: bad policy [ 110.427069] binder: release 15514:15521 transaction 438 out, still active [ 110.434089] binder: undelivered TRANSACTION_COMPLETE [ 110.439241] binder: undelivered TRANSACTION_ERROR: 29201 [ 110.444718] binder: send failed reply for transaction 438, target dead 2018/03/02 11:09:19 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x242, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x35, 0x0, @tid}, &(0x7f0000000440)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x6}, &(0x7f0000000140)=0x8) setsockopt$inet6_buf(r0, 0x29, 0x3f, &(0x7f0000000340)="bb9596c44cf1ea1487abcae13ebe1e2b180011c5ba114fb582bd305814a369655da540356500ce2fe00cff099db83013418a546eb82512cb26cccde3f71d7c189fdd206f0217e46fd5c1eb213ae8908d085f003d63dda7ee6ec958f5be63630d255f9563bb2bec132cb9bcc06142fe9de7327a896d47f3a55a8c6a17151e5dc936cca6de6a5acfda955f0897ada10e6a90e06c99b694d3476e81e74a1c6928b4eba490401bd7e0b8aceaf81b632bb9dad593f460b6170418387cd308bd3f6e26df3f070743ea07b4e6876700e6a6fd5d46bf7db5a65ac15317696e571cc64b80936fd72a19283a984184e5b1e302b139c2aacb8f9b4f1ef9c28103e06d", 0xfd) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000180)={r2, @in={{0x2, 0x4e23, @multicast1=0xe0000001}}}, &(0x7f0000000240)=0x8c) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x80000, 0x0) recvmsg$netrom(r3, &(0x7f000031ffe4)={&(0x7f0000ff9000)=@ax25={0x3, {"74eae9ecfcc0a7"}}, 0x10, &(0x7f000037aff0)=[], 0x0, &(0x7f000090e000)=[]}, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000040)=0x9, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) tkill(r1, 0x1000004000016) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f00000000c0)) accept4$nfc_llcp(r0, &(0x7f0000000280), &(0x7f0000000300)=0x58, 0x80800) 2018/03/02 11:09:19 executing program 2: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000001fe8)) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000003ff0)={&(0x7f0000012f80)=ANY=[@ANYBLOB="020f00001000000000000000000000000800120000000300000000000000000000e0000001000000000000800000000000000000000000000000000000000000000300064e20ac1476bb000000000000000003000500000000004e20ac14ffbb0000000000000000000000000000000000"], 0x80}, 0x1}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000fe6000)={@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x0, 0x2}, 0x20) r2 = fcntl$dupfd(r0, 0x406, r0) recvmsg$kcm(r2, &(0x7f0000000400)={&(0x7f0000000100)=@ethernet={0x0, @dev}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000140)=""/236, 0xec}, {&(0x7f0000000240)=""/14, 0xe}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000000280)=""/14, 0xe}], 0x4, &(0x7f0000000300)=""/219, 0xdb, 0x20}, 0x10100) 2018/03/02 11:09:19 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0xc0, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x0, []}]}, 0x208) 2018/03/02 11:09:19 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:19 executing program 3: perf_event_open(&(0x7f000014c000)={0x4000000002, 0x78, 0xa1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) fcntl$setlease(r0, 0x400, 0x0) rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000100)={'security\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, &(0x7f0000d31ff0), &(0x7f00007adff0)={0x77359400}, 0x8) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80585414, &(0x7f0000000080)=""/85) truncate(&(0x7f000037eff8)='./file0\x00', 0x0) fcntl$setlease(r0, 0x400, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000040), 0x4800) 2018/03/02 11:09:19 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x6cd66fa4c205bca7, 0x0) sendto$llc(r1, &(0x7f0000000080)="ebb05d1dffd343b440918582e6ab46e10c443c859ede146066a396bb0d8da64708bfd07a5b3c8d6365a51ba939199c4821275646042b7a4fda179b7ce374420ae7781e7ba12eaf6cd6b054eb8d5895274ce6dc5a70034ac2d758de19f2b2b6a90e3f750ec01fad92b05ea8bb27a7449287c2fa850eb4f150201c", 0x7a, 0x8080, &(0x7f0000000100)={0x1a, 0x17, 0x4, 0x1f, 0xd4, 0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000"], @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="000000000000c2863224550000"]], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:19 executing program 6: prctl$intptr(0x18, 0x8) 2018/03/02 11:09:19 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x1, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000240)=0x200, &(0x7f0000000540)=0x1) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000f40)={'ipvs\x00'}, &(0x7f0000000580)=0x1e) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) accept4$unix(r0, 0x0, &(0x7f0000000500), 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f00000003c0)=0xe8) fstat(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000ec0)=@nat={'nat\x00', 0x19, 0x6, 0x8d8, [0x200005c0, 0x0, 0x0, 0x20000724, 0x20000878], 0x0, &(0x7f0000000280), &(0x7f00000005c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x13, 0x8, 0xf6, 'nr0\x00', 'ifb0\x00', 'ip_vti0\x00', 'gre0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0x0, 0x0, 0xff, 0x8ff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x10c, 0x10c, 0x134, [@cluster={'cluster\x00', 0x10, {{0x2, 0x80, 0x8}}}, @physdev={'physdev\x00', 0x44, {{'ip_vti0\x00', {}, 'erspan0\x00', {0xff}}}}]}, []}, @common=@STANDARD={'\x00', 0x4, {0xffffffffffffffff}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x1, [{{{0x3, 0xb, 0xe8ff, 'syz_tun\x00', 'bcsf0\x00', 'ifb0\x00', 'syzkaller0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], 0xf4, 0xf4, 0x124, [@ipvs={'ipvs\x00', 0x28, {{@ipv4=@empty, [0xffffffff, 0xff, 0xffffff00, 0xffffffff], 0x4e24, 0x11, 0x2, 0x4e20, 0x17, 0x1}}}, @statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x1, 0x3534, 0xffff, 0x5}}}]}, []}, @common=@dnat={'dnat\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x7, 0x4, 0x884c, 'nr0\x00', 'ifb0\x00', 'syzkaller1\x00', 'ipddp0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x12}, [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x18}, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], 0xc8, 0x128, 0x158, [@arp={'arp\x00', 0x34, {{0x33f, 0x19, 0x4, @broadcast=0xffffffff, 0xff, @loopback=0x7f000001, 0xffffff00, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0xff, 0xff, 0x0, 0x0, 0xff], 0x0, 0x9}}}]}, [@snat={'snat\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xfffffffffffffffc}}}, @arpreply={'arpreply\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x15}, 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0xfffffffffffffffe}}}}, {{{0x5, 0x42, 0x88ff, 'bond0\x00', 'erspan0\x00', 'erspan0\x00', 'bond0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x14}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], 0xcc, 0xfc, 0x12c, [@m802_3={'802_3\x00', 0x8, {{0xfc, 0xffff, 0x4, 0x3}}}, @mark_m={'mark_m\x00', 0xc, {{0x2, 0x800, 0x2, 0x2}}}]}, [@arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}]}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x4, 0x0, 0x2, [{{{0x15, 0x4, 0x8917, 'gretap0\x00', 'vlan0\x00', 'yam0\x00', 'bridge0\x00', @empty, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @arpreply={'arpreply\x00', 0xc, {{@empty, 0xffffffffffffffff}}}}, {{{0x11, 0x0, 0xf9, 'yam0\x00', 'ipddp0\x00', 'ifb0\x00', 'bridge0\x00', @empty, [0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], 0x100, 0x274, 0x29c, [@arp={'arp\x00', 0x34, {{0x201, 0xf5, 0xb, @broadcast=0xffffffff, 0xff000000, @multicast2=0xe0000002, 0xff0000ff, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0xff, 0x0, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], 0x1, 0x2}}}, @owner={'owner\x00', 0x14, {{r2, r3, r4, 0x0, 0x1, 0x6}}}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x4, 'system_u:object_r:passwd_exec_t:s0\x00'}}}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x1, 0xffffffff, 0x3ff}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0x5}}}}]}]}, 0x928) [ 110.474967] binder: 15524:15526 transaction failed 29189/-22, size 40-8 line 2848 [ 110.506310] binder: undelivered TRANSACTION_ERROR: 29189 [ 110.538186] audit: type=1400 audit(1519988959.905:132): avc: denied { setpcap } for pid=15535 comm="syz-executor6" capability=8 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 110.566670] kernel msg: ebtables bug: please report to author: Wrong len argument [ 110.577298] binder: 15536:15543 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:19 executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) read(r0, &(0x7f0000000000)=""/197, 0xc5) r1 = socket$pppoe(0x18, 0x1, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={&(0x7f0000de2ff4)={0x10}, 0xc, &(0x7f0000023000)={&(0x7f0000197000)={0x14, 0x4, 0x1, 0xfffbfffffffffffd, 0x0, 0x0, {}, []}, 0x14}, 0x1}, 0x0) read(r1, &(0x7f0000000180)=""/76, 0x4c) 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x0, 0x1, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 110.582470] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 110.590389] binder: 15534:15540 got transaction to invalid handle [ 110.599505] binder: 15534:15540 transaction failed 29201/-22, size 0-0 line 2848 [ 110.614316] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 110.620412] binder: release 15534:15540 transaction 443 out, still active [ 110.629467] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:20 executing program 5: io_setup(0x8, &(0x7f0000000000)=0x0) io_getevents(r0, 0x4, 0x1, &(0x7f0000000080)=[{}], &(0x7f0000000180)={0x0, 0x989680}) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x0, 0x0) pread64(r1, &(0x7f00000001c0)=""/202, 0xca, 0x0) io_setup(0x6, &(0x7f0000000040)) 2018/03/02 11:09:20 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad0") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:20 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x33, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) pipe2(&(0x7f0000fb0ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r2, 0x407, 0x10000000002) vmsplice(r2, &(0x7f0000fccff0)=[{&(0x7f0000011fff)="b1", 0x1}], 0x1, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) vmsplice(r2, &(0x7f00000006c0)=[{&(0x7f0000000600)}], 0x1, 0x0) read$eventfd(r1, &(0x7f0000000000), 0x8) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000000040)={{0x14000000, 0x7}, {0x7fff, 0x10000}, 0xa352, 0x3, 0xffff}) tkill(r3, 0x1000000000016) close(r0) setns(r0, 0x8000000) [ 110.634600] binder: undelivered TRANSACTION_ERROR: 29201 [ 110.640128] binder: send failed reply for transaction 443, target dead [ 110.647132] audit: type=1400 audit(1519988960.008:133): avc: denied { read } for pid=15552 comm="syz-executor6" path="socket:[40104]" dev="sockfs" ino=40104 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 110.702896] binder: undelivered TRANSACTION_ERROR: 29189 [ 110.795198] binder: 15563:15568 got transaction to invalid handle [ 110.801581] binder: 15563:15568 transaction failed 29201/-22, size 0-0 line 2848 [ 110.815458] binder: release 15563:15568 transaction 446 out, still active [ 110.822459] binder: undelivered TRANSACTION_COMPLETE [ 110.827642] binder: undelivered TRANSACTION_ERROR: 29201 [ 110.833114] binder: send failed reply for transaction 446, target dead 2018/03/02 11:09:20 executing program 6: r0 = socket$unix(0x1, 0x10000000000007, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'sit0\x00', &(0x7f00000001c0)=@ethtool_rxnfc={0x30, 0x0, 0x0, {0x0, @udp_ip4_spec={@broadcast=0xffffffff, @broadcast=0xffffffff}, {"2d88", @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, @usr_ip6_spec={@dev={0xfe, 0x80}, @dev={0xfe, 0x80}}, {'E8', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x0, 0x80000001}, 0x0, []}}) 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:20 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000028000000000000000800000000000000663ca6d50034b445cee28a876a29376812bd6ffe469e6d5e6fdd3df16399a4c6d3f3f8a9890ccea6cac3176faa2deb7da96fc9c91ea0542222d06f2b", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:20 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad0") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:20 executing program 3: syz_emit_ethernet(0x4a, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60d8652b00140600fe8004000000000000000000000000aafe8000000000000000000000000000a20e204e208803d1857f4acda316a24b2f45770e0cafa38edc9d24e29d06036b5ab197cb78ca4f1a64e17a9900d36f731c57498da65dfa5ceda3d5050b1299c4403e20f9da7f691c60dc3206838eb9cec91725a8b57ed42669c401f893db28c9579040000000000000000d66a44e3a6d63fc99232f01a47dcee62cf0a1953ec9bda29db3211544c8313a2b528cc999e8a62667ffe574a22dd2f7051c8d88a87909a17cfb4de259e28ddfa50174afa0087b3d203dd6311d8cdc84f2efa4b8447f43e40a78d90804c498087ccbb079c6ac0d4b322e62ebc42220636e5d5461640000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], &(0x7f00000002c0)) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000000)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, &(0x7f0000000080)={0x0, 0x9, 0xffffffffffffff60, &(0x7f0000000040)}) 2018/03/02 11:09:20 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000180)="2f0100000000000000617a6269746572006f7dcad263c9460000", 0x0) r2 = syz_open_procfs(0x0, &(0x7f00008feff8)='net/udp\x00') sendfile(r1, r2, &(0x7f00006dbff8), 0x401) socket$nfc_raw(0x27, 0x3, 0x0) r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setns(r3, 0x8000000) close(r2) execveat(r1, &(0x7f0000ff7000)='./file0\x00', &(0x7f0000c83000)=[], &(0x7f000034bff8)=[&(0x7f0000ff7000)="00000000000007060804002000fffc0c6565643b799365195f1b76"], 0x1000) recvmmsg(r2, &(0x7f0000002d40)=[{{&(0x7f00000008c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x14, &(0x7f0000000e80)=[{&(0x7f0000000900)=""/173, 0xad}, {&(0x7f00000009c0)=""/2, 0x2}, {&(0x7f0000000a00)=""/218, 0xda}, {&(0x7f0000000b00)=""/48, 0x30}, {&(0x7f0000000b40)=""/252, 0xfc}, {&(0x7f0000000c40)=""/190, 0xbe}, {&(0x7f0000000d00)=""/170, 0xaa}, {&(0x7f0000000dc0)=""/169, 0xa9}], 0x8, &(0x7f0000000ec0)=""/94, 0x5e, 0x7}, 0x12}, {{0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000f40)=""/243, 0xf3}, {&(0x7f0000001040)=""/240, 0xf0}], 0x2, &(0x7f0000001180)=""/48, 0x30, 0x8}, 0x101}, {{&(0x7f00000011c0)=@alg, 0x58, &(0x7f0000001780)=[{&(0x7f0000001240)=""/195, 0xc3}, {&(0x7f0000001340)=""/49, 0x31}, {&(0x7f0000001380)=""/59, 0x3b}, {&(0x7f00000013c0)=""/214, 0xd6}, {&(0x7f00000014c0)=""/166, 0xa6}, {&(0x7f0000001580)=""/214, 0xd6}, {&(0x7f0000001680)=""/177, 0xb1}, {&(0x7f0000001740)=""/53, 0x35}], 0x8, &(0x7f00000017c0)=""/210, 0xd2, 0x1f}, 0x4bf3}, {{&(0x7f00000018c0)=@nfc, 0x10, &(0x7f0000002c00)=[{&(0x7f0000001900)=""/111, 0x6f}, {&(0x7f0000001980)}, {&(0x7f00000019c0)=""/227, 0xe3}, {&(0x7f0000001ac0)=""/48, 0x30}, {&(0x7f0000001b00)=""/29, 0x1d}, {&(0x7f0000001b40)=""/59, 0x3b}, {&(0x7f0000001b80)=""/4096, 0x1000}, {&(0x7f0000002b80)=""/126, 0x7e}], 0x8, &(0x7f0000002c40)=""/246, 0xf6, 0xe033}, 0x100}], 0x4, 0x1, 0x0) connect$can_bcm(r2, &(0x7f0000002dc0)={0x1d, r4}, 0x10) sendmsg$alg(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000001c0)="f19d35b34dbee57475795c320f7468f11af6b2d5eaa74c64d2fe9abb0c8a1046f544f9b30fc911f91fed955dc1c001efb5ebe6b7cc80097da19a0183ff2d314570d92bce5363e790", 0x48}, {&(0x7f0000000240)="a6b24373991d60d96979e11693b813b8cf37fa58", 0x14}, {&(0x7f0000000280)="2c4a56cf6a1852b391e8d510ebb2192060435fe9a05ce06fa4826115e1d264a8f46d8a042bec3855304d01c4cddce1571e51c522020884dded9bf93739265bdd5ca5fe48705c1d05a77515dbee33fb2d719a43d3b5d25c65d9b17eb623379f5ba0", 0x61}, {&(0x7f0000000300)="435d6b234ea5bdc33681fec7c6bca7a47465acd4283f885dbefd7c9d1ca9f2f6c627ea4c90c84b65af0ce7388565a8170768394eec9c23745045c033a96610328e7e8cd5a9bb8eff00e70f8afbe3f88aabc2478547828b7b383fb6962d774ae7ba9039555bb09c64bfcbe93e6a9118418e7e9f37aa1b0f76c87d44d4d1caec282c9b2e73c0adaa2e0535197322ca2d09df6ac83b3f393ffec60b2610589ad4f5efacbc299ed0b84050bc74220aa84c3e8bea3681d349ba26471a3db9a54cf8dd3cf967e677d4ef8f2bda0d2401e958a32ea9428e7e02ab2caad6a4ed39353c8e2d", 0xe1}, {&(0x7f0000000400)="9c71d2c56fcc5f37d1521892e14419220e30a4aa6b1a497246c81aa7061a5d74e7b3de0b9425b0b20058f73f70ac879066f87b29c566955d6f927b27bf177b5bba8f8c5e5a8de1ad9959d2e0d71db7a81c29596e2c6e177f68bbc06a9d9d6eb652d7c8efa2072c0b95a64a4ea0ba4056dba044a279b824060c9103aaf1a58500d62fd4", 0x83}, {&(0x7f00000004c0)="88b5ec5f5cd993433614894845c269e7d4166758bc356494a4f147e5f93f2d5d534af2a94bb4b3c66dbcbc93ddd3dda446d73a6164c0ffe0569d4f3cb0b896710e3a73172b4f4da9e096f820fb9c6b734cdacdbb174fa2004d55fb30a1c1df17e7071c2d6e9133b0a9bd03e48711d6728f580b5394db1526f79191d34592a95d701e6fc24e139fb57043fa3baf29a1fd6a244598fd9c6f624b5d6bd5a0197aba56cc6393a70b7990a6773e", 0xab}, {&(0x7f0000000580)="353f2076f7145af5c681449b98bfe696467dee924376b48de44149c2200038a72a869693b43c8af6ffd0284779d4aec39e6e4a1aa213acda56043e5270ca1b2c8846a5c63fcc6636522c92fe2563a4805e08d8fab7eccdc839a81e5751592916b83162a9045308084fd0596b20601910902819f4bc4eecbd654c6cfcdd4033821cb37da2147e9b0f5ce74145", 0x8c}], 0x7, &(0x7f0000000680)=[@assoc={0x10, 0x117, 0x4, 0x1ff}, @assoc={0x10, 0x117, 0x4, 0x401}, @op={0x10, 0x117, 0x3, 0x1}, @assoc={0x10, 0x117, 0x4, 0x8}, @op={0x10, 0x117, 0x3, 0x1}], 0x50, 0x8851}, 0x4000000) getsockopt$inet6_buf(r0, 0x29, 0x0, &(0x7f0000000080)=""/30, &(0x7f0000000000)=0xfffffffffffffffa) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={@ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, @mcast2={0xff, 0x2, [], 0x1}, @empty, 0x5, 0x0, 0x54, 0x100, 0x9, 0x4800000, r5}) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000040)) 2018/03/02 11:09:20 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000d8d000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0xaf01, &(0x7f0000197ff8)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0xaf02, &(0x7f0000d7c000)) 2018/03/02 11:09:20 executing program 0: r0 = socket$inet(0x2, 0xfffffffffffffffc, 0x80000000000000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:20 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000280)=@nat={'nat\x00', 0x19, 0x3, 0x31c, [0x20000480, 0x0, 0x0, 0x200004b0, 0x200004e0], 0x0, &(0x7f000092cff0), &(0x7f0000000480)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x3, 0x8, 0x22f0, 'erspan0\x00', 'bcsh0\x00', 'syzkaller1\x00', 'bcsf0\x00', @empty, [0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@STANDARD={'\x00', 0x4, {0xfffffffffffffffc}}}, {{{0x1b, 0x12, 0xa00, 'ip6_vti0\x00', 'bridge0\x00', 'gretap0\x00', 'syzkaller1\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x12}, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xb}, [0xff, 0xff, 0x0, 0xff, 0xff], 0xe4, 0xe4, 0x12c, [@connlabel={'connlabel\x00', 0x4, {{0x0, 0x2}}}, @ipvs={'ipvs\x00', 0x28, {{@ipv4=@broadcast=0xffffffff, [0x0, 0xffffff00, 0xff], 0x4e20, 0x1d, 0x5, 0x4e23, 0x0, 0x14}}}]}, []}, @common=@log={'log\x00', 0x24, {{0x6, "7e121612c003e2e66340f423d5ae0c37841339ab7c5572498377251bda54"}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x200, 'nr0\x00', "74756e6c300000001c84000900", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @random="2a97e74a12af", [0x0, 0x0, 0x400000000000000], 0x70, 0x70, 0x98, []}, []}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0xffff}}}}]}]}, 0x36c) fgetxattr(r0, &(0x7f0000000000)=@random={'os2.', 'tunl0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, &(0x7f0000000200)=""/95, 0x5f) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x3, 0xc0800) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000300)={0x0, 0xb6, "540c3ebe6b1fd7004452e6e5e21818beb63220381303663b0fcd6072ec58cdefcdd9bdfcecb308778d0bfb593d143b40b6d9654731990a36c1e1142db9df2a3ac4fade739473f342400840b4d10ce9b5b8911ba7d23d93eac3b410b3e0b65e017b4aa78e020895575ccee1387c59a8f1c8b14f1907c0294ab038f2810f3cae75651c40219bf67049ca2ddab193d9dd161b5e363e41c14cf2eabb6b8a8a10e9918cf74c2c725ad8d926bc33b76c4c196e9c7c27f5294c"}, &(0x7f00000003c0)=0xbe) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000400)={r2, 0x10001, 0x6}, &(0x7f0000000440)=0x8) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f00000000c0)={r3, 0x1}) 2018/03/02 11:09:20 executing program 6: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x5, &(0x7f0000016000)=@framed={{0x18}, [@map={0x18, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0xd0}], {0x95}}, &(0x7f000000bff6)='syzkaller\x00', 0x1, 0xd1, &(0x7f0000000180)=""/209}, 0x48) 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0xb1}}}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:20 executing program 3: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fcntl$setsig(r0, 0xa, 0x1d) madvise(&(0x7f0000dbe000/0x4000)=nil, 0x4000, 0x10200000008) 2018/03/02 11:09:20 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x7) close(r0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x40000, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x1, 0x4) [ 110.905739] binder: 15576:15582 got transaction to invalid handle [ 110.912179] binder: 15576:15582 transaction failed 29201/-22, size 0-0 line 2848 [ 110.927567] binder: 15573:15585 got transaction with invalid data ptr [ 110.947992] binder: 15573:15585 transaction failed 29201/-14, size 40-8 line 2982 2018/03/02 11:09:20 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad0") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:20 executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000180)) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00004ca000)={&(0x7f0000000040)={0x1c, 0xa, 0x206, 0x1, 0x0, 0x0, {}, [@nested={0x8, 0x1, [@generic="06"]}]}, 0x1c}, 0x1}, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0}, &(0x7f0000000140)=0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="0c0200000d07040025bd7000fedbdf250300000a3f0e6017168e47c2e046d4680d7ef45cb51756b964c2305af646c6e0d8001a0000000000dd7d62a15cbd5152d3e6d513ad87148551a489fc1770c508e9d4c329452bfaeda8d37a18c07460faabdb6da25dca3d99e39252a83d30eb3925311246c4668353bfcb235a5d75bdca86c3c590864ba9a5fa00bb1616e32ff6f09ca30753cbfb65a5cd5e630144ffd0c6c49587c0a04d820c45b9ab9b67176d267c3fb1253cf9df2834f2ee7e4cea559d021c6277bda55964594525031db6150d300c21bbdc54f63f537d2e6eaf957920596af171da2d01de5bbf4d2c805e41f2516996a759ed2fc7e3ce34f917de007749c51bde5f00001800370000000000fe8000000000000000000000000000bbabd3223e8c992454c58efbf84557c6b594b8f5b9243376df4ee3950c2deade0c006f00000000002a0000000c00670000000000", @ANYRES32=r3, @ANYBLOB="496344fd1ee290b43bea2fe312b105000000ff62e9d143d62daa9fb0d4a3f63900e71c50868c43f205f4d5cc2c3bbbac5ca9f916267542f353dbf8b137d1619ca95453cca979063d4d863e439a6f7126bc8c60c9bf46b40bde27766e1642bc474f2740d9447f75d2815f4d09ffdebbcc8e6be8798bcf5a79136604d6ef8b72d2d3207907213fbd5dfad5c4711235aff0c96c207b491cabed4e0c00900000000000010000800c00460000000000043998161db3f1f62693ec9d627eb47b288099890198805995c46ddb915f00dbe43e3c3342733f3cab03fd057e740f2ae49379ac43d44047b0e2af1ba1863d810e9da91d50203f2650d89435c12c576e43e9568332bc74256ba8a69c6ffb627d955be2f25e8d6bc9a5af583eb874af2a7f24f3f34c48de3b4af9caada66868c490434b8e0d4ba416c45e37db24bd9911593e5297e73177a73b0f6268c452592f5f35a7068128aa733256880c1de6624ff13361e1b13528f64ff50ec9ecb6e881ccccaad534791820522daacb9e4b6916d0a0219fa0aa3b82caf0c09e01c1e65d2578189b9e986d191ec93f9120af9485"], 0x2f4}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000200)) r4 = add_key(&(0x7f00000001c0)='.request_key_auth\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000004c0)="5a32eb140f391aa2eb0ea3355760e9076ef272c932f04effe0a9bd3a5055220654c82b5d5bfb314213d20af7c6a95033ee85d05191b4fa7892bd116e0536588f216d14", 0x43, 0xfffffffffffffff8) keyctl$describe(0x6, r4, &(0x7f0000000540)=""/197, 0xc5) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000240), &(0x7f0000000280)=0x8) [ 110.957771] binder: release 15576:15582 transaction 449 out, still active [ 110.964795] binder: undelivered TRANSACTION_COMPLETE [ 110.969957] binder: undelivered TRANSACTION_ERROR: 29201 [ 110.975459] binder: send failed reply for transaction 449, target dead 2018/03/02 11:09:20 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000f54fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r1 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f00000001c0)={0x9, {{0xa, 0x4e21, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0x7}}}, 0x88) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00004f7000)="649c47ad46390d006dc80000009d4d54", 0x10) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000140)={r2, r3/1000+10000}, 0x8) r4 = dup(r0) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) r6 = eventfd2(0x9, 0x80001) sendmsg$alg(r5, &(0x7f0000b37000)={0x0, 0x0, &(0x7f0000a50fe8)=[{&(0x7f0000000000)="7d8975912568ed3167dfa7b4da789393fc0e3e7d5ebfeffca8600aa7e877b864ed0b6a08cfa518755c7c290c47b95032fe799adec447d04756872b830326234b8255d8b5c77b1d109583cfa8eac51569", 0x50}], 0x1, &(0x7f0000b27000)=[]}, 0x0) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x103000, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f00000002c0)={r6, 0x8000, 0x78b5, r7}) recvmsg$kcm(r5, &(0x7f0000e63000)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/73, 0x49}, {&(0x7f0000001140)=""/248, 0xf8}], 0x2, &(0x7f0000142000)=""/60, 0x3c}, 0x0) [ 111.013353] binder: undelivered TRANSACTION_ERROR: 29201 [ 111.051434] binder: 15611:15612 got transaction to invalid handle [ 111.053552] netlink: 'syz-executor6': attribute type 1 has an invalid length. [ 111.057805] binder: 15611:15612 transaction failed 29201/-22, size 0-0 line 2848 [ 111.066547] audit: type=1400 audit(1519988960.433:134): avc: denied { getopt } for pid=15614 comm="syz-executor6" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 111.081915] netlink: 'syz-executor6': attribute type 1 has an invalid length. 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x190, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xa0, 0xd0, []}, [@snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:20 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x80000, 0x0) recvmsg$netrom(r0, &(0x7f00000003c0)={&(0x7f0000000080)=@full={{0x3, {"c7393256128a78"}, 0x2}, [{"c4680436dddd36"}, {"af8042a31503e8"}, {"a23eef52e8c2d9"}, {"5cad6b20f6e6e3"}, {"697175aa203c94"}, {"a797047ceb8f9d"}, {"edd861125b1ac1"}, {"0fdc4c4e19e80f"}]}, 0x48, &(0x7f0000000380)=[{&(0x7f0000000100)="777dfb5fb7e6778ac212a7", 0xb}, {&(0x7f0000000140)="202ba0413839f4a3cea95d011fbe121691ed7d590c6bd0ecaff764c7f8409eec1f79c3c70a34bf8f929f7f0a85fb02f22c84281e111e7ec24c21dd9d3d09ac08ca6973b2a9bd6bcb8908aa8432cc6b01dcbaf29930e19b918676035e626da490167e2d5959ecdc47237bb70872540bc4e5601c1550145303d9896293d49f6c7bcc9c5785827dc7726886089f48496129bc49acdf704dc65b5b5b03396ca6fa6db0825f0a8d25e1ed7dbace0b613cec8e6af19848e485d39c757db9ab6fe88cf0c2537f1e81e30d7218d2ba9ceb657082", 0xd0}, {&(0x7f0000000240)="8aa5f240b8843d0982f0104a5e9d66ff1af5591bca4b441f4174bcabda964badc37997c09634ef4c55ab2ed8a1533981fc1d34ecf9a55654d6faa04f98dc69c4f2733430e27daf9c4f27c5362ebd437c6b27c9d534ee8d03198697676ba863b9e2f3a9892cdfd3c25c250f3332ca693e98d4d9dd43a5bb6fb9e9e244d24b8018b2", 0x81}, {&(0x7f0000000300)="e19941608e2579d5b63b3bd66bf8c75cb6cc45ec2d3b254bb5aea5be5e7a34e9ed4fa1349220ecf4bc2d2fb21eae22626e27d68efcdbbbe2bf6a02abca04836ccb2024d70bac91cdc3873c07f512eae347c6aeb871b5b1", 0x57}], 0x4, 0x0, 0x0, 0x4081}, 0x3) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0x0, 0x1ffffffffffd) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0xffffffffffffff34, 0x0, &(0x7f0000004fbc)=ANY=[], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:20 executing program 2: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) socketpair$ax25(0x3, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000040)={r1, r2, 0x8, 0x0, &(0x7f00000000c0)="93636bd335ebdfba5e70d97421a19d97b6b2e40cb3638a39bbdf9aebb3123c0ba5727fe093abab116e67e5c20028e2c8d7394421ff60b167545aa5cf5da0431785fa7713e07711f1fbc7e5405590b1c9e042ee60292ce20e", 0x7, 0x10001, 0x2, 0x8, 0x3f, 0x7, 0x4, "63fa54a399f6b0a07122e58389ec6621ae6e"}) sendmsg$rds(r0, &(0x7f00000009c0)={&(0x7f0000000140)={0x2, 0x4e24, @broadcast=0xffffffff}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000180)=""/61, 0x3d}, {&(0x7f00000001c0)=""/79, 0x4f}, {&(0x7f0000000240)=""/6, 0x6}], 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="5800000014010000080000000000000006000000ff7f0000", @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB='?\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000300)=ANY=[@ANYBLOB="0100000000000000"], @ANYBLOB="03000000000000000400000000000000001000000000000008000000000000000100000000000000ffff000000000000580000001401000009000000000000000700000002000000", @ANYPTR64=&(0x7f0000000340)=ANY=[@ANYBLOB="ff0f000000000000"], @ANYPTR64=&(0x7f0000000380)=ANY=[@ANYBLOB="ffff000000000000"], @ANYBLOB="01000080000000000400000000000000ff03000000000000080000000000000061000000000000000600000000000000580000001401000007000000000000000500000008000000", @ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYBLOB="ef06000000000000"], @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYBLOB="ff00000000000000"], @ANYBLOB="000000000000000081ffffffffffffff00020000000000000600000000000000400000000000000001000080ffffffff580000001401000006000000000000000900000001800000", @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYBLOB="ffffffff00000000"], @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="0500000000000000"], @ANYBLOB="0002000000000000fc000000000000000600000000000000171100000000000007000000000000000300000000000000580000001401000007000000000000006e09000008000000", @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYBLOB="0001000000000000"], @ANYPTR64=&(0x7f0000000500)=ANY=[@ANYBLOB="0100008000000000"], @ANYBLOB="040000000000000002000000000000000400000000000000020000000000000010000000000000008000000000000000180000001401000002000000000000000104000001000000580000001401000008000000000000000d3a000000000000", @ANYPTR64=&(0x7f0000000540)=ANY=[@ANYBLOB="0101000000000000"], @ANYPTR64=&(0x7f0000000580)=ANY=[@ANYBLOB="ffffff7f00000000"], @ANYBLOB="a5020000000000001f00000000000000fdffffffffffffffe10000000000000001000000000000000500000000000000580000001401000007000000000000003f00000000000000", @ANYPTR64=&(0x7f00000005c0)=ANY=[@ANYBLOB="0500000000000000"], @ANYPTR64=&(0x7f0000000600)=ANY=[@ANYBLOB="f500000020ffffff"], @ANYBLOB="01000000010000000000000000100000fdffffffffffffff00000000ffffffff3d00000000000000090000000000000058000000140100000800000000000000000000002af2ffff", @ANYPTR64=&(0x7f0000000640)=ANY=[@ANYBLOB="0180000000000000"], @ANYPTR64=&(0x7f0000000680)=ANY=[@ANYBLOB="1f00000000000000"], @ANYBLOB="4900000000000000ffda423400000000030000000000000002000000000000000a000000000000000900000000000000"], 0x2d8, 0x20000800}, 0x40000) r3 = socket(0x15, 0x1, 0x0) getsockopt(r3, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, &(0x7f0000000080)=0xfe98) 2018/03/02 11:09:20 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x13) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000e84000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000516000)) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000000)) 2018/03/02 11:09:20 executing program 0: r0 = socket$inet(0x2, 0x4, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x20001, 0x104) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/udplite6\x00') ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x100001}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f0000000000), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x11}, [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:20 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0x800000000005, 0x0, &(0x7f000000b000)={0x77359400}, &(0x7f0000000040), 0x0) r1 = socket$inet(0x2, 0x200000000000003, 0x5) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000000e0000000400000088020000ffffffff940000000000000094000000fffffffffffffffff4010000f4010000f4010000ffffffff04000000", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700094000000000000000000000000000000000000000000240052454a45435400000000000000000000000000000000000000000000000000000000ac14140000000000000000000000000069705f7674693000000000000000000073797a6b616c6c65723100000000000000000000000000000000000000000000000000000000000000000000000000000000000900000000700094000000000000000000000000000000000000000000240052454a45435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009c00cc0000000000000000000000000000000000000000002c006164647274797065000000000000000000000000000000000000000000000000000000000000000000003000434f4e4e4d41524b0000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000940000000000000000000000000000000000000000002400000000000000000000000000000000000000000000000000000000000000feffffff"], 0xb7) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendto$inet(r2, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) 2018/03/02 11:09:20 executing program 3: r0 = socket(0x1e, 0x802, 0x0) sendmsg(r0, &(0x7f0000db5fc8)={&(0x7f00004aeb5c)=ANY=[@ANYBLOB="1e00030000000000000000000001e526cc573c5bf86cf40c00001e14dd6a739effea1b48007be61ffe06d79f00000000000000076c3f010039d8f986ff01000000000000af06d5fe32c419d67bcbc7e3ad316a198356edb9b7341c1fd45624281e27800ece70b076c3979ac40000bd767e2e78a1dfd300881a1565b3b16d7436"], 0x80, &(0x7f000045d000)=[], 0x0, &(0x7f000016cf61)=[]}, 0x0) 2018/03/02 11:09:20 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 111.111997] binder: release 15611:15612 transaction 453 out, still active [ 111.119056] binder: undelivered TRANSACTION_COMPLETE [ 111.124207] binder: undelivered TRANSACTION_ERROR: 29201 [ 111.129700] binder: send failed reply for transaction 453, target dead 2018/03/02 11:09:20 executing program 3: r0 = socket$inet_sctp(0x2, 0x3, 0x84) setsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000ec0f4d)="835320b3ac10bcd5042bca2df88451c62a5ef83dcf688f33f835e3618064e5d6aec0fa3a390216a52417dd24cba46d0343aed1c273701851d147b105d6ffb5923cf4d94e1d807bbac99b754665581382bc2e21ed86be3d96787d7e13a429d8e69c48cdf72a6d2b9841eb171546a99fb84361d287f5479c4c705988b0a1207468c4d60e17edd3053ba67515b5ab878a01", 0x90) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x7fffffff, 0x100000001, 0x1, 0x8000, 0x70}, &(0x7f00000000c0)=0xa0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={r1, 0x6}, &(0x7f0000000140)=0x8) socket$vsock_dgram(0x28, 0x2, 0x0) 2018/03/02 11:09:20 executing program 1: r0 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x0, 0x200) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000180)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$setendian(0x14, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB="cf92a77432c0c0457e4fcb04"], @ANYBLOB="01000000000000000000000000000000000000000000000095006b7ce9bcfe6bdff96f13fa98dafe4c9108be3be58fce1d20bab1b6e45a1a7f8d35a961d0cd67e9756f39c14fdedce22e8b71ddd5bdf9bb66c506173d43712c7dcd9e746a6d9cb65aaf1b44683c69474a8a8f3895a83c98d3e3aa59381730136a1a131c6ad106c09d6f566a5106b1accf00d9b0da1ca0a6a88555430a7614fcb5dc44c4eeaf0eaa3ff8427b5e75b516d038952a1d4531cb905b15f2772159ea334b8568eabe904438e7cccd29"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x80013, r0, 0x0) 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp, 0x0, 0x20000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) modify_ldt$read_default(0x2, &(0x7f0000184f11)=""/239, 0xef) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000068cfe8)='/selinux/avc/hash_stats\x00', 0x0, 0x0) connect$packet(0xffffffffffffffff, &(0x7f0000bb7000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) sendto$inet(0xffffffffffffffff, &(0x7f00001b9000), 0x0, 0x0, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) listen(r1, 0x1008003) r2 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f00000000c0)=@req={0x50, &(0x7f0000000040)={'syzkaller1\x00', @ifru_addrs=@in={0x2, 0x4e22, @multicast2=0xe0000002}}}) connect$inet(r2, &(0x7f0000772000)={0x2, 0x4e23, @empty}, 0x10) socket$bt_l2cap(0x1f, 0x0, 0x0) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000464ffc), 0x1fb) sendmmsg(r2, &(0x7f0000ec6f00)=[{{&(0x7f000075aff0)=@nfc={0x27}, 0x10, &(0x7f00004b6000)=[{&(0x7f00007d1000)="12", 0x1}], 0x1, &(0x7f0000d10fdc)=[]}}, {{&(0x7f000096cff7)=@rc={0x1f}, 0xa, &(0x7f0000870ff8)=[], 0x0, &(0x7f0000899000)=[{0xc}], 0xc}}], 0x2, 0x0) accept4(r1, &(0x7f00009d6ff0)=@can, &(0x7f0000545ffc)=0xffffffffffffff19, 0x0) [ 111.170129] kernel msg: ebtables bug: please report to author: Couldn't copy entries from userspace [ 111.198219] binder: 15625:15634 got transaction to invalid handle [ 111.204674] binder: 15625:15634 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f00000001c0)={0x18, 0x0, {0x1, @random="9139ed510fa1", 'bridge0\x00'}}, 0x1e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) r3 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x480040) ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e21, @multicast2=0xe0000002}, {0x1, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x10}}, 0x40, {0x2, 0x4e20, @multicast2=0xe0000002}, 'lo\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8924, &(0x7f0000000200)={'bridge0\x00', r2, [0x6]}) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x0, @random="98b76494050e", 'irlan0\x00'}}, 0x1e) 2018/03/02 11:09:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x10) r1 = dup(r0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000040)={0x0, r2, 0x5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f00000000c0)={r3, r4, 0x9}) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)={0x18, 0x23, 0xaff, 0xffffffffffffffff, 0xffffffffffffffff, {0x3}, [@nested={0x4, 0x1, []}]}, 0x18}, 0x1}, 0x0) [ 111.290088] binder: release 15645:15659 transaction 461 out, still active [ 111.297155] binder: unexpected work type, 4, not freed [ 111.302481] binder: undelivered TRANSACTION_COMPLETE [ 111.335675] binder: release 15645:15647 transaction 458 out, still active [ 111.338187] dccp_close: ABORT with 1 bytes unread [ 111.342708] binder: unexpected work type, 4, not freed [ 111.342714] binder: undelivered TRANSACTION_COMPLETE [ 111.348301] binder: release 15625:15634 transaction 456 out, still active [ 111.365319] binder: undelivered TRANSACTION_COMPLETE [ 111.370472] binder: undelivered TRANSACTION_ERROR: 29201 [ 111.375975] binder: send failed reply for transaction 456, target dead [ 111.382704] binder: send failed reply for transaction 458, target dead [ 111.389399] binder: send failed reply for transaction 461, target dead 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x188, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0x98, 0xc8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:20 executing program 0: r0 = socket$bt_l2cap(0x1f, 0x7, 0x0) listen(r0, 0x7) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff75463e3eadec3a7ea09cd1ed73735b8c20953087e55e4146f018c96ee0e6ff9e1b452712b925af2c0b61836468c0adf76f7c41c0eba93af8105a8aed98418fca91422c0be2f8d5f1a40c1cab591fe5f35450b31affa2a4645f6fa5b61370e6665d5fd9a2b2fa3cad316892ee4770b2e80f0e"]}, 0x222) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) 2018/03/02 11:09:20 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:20 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x3f, 0x40) getsockopt$ax25_int(r1, 0x101, 0x5, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:20 executing program 3: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x8) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000080)={[0x80000000, 0xfffffffffffff43d, 0xd42e, 0x200, 0x5, 0xff, 0x5, 0x4, 0x0, 0x2, 0x4, 0x4, 0x5, 0x10001, 0x10001, 0x8], 0x1, 0x10}) r1 = syz_open_dev$sndtimer(&(0x7f0000014000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000001000)={{0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1}, 0x2c) 2018/03/02 11:09:20 executing program 6: unshare(0x8000000) r0 = mq_open(&(0x7f0000000080)='^procwlan1\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f00000000c0)={0x4ee, 0xfffffffffffffc00, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r1 = fanotify_init(0x2, 0x0) mmap(&(0x7f0000cb7000/0x1000)=nil, 0x1000, 0x8, 0x80010, r1, 0x0) mprotect(&(0x7f00002b1000/0xc00000)=nil, 0xc00000, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) clock_nanosleep(0x1, 0x1, &(0x7f0000000100)={r2, r3+10000000}, &(0x7f0000000140)) r4 = dup(r0) mq_getsetattr(r4, &(0x7f0000000040), &(0x7f0000acaff8)) 2018/03/02 11:09:20 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000280)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000900000003000000bc0100009800000081b6d91480ffffffffffffffff00000000ffffffff28010000ffffffffffffffff28010000ffffffff0300000000000000000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="e0000001ffffffff0000000000000000626373663000000000000000000000006e7230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000070009800000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000238c4fffb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000940000000000000000000000000000000000000000002400000000000000000000000000000000000000000000000000000000000000feffffff"], 0x218) 2018/03/02 11:09:20 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$TIOCLINUX2(r1, 0x541c, &(0x7f0000000040)={0x2, 0x401, 0x6, 0x7, 0xffff, 0x3}) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000ac0)=ANY=[@ANYBLOB="6e617400000000000000020000000000000000000000000000000000000000001b00000005000000680400000c03000030010000ffffffff0c030000ffffffffd4030000d403000005000000000000000000000000000000", @ANYPTR=&(0x7f0000000a40)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="e0000002e000000100000000ffffffff766c616e3000000000000000000000006772657461703000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d40030010000000000000000000000000000000000000000640070687973646576000000000000000000000000000000000000000000000062637368300000000000000000000000000000000000000000000000000000006263736630000000000000000000000000000000000000000000000000000000000800005c00434c5553544552495000000000000000000000000000000000000000000000000000000000000000000006000f003a001d002b0024003a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000b80000000000000000000000000000000000000000004800444e4154000000000000000000000000000000000000000000000000000100000000e0000002000000000000000000000000fe8000000000000000000000000000aa000000007f000001ffffffff000000000000000065716c000000000000000000000000006970646470300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0002401000000000000000000000000000000000000000040007365740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400073657400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003400444e4154000000000000000000000000000000000000000000000000000001000000000000007f000001ac1414aa000000000000000000000000000000000000000065727370616e3000000000000000000065727370616e30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009400c80000000000000000000000000000000000000000002400736f636b65740000000000000000000000000000000000000000000000010000000034005245444952454354000000000000000000000000000000000000000000000100000000000000e0000001ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000940000000000000000000000000000000000000000002400000000000000000000000000000000000000000000000000000000000000feffffff"], 0xfd45) 2018/03/02 11:09:20 executing program 2: socket$rds(0x15, 0x5, 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) signalfd(r0, &(0x7f0000000000)={0xffffffffeffffffe}, 0x1f7) r2 = dup(r1) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r2, 0x80dc5521, &(0x7f0000000080)=""/150) 2018/03/02 11:09:20 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x805, 0x0) socketpair$llc(0x1a, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='erspan0\x00', 0x341) sendto$inet(r0, &(0x7f0000000040)="b0", 0x1, 0x0, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14}}, 0x10) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f00000002c0)=0x53ad7868, 0x4) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000100)={0x8, {{0xa, 0x4e21, 0x1c000000000, @loopback={0x0, 0x1}, 0xf495}}, 0x0, 0x2, [{{0xa, 0x4e20, 0x5, @mcast2={0xff, 0x2, [], 0x1}, 0x3}}, {{0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x7}}]}, 0x190) dup2(r2, r1) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDGETMODE(r3, 0x4b3b, &(0x7f0000000340)) 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 111.466671] kernel msg: ebtables bug: please report to author: Wrong len argument [ 111.466740] kernel msg: ebtables bug: please report to author: Wrong len argument [ 111.490193] binder: 15674:15680 got transaction to invalid handle [ 111.496628] binder: 15674:15680 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000e48000)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x4000000002283, &(0x7f00006a1000)) lseek(r0, 0x0, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000000)=""/4096) 2018/03/02 11:09:20 executing program 3: r0 = open(&(0x7f0000000040)='./file0\x00', 0x2, 0x18) sendfile(r0, r0, 0x0, 0x8) bind$bt_rfcomm(r0, &(0x7f0000000080)={0x1f, {0x710b, 0x4, 0x5, 0x8, 0x1, 0x3f}, 0x8001}, 0xa) r1 = syz_open_dev$evdev(&(0x7f0000162fee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000000)) syncfs(r1) 2018/03/02 11:09:20 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:20 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xe08, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000200)={'security\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 111.518316] kernel msg: ebtables bug: please report to author: Wrong len argument [ 111.524206] binder: release 15674:15680 transaction 465 out, still active [ 111.527908] binder: 15676:15692 transaction failed 29189/-22, size 40-8 line 2848 [ 111.533042] binder: undelivered TRANSACTION_COMPLETE [ 111.533054] binder: undelivered TRANSACTION_ERROR: 29201 [ 111.533087] binder: send failed reply for transaction 465, target dead [ 111.558062] binder: send failed reply for transaction 467 to 15676:15686 2018/03/02 11:09:20 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f"}}}}]}]}, 0x208) 2018/03/02 11:09:20 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x1, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000080)={@remote}, &(0x7f00000000c0)=0x14) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:20 executing program 6: r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x1) statx(r0, &(0x7f00000000c0)='./file0\x00', 0x1c00, 0xfff, &(0x7f00000001c0)) symlinkat(&(0x7f0000000140)='./file0\x00', r0, &(0x7f00000002c0)='./file0\x00') syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff0000000000000000004700002cffff0000004f98424baced974dc30700000014ffaaffffffff830a0583035a00154c20c06242678ec40000000000"], &(0x7f0000000180)={0x0, 0x1, [0xfffffffffffffffd]}) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000100)) 2018/03/02 11:09:21 executing program 2: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x22000, 0x0) r1 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff8) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000240)=0x0, &(0x7f0000000280), &(0x7f00000002c0)) keyctl$chown(0x4, r1, r2, r3) getsockname(0xffffffffffffffff, &(0x7f0000000040)=@can={0x0, 0x0}, &(0x7f0000000080)=0x10) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, r4, 0x3}, 0xc) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) 2018/03/02 11:09:21 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d5") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 111.590619] binder: 15707:15708 got transaction to invalid handle [ 111.597078] binder: 15707:15708 transaction failed 29201/-22, size 0-0 line 2848 [ 111.599559] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:21 executing program 5: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000240)) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f0000000100)=0x3) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) r3 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000040), 0x800) dup3(r0, r1, 0x80000) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000080)=0x3, 0x4) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, "d8b8c7b79638bb0100008000000000d3c628220ff9fec9337be2a01d2e8d2c128f4472f094f1bb5983315fadc655e4a99330b229054fba270f4e232976a26691", "0e60e9dbc36932ec0a2a15e0c018d0967533bbea5903bcb8a770391759382aa5997a5c4b37e0001f24e299819c21706a85e511b7b8a3ccf33ee77c1ce1f5257b", "b691951271113c9b66b9e3d8ebf6d8f2e4fd389e4b4c350ee21c9d18eb9a6252", [0xba]}) [ 111.675849] binder: release 15716:15718 transaction 474 out, still active [ 111.682922] binder: unexpected work type, 4, not freed [ 111.688263] binder: undelivered TRANSACTION_COMPLETE [ 111.689471] binder: BINDER_SET_CONTEXT_MGR already set [ 111.702756] binder: undelivered TRANSACTION_ERROR: 29189 [ 111.708571] binder: 15728:15730 ioctl 40046207 0 returned -16 [ 111.712470] binder_alloc: 15707: binder_alloc_buf, no vma [ 111.718070] binder: undelivered TRANSACTION_COMPLETE [ 111.720150] binder: 15728:15733 transaction failed 29189/-3, size 40-0 line 2963 [ 111.725213] binder: undelivered TRANSACTION_ERROR: 29189 [ 111.738787] binder: release 15707:15708 transaction 472 out, still active [ 111.745236] binder: 15728:15730 got transaction to invalid handle [ 111.745869] binder: undelivered TRANSACTION_COMPLETE [ 111.752034] binder: 15728:15730 transaction failed 29201/-22, size 0-0 line 2848 [ 111.757107] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:21 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f000070ffe3)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f000023effe)="7f", 0x1, 0x0, &(0x7f000010e000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) shutdown(r0, 0x1) mq_unlink(&(0x7f0000000000)='\x00') readv(r0, &(0x7f0000002300)=[{&(0x7f0000002240)=""/146, 0x92}], 0x1) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000140)={0x0, @multicast1, @local}, &(0x7f0000000180)=0xc) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000001c0)={@empty, @local={0xfe, 0x80, [], 0xaa}, @mcast1={0xff, 0x1, [], 0x1}, 0x7, 0x5, 0x81, 0x400, 0x7f, 0x80000, r1}) 2018/03/02 11:09:21 executing program 4 (fault-call:1 fault-nth:0): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:21 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x18, &(0x7f0000d01000)=0x7ff, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x3e, &(0x7f00002cef88)="5780d01c", 0x4) sendto$inet6(r0, &(0x7f0000adb000)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e602721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ef42eeb66c3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a0e1d0607f57f626a5b8d476636ef1ee76307524cf9ae49be4db0ab2c8ea0c5ebd1e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408cc4c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dff02ba9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669c24c206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb25c89074fcb1bba20c41bddd9ca5cd2f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2ebdfad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea09364ab42ee9802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c5912a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e218daa5a3ef64617beb30cccb31016b13ed8d7bcabb03e176b1c906a38cbda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe9bc88fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97184339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f400582bd95e5ad802050d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60be632697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20f4774d66c5ae0a0adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5b4967904daf833d91ae9461ef10036f8be7700d66f2d2c3a63dba8eb35e7127246029e222f0b2aebbe767f5125e2d9ea5d5987b9bb96f303e4f3c647c776c5b6306472896dcebe0de6d001b453a4e26dfe433b409586e0faca3ee89e8b936ea46b97a0f663544a8f4784c6b484334949f583b02557645c7d7884910eaf4879da3f4f37ce789b728a49d0546730e2adb0a9cb74620b0cf3a28061a607089a47a23e831c16dd002fc6ad4ebd7c62d265da40d6bfd145698d18d14522e19aa599cd9e412c4644dccb31849bd5e31411c6ff9249be50762cc6fdaa01a7cdcb162dc0516524002b688a462f69b6cce348a6dc5e9356ae3938909ea062f9501220214e83a4e621b8d685925c92c7564e9132cfe10f8acb646b731114ff101479f99d70a4bd6033bf5e4e6675120fa21d0610a685af21ba76162fa5cc571056b295b8f9987fdef14526be89516234dee2d93bf7ceba533af07bb7a6e9f1d5756f81a7558b5e029e662c5dfe00f657bd5a5165c6d44bd90f719342b7ac36eb8f10cdaeda44c079ecb31d324125ac848a27ba173ad35d1acd4e206387ecea474d6a70086d225448e247bfcd51ecae1f15dfe10acc50e7757cca9c5ef80562b63224c3259d6d1fc928264d356b8345ba03e10cd6970c0343ee98359dcb5920b83cb0aa034807f40050c6cf63543e107d85bfa82ce4f5e90f6078a743b0c7ccdd007c7c0115abfd5a9a52873b7b5da78a1ab7404016c5d00aabcfc3e16070b8222a99efebebf6042e6da1dbb3e782d831c0eb4f464b82abc0a8", 0x7d0, 0x0, &(0x7f0000809000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x1) recvmsg$kcm(r1, &(0x7f0000001380)={&(0x7f0000000040)=@sco, 0x8, &(0x7f0000000340)=[{&(0x7f0000000080)=""/89, 0x59}], 0x1, &(0x7f0000000380)=""/4096, 0x1000, 0xff}, 0x2120) recvmsg(r0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006315427d2c5a7e3905095e000000000000000000000000c8b673a1ea8b367ea07acc7c833231dd5c6e9dd66725343d53a2c293c9eecda6d8fc18885729cc820b1fccfa517f9b60b25bb5d63dc22aa3c6ae37ac896cf7e2cf0598a49d61783de5a379d9932268e5bd77901ebb395f8129d3ac23ee64f59ab65fe9ae9ff6fdd66520d2a06753c3786e5c0cf37b2beda6665f7e39065440091af57a235d6a14a8fcba44f8f4eba18bcddcac71c8ae623871"], 0x58, &(0x7f00000000c0)=[], 0x0, &(0x7f0000000100)=""/210, 0xd2}, 0x0) 2018/03/02 11:09:21 executing program 2: r0 = socket$inet(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000040)={@mcast2}, &(0x7f0000000080)=0x14) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = syz_open_dev$sndpcmp(&(0x7f0000000180)='/dev/snd/pcmC#D#p\x00', 0x1, 0x210000) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000001c0)=0x401, 0x4) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f00000000c0)=""/123, &(0x7f0000000140)=0x7b) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='gre0\x00', 0x10) dup2(r2, r1) 2018/03/02 11:09:21 executing program 6: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000001fe8)) chroot(&(0x7f0000000080)='./file0\x00') r0 = syz_open_procfs(0x0, &(0x7f0000000ff9)='ns/ipc\x00') setns(r0, 0x0) ioctl$sock_bt_cmtp_CMTPCONNDEL(r0, 0x400443c9, &(0x7f0000000040)={{0xc46, 0x7, 0x4, 0x5, 0x77, 0x800}, 0x2}) shutdown(r0, 0x1) 2018/03/02 11:09:21 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = getuid() getresuid(&(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300)=0x0) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x7, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff]) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000010c0)=@nat={'nat\x00', 0x19, 0x4, 0x478, [0x20000c40, 0x0, 0x0, 0x20000ee8, 0x20000f18], 0x0, &(0x7f000092cff0), &(0x7f0000000c40)=[{0x0, '\x00', 0x0, 0x3, 0x2, [{{{0x5, 0x20, 0x88ff, 'bond0\x00', 'ifb0\x00', 'dummy0\x00', 'ip6gre0\x00', @random="afdf25a5fd4b", [0x1, 0x0, 0x0, 0xff, 0xff], @random="89d01f145470", [0x0, 0x0, 0xff, 0x0, 0xff, 0xff], 0xe8, 0x110, 0x140, [@owner={'owner\x00', 0x14, {{r1, r2, r3, r4, 0x6, 0x4}}}, @ip={'ip\x00', 0x1c, {{@multicast1=0xe0000001, @remote={0xac, 0x14, 0x14, 0xbb}, 0xff000000, 0xffffff00, 0xfffffffffffffff8, 0x5c, 0x20, 0x35, 0x4e22, 0x4e20, 0x4e21, 0x4e22}}}]}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0x3}}}]}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffd}}}}, {{{0x9, 0x40, 0x9000, "65716bfff4000800", 'yam0\x00', 'syz_tun\x00', 'ip_vti0\x00', @random="97e02dc9beb3", [0xff, 0xff, 0xff, 0x0, 0xff], @empty, [0xff, 0x0, 0xff, 0xff], 0xd8, 0x108, 0x138, [@physdev={'physdev\x00', 0x44, {{'ifb0\x00', {}, 'bpq0\x00', {}, 0x0, 0xa}}}]}, [@arpreply={'arpreply\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffe}}}]}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x2, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x44, 0xe8bf, 'bcsh0\x00', 'ipddp0\x00', 'bridge0\x00', 'bcsf0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0, []}, []}, @arpreply={'arpreply\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0xff], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x4c8) 2018/03/02 11:09:21 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5f, 0x8000) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r0, 0x800443d2, &(0x7f0000000140)={0x5, &(0x7f0000000080)=[{}, {}, {}, {}, {}]}) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:21 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d5") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 111.770179] binder: send failed reply for transaction 472, target dead [ 111.776976] binder: send failed reply for transaction 474, target dead [ 111.789255] binder: undelivered TRANSACTION_ERROR: 29201 [ 111.794821] binder: undelivered TRANSACTION_ERROR: 29189 [ 111.814070] FAULT_INJECTION: forcing a failure. [ 111.814070] name failslab, interval 1, probability 0, space 0, times 0 [ 111.825369] CPU: 1 PID: 15744 Comm: syz-executor4 Not tainted 4.16.0-rc3+ #245 [ 111.830187] binder: 15738:15750 transaction failed 29189/-22, size 40-8 line 2848 [ 111.832726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 111.832731] Call Trace: [ 111.832750] dump_stack+0x194/0x24d [ 111.832770] ? arch_local_irq_restore+0x53/0x53 [ 111.832785] ? reacquire_held_locks+0x1f9/0x3e0 [ 111.832796] ? reacquire_held_locks+0x1f9/0x3e0 [ 111.832827] should_fail+0x8c0/0xa40 [ 111.855436] binder: undelivered TRANSACTION_ERROR: 29189 [ 111.855974] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 111.855990] ? trace_hardirqs_off+0x10/0x10 [ 111.855999] ? lock_downgrade+0x980/0x980 [ 111.856011] ? lock_downgrade+0x980/0x980 [ 111.856027] ? trace_hardirqs_off+0x10/0x10 [ 111.856038] ? lock_acquire+0x1d5/0x580 [ 111.904920] ? lock_acquire+0x1d5/0x580 [ 111.908887] ? find_held_lock+0x35/0x1d0 [ 111.912977] ? check_same_owner+0x320/0x320 [ 111.917288] ? rcu_note_context_switch+0x710/0x710 [ 111.922200] ? check_same_owner+0x320/0x320 [ 111.926519] should_failslab+0xec/0x120 [ 111.930477] kmem_cache_alloc_node_trace+0x5a/0x760 [ 111.935504] __get_vm_area_node+0xae/0x340 [ 111.939735] __vmalloc_node_range+0xa3/0x650 [ 111.944131] ? compat_do_replace+0x19f/0x7c0 [ 111.948548] vmalloc+0x45/0x50 [ 111.951725] ? compat_do_replace+0x19f/0x7c0 [ 111.956117] compat_do_replace+0x19f/0x7c0 [ 111.960347] ? do_ebt_set_ctl+0x110/0x110 [ 111.964520] ? ns_capable_common+0xcf/0x160 [ 111.968835] compat_do_ebt_set_ctl+0x22a/0x2d0 [ 111.973407] ? compat_do_replace+0x7c0/0x7c0 [ 111.977824] ? mutex_unlock+0xd/0x10 [ 111.981521] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 111.986791] compat_nf_setsockopt+0x88/0x130 [ 111.991182] ? compat_do_replace+0x7c0/0x7c0 [ 111.995581] compat_ip_setsockopt+0x8b/0xd0 [ 111.999890] inet_csk_compat_setsockopt+0x95/0x120 [ 112.004802] ? ip_setsockopt+0xa0/0xa0 [ 112.008680] compat_tcp_setsockopt+0x3d/0x70 [ 112.013082] compat_sock_common_setsockopt+0xb2/0x140 [ 112.018336] ? tcp_setsockopt+0xd0/0xd0 [ 112.022301] compat_SyS_setsockopt+0x17c/0x410 [ 112.026861] ? sock_common_setsockopt+0xd0/0xd0 [ 112.031519] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 112.036260] ? do_fast_syscall_32+0x156/0xf9f [ 112.040744] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 112.045574] do_fast_syscall_32+0x3ec/0xf9f [ 112.049892] ? do_int80_syscall_32+0x9c0/0x9c0 [ 112.054456] ? _raw_spin_unlock_irq+0x27/0x70 [ 112.058931] ? finish_task_switch+0x1c1/0x7e0 [ 112.063429] ? syscall_return_slowpath+0x2ac/0x550 [ 112.068353] ? prepare_exit_to_usermode+0x350/0x350 [ 112.073355] ? sysret32_from_system_call+0x5/0x3c [ 112.078192] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 112.083038] entry_SYSENTER_compat+0x70/0x7f [ 112.087425] RIP: 0023:0xf7f84c99 [ 112.090769] RSP: 002b:00000000f778009c EFLAGS: 00000286 ORIG_RAX: 000000000000016e [ 112.098465] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000000000 [ 112.105715] RDX: 0000000000000080 RSI: 000000002018c000 RDI: 0000000000000208 [ 112.112965] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 112.120212] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 112.127461] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 112.135056] syz-executor4: vmalloc: allocation failure: 256 bytes, mode:0x14000c0(GFP_KERNEL), nodemask=(null) [ 112.145234] syz-executor4 cpuset=/ mems_allowed=0 [ 112.150154] CPU: 1 PID: 15744 Comm: syz-executor4 Not tainted 4.16.0-rc3+ #245 [ 112.157508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 112.166861] Call Trace: [ 112.169448] dump_stack+0x194/0x24d [ 112.173084] ? arch_local_irq_restore+0x53/0x53 [ 112.173831] binder: 15748:15757 got transaction to invalid handle [ 112.177741] ? idr_get_free+0xfd0/0xfd0 [ 112.177755] ? rcu_pm_notify+0xc0/0xc0 [ 112.177782] warn_alloc+0x19a/0x2b0 [ 112.177802] ? zone_watermark_ok_safe+0x400/0x400 [ 112.177813] ? kmem_cache_alloc_node_trace+0x36f/0x760 [ 112.177845] ? __get_vm_area_node+0x234/0x340 [ 112.184082] binder: 15748:15757 transaction failed 29201/-22, size 0-0 line 2848 [ 112.188027] __vmalloc_node_range+0x4f0/0x650 [ 112.188055] vmalloc+0x45/0x50 [ 112.222833] binder: release 15748:15757 transaction 481 out, still active [ 112.225244] ? compat_do_replace+0x19f/0x7c0 [ 112.225257] compat_do_replace+0x19f/0x7c0 [ 112.225277] ? do_ebt_set_ctl+0x110/0x110 [ 112.225320] ? ns_capable_common+0xcf/0x160 [ 112.232237] binder: undelivered TRANSACTION_COMPLETE [ 112.236615] compat_do_ebt_set_ctl+0x22a/0x2d0 [ 112.236630] ? compat_do_replace+0x7c0/0x7c0 [ 112.236657] ? mutex_unlock+0xd/0x10 [ 112.240877] binder: undelivered TRANSACTION_ERROR: 29201 [ 112.244972] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 112.244990] compat_nf_setsockopt+0x88/0x130 [ 112.244999] ? compat_do_replace+0x7c0/0x7c0 [ 112.249321] binder: send failed reply for transaction 481, target dead [ 112.254383] compat_ip_setsockopt+0x8b/0xd0 [ 112.254399] inet_csk_compat_setsockopt+0x95/0x120 [ 112.302262] ? ip_setsockopt+0xa0/0xa0 [ 112.306136] compat_tcp_setsockopt+0x3d/0x70 [ 112.310528] compat_sock_common_setsockopt+0xb2/0x140 [ 112.315693] ? tcp_setsockopt+0xd0/0xd0 [ 112.319650] compat_SyS_setsockopt+0x17c/0x410 [ 112.324206] ? sock_common_setsockopt+0xd0/0xd0 [ 112.328855] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 112.333594] ? do_fast_syscall_32+0x156/0xf9f [ 112.338071] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 112.342803] do_fast_syscall_32+0x3ec/0xf9f [ 112.347108] ? do_int80_syscall_32+0x9c0/0x9c0 [ 112.351667] ? _raw_spin_unlock_irq+0x27/0x70 [ 112.356141] ? finish_task_switch+0x1c1/0x7e0 [ 112.360621] ? syscall_return_slowpath+0x2ac/0x550 [ 112.365528] ? prepare_exit_to_usermode+0x350/0x350 [ 112.370523] ? sysret32_from_system_call+0x5/0x3c [ 112.375350] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 112.380174] entry_SYSENTER_compat+0x70/0x7f [ 112.384556] RIP: 0023:0xf7f84c99 [ 112.387894] RSP: 002b:00000000f778009c EFLAGS: 00000286 ORIG_RAX: 000000000000016e [ 112.395582] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000000000 [ 112.402826] RDX: 0000000000000080 RSI: 000000002018c000 RDI: 0000000000000208 [ 112.410077] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 112.417324] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 112.424569] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 112.431890] Mem-Info: [ 112.434331] active_anon:84372 inactive_anon:63 isolated_anon:0 [ 112.434331] active_file:3550 inactive_file:8560 isolated_file:0 [ 112.434331] unevictable:0 dirty:78 writeback:0 unstable:0 [ 112.434331] slab_reclaimable:9945 slab_unreclaimable:84782 [ 112.434331] mapped:23927 shmem:83 pagetables:693 bounce:0 [ 112.434331] free:1409641 free_pcp:450 free_cma:0 [ 112.468078] Node 0 active_anon:325024kB inactive_anon:252kB active_file:14200kB inactive_file:34240kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:95608kB dirty:312kB writeback:0kB shmem:332kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 143360kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 112.496116] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 112.522258] lowmem_reserve[]: 0 2864 6373 6373 [ 112.526892] Node 0 DMA32 free:2934448kB min:30292kB low:37864kB high:45436kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129292kB managed:2935320kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:872kB local_pcp:816kB free_cma:0kB [ 112.554597] lowmem_reserve[]: 0 0 3509 3509 [ 112.558944] Node 0 Normal free:2701236kB min:37120kB low:46400kB high:55680kB active_anon:325024kB inactive_anon:252kB active_file:14200kB inactive_file:34240kB unevictable:0kB writepending:312kB present:4718592kB managed:3593748kB mlocked:0kB kernel_stack:4448kB pagetables:2624kB bounce:0kB free_pcp:952kB local_pcp:316kB free_cma:0kB [ 112.588738] lowmem_reserve[]: 0 0 0 0 [ 112.592581] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 112.606177] Node 0 DMA32: 4*4kB (UM) 2*8kB (M) 1*16kB (M) 2*32kB (M) 1*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 2*2048kB (UM) 714*4096kB (M) = 2934448kB 2018/03/02 11:09:22 executing program 2: futex(&(0x7f00000005c0), 0x4, 0x0, &(0x7f0000000640), &(0x7f0000000680), 0xbd2) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xfffffffffffffffe, 0x200201) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000040)=0x1) socket$inet(0x2, 0xe, 0x2) 2018/03/02 11:09:22 executing program 6: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x2}, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) 2018/03/02 11:09:22 executing program 3: r0 = add_key(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000140)="83f410272a5ba188a02e98921a416953bcae1b85bcbca4c344ccb6a6cd141e3ef0f6e74f71864dc2642130acb41070567e23a1c5560f47f7ea029ea4d0f112c6aba561cb6327b9d518df2da893d0a3dc9f0790fde2ae74b69defddb79039000297f7bf699be1df1e5f1868fe4e677dc1b1528a94fd71aad3ec1631f477b03d84946d0adf2bcef8da83f31d0cc4f31c2f1c6c006a1476e66e1d9ce3a44436c8dc79081c175c664beedc951a3cf267ca3cf5f2dcfe92ce0764a64bd0a6b7ca9e716af89eaabad9712a4e179d04cedf479f6595c7dfcd09f24b106db688b1e510a54564d74c4828c5e0eb65376c7c3c04f620e2fdd0b6eaa88e572f0fa1dc267dfc03a69e23978137bf7b9750119fd75fd972319b9a7497b973800a051cb1efe2ce89eb4026c51a22a43660ae7e9700509396286c7ea70cfe540fcf573bd2395828d9cd95197ad9ee4adc5b9965876b952a63ab0c1519c9847aae8d1e5f87da28177b2c09a1df5aca778560ee5aafb05ee44e28f1fcb2b5589a2a113ad14e6060ec8d5fd953411e1d05181869a104e523ae6c3ebe60a0c05b40fcfd7183965f0fb0993df22064a3cade70590945a25520513d408bfaec0f1bbd2bac0f5e5205f87282d0be4707650f0d0b95cde67b5879522e055991d43a09deb60abcd8801cadb700f04621b59ac0c4aded483d4e4950d89d750aaf4553ab9cbe7ef21bdaa5858f53dac4ab36e2fec6a98c17da58ca6a57e2fcaa98355d00ceec940ae937e2b41f12b6ca5bb504ce18e0ef517517810b97694870f03509015ad801930e0793f3a53efffbd5cceb8823e8b50702795a306d320c309203f5249bc568cb4d369d95181f73d33771ba5125a9471f39a0f02de5c597b2c65e831e0f433c07bb6fceee4edb357763820077bcbc5bbdefe1bfb7df0f2f24306388160807b7bd3a9217abce53ce0a22875996742029a50554393baeb82a3bd5ced85968ce4d11997fa258b849fda926dbcb2d7ad693ab5dc5d0c6aac40d64bbb9b239fc233d8a4496b8dd0ec039e48460cd158cd2d41781cb9c4cc923015b5a989b09de6190918c741625cae0ba8d671691428832d9bbe582a5e27a822fd956793d46a5117a32cea4f63cd44f81a76471a7884fe68998d9c97f821ab5da969865a850de869678025b282650fb4195b919faeaedbf106e104a0c8a13883cd0b1bf7479df53f856e428f6563413d130c8133ab59f3316796b249576084aba0e48ce2a2ed230af63d12883bfb6d005bd77e08128556ff2bb9fbcbf62857748b41e708054868c149690283ae790ada4489e0a51d3f364a11c44a527420f7a60e323eb0cd445013e882cdf7d50b7dbc1cc1a2f9850dfc9bca8c04add87a6e03af95cdb3466578c1065f9bd26bc54099d61a6dad6b751148dde8f29ba674a4d7f998545bb0e118a4457aee0db4de6061621bffe627a79376ad534e29468630a6bb57976324e6e3441370eea7b18654a4076e0bc894b523bde60ad261e496bdaa8127c9f7b863f5aa26119f67636820bfcfc4b32256dfdccced4c64bab01c4c605f1db0dc497a86cb22b48b5cf9bddee4ce80693be3a236b6ad2afae934d3930be6966251409a1333effb14ed9b589be1515c44d9d430ec281257b52341b29ff41f5f381e2dc00570300c333af65a085721d800af8a43d3b94160feb58a7199dde374b942eed985b2fef52e13a4061824e9754dd3d327e8c2178291d0d62164e8d882b9d4ea7931cd078178f392c62dc589e7c5c52f123b34aff46b87505cc832ecec42ff0debe08d2c771a6d488bb1857a221dedb302f3a2f49ace71c89051041ebef9857ca48c7480454d73a4db161b4929145a3ad2501e09efddeb026dc72affb2f93f5856e90c522f766042d09a4bf2c734ab408581371232db6423f5a83665694e73b03cf8d5e5b48dc7175e17e546d086c4f4dc9822797aeee984a1d0dc8a36244da634c9d9e3877a5eb679cbad722db0ead64ef2acc17c830d0f46a6354ad7a6c9d7cc9a53a8480a47984166a95fa0eee6bd09b10c5134bcfbdc3eddd5624ddf584d8f73592783f06428cbbebcea64a8649cd21aed59b14e858428b1b9097667f0b10632df0f2a1adddc4331b0c0468acc6a31786d77035d7f1bfa3aa91760ffdb0d97d3749da27809f06b271ccccd81603e4426025166c98e8e4031bfc7b8e2eb320326dc35c292938d464c6dd5c1b88e83793056f094e325ee02dec5b106ec5acfb393567d95c239b05307ad456d5064a479afc6e544cb1cd4e7a893e44722f58c6929c6b1f040803294671a52655f661b53b3962923ddd45d5804d33cde33abbbd820ab936822906fd955d84a95feb902c9e2afe4c5f95ee564244cd54c15695ecbe918be50d3e6752ff665fa0e09fda9a48987900d02ba53e4b1c5b7008d385133c4e3c0ec91b6b9bb13ac55db79c2fa74462084127d2537bbd795535cb5e8fea015fae86e9ed9de101a03054e404c31ad2e4526b45d5c806c3741000854b88c6fa1a869aa3e43c924416c8118108a1ee14114e58c58028b9a390a8186106049c3f724f78f8a7d9496652b25158cb6031ad53e6ed7a368b4e23f24e08f9692f7c53647e8699885fc1bd858ad76cc1b6cfae8335ae91d12967895e489985c6e409506cc3e0fb213a8867d22b5f234d5f8701c2e6170720920839885c94beacc1aa7c843db769772af63634e0c41387e7e0bf62a8b7153250e3704559b43c5571febc644df5b264c2f8fa0171409e765eed0030b5b99b507ec2d666bdf3871ca3a928a6f3c1dd41a187bc9f8963dd57204e9564e5eafd616589a879dd27a191007b45e29b7fe7133af036959c314379c27f15cd7676b7b9e20845564eabc182808cbf0c69d210be5adf71586e1eeef01b24d7c02ed26a60a82a6f9b3aa60605e09924a78a8d5e070de4a57236f29eaad4254b140d636050ea6465f7e919d064dcc35e9d45879b58fabe6a2ff6b7b4c00d47022bd4b35e8a47036b4efc9ad51d9a3307f85e5c2e31d7dcd9552b21af89aa266975833079e4053da4634db98dd66e91f5c51e0f4140f5f7cf17e4771ca6e454b0eb8e8ce9c85857e291454e8abf832116273b04dbb038805e449b2eba869c0bfa2bb999a680b23d823945e36ff63df18a6c50b9c19f79c4337c8c12eae9d1dfe38a39319e221722d4f06d6d9e9915a3594f9b6714035efbe72d223d1231be9fa6442efb15d6697c3503e95d88d8658111a0b384b51e0ce26ea4f62f4b9c1dc825390d39feb5fca5fbcdc977f17404587214cef7edd6fc5a6434f8f24236ad24fb2ce8b260b283ca5dfaa702512e95d584f99bf651fe31eb05964cce1d947eaea8b1098b5c645ebe337a307c033c86086189c677989a1c8c1934607da2770baf45555024dd57ea7b6d816e8c27b325e999b9ee7cd8522e6c8f57b4a685ee071be5dbb39945cc8f18e91e1fdee14c2337b92e722714488916dd6d69b210408f32a44bd5cdd60518c1dea7de21f49e90ec78be0cb4bbe1091a10ad996831cf7e3eb3708457da53a7b34c8f104bbfab944e632142a3a9c9194d57b4b581f5857ad5050107b09a64e7cf4040e15e9284307b03f33ae15fd8ce647da74387d4e7c666b1c65a4ed433e1e3482b987e4bee46456f18faea7ba03cb9458530a7ce12c39abd58fecb595360a5d3415c9a8442b2f20697accfc59aa3b95ff92ceb7b14adaaa2fb7052b03306764254410e509d203eba12831949b743d017a1991f6d1e605ec8905b30d840c58c2754da668282102f57cfe3af2cea3b8feda3730c36fbd870fea61c4eccc2b793647970850b61b265b92b624ef1408bf948e0d5d39eef9325638ee1d0b25c4bf564da073ecfaa74962a03a803feade1f11709c88daa9ec5f962fcee8599c01eae7d5d67273ea0607303d27fc598d04b76ca31072df2a3004439f1ae2b6b0221fbdf9c033f4078a790fc4106e360d3e44614db6f9be52f902ba7bc8de0611216509dc38bb37e11d851d301801bed4df8145fd53e83681dcd2ad0a84a990d92c211aab3f3cf40e4b51dea59c013cfb84e47d2f67e6ecb42e258373592c2a52e17d8bc4957b4c4e195bf4b557f2571bd15751b39838cab6e664577c84b82cf465c3f9de0198b937277d37397884807d59a29c11f461d9d30a70c5c40814362afb4988a95a6c53bcbd15d6a999d6e4dfeaebd29b1478e198a105b16c2b6bfb250febe74785cd81025f7f5ae2906796bcfe86529c458aab5db5ab9ec7a27855be9294e728595f041cf885eb35078c6d7c72dae053104ed1545bb464fb76bc59227e83495e90fe97915dbba72ac19c274f518fe69484e1380d0aa4cdcd10edde87994c2eef2fd633a751b08eab37148c26b2c26fe362bbc82fc508cc158595b6f950044a47020fd2ffc6c314b124bf36327df19c65f34e855bababb1ef1095b77b7878f88b35511f3fcbee54c7116f19a7492957f00d02c9c8a484785a5a4535952a05ea1b4b7cf7bf1b4d55e72b3c6220cffa2c4ce87e79d570c352b7163e19b677a6e6b1db9ca604f22aea4090f46de05681492b78121d9e9767458daec4da25475f0116bbf982c3ac8cb6d9adcff76f62015600e97c9f77084c0850a5adeb9305b0fb9042bda2cc60ab188cf2a546f967917f2e692ccec1a3f8705d09f44898e5b912776b7104fc8ab7571b2055c061e2130146bbdadd80d3b3e48537dcb1ec0ea7dd971861ebef467d44f84d50d8ac96aabccb67fa702ff6f7e04d8380b09e019a983665d6a5ce370545e411df12bba0ccb75ac9e12a12f41a523f93eb7f68423beb5c99f7560fc4bb7fc25d56a2e5cfe9b6bf74f3b40832865a2d9527804b0c530580bb44f3e75dc1b4906c192a051670033df3820ed481b847ea90cc058e41da955b89dc8cc5374f68eeb853399eaae4c65e98c850d42a85ae336cbb574f5dd255dea6c45036fa8c1cad7005d0ab7c9912a94f76b0692804093b91cab45d335bdf679992b3b6f43f7570d5261b3545a1c2fff22c80ad4d367f10a138c03242f04ac98abcd98bd77a921a23eed43374b85426e04d09a5f23c2372772b8ad04dd96a97143cdd2d002e9684ecce99a07251441311b3cf919ad534f770a31f7b418dd3062a6c1768b5e22cf7d9f10d2368f1fdb885473b01829bf0bc907b01913efa1b4859617287de9b3523cbcb2ac0e838c0704dd20450a4827880b02bde3c21fec8d685a89b05c8b1219142214e330d7c46784c7364b8e019d73a2613027a1960b7154dd671d597a6797c99d6fe838fee30989a0f282860e93e89847fcea21793700bafb7f82cb28f4cbfa28662a078a5d262e1608d04bb62e666e2b59afab166a45e164725cba68dfb2467f3fb74575fa8b7e61378248a56f68bbefeec82ec2c539e9ca82182d8277700150f1916c38c2bb2dba85b60e31d0840defe041b8285df00207300b632a915c1427e8afcd1a3ea4413b3b3d569088f4c22d8619f616df196c0c480204ca362279cb7ac770cb0bc4c22e93dbb61363f26ec2299f2ec8b6959298a33b5b8d9b7211260dcf3b44030c71326e2563bc3207cf07db72968c5cfe8e229b14acdf97ac5e188d874e6eeba20d0f5d8920da90eb521f2cf4fdda5b2bc5ee241abce25fdf91948ceb346c0cb80f677e965eff9d60d58093f30bf7b4ada9fe00eecd3d0bb9bd027559e8bce52e50f63b02aa31cace1d722c17f038e268da7d557dac67ff342701ccab16ac4a4a7e0251bb783fe688bf07d824d5efcbb229462e8bf73f345bedee88d9777a27af", 0x1000, 0xfffffffffffffff8) keyctl$describe(0x6, r0, &(0x7f0000001140)=""/193, 0xc1) mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10470}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffd) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000013c0)=0x0) perf_event_open(&(0x7f0000001340)={0x4, 0x78, 0x2c, 0x3, 0x7, 0xffffffffb8eaaa32, 0x0, 0x3, 0x10, 0xa, 0x80000001, 0x9, 0x200, 0x3ff, 0x1, 0x100000000, 0x401, 0x100000000, 0x3, 0x5, 0x0, 0x3, 0xd3d, 0x80, 0x100000001, 0x4a4d, 0x7ff, 0x1, 0x101, 0x3, 0x0, 0x40, 0x7, 0x7c31, 0x5e, 0x7, 0x7dc, 0x5, 0x0, 0x101, 0x2, @perf_bp={&(0x7f0000001300), 0x1}, 0x8000, 0x1, 0xfffffffffffffb56, 0x3, 0x10001, 0x100000001, 0x5}, r3, 0x200, r1, 0x4) keyctl$invalidate(0x15, r2) mbind(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8003, &(0x7f00000012c0)=0x2, 0x8, 0x6) r4 = syz_open_procfs(0x0, &(0x7f0000001240)='ns/pid\x00') bpf$MAP_CREATE(0x0, &(0x7f0000001280)={0xb, 0x2a, 0x100000001, 0x3, 0x4, r4, 0x1}, 0x2c) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0x5, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcfffffff8d30000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d5") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:22 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x355, 0x4000) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r0, &(0x7f0000000140)="7b29d1f07cb34d081d645ed53ff0a7916e382900acf930c9e3fa02dcbed1213526459fe98dc01fce9a8b2626ffe53dd4d3f1b4de0964a631d08418aad4ffc647f35c73f8d6b87656ce7433bcd77f898e30c52d9935da6359c562015dd47755e06faa51883e3f610ca86b1842d2d905cb3d82534b16020d0e49988775fa3338bf290306f3", &(0x7f0000000200)=""/81}, 0x18) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) syz_fuse_mount(&(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 2018/03/02 11:09:22 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) fcntl$addseals(r0, 0x409, 0xe) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) getgroups(0x4, &(0x7f00000000c0)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff]) fchown(r1, r2, r3) 2018/03/02 11:09:22 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) unlinkat(r1, &(0x7f0000000040)='./file0\x00', 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 112.621896] Node 0 Normal: 774*4kB (UME) 161*8kB (UME) 164*16kB (UME) 514*32kB (UME) 127*64kB (UM) 86*128kB (UME) 51*256kB (UM) 27*512kB (UM) 38*1024kB (UM) 12*2048kB (UM) 627*4096kB (UM) = 2701152kB [ 112.639841] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 112.648429] 12192 total pagecache pages [ 112.652411] 0 pages in swap cache [ 112.655869] Swap cache stats: add 0, delete 0, find 0/0 [ 112.661234] Free swap = 0kB [ 112.664250] Total swap = 0kB [ 112.667268] 1965969 pages RAM [ 112.670371] 0 pages HighMem/MovableOnly [ 112.674347] 329725 pages reserved 2018/03/02 11:09:22 executing program 6: r0 = socket$can_raw(0x1d, 0x3, 0x1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x10080, 0x0) mmap(&(0x7f0000bff000/0x400000)=nil, 0x400000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r0, 0x65, 0x1, &(0x7f0000cbc000)=""/244, &(0x7f0000001000)=0x33b) 2018/03/02 11:09:22 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/checkreqprot\x00', 0xc000, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000280)=@buf={0x59, &(0x7f0000000200)="dcd292ecc6833c71ed9960388557d730c51f441e119b58c0cc58eb94aee1c5f7e54adcf0ce863e170bbe965fd8d36828f6ddaae254490842d1e21575207c00a868f3d2f3626a3ee3f019ca7a27bd75479811232bfd24b5f93b"}) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0x10) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x440100, 0x0) r3 = socket(0x1e, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) poll(&(0x7f0000000040)=[{r3}], 0x3e0, 0x7f) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000000)={'eql\x00', @ifru_addrs={0x2, 0x4e23, @multicast1=0xe0000001}}) writev(r3, &(0x7f0000000080)=[{&(0x7f0000000100)='T', 0x1}], 0x1) [ 112.712914] kernel msg: ebtables bug: please report to author: nentries does not equal the nr of entries in the chain [ 112.718556] binder: 15772:15781 got transaction to invalid handle [ 112.730131] binder: 15772:15781 transaction failed 29201/-22, size 0-0 line 2848 [ 112.734049] kernel msg: ebtables bug: please report to author: nentries does not equal the nr of entries in the chain 2018/03/02 11:09:22 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:22 executing program 5: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000001080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000010c0)='syz_tun\x00', 0x10) perf_event_open(&(0x7f000025c000)={0x80000000002, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) connect$rds(r0, &(0x7f0000001140)={0x2, 0x4e23, @multicast2=0xe0000002}, 0x10) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r1, 0x20000003) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000012c0)={0x0, 0x5}, &(0x7f0000001300)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001340)={r2, 0x3f, 0x27a00000000000, 0x6}, &(0x7f0000001380)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000013c0)={r3, 0x9}, 0xc) ioctl$int_in(r1, 0x5452, &(0x7f0000568ff8)=0x8f3d) r4 = socket$inet6(0xa, 0x6, 0x0) bind$netlink(r0, &(0x7f0000001100)={0x10, 0x0, 0x25dfdbfd, 0x50}, 0xc) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) ptrace$getregs(0xe, r5, 0x7ff, &(0x7f0000000080)=""/4096) connect$inet6(r4, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) close(r1) getsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000001180)=@assoc_value={0x0, 0x6}, &(0x7f00000011c0)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000001200)={r6, 0x2, 0x7, 0x8, 0xd7cb, 0x7}, &(0x7f0000001240)=0x14) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000001280)={0x2}, 0x1) 2018/03/02 11:09:22 executing program 0: socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x9, 0x7, 0x8, 0x5f03, 0x9}, &(0x7f0000000100)=0xa0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000140)={r1, 0x6}, &(0x7f0000000180)=0x8) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000400)=@nat={'nat\x00', 0x19, 0x2, 0x1b9, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f0000000200), &(0x7f0000000240)=ANY=[@ANYBLOB="00009940e0f9cf12ad2f00000000000000000000000000000000fdffffff0000000000000000000000000000000000000000000000000000000000000000000000006200000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006e72300000000000000000000000000074756e6c300000000000000000002000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e61740000000000000000000000000000000000000000000000000000000053df3d196bf45e60072b6a245a0c000000c9c37ee3085f0000fdffffff000000000000000000000000000000000000000000000000000000000000f9bfa3d3ba8ff6603701000000d3f24a92f29d7534c19a020b032bfa207200b535491dc3f02ee183191d3985929409f453eff3d5a22f9b35233cabba48b4688fb55426bdfc09c2131806fcfa"]}, 0x209) 2018/03/02 11:09:22 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffe) r1 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x4, 0x2) ioctl$VT_ACTIVATE(r1, 0x5606, 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={r0, 0x6, 0x1, 0x3ff, &(0x7f0000000200)=[0x0, 0x0], 0x2}, 0x20) io_destroy(0x0) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="8000000000008000acd91a4caf169e8486ece3b1557c5c97db484d1d18d48fda19f73852fb659499759bcfefc1eaf898c3c57a61e21bcccd57d1d5346ee8bce249a8c4e0ad3a3b7dfa55222f6fa725d02bfd524eda7400e96896aa9b73cc4cea7d53336e7ffddaedbeeb62127b1dd29202497572851455f1abe98fba55b4961754832ba39f8939157385a06f6a8dc12e3927125d03117bb2e139b89d34ecf4e992e238d96c66e3aff5424a58fd84701f8cd6368644bc5c9b464e2a96397681dcc9d6f722599958e463fb6c7a5bbf7ba0adfab6ec9f25b3b867a2dd7592017294bc8b13b5c6836f96e77cffa82e3232060cfa83c4d2d0f615fc414aefb418f64c1ffc7e12f1149d7b9cfe2bac535a76ffb24918a41c96208e4d627f4e33afa331147de6d8728a526aa7084c20144304b5c897334d60669eef94f4f4189b14ff15709548056e9c7654fbb9d89139c38b5c61879531ead7ad305fefb087e3442369ec66a004c81ed4b4"]], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000d09fe9)='smaps\x00') mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x3, 0x4d031, r0, 0x0) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000040)=""/249) pread64(r0, &(0x7f0000000000)=""/8, 0x8, 0x100000) [ 112.774877] binder: release 15775:15783 transaction 489 out, still active [ 112.781950] binder: unexpected work type, 4, not freed [ 112.787280] binder: undelivered TRANSACTION_COMPLETE [ 112.798416] binder: release 15775:15783 transaction 486 out, still active [ 112.805433] binder: unexpected work type, 4, not freed [ 112.810759] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000974fee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000000)=""/158) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f000028fff4)={0xfffffffffffffffe, 0x0, &(0x7f0000a5b000)}) [ 112.830515] binder: release 15772:15781 transaction 484 out, still active [ 112.837561] binder: undelivered TRANSACTION_COMPLETE [ 112.842724] binder: undelivered TRANSACTION_ERROR: 29201 [ 112.848248] binder: send failed reply for transaction 484, target dead [ 112.854969] binder: send failed reply for transaction 486, target dead [ 112.854978] binder: send failed reply for transaction 489, target dead [ 112.868694] binder: 15793:15803 got transaction to invalid handle [ 112.868734] binder: 15793:15803 transaction failed 29201/-22, size 0-0 line 2848 [ 112.890455] binder: 15796:15810 got transaction with invalid offset (36028797018964096, min 0 max 40) or object. [ 112.890491] binder: 15796:15810 transaction failed 29201/-22, size 40-8 line 3026 [ 112.905198] binder: release 15793:15803 transaction 493 out, still active [ 112.905205] binder: undelivered TRANSACTION_COMPLETE [ 112.905214] binder: undelivered TRANSACTION_ERROR: 29201 [ 112.905236] binder: send failed reply for transaction 493, target dead [ 112.946174] binder: 15796:15816 transaction failed 29189/-22, size 40-8 line 2848 [ 112.981997] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:22 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00002ac000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c97ff8)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) close(r0) socket$packet(0x11, 0x3, 0x300) getrlimit(0xd, &(0x7f0000000080)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000b04000)={0x0, 0x0, &(0x7f0000ae5f44)=""/188, &(0x7f0000034000)=""/95, &(0x7f0000ce1f30)=""/208}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000ee1000)={0x0, 0x0, []}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000d7c000)={0x0, r1}) poll(&(0x7f0000000000)=[{}, {}, {r1}], 0x3, 0xfffffffffffffffd) sendto$inet6(r1, &(0x7f0000000100), 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x4e20, 0x4, @loopback={0x0, 0x1}, 0xfff}, 0x1c) 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:22 executing program 6: mmap(&(0x7f0000000000/0xf9a000)=nil, 0xf9a000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) socketpair(0x13, 0x4, 0x7, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x7) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@decrefs={0x40046307, 0x1}, @transaction={0x40406300, {0x2, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x38, 0x38, &(0x7f00000000c0)=[@fda={0x66646185, 0x1, 0x0, 0x1d}, @fd={0x66642a85, 0x0, r1}], &(0x7f0000000100)=[0x40, 0x48, 0x0, 0x48, 0x40, 0x38, 0x38]}}], 0x6f, 0x0, &(0x7f00000001c0)="70c90c0272addaad270d3f0d4c863f30499209f6dbe9391079c262e18fef7720df92a8de7d7a9fc1ae56dd2a7146b7643354501221cba5719e889ba820137e3145a20bb231b4c288ad51e40e63366ced87c84627e97d6cf5f4ff819c7a57c69e71c7d21d71243dfd0ae8027647d604"}) 2018/03/02 11:09:22 executing program 3: openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000001900)='./file0\x00', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) pipe2(&(0x7f0000001c80)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000001cc0), 0x8) eventfd2(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) syz_fuse_mount(&(0x7f0000002600)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000002a80), 0x8, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) epoll_create(0x9) socket$inet_tcp(0x2, 0x1, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat(r0, &(0x7f0000000000)='./file0/file0\x00', 0x0, 0x40) epoll_create(0x6) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000003b40)) memfd_create(&(0x7f0000003b80)='&!ppp1eth0selfsystembdev\x00', 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x4002, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000003ec0)='/dev/loop-control\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000003f00)='/dev/hwrng\x00', 0x0, 0x0) inotify_init1(0x0) pipe2(&(0x7f0000004000), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) 2018/03/02 11:09:22 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0x4004000000000003) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in6=@loopback={0x0, 0x1}, 0x4e20, 0x0, 0x4e20, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14}, 0x0, 0x2b}, 0x0, @in=@broadcast=0xffffffff, 0x0, 0x0, 0x0, 0x90}}, 0xe8) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @empty}, 0x1c) 2018/03/02 11:09:22 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x801, 0x0) ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000040)=""/215) lsetxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@random={'user.', 'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, &(0x7f00000001c0)='\x00', 0x1, 0x3) 2018/03/02 11:09:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) times(&(0x7f0000000040)) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0xb, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 112.987532] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:22 executing program 2: r0 = syz_fuse_mount(&(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x9206be039cae52e5) dup3(r0, r0, 0x80000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x408000, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f00000000c0)=""/131) 2018/03/02 11:09:22 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000051cff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000943ffc)=0xa35) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000ccb000)) ioctl$sock_ipx_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000140)={"9863c534a8a7ac074a27dacb184d0a38", {0x4, 0x0, 0x0, "2371c78586c7"}}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_UNIQUE(r1, 0xc0086401, &(0x7f0000000040)={0x72, &(0x7f00000000c0)=""/114}) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000300)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x11, 0x0, 0xfffffffffffffffd, 'nr0\x00', 'bcsh0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x210840) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000040), &(0x7f0000000200)=0x6) 2018/03/02 11:09:22 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000000000000000006000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000ffffffe40000000000000000000000000000000000000000ffffffff000b0000000000000000003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000004000000008006e723000000000eb0000000000000180c2000000000000000000ff00ffffffff000000000000000070000000c8000000f8000000436c4c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000756000000000000000000000000000000000000c"]}, 0x1e2) [ 113.023058] binder: 15817:15829 got new transaction with bad transaction stack, transaction 499 has target 15817:0 [ 113.033733] binder: 15817:15829 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:22 executing program 0: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x80, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000200)={'filter\x00'}, &(0x7f0000000040)=0x50) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000000000000000517d6f49b162030000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee308"]}, 0x1b0) 2018/03/02 11:09:22 executing program 2: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x201, 0x0) setsockopt$inet6_int(r0, 0x29, 0xdb, &(0x7f0000000040)=0xf7, 0x4) prctl$intptr(0x33, 0x4) 2018/03/02 11:09:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r0, 0x40bc5311, &(0x7f0000000080)={0x2, 0x2, 'client0\x00', 0x3f9a363531f10ae, "b0563a10270e26a6", "77caa22e71b9adbde46fb19fb9b9999d8c7dbd9b1352cd35723b0cc2d9e48956", 0x3, 0x1ff}) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d538") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) [ 113.078069] binder: release 15823:15831 transaction 503 out, still active [ 113.085129] binder: unexpected work type, 4, not freed [ 113.090474] binder: undelivered TRANSACTION_COMPLETE [ 113.103873] kernel msg: ebtables bug: please report to author: Wrong len argument [ 113.123088] binder: release 15823:15831 transaction 498 out, still active [ 113.130235] binder: unexpected work type, 4, not freed [ 113.135572] binder: undelivered TRANSACTION_COMPLETE [ 113.136347] binder: BINDER_SET_CONTEXT_MGR already set [ 113.146182] binder_alloc: 15817: binder_alloc_buf, no vma [ 113.151469] binder: 15856:15859 ioctl 40046207 0 returned -16 [ 113.151888] binder: 15852:15855 transaction failed 29189/-3, size 40-8 line 2963 [ 113.164805] binder_alloc: 15817: binder_alloc_buf, no vma [ 113.170837] binder: 15856:15860 transaction failed 29189/-3, size 40-0 line 2963 [ 113.176804] binder: release 15817:15829 transaction 499 out, still active [ 113.185398] binder: undelivered TRANSACTION_COMPLETE [ 113.187101] binder: 15856:15859 got transaction to invalid handle [ 113.190542] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.190589] binder: send failed reply for transaction 499, target dead [ 113.190600] binder: send failed reply for transaction 498, target dead [ 113.196852] binder: 15856:15859 transaction failed 29201/-22, size 0-0 line 2848 2018/03/02 11:09:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x1, &(0x7f0000000040)) io_setup(0x10001, &(0x7f0000000080)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="c5b075d122386c90", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) syz_emit_ethernet(0x27, &(0x7f00000000c0)={@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@generic={0x9100, "896829350d60aff4036ffadf758d340e4228d4bf69c337df11"}}}, &(0x7f0000000100)={0x0, 0x2, [0x7ba, 0x9e9, 0x85c, 0x3a4]}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) r3 = accept4(0xffffffffffffff9c, &(0x7f0000000500)=@pptp={0x0, 0x0, {0x0, @empty}}, &(0x7f0000000540)=0x20, 0x80000) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000580)=@assoc_value={0x0, 0x6}, &(0x7f00000005c0)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000000600)={r4, @in={{0x2, 0x4e23, @empty}}}, 0x8c) migrate_pages(r2, 0x92fe, &(0x7f00000001c0)=0xfffffffffffffffb, &(0x7f0000000200)=0x6) 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d538") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:22 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f000000b740)=[{{&(0x7f0000007700)=@can, 0x10, &(0x7f0000009980)=[], 0x0, &(0x7f00000099c0)=""/255, 0xff}}], 0x1, 0x0, 0x0) recvmsg(r0, &(0x7f0000000140)={&(0x7f0000000000)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}}}, 0x32, &(0x7f0000000080)=[], 0x0, &(0x7f00000000c0)=""/127, 0x7f}, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x53b4, 0x10000) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) sendto$inet6(r0, &(0x7f0000419000), 0x0, 0x0, &(0x7f0000253fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/03/02 11:09:22 executing program 5: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) add_key$user(&(0x7f0000c24ffb)='user\x00', &(0x7f00003ebffb)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000d6c000)="0000000000000001e3a255ec4a8d9d652d0536c67b9695cfb4c29da627ab9e5e0587e50ec159997396abc344a7d9f563a3e3af2d90a5dfcade859e4717cdf8f03fdf022186424d68996f51a7b3f20108f152bfd57ac5a50be84a106249d0216d5c98c41df97cd7d5032e9c632e4715a226907aabbfc5b3f2e96bf3039474801053b87fbf8674e10076be0bb4ae6947fd", 0x90, r1) r2 = add_key$user(&(0x7f0000ef5000)='user\x00', &(0x7f00008fa000)={0x73, 0x79, 0x7a}, &(0x7f0000537ffd)="000386", 0x3, r1) r3 = add_key$user(&(0x7f0000688000)='user\x00', &(0x7f00008d9ffb)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000f19edc)="b33ab76079ebe0d14f729cd653e520d29ad7ef0000000000000044c249b544230b9387fb8bd6ed266ccf59ef70995bf2e8e0ecd3fff32853747eda22d2818d08ca27e0ec821620e365a0e6b9485f2d925493f62113e33e5f8c7eba67fc19a9497f5b07e5849d2e875b066cd6401d36616fe0f3c3002801b4627ee7597689525e8e81f750a86eb580fb4690ea52246bd3d32b1a91f944edb74b1f50ae08c5387ed8fd0598b600579f3af3f864e1c324f6928f6672f98f7e149bd61bd78b506e8bd69b02620d72ea326556ce5ce1c0c75d96ac0000000000000007480192b6e519bf7c0b700d89139a40b7fb8e06a9237d7eb0d0cf97621525f9d93fda4f21f67de2e2d3bf8a1c16e4e1", 0x109, r1) r4 = request_key(&(0x7f0000a98ffb)='user\x00', &(0x7f0000626000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000dde000)="2f6465612f7675746f66730719", 0x0) sync() keyctl$dh_compute(0x17, &(0x7f00004c8ff4)={r2, r3, r4}, &(0x7f00005cd000), 0x0, &(0x7f000010c000)={&(0x7f0000bf4ff3)={'ghash-generic\x00'}, &(0x7f0000000000)}) 2018/03/02 11:09:22 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)=0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000080)=r2) 2018/03/02 11:09:22 executing program 2: gettid() ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000040)={0x3, 0xffffffffffffff9c, 0x1}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @rand_addr, @multicast2}, &(0x7f00000000c0)=0xc) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) getpgid(0x0) r1 = getpgid(0x0) setpriority(0x2, r1, 0x7) 2018/03/02 11:09:22 executing program 4: r0 = socket$inet(0x2, 0x405, 0xfffffffffffffffe) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x8, 0x200000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000036e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c3000000000000000e6ff6e7230000000000000000000000000000180c200000000ff000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) [ 113.202302] binder: send failed reply for transaction 503, target dead [ 113.227719] binder: undelivered TRANSACTION_ERROR: 29189 [ 113.256202] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.261719] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:22 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000001400)='/dev/snd/pcmC#D#c\x00', 0xffffffff, 0x40000) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000001440)=0x7fff, 0x4) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x440a00, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r2, 0xc0405405, &(0x7f00000013c0)={{0xffffffffffffffff, 0x0, 0x0, 0x3, 0x10000}, 0x4, 0x8, 0x8}) getsockopt$inet_buf(r1, 0x0, 0x10, &(0x7f00000003c0)=""/4096, &(0x7f0000000000)=0x1000) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0, 0x4}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f00000001c0)={r3, 0x28, "66e138b17fa6e6812b7fc540b04508f9b1c7c7be0668d86b5b368df1fcfff924ea7f5670934a7859"}, &(0x7f0000000100)=0x30) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000001480)={r4, 0x2}, 0xc) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x1, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r5, 0xae78, &(0x7f00000014c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000180)={r4, 0xfff}, 0x8) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000000)='wlan1{\x00', 0x1) getpeername$llc(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000200)=0xfffffd59) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f00000002c0)={'security\x00', 0xe, "e8e37dc8f4626548694fd4ebfe3d"}, &(0x7f0000000300)=0x32) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000240)={'icmp\x00'}, &(0x7f0000000280)=0x1e) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="000000e49b2515f1b3b0850000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) getpeername$llc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040), &(0x7f0000000380)=0x4) [ 113.291164] binder: 15866:15872 transaction failed 29189/-22, size 40-8 line 2848 [ 113.323434] binder: 15866:15872 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:22 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x9, 0x121, 0x70bd2d, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40042406, &(0x7f0000000140)="219200") 2018/03/02 11:09:22 executing program 6: socket$inet6_icmp(0xa, 0x2, 0x3a) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="020300020e0000000000000000000000040008000000000000000000000000000000000000000000000000000000000003000600000000000200000000000000000000000000000002000100000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x70}, 0x1}, 0x0) fchmod(r0, 0x1) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0xfffffffffffffffd, 0x8040001060fc1a39) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000380)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000200)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000000)=0xe8) pipe(&(0x7f0000000480)={0xffffffffffffffff}) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000004c0)={0x1f}, 0x4) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={r1, @dev={0xac, 0x14, 0x14, 0xe}, @multicast1=0xe0000001}, 0xc) 2018/03/02 11:09:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f00000000c0)=""/158) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) [ 113.337219] binder: 15875:15883 got transaction to invalid handle [ 113.343557] binder: 15875:15883 transaction failed 29201/-22, size 0-0 line 2848 [ 113.362609] binder: release 15875:15883 transaction 512 out, still active [ 113.369709] binder: undelivered TRANSACTION_COMPLETE [ 113.374867] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.380385] binder: send failed reply for transaction 512, target dead 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d538") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:22 executing program 6: r0 = socket$inet_smc(0x2b, 0x1, 0x0) poll(&(0x7f0000000040)=[{r0}, {r0, 0x800000}], 0x2, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000140)={0x6, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}]}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={r0, 0x6, 0x1, 0x20, &(0x7f0000000000)=[]}, 0x20) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcfffbff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff000000000000000000"]}, 0x1b0) 2018/03/02 11:09:22 executing program 5: rename(&(0x7f00008cffff)='.', &(0x7f00004f279d)='./file1\x00') setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000001140)="76e24b9c686a7d4ba2eb65fa92817853c872dedddd1c075aede7f83313f821656e3f0579628ef3a47f8a563150c12dc514fb31575148f2cfd2118d1fddb521d27c20f0b136a577ff31892040ead97a48cdff60ff2e86203387479c566a6fc290", 0x60) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000001040)="dfec3c307ea2ee0282cf0e21e41fcd94664ab4aa34ce8f3dfbd8f16450c43e28ecedd60d1526256a5015bbf143e8a0cc51ec2a340e05206ca030512c5942a4bec359e43dadcd0c46914316919b275376ebb7a99a91a79c2ee781bcceeac77dac28dc28238d1f207feaa825f401cb5b5ece8ee35b0921c4b70632ff06a07ffbed6da7507ce0532e27c107fb5fa0410a102245d4c01983f098d1f9da8b8c0d6d4222d7e04863eadec172e49efed987d6a089b76ebb525e68112e0233b4f4489883b59a2c32bfc456c458", 0xc9) modify_ldt$read(0x0, &(0x7f0000000000)=""/4096, 0x1000) [ 113.401314] binder: undelivered TRANSACTION_ERROR: 29189 [ 113.410244] binder: undelivered TRANSACTION_ERROR: 29189 [ 113.441580] binder: 15910:15911 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000000)={0x0, 0xfffffffffffffffd}) 2018/03/02 11:09:22 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000683ff4)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x7f, 0x431c02fd, 0x0, 0x8, 0x4}, 0x14) r1 = request_key(&(0x7f0000000200)='encrypted\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000280)='hash\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffff8) request_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000001c0)='vboxnet0.\x00', r1) sendto(r0, &(0x7f0000000040)="a42b359ad9a25cf6d7ca4e6ba8bf", 0xe, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='&\x00hash\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00crc32-pclmul\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x58) syncfs(r0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000d59fc8)=ANY=[@ANYBLOB="e00000027f0000e00000000000000000000000007f000001e000000200000000ac140000e0000001ffffffffe0000001ac14ffaa7f000001"], 0x38) setsockopt$inet_mreqsrc(r0, 0x0, 0x28, &(0x7f0000eee000)={@multicast2=0xe0000002, @loopback=0x7f000001, @dev={0xac, 0x14}}, 0xc) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000100)) 2018/03/02 11:09:22 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x400000, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={0x0, 0x7f, 0x7fff}, &(0x7f00000003c0)=0xc) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000400)={r1, 0x100}, 0x8) r2 = socket$inet(0x2, 0x1, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff13000000000000000000000000000000000000000000000000000000000000b8e6d9f7eb7c6f474f000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37e"]}, 0x208) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000480)={0xfffffffffffffffd, 0x1, 0x10000, 0x3, 0x4, 0x800, 0x100000000, 0x1, 0x8, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) fstatfs(r3, &(0x7f0000000000)=""/119) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000100)={r4, 0xfffffffffffffffb}, &(0x7f0000000140)=0x8) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000440)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000500)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000540)={0x1d, r5}, 0x10) 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x1, 0x800000000000000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff0000000000000000"]}, 0x1b0) 2018/03/02 11:09:22 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00002ac000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c97ff8)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000080)={0x11, 0x11, &(0x7f0000000040)="b7a9de1d2b419fd85f7241fb4b53eeeacd"}) socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000ee1000)={0x0, 0x0, []}) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000d7c000)={0x0, r1}) ioctl$LOOP_SET_FD(r1, 0x4c00, r1) [ 113.456480] binder: 15905:15916 got transaction to invalid handle [ 113.462877] binder: 15905:15916 transaction failed 29201/-22, size 0-0 line 2848 [ 113.492489] binder: release 15905:15916 transaction 516 out, still active [ 113.499519] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:22 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) getpeername$inet(r0, &(0x7f0000000000)={0x0, 0x0, @loopback}, &(0x7f0000000040)=0x10) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x0, 0x20000) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000240)={0x100000000, 0x13a67ccd, 0x2, 0x4, 0x8}, 0x14) [ 113.504687] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.510213] binder: send failed reply for transaction 516, target dead [ 113.526207] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:22 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f00002ec000)="00fcdf7f00200000000003ff9f3f000100014700008a19f5d46f79ae9d8670539dc75596f524d81ad9e301b37f37a87223") fcntl$notify(r0, 0x402, 0x800000000000010) getdents(r0, &(0x7f0000000040)=""/211, 0xd3) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x0, 0x4) setns(r0, 0x4000000) accept4$unix(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000794c59d759b59f64dc26d7f332a944ded574a567c654124c309b47eaa675a23de3b6621dca6f925d2e248f6623a4df828d434b81425612fcb11940572ead522a3d37f321dadb8d344afcd68f51d74032d478b3d16d94a7396536f7fb0b9d9b6d2afd8760e237bee6b99d13acdc3d"], &(0x7f0000000140)=0x39, 0x800) rmdir(&(0x7f0000000000)='./file0\x00') 2018/03/02 11:09:22 executing program 3: pipe2(&(0x7f00008bfff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r0, 0x407, 0x0) write$evdev(r1, &(0x7f00005d7fa0)=[{{0x77359400}}], 0x18) vmsplice(r0, &(0x7f0000000300)=[{&(0x7f0000000040)="fbe0285395a1fd91fbac5e335e5b9992078ff16b975f408cb9bbff61b64fbb97b18566a57f7dd5591e9775a1295ea887a5bb66", 0x33}, {&(0x7f0000000080)="fc2c3a4b4c57b5950dcc52", 0xb}, {&(0x7f00000000c0)="e8f357524c23dfc41844fab4ff069b51e55c9efd99712753ee8f6bb8631206a79357912370c52066cfbb582480d385312a875d269434dbe79f48c6965a20971190e74504ba6491f006ae120bbb3e45cdbc288be689ef615cccbff59fd280f770ffbdbef61def67faca8044e5a708252dad563918af238072487912939f3579438d171b4654c5936a8c9f43c434a9300203be4e27cc2582c2", 0x98}, {&(0x7f0000000180)="ad1cd40a3437fb1124165a9914c1b88a0cbf9a4d51a62d9ed21dcc993f34fce70012abe42335a98113ee5d4fefb35604bfcea8fd158ea5e59f8959b0ac1d8e572e238a6d29946a1849", 0x49}, {&(0x7f0000000200)="0f2edfea4964ebf51f0f09e24c0946eff401bb9593c87d95f2670a11bccf90c20a63b7837af9f2e81b2d9b9e8e6fd6fd1f648bf5d167f4bdd66d3da4396635f03eb50d2206d32d1f9bef", 0x4a}, {&(0x7f0000000280)="799e2ef728499039d1752a2ad509177342354e973ef638533fd2f6e853e1a54838fe880ccd57a7fba98b5fadb8d186a3042872e50f3b06efdacf592a976a09107f40cdc323ea7f6f218f4ab3146e7d47ca3fe0be2defe91e3824bb9b7c6f06bec8a5158141018804e428a2f2724ce39e2af64dd1856b0bcc727ff4c8146034a7", 0x80}], 0x6, 0xa) vmsplice(r1, &(0x7f0000fccff0)=[{&(0x7f0000011fff)}], 0x1, 0x3) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000000)=0x101) 2018/03/02 11:09:22 executing program 5: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000040)=0x66, &(0x7f0000000080)=0x2) r1 = socket$kcm(0x29, 0x5, 0x0) sendmmsg(r1, &(0x7f0000006700)=[{{&(0x7f0000001d40)=@nl=@unspec, 0xc, &(0x7f0000002040)=[], 0x0, &(0x7f0000002080)=[]}}, {{&(0x7f0000004280)=@nl=@unspec, 0xc, &(0x7f0000005600)=[{&(0x7f0000004440)}], 0x1}}], 0x2, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(anubis-generic)\x00'}, 0x58) 2018/03/02 11:09:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x7b, &(0x7f0000000040)) io_setup(0x2c3, &(0x7f0000000080)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket(0x5, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x1, &(0x7f00000000c0)=0x3, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:22 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:22 executing program 2: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f0000000200)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000000240)="636dc0afab000886eb7e00000000696e650000") ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000080)=""/31) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6050a09c00081100fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e204e20000890788ba4813d888a9c3d32b3db12afb0a8ecc254a6edf0d62d04d1ffdbf1113c6eb5ed82a6ecb73aa250ea9415d5eed736f251251f6013489b2c02eaf6ce5d0f571ab273be2bd3db4938207364c864983af0b266990b44f27dbfc0c614f53d0493ae6d56c11a46637e7747def4c7e72cb4f6617d09ed284290220e046301afdf98f8448d8b499bc14a44ff4488556fff98330fb1506c05dc254ac1180fd623a554f1a73c881643dd451655d09bf8a18f4b9309de39f5a02863ac82f0c6f3021db0f0112cae946c35299c310091c4a475ab5992f3cc0a56ef18c871fd895b2a"], &(0x7f0000000040)) ioctl$PPPOEIOCSFWD(r1, 0x4004b100, &(0x7f00000000c0)={0x18, 0x0, {0x2, @random="39dffb0ffb8b", 'gretap0\x00'}}) 2018/03/02 11:09:22 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffff188a04a03021b81d0000000000000000000000000000000000000000000000000000000000000000000000000100ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff010000fa040000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) 2018/03/02 11:09:22 executing program 0: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDMKTONE(r0, 0x4b30, 0x1ff) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 113.560740] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 113.571258] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 113.632616] binder: 15943:15950 got transaction to invalid handle [ 113.639050] binder: 15943:15950 transaction failed 29201/-22, size 0-0 line 2848 [ 113.657968] binder: release 15943:15950 transaction 519 out, still active [ 113.663991] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 113.665046] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000600)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0x0, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x400000, 0x0) recvmsg$kcm(r1, &(0x7f0000000580)={&(0x7f00000005c0)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @loopback}}}, 0x26, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/25, 0x19}, {&(0x7f00000000c0)=""/32, 0x20}, {&(0x7f0000000100)=""/168, 0xa8}, {&(0x7f00000003c0)=""/100, 0x64}, {&(0x7f0000000440)=""/66, 0x42}, {&(0x7f00000004c0)=""/127, 0x7f}], 0x2000000000000127, &(0x7f0000000540)=""/8, 0x8, 0x6}, 0x40010000) 2018/03/02 11:09:23 executing program 5: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCSBRK(r0, 0x5427) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) unshare(0x40600) fchdir(r1) 2018/03/02 11:09:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000e0f000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000075afd0)={0x4c, 0x0, &(0x7f000092b000)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000bd1fb8)=[], &(0x7f0000a81fe8)=[]}}}], 0x235, 0x0, &(0x7f000005af7e)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000b8000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000acf2d52a69b0620ec1184ef14161a0c48ed71951b43eed9800000000000000000000000000000000"], 0x1, 0x0, &(0x7f0000583f53)="e7"}) 2018/03/02 11:09:23 executing program 6: r0 = socket$inet6(0xa, 0x7, 0xfffffffffffffffd) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x9}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x1c) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x40) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000100)={0x200, 0x6, 0x3, 0x2}, 0x10) connect$pppoe(r1, &(0x7f00000000c0)={0x18, 0x0, {0x3, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 'dummy0\x00'}}, 0x1e) sendto$unix(r1, &(0x7f0000000140)="93f8e8a93f3c9e49db87fb901d419ef2cf1b44c5be4459582dcea384fe8b8c1c3e4db5c0343b299f97cca71b9b8ee4334907", 0x32, 0x40084, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x8) 2018/03/02 11:09:23 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:23 executing program 3: r0 = socket(0x11, 0x4000000000080003, 0x0) setsockopt(r0, 0x8000000107, 0x10000000c, &(0x7f0000000000), 0xfffffffffffffe36) 2018/03/02 11:09:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:23 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x8100) execveat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000240)=[&(0x7f0000000200)='cgroup\x00'], &(0x7f0000000440)=[&(0x7f0000000280)='+\x00', &(0x7f00000002c0)='\x00', &(0x7f0000000300)='$--,vboxnet1system\x00', &(0x7f0000000340)='ip6tnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000380)='tunl0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000003c0)='vmnet1\x00', &(0x7f0000000400)='},loeth0securityeth1\x00'], 0x1000) [ 113.678174] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.683661] binder: send failed reply for transaction 519, target dead [ 113.749683] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 113.762235] kernel msg: ebtables bug: please report to author: bad policy [ 113.776277] binder: BINDER_SET_CONTEXT_MGR already set [ 113.776394] binder: 15969:15980 ioctl c0306201 200b8000 returned -14 [ 113.782553] binder: 15972:15981 ioctl 40046207 0 returned -16 2018/03/02 11:09:23 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00007f2000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) r2 = fcntl$getown(r0, 0x9) getpgrp(r2) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000736000)={0x0, 0x81000000200007d}) r3 = perf_event_open(&(0x7f0000000000)={0x6, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_LOCK(r3, 0x4008642a, &(0x7f00000000c0)={r4, 0x10}) r5 = socket(0xa, 0x1, 0x0) ioctl(r5, 0x8982, &(0x7f0000000000)) 2018/03/02 11:09:23 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x40, 0x0) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000080), 0x4) fcntl$setlease(r0, 0x400, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f00000000c0)}) [ 113.793926] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 113.798144] binder: 15972:15981 got transaction to invalid handle [ 113.808665] binder: 15972:15981 transaction failed 29201/-22, size 0-0 line 2848 [ 113.812397] binder: release 15974:15979 transaction 525 out, still active [ 113.821412] binder_alloc: binder_alloc_mmap_handler: 15969 20000000-20002000 already mapped failed -16 [ 113.824099] binder: unexpected work type, 4, not freed [ 113.824104] binder: undelivered TRANSACTION_COMPLETE [ 113.827223] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/02 11:09:23 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0xfffffffffffffffe, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000000)={0x1e, 0x0, "fd5f1dfc8b59ae1bd2e584c711d5ca83e6aee2e5cf93"}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000a80)=@filter={'filter\x00', 0xe, 0x2, 0x320, [0x0, 0x20000b00, 0x20000c50, 0x20000df0], 0x0, &(0x7f0000000000), &(0x7f0000000b00)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x9, 0x10, 0x88ff, 'bpq0\x00', 'bridge0\x00', 'gre0\x00', 'sit0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], 0xdc, 0xdc, 0x120, [@stp={'stp\x00', 0x48, {{0xffffffffffffffe1, {0xfffffffffffffffc, 0x1, 0x8, @empty, [0xff, 0xff, 0xff, 0xff, 0xff], 0x401, 0x1, 0x3, 0x8, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0xff], 0x4e22, 0x4e21, 0x3, 0x100000000, 0x1ff, 0x4, 0x7d, 0x4, 0x5, 0x200}, 0x20, 0x200}}}]}, []}, @common=@ERROR={'ERROR\x00', 0x20, {"1b2cd563f735f347a3d059cd4bf7afe9ab3464ad00a8fe6dedb1f2f3f969"}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x1d, 0xf, 0x89ed, 'vlan0\x00', 'ip6tnl0\x00', 'dummy0\x00', 'vcan0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0x0, 0x102, 0xff, 0x0, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0x100, 0xff, 0xff], 0xd8, 0x100, 0x170, [@connbytes={'connbytes\x00', 0x18, {{0x0, 0x1000, 0x0, 0x2}}}, @cpu={'cpu\x00', 0x8, {{0x9, 0x1}}}]}, [@common=@redirect={'redirect\x00', 0x4, {{0xffffffffffffffff}}}]}, @common=@nflog={'nflog\x00', 0x4c, {{0x3, 0x6, 0x1, 0x0, 0x0, "126f17b8cb7884d3234f30adda54c42b9fcf72f646d26cb6842d7ebdc9a0098c40fe1ec04a5068342aa696f4c76f7970bc20ce0202831faa49d00f7850c30113"}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x0, []}]}, 0x370) 2018/03/02 11:09:23 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x1, 0x190, [0x200003c0, 0x0, 0x0, 0x200003f0, 0x20000420], 0x0, &(0x7f000092cff0), &(0x7f00000003c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0x0, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0x3], @random="2a97e74a12af", [0x0, 0x400000000000000], 0x70, 0xa0, 0xd0, []}, [@arpreply={'arpreply\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xfffffffffffffffc}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1e0) 2018/03/02 11:09:23 executing program 6: r0 = syz_open_dev$sndpcmc(&(0x7f000027a000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x0, r1}) fcntl$setstatus(r0, 0x4, 0x2c00) [ 113.856353] binder_alloc: 15969: binder_alloc_buf, no vma [ 113.862189] binder: 15969:15989 transaction failed 29189/-3, size 0-0 line 2963 [ 113.893219] binder: release 15972:15981 transaction 523 out, still active [ 113.900259] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:23 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:23 executing program 6: sendmsg(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x32, &(0x7f0000001500)=[{&(0x7f0000000480)="a98e18250b8afce1411b8578e34dc910e5461178c690ae2ebd3407eb008eeedac803d6a78171ba152b689dedde771c09e72132fae9c9ddf554cbd9cae4ce88a43430f6cea2063b65872515402f72e466f26169a68a6a18f904e0c2502fd6fd942b716ddb5773473a113142d306ba411b024f94fd498204ea4fe2906c5a918ddb44f5113a76811d170c4cb241c7825413458f8a00921c750862f0c240015c06c5e1c68a8cd6fe115f595fa4bd99ca4b217436204b057d585dbf45fb5b52d93ded22a7c555616a4095db61d6e6490d76ae9a2d74953482e2a51815ef9b2136c90bd4a9bb5ce36a513970abb7167624841313191aa171e00047d280cc7ec05f0e68519d06bf216c72ef775cc884e742e04038347a967c8bec3024929ce30610edb42bc42c271104c0d6d95ba5b56de0a5cf596d99c1f9075145fbb6a05d8ed9288eb9ef05daabb84ffc6ae5168fad39e350025b4c87ebcf2a57daf06cfbc14b6084d210955d4254194b9c58bfeb00a406604725a421e26520a199363bb9cb40bec5bed2db339520a7b30177576380dc673df478a5a3b2f567eab6a3d3519cea5e08c0f62120fc640cd470004e5ce6757e364fc170296b99f8139c0c51a13475c03cbe31e1f5d68d6746cabe4487fb6e9f954cecbc9b92d7d5191daa7cbbb1ae2c04c93040c8d20ab0d7ade346025f48f838c47c442ae19dd754e1f56b23464872ac68587a4557bbe828291bc9b8add05f1eb614199171f62b6cde61e59744e56b91ba7fc3c697b29cb8b379837474ba4417c25dbbce3de785eacb60755edf195c7330c919b6d1b41a8d2091dd411f307d101b4320c3fab7cea1c107bafd4c79288cde1a805711e7b16c725f6950488a5c46cae3885cedf083d67fa443bf7aef7ecf641ecc26929d7a4c0a36231931e74aa6e6f1ccc4fc7215fc7eda413c3108819b6dea4748a9ed5bef10cbe403c381505069299dab8b145e10b532507e32e30aaaa8bd9cc89cb2d40a45dedf575b7691c38c522e2b77db77b6285a2b9e19884ae38b5d27331db0eee165cfec443e05c171945330d3e5471212c76f23475f650ed9fe4e081a28f3fd30b386b305ee9169e6e288a37fc2af19a76e24761b92ebbd82c57c6a7bfbb28b06ceb4472ea4ba9405bf2e15f7487a57b5cda315a4ab3dc519c07db99e388e21f5958377eb82642c708c4b6a8b96d2fbec0dec109ea12d98ceae2102412f6da646fd898ca2402dba60c058b1fce3fd17d6fe0e427060363f880bf70b9a60aec65c32255ab19f1fbed83dfddfc62de4e37603ab94b1f359760495eccb787c4c6f7fe19469ef75145884f7b9713218d34535e07dc7a54f23062261ff86dfffa460fa68741e5023384451cf4cde7e2dbd546d408098aa971a3c50966786c34b1f8e782e80beab7b80c63e5c3001d929849aa4853920892e9c0d8168b5742c37f11c831216cb0abdde9c5e9a6f7774b42106993c0527e87baece2817c47d7a0c29f6e366b2ac728a3180096e8218fd52d1cba9b14a70f8ddd1bf5e3600f7e701f851059813a574eda376899504a89b3c10e303eb01a7bd33f41095c80790c1477ffa2408d6a4bd6e004c4fe3c7b374375ada84a8e221d088abbe74df831e48af7fb5cb4f8183b72aa54d01e6c6c54981e59892bda7833acafc93efa156b3b07a48710308e1edb3e2706a9147b6afc62f4bed30879c92b6699da1379e77118319c93fb79549cd1030ac6ad106ea5b74d0827bdf9fac349840a207a96f9c72701ba8095fa4649ac992e2c02342632b8336601c0c5270bcefb4fd1c3329a379abc78474ab70693ce30b7fed77ab0661ff419601d1b56395feeec788441b36381427882c4b781c5c835f0d725a7a45eff55583e01e3e9151c5fad4150b6796b635ad41b331789d8faefd9e4353b166d3dc2e140b1974bb5b05d9fc7d75d89e1fd18e394097899e06954f9cdbf31d6c865371602669497ef237a82c8212cc4d42af27c361a839ef11c68a1cb07ea2f47a67c30635836e64262ff4efbf0e7f9f65fed8a3da2e163492069ef76c203b0ce14a8276357ff0187f8ee17b3f18b24af8de34d692ebba133ed2e323fe618f5074f48131a03ec6d8b92e466f3475c81284bc2297dfad05f95dd4b7fe7a44a64f63a054ff1f0c0b38158d2308e6560f0ddba8d0a6e0fda1bc5f32040d8113ed9ad5927f0cb95428370f8c0711a24e7632e661a4a1906a46d4b4b83633195890f9b566d17cf56ccc10c6f49d9b5d08c20109", 0x643}], 0x1, &(0x7f00000015c0)=[]}, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000a40)=@broute={'\n\x00oute\x00', 0x20, 0x4, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000240], 0x0, &(0x7f0000d9e000), &(0x7f0000000240)=[{0x0, '\x00', 0x1, 0x0, 0x0, []}, {0x0, '\x00', 0x2, 0x0, 0x0, []}, {0x0, '\x00', 0x2, 0x0, 0x0, []}]}, 0xe0) socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000000040)) 2018/03/02 11:09:23 executing program 3: r0 = socket(0x10, 0x3, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000000c0)={0x8, {{0x2, 0x4e23, @broadcast=0xffffffff}}}, 0x90) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000080), &(0x7f0000000040)=0x4) write(r0, &(0x7f000024efd9)="260000001000277c9301c1ff00000023000000170800f400000000000000067105000c0000ed", 0x26) [ 113.905420] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.909795] binder: 15969:15980 ioctl 40046207 0 returned -16 [ 113.916100] binder_alloc: 15969: binder_alloc_buf, no vma [ 113.922492] binder: 15991:15996 transaction failed 29189/-3, size 40-8 line 2963 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f00000003c0)=""/4096, &(0x7f0000000000)=0x1000) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x161080, 0x0) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080)=0x1, &(0x7f00000000c0)=0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 113.948615] binder_alloc: 15969: binder_alloc_buf, no vma [ 113.954271] binder: 15991:16009 transaction failed 29189/-3, size 40-8 line 2963 [ 113.957218] kernel msg: ebtables bug: please report to author: bad policy [ 113.980672] binder: BINDER_SET_CONTEXT_MGR already set [ 113.990209] binder: 16005:16010 ioctl 40046207 0 returned -16 2018/03/02 11:09:23 executing program 2: perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x78, 0x1e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x3, 0x0) io_setup(0x7, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000140)="10000000f0fffffffffffffff9855da0", 0x10}]) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x65, &(0x7f0000000000)=[@in={0x2, 0x4e20, @broadcast=0xffffffff}], 0x1) 2018/03/02 11:09:23 executing program 5: r0 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000380)=0x14, 0x80000) fremovexattr(r0, &(0x7f00000003c0)=@known='security.ima\x00') r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x0, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x400000, 0x0) set_thread_area(&(0x7f0000000240)={0x0, 0x20100800, 0xffffffff, 0x4, 0x7f, 0x2, 0x4, 0x4, 0x5, 0x7}) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000140)={{{@in=@multicast2, @in6=@mcast1}}, {{@in6=@local}, 0x0, @in6=@empty}}, &(0x7f00000000c0)=0xe8) pread64(r1, &(0x7f0000000040)=""/98, 0x62, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4, 0x8013, r1, 0x0) syz_open_dev$adsp(&(0x7f0000000500)='/dev/adsp#\x00', 0x4, 0x800) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000440)={0x0, 0x4}, &(0x7f0000000480)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000004c0)={0xfff, 0x0, 0x200, 0xbe, 0x23e7, 0x1000, 0x101, 0x4c30366d, r3}, 0x20) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000280)=@assoc_value={0x0}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000300)={r4, 0x4}, &(0x7f0000000400)=0x8) 2018/03/02 11:09:23 executing program 0: r0 = socket$inet(0x2, 0x200000001, 0xfffffffffffffffc) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001780)=@nat={'nat\x00', 0x19, 0x4, 0xdcc, [0x20000980, 0x0, 0x0, 0x200012a4, 0x20001590], 0x0, &(0x7f000092cff0), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x3, 0x40, 0x6004, 'rose0\x00', 'bridge0\x00', 'nr0\x00', 'tunl0\x00', @random="25db9708c461", [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x18}, [0xff, 0x0, 0x0, 0xff, 0xff, 0xff], 0x87c, 0x8ac, 0x8f4, [@connlabel={'connlabel\x00', 0x4, {{0x6b4, 0x2}}}, @u32={'u32\x00', 0x7c0, {{[{[{0x200, 0x3}, {}, {0x8, 0x2}, {0x2, 0x2}, {0x4, 0x2}, {0x8001, 0x1}, {0xa0000000000000}, {0x5, 0x3}, {0x600000000000000, 0x3}, {0xf6, 0x3}, {0x4, 0x1}], [{0x4, 0x1}, {0x3, 0xffff}, {0xffffffffffffff80, 0xfffffffffffffff9}, {0x8, 0x7c1}, {0x9, 0x4}, {0x5, 0x5}, {0xfffffffffffffffa, 0x100000001}, {0x5, 0x9}, {0x7ff, 0x5}, {0x18000000000000, 0xff}, {0x3, 0xfffffffffffffff9}], 0xb, 0x7}, {[{0x3, 0x3}, {0xfffffffffffffff7, 0x2}, {0x3}, {0x6, 0x2}, {0x5, 0x3}, {0x9c, 0x2}, {0x4, 0x1}, {0x7fff}, {0xffffffffffffff9b, 0x3}, {0x20}, {0x2, 0x3}], [{0x4, 0x3f}, {0x749, 0x4}, {}, {0x100, 0x5}, {0x80000000, 0x4}, {0x3, 0x7}, {0x1, 0x3f}, {0xa26e, 0xffffffff}, {0x832, 0x81}, {0x2, 0x5}, {0x100000000}], 0x4, 0xa}, {[{0x2, 0x2}, {0x4, 0x1}, {0x3, 0x1}, {0xbb7c, 0x2}, {0x7f, 0x2}, {0x10001, 0x3}, {0x8bca, 0x3}, {0xffffffff7fffffff, 0x3}, {0x1, 0x2}, {0x7f, 0x1}, {0x6, 0x3}], [{0x8, 0x3}, {0x0, 0x2}, {0xffffffff, 0x7}, {0x5, 0xfffffffffffffffe}, {0x2}, {0xff}, {0xb37c, 0x7}, {0x2, 0x2a6}, {0x2, 0x6}, {0xdb, 0x84b8}, {0x1000000000, 0xffffffffffffffff}], 0xa, 0x3}, {[{0x4, 0x2}, {0x4, 0x2}, {0x6, 0x1}, {0x800}, {0xffffffffffffffff, 0x3}, {0x2}, {0x5, 0x3}, {0xffffffff}, {0xa8}, {0x4, 0x1}, {0xfffffffffffffff7}], [{0x8, 0x6}, {0x20, 0x7}, {0x1, 0x7}, {0x3}, {0x20, 0x3}, {0xff, 0x7}, {0x3, 0xffff}, {0x7, 0x38c}, {0x1}, {0xfffffffffffffffa, 0x2e1}, {0x7, 0x1}], 0x4, 0xa}, {[{0x1, 0x1}, {0x80000001}, {0x5, 0x2}, {0x2}, {0x6, 0x3}, {0x5, 0x1}, {0x7f}, {0x8, 0x3}, {0x8f}, {0x100000000, 0x1}, {0x2, 0x3}], [{0x200, 0x3}, {0x6, 0x2}, {0x3ff, 0x4}, {0x800, 0x800}, {0x8e, 0x9}, {0xff, 0x20}, {0x5, 0xfe}, {0x100000001, 0x448c}, {0x0, 0x800}, {0x9}, {0x9, 0x40}], 0x2, 0x4}, {[{0x5, 0x3}, {0xa1f, 0x3}, {0x6, 0x3}, {0x4, 0x3}, {0x7, 0x3}, {0x100000001}, {0x7}, {0x4, 0xf683c67f5c9eba7e}, {0x2}, {0x2, 0x3}, {0x8, 0x2}], [{0xa2a, 0x5d}, {0x53, 0x5}, {0xbb, 0x7ff}, {0xfffffffffffffff9, 0x3ff}, {0xffffffff, 0xff}, {0x7, 0xffffffff}, {0x1f, 0x20}, {0xe0, 0x156047b2}, {0x0, 0x1}, {0x1, 0xfffffffffffffffb}, {0x8001, 0x2}], 0x2, 0x4}, {[{0x2, 0x3}, {0x61}, {0xd35, 0x2}, {0x100000001, 0x3}, {0x9, 0x3}, {0x3f, 0x2}, {0x8, 0x3}, {0x4, 0x3}, {0x2, 0x1}, {0x0, 0x1}, {0xfffffffffffffff8, 0x3}], [{0x49ce}, {0x20, 0x1ff}, {0x3, 0xe860}, {0x80000001, 0x3}, {0x9, 0x8}, {0x81, 0xfffffffffffffffe}, {0xffffffffffffff40, 0x81}, {0x3, 0x54c}, {0x66e, 0x101}, {0x2, 0x4}, {0x0, 0x4}], 0x9, 0x5}, {[{0x6fbb, 0x3}, {0x10000, 0x3}, {0x10001, 0x1}, {0x6, 0x3}, {0x10001, 0x3}, {0x9, 0x3}, {0x2dc, 0x2}, {0x4, 0x2}, {0x2, 0x1}, {0x8}, {0x0, 0x2}], [{0xabc, 0x5}, {0x1, 0xcef}, {0x5}, {0x8, 0xe8df}, {0xffffffff, 0x7}, {0x2, 0xfffffffeffffffff}, {0x0, 0x401}, {0x10001, 0x50}, {0xffff, 0x9}, {0x101, 0x200}, {0x8e4, 0xfffffffeffffffff}], 0x7, 0x8}, {[{0x3ff, 0x3}, {0x1, 0x1}, {0x400, 0x1}, {0x20000000, 0x3}, {0x3, 0x3}, {0x2}, {0x20}, {0x5, 0x2}, {0x3, 0x3}, {0x9, 0x2}, {0x5, 0x3}], [{0x10000, 0x60f0}, {0x1, 0x23cf26ed}, {0x6, 0x800}, {0x4}, {0xec5, 0x4}, {0x101, 0x8}, {0xffff, 0x10000}, {0x4, 0x1f}, {0x3ff, 0x2}, {0x3f, 0xf3}, {0x10000, 0x101}], 0x7, 0x7}, {[{0x6, 0x3}, {0xf2, 0x3}, {0x1, 0x1}, {0x3859, 0x2}, {0x7, 0x3}, {0x3, 0x3}, {0x9, 0x3}, {0x3f, 0x3}, {0x14, 0x1}, {0x1, 0x3}, {0xcb5d, 0x3}], [{0x401, 0x101}, {0x86}, {0x4, 0x4}, {0x6, 0x4}, {0x63, 0x2}, {0x7, 0x5}, {0x1f}, {0x10000, 0x401}, {0x1000, 0x48b}, {0x8, 0x3}, {0x7, 0x27d}], 0x4, 0x7}, {[{0x6, 0x3}, {0x3f, 0x2}, {0x2, 0x3}, {}, {0xffffffffffffffff, 0x1}, {0x9, 0x3}, {0x7, 0x3}, {0x6, 0x1}, {0x4, 0x3}, {0xa0, 0x3}, {0x9, 0x3}], [{0xda5, 0x6}, {0x90000, 0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x2, 0xcd}, {0x7, 0x6}, {0x6, 0x8d1}, {0x4, 0x9}, {0x80, 0xf2}, {0x8, 0xcd}, {0x260c, 0x8}], 0xa, 0x9}], 0x3}}}]}, [@arpreply={'arpreply\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xe}, 0xffffffffffffffff}}}]}, @common=@log={'log\x00', 0x24, {{0x6, "3341dfd5985dca5f11043122c20df870eca9b77a9ddc36866c9226846a11", 0x8}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x2, [{{{0x3, 0x8, 0x3, 'gretap0\x00', 'erspan0\x00', 'tunl0\x00', 'dummy0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @empty, [0x0, 0xff, 0xff, 0xff, 0xff], 0xa8, 0xa8, 0x1d4, [@devgroup={'devgroup\x00', 0x14, {{0x0, 0x8000, 0x8, 0x40, 0x1}}}]}, []}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x2, 'system_u:object_r:dhcpc_exec_t:s0\x00'}}}}, {{{0x1f, 0x0, 0x892f, 'nr0\x00', 'ip6gretap0\x00', 'erspan0\x00', 'ip6gre0\x00', @random="19d3fee0b135", [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xb8, 0xe8, []}, [@common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x3}}}]}, @snat={'snat\x00', 0xc, {{@empty, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x4, 0x8b06, 'eql\x00', 'nr0\x00', 'eql\x00', 'eql\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xfe, 0x0, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff, 0xfb], 0xe4, 0x15c, 0x18c, [@limit={'limit\x00', 0x18, {{0x1, 0x0, 0x7, 0xffffffffffffff00, 0xdb6, 0xc2de}}}, @devgroup={'devgroup\x00', 0x14, {{0xb, 0x100000000000, 0x7, 0xf4}}}]}, [@snat={'snat\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x1a}, 0xfffffffffffffffe}}}, @common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0x1, 'syz0\x00', 0x2}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}}]}]}, 0xe1c) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/status\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000240)={0x80000001, 0x8, 0x7, {0x77359400}, 0x2, 0x8766}) 2018/03/02 11:09:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup2(r0, r0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000000c0)=@pic={0x4, 0x3, 0x3, 0x1, 0x6, 0x1, 0x3, 0x7, 0x80000001, 0x3, 0x10001, 0x4, 0x8, 0x0, 0x3, 0xaf2a}) sendmsg$nl_netfilter(r0, &(0x7f0000498000)={&(0x7f0000d55000)={0x10}, 0xc, &(0x7f00008b7ff0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2400000000010100080000000000000012000020100002000c00010000000000e0000002"], 0x24}, 0x1}, 0x0) socketpair(0x13, 0x0, 0x3ff, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000040)={'ip_vti0\x00', @ifru_names='yam0\x00'}) ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0xd000) 2018/03/02 11:09:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000080)=0x1f, 0x4) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:23 executing program 6: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x84d, 0x4) sendmsg$can_raw(r0, &(0x7f0000002880)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f0000000040)={&(0x7f0000002800)=@can={{}, 0x0, 0x0, 0x0, 0x0, "4d19ca39e9418483"}, 0x10}, 0x1}, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000100)={'ifb0\x00', @ifru_names='vlan0\x00'}) [ 114.005182] binder_alloc: 15969: binder_alloc_buf, no vma [ 114.006252] binder: undelivered transaction 522, process died. [ 114.010866] binder: 16005:16010 transaction failed 29189/-3, size 40-0 line 2963 [ 114.016853] binder: send failed reply for transaction 523, target dead [ 114.031124] binder: send failed reply for transaction 525, target dead 2018/03/02 11:09:23 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x202000, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r1, 0x400443c8, &(0x7f0000000040)={r0, 0x8}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:23 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x6, 0x81, 0x1, 0x3f, 0x1f, 0x1000, 0x80, {0x0, @in6={{0xa, 0x4e21, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x5}}, 0x6, 0x7ff, 0x8, 0x9, 0x8}}, &(0x7f0000000000)=0xb8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000040)={0x100000001, 0x1, 0x2, 0x122f, r1}, 0x10) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/member\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080), 0x8) [ 114.061316] audit: type=1400 audit(1519988963.428:135): avc: denied { map } for pid=16023 comm="syz-executor5" path="/proc/507/net/pfkey" dev="proc" ino=4026533317 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=1 [ 114.119943] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 114.125305] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. [ 114.132964] binder: 16031:16034 transaction failed 29189/-22, size 40-8 line 2848 [ 114.141887] QAT: Invalid ioctl [ 114.157197] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:23 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) socketpair(0xb, 0x6, 0xfffffffffffffffd, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt(r1, 0x3, 0x7fff, &(0x7f0000000240)="14d891b3f5c2a7efe01249e523ebb6512703ee7a471d7c06361a002cb2a69e69b18d7d95d767f728b588b373c75049ff38330d57031bd8220af65a447cdd35d14ab2f7420fa02623e35104562c25f8fd77f5a77f6034df482149696a31f0a146a33001414bae7e946fdb531f1e94e11f56fd4f02c38a153b04c59ac86f2f21d56e37d610dd8491ecd836a073404b8f2399190a8b35ceb708790cdf733e9fc1cf42d4", 0xa2) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000180)={0xfffffffffffffff8}, 0x4) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f0000000040)='/dev/binder#\x00', 0x1) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000080)={[0xffffffff, 0x0, 0x1, 0x10000, 0x7c9a, 0x9, 0x9, 0x2, 0xfffffffffffffff9, 0x5, 0x10004, 0x3, 0x974, 0x6, 0xfff, 0x7fff], 0x1000, 0x40a40}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="fbb3f4e06a8040"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:23 executing program 5: socket$inet_sctp(0x2, 0x1, 0x84) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet(0x1e, 0x4, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e22, 0x7, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x3}}}, &(0x7f00000001c0)=0x8c) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000140)={r1, 0xd3}, 0x8) 2018/03/02 11:09:23 executing program 6: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x404200, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000040)={0x4, 0x7, 0xeb, 0x200, 0x1000, 0xec, 0x57, 0x2, 0x48c}) r1 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x9, 0xc0c1) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f00000000c0)={0x7b, 0x0, [0x0, 0x6182, 0x6, 0x2]}) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x5, 0x1d, 0xc, "dfed1a6e33af8bedcce4a493f027f719f8691a7cf05656330e70e6ef616ef36abc6c801fe3e5cd3fd1f02ace954566a68b9937b111882d4e90cea90fa457651e", "a1e2ebba1f7f4f7eab56eed036d5acf41470fb005e74c29907065973b4da5747fe0621af0c711fe69c90235ca7764b43952bd049360543a30f3908483fdebc74", "2dcdd5161c61128ca4a2f9936c3eab0347ad673283d09c8ab736b4f7ec3e1de4", [0x2, 0x80000000]}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000240)={0x1, 0x4, [@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}]}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000280)={0x4, 0xfff, 0x3f, 'queue0\x00', 0x7}) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) ioctl$KVM_SET_FPU(r0, 0x41a0ae8d, &(0x7f0000000340)={[], 0x10001, 0x0, 0x1ff, 0x0, 0x5, 0x5000, 0x7002, [], 0x1000}) close(r1) lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r2, r3) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000006c0)={0x0}, &(0x7f0000000700)=0xc) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000740)=r6) execveat(r0, &(0x7f0000000780)='./file1\x00', &(0x7f0000000880)=[&(0x7f00000007c0)=':\x00', &(0x7f0000000800)='queue0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000840)='-\x00'], &(0x7f0000000a80)=[&(0x7f00000008c0)='mime_typeselfbdevppp0:$\x00', &(0x7f0000000900)='*wlan0bdev&cpuset\x00', &(0x7f0000000940)='/dev/sequencer2\x00', &(0x7f0000000980)='/dev/sequencer2\x00', &(0x7f00000009c0)='procnodevvboxnet0\x00', &(0x7f0000000a00)='queue0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000a40)='\'\x00'], 0x800) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000ac0)={0x0}, &(0x7f0000000b00)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000b40)={r7, @in={{0x2, 0x4e22, @multicast1=0xe0000001}}}, 0x8c) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000c00)={0x5, 0x0, 0x6, 'queue1\x00', 0x919}) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000001, 0x4010, r4, 0x0) mq_notify(r0, &(0x7f0000001dc0)={0x0, 0x1, 0x1, @thr={&(0x7f0000000cc0)="a1288d2ae2773116021e74927995310df9d395c458a3449af18a27ab8d3f06b9d48defc541909c9ef2d735cb82f05878c3185d5a0292ec117962dcefb7cae719226e399ce734a4dd31e064a2a99ad545090397ccea1511f7f1e1e22aa2fc73568f9f510c9fde330fdb31ca2397fffb137e0186df0307340c4b54bae1d60bf0fe4cc5a3fd5d509c404a1a6a7e8c197ecac40c5e069e578dcb50e06a22a8c99798b0fc9b6f0dbea8ed0c029bd0f0b12d199416bc44f6c02571c6521d193dfb9543f6c98876fad5757d2e03a64de5dcce848a113987a0ff1a6a210fc2509233058bafd4dfe4aa268092c9", &(0x7f0000000dc0)="961575a0b3a79d19a42a70933d5deca3b7702be87014d1450936a28eed6e2cea56b3ac1ceee82aeff97563fac16f25e8142b99e88f7b65768723efb596ed062606aac295dc9029e07cafe8de934133ff559ed849959ce20d93d1af281b9d7197f1259c048850d33c7430ae2087b06c41d0bc7f9c1321dbd8f7ea281bc1321a3d92a26d52ff1bc459c87f563a70e31a3ac1cf1c55097b971b92e6dce4741333bc5c316f4674812db6f224d47ab40a83465074e407142ee16c854bb1a4dbbd538b4d9d953ebafa65454794adb3e957c1a5300e97b00fbc8e4c84a713e1ab9662c2827ea20fa9d56bf98a826c767f44562ba152914939ffa5f571961cd14e7d54e755127eeeedb623e13f18d5997b273fb7d5e9d7c2b869cae4cd587c5049ca53cdf7d667de1dcdba82e578702d825ab3ca87467bc22b15589e223ec967a8703312792023dc7dc35cc8f0a183341fd2f96565f2667cf3d850e4733e8c547c1dbd9b8d794db090cc5c9e3bfa3f5fbc50d01df2964d86a5b1ddfe1feb62c422a524ffba65ee8d95e6b79f319a2ec30c4b59c6cbd1a827268c0a8a9b591bf52d4819e5bdb128951922d8f11e24d2ee5dd6f0227426188968e3bbca9e27c9b2ac956e26f0ea492a1017c6ae579a5da895bd9f7e2d4910eccd594c71e525c7bc8f1a22e53c2f0aaa2e11436d4f8bdb202cff5044998e6fa15b6f796957da1eacc09aafd4b7bad15c0e465eab94c823e8222fe7778f1fa9179eea5292eefec0c3a57ec20fa78717f157ce250fdb8d7eed179ce86d0bf26caad4e756307dbbeeee5c860101b06315ff4c3d4fe03f21583388b73283a4ad25ae8b52a24072172116fd5aab907bdb92192491f2f40ee3d2cab169c1750bb862bdc4611265d5dd882ccee93b26d19eb33c6ed0a1d77482e62333488d382a544e7d08fb5d3ec22050c5b013725f708d6685b7506d87398337af3660476e8495fbbd32fb2f6bc2ce4ded8bcf6ee147102ba0d93c1f2ffa4c47506218d63fe270875c4bebf0bd987fb51edbb0fb32209b9b0f0792b315f03b6038a0a955e4b459841426c52dd5542c6f4f3360bbac7508d4e32288266b8e2b55d3b644e000499cc2e58aefb2e3f7456cffa575bb3414255e6312043099269bb2aa1b6724f21e3f3826ade51aaab6ee6f29837a5e6becad01168040e1e0b3e9316e32b2b1a35342ac4efff133c0775cf3a7b1dd9e8795239c1365ae33e25848b09c3d3d118179529d4a82ef75bf4d8a341b940537b84b7397808b7fe3f7de460b0b8781b3c26c4c60df52c76ec3163dea8e93675b07594d30cc4165c34ddf46557098aa78d751d60a5a5e0834e0c5c6d8b4ccf4fbd4e8d1468b8a8e9a6b65022d093e5bed60789596d052b73a3e1b5c116af5861791a5d0fd1c43028b2258c742c2693476c704c8c2c29c111c4f6f0c318d80b98f1395dcef9e36feb64bfa271acd2623822fd38d913cc7dd52c49257dd0168256ad1eb92c6d3fd509e097e54ee02bd45f3e87e24112cbd5e7615bfee5841c53d4c602129e96638f0536a35920e9c28d4bef8f95b4e5c85f9a938bbd296f108e287695e259eba955d9dc7899a4415d799542ea73f3b3bfdb74121e0190b551a004cb9089043f418a8fe514dcb784cb87d7242aab81e6b67e1af60b3cc34679189826425814cad1da1a7aee46e717346c6eaffb47ffcbb1ee3a53664015c53ca433af3b2e4ef2fec50fd42c498908a1d8d69078d4a8f0aec9df46f48ee2ffcf37a81bfff2bd204a1f38faec1028044b283be42e5f34e0617a0404e43a88df3d5db94e6556b4e7a12099956d2a7bb67eec82713a9919a2199666a79194715a69d9505ca3ffe2e6b79e60d4d11daa73f1a3f654c4172ef11bfee0e36893472c9b3b87814841a3418bf717366512027f8ea1b2101baa63d0f2c65c5a797a5e242fce4813300cd3f71e4ab65376410a54d35e9e2d005200b28aa4741940df59aea8b92ce695305a24d3f2d5168bd92c427bc3ef26bf840b7f1da3353b540bcf4fcc616e85eefabcf9eab49c2634ae43b671a432dd6a6d2d04b9e50621e0ad8162250e44e7f235092616a51c5fe7e149e9a90dcc5b446502e721e620f4acdf9b3258f5446b57b24cb1b89d095d2b554fab77da63cee0c600b24cb10b6a5ecab9013ac0e8a189016bf8f6bdbee20949818259d4eb3e6bc60c6ac8346ea5e1caa5b875bea9d0fe5ef1c25b033d1d07b475153028af57d60d6cf8022b32529aa22459dc532d10a1d3f8e32134a1166fecbf6dcfe29807cdd47dcd12adcc0e27382ada8b17a2eb7deaa44730ee3b1c0ceb27308667e1354c1920a064e3770f88f41120e73a0bacd63cbf309794851bfe8fbf8572f7f7b4c8d643260abb542105715d38964099f1394e2a7efe12d9d88474f581dd0850ee1ba3e07549855817d35e1d64349a1ad8bfc448d65a93b18ebb94fededbca512f5bf5e8b8f18ab73a6188a6ab99add95cd448a45471b1db35c1645466ba20296f06d9a9032fc3930489feabb8c40000b6270580d28c673be9b145e1fd7d9960d3e978cd2de7311115322f0ece269d84266caac8fb2fc8089aff7ad357815c5f22a5a75fa09c2a4a31abfab4344ce8449f5a932da7074b162e72b2a67f8218475b7fe6c46a6d35498540e8cbfccb8920fd5e72bc1eedbc33292892eea9c70d98ed74878ccdeda795dcb07e358109d6b495352f0fe83ed5c8581d236812d4dd8edfc3f52ddb3f7877fdaf35bc5ab10a893ff67c27df1d21f1c94317e0ebea4860a5abad2f2d454a7d5352e2991550151b80faff9afec00fe8de68eda2f0c2c2b72b2ac076d37adead025e15439797f8a0e66fb62accabd6a143138dcb127f78c498e0efb7b1f7a6ed3f4190b420d828b60869b3c393c7cbf9c7b2dda52d6cf6ed6b13441a4ac792992c9732a816fbb2716318f29ee3d2f38108f67c08a7dbe2e8c88b6f91eae140cca57a9aad2c4cd5b7a6d4f259083d95876596eb962c1eb0a725655b457a6812a574f93bc3e1306ac9c05cdbefbb281c1742ced26b25d1b6c79cc35add74435c5224f3de5b645860de873c7659e7c12ab4ad81259375a9b93e9a9292271213712862fa317d4475f1ee30a3bce84f0fd08ee7ea6e938c3d5902470464493a8cd92028f16de26bf38d33de805fe4601b70667a4e7a132f8d415a57aa2bafffe2470f61c28a1e8a2ace7f9d57ea010e680fea9b921daac69f8fbd79ccb2dc25880007b6b460c65163097a0dd70b6eb5d4d18f71b4372281292916d1ac4a391d191fe3cd25c031d9b787cf9d3f6c1a74ee791154c1960183d15ce1dd5901ab907e8a3df2819d279255a54fcd113fb403accc769e19def1675c6644ce808e0588dbd0aa016442a45a3c1f66ce3ae63dd1d1940c56badb29317a914eb3392a09c6ec39214971dd9091b355dd24378c55fd4c5bf7519fd725ecc0b783843e9c16f6121b5c50984569d05dee58993dc0493e5d39af9b2590a0ff6ccd4d5e17681745844965dfd0a66b6f056e5660b9b08336e6c00258cbe007a9699c6ab8661d2dd207a14d16f883fb2d0631d68f86aa03eec5aa9f2c853a9ce367b9ae338285b53086e00d99d14e686bd118bfa3e5f481e94779c94ace955cb0a9c3af25bb0628a4004234d2544d5c729644ba11d14738f92cf1ee4cbad8b104ac7ea2fa5da63f95438b7b7f6a053d998c7243418373ce57771fdd41804cbf971b2a3e20bcd8e1bbba89fbc82ecdffc990027eae825411cd44c5a85cdf09600151198a8a124530f5646ac0938962e224f3fc0457a5d80ddcba7d4227c57a856c84ac2e5883c977473e190161ec4cf372b2885e68868794549b9980f34c2e6188910513bdf4833aa140f2ae98c6e971e16a268daa39f7234f61ab9c24a23bcc3d15ccfb19cb9734d68348f4f6372754601a4813a72ecff4eefcbc4ede4c8bf9a4d644dc7921adbc275ffe0d895e027f12d555ea41f06ad4c50115d7e7f874daa5b4e36fc4182f2f1ec277a2caa8a101504ddda22f85af66342466bc734c777cd9b3e0ac544d71471b302c63a0c6c962ebc32c0c0ae45eb4a7a53e270d8d14dbdd2939ec00046fa946577ec681b2569e12a09538152c2b8eb69d39fbafff414f28f2b6e42ae8bb613aed2892ce1d10e3178920a6b9f63cba1f6e75bf82399ae6c371e5d95d5941787c66f86fc3c4ed0cdb11c4793f8847dd1403b4a71b30edb45fd8f746dee68c107035359ae535e0889d9807d34e9422550c454d596973f02afc72a8d9c6c433be1f8892e50e0242dd8f92e2f122a6118481227aaa94cd6d041517adcc423345b6070a591ce713b66c57832ede0a397adc1950ff99232a0f01dbd022b3f1ba17b0590e66e5a89e53d3e0040b442984ab5615dec4c07eaab05a7aeca886184ca3716de5617da4f74794731b8a70230e51501cc5df58e8db63acca95615f8e80a99f4b87a2c7f85bf570acf5e8edd2048658f0c020b985170f0737e64fbae31b54cf8f08c20c5ffd5bc3e56dacd8b56221b48e3cdb654da6de159f963c2b046025d20d9ae9f5299767347335c5375cd11798ef8c3439e000748428055fe536087a0387ae0f8cd5d930b7546247a5c92308595545ed9279ee95f1e9a72291e593c517c97705e0e2cc56152ef876f07faed200788ccacaba7897af523bb14b74fc2d68c29a33ec96d1c0dfb69d661642d9d7aa41a08b4c6915753f0d6ca6dcc28d642c1d1bff98601cabe06c026dccfdf8ed5711f49a9b87e46a90f9acff250fb0c971e96ed3baf795ff1074b2f05fb4e831926e2a344fba30f0ec7ac7e7f391d0ca78b00ad358b6fb5a7682207fb34ff9556e90515f9ac07d269b358055acf60123a51b6862eb6236285f4515987f40827198f3e5c54548d77a3577c609f11636a94cf4ba908c3c1709b9d8bb92370f6324cd773bc1f7824e63345dad21c53bcc7a6df05e42b5fc36ae9724bd3d651151873090b1a9bf7c271859aa0b46729e849433368de8bbaf8ac1bd8b0a4ddc88124de4864f36981a7db3199704c1d459c1174e7760fc8e8fa78562c126a4e0d3ccd9416c87414f2d749620b8bde444fcdeea57df874b6072599e12d7053fe570e4e270616a65590c5047986304dc349121a6fcdfb4e9a8adcab1ea23dcae21cb21454aa464196888649a1438127f42930a9e489cb7371b5360ad587f9995f23d1cbcd3c9bfa40672b5fd3646a4d4617d57a9be7d0736f8292441069f40c47f3191674983d038e1961280933bfdaba0bbe3f3ef7e55636a4c807bfd4102363cff6796b602c40379679fb3c44f4a1b20c7b8f2605529f3ca5377cf002a368b03d9c2156b2e1117d7dcfb4de68d747810806621163962cdf9bcd7eafdc746d40bd4b039226011f326528d905143c725524cbdf44b8f7034602f71b2265f5c3c2ea5716a06daabaadc9f042bbd78110bdaf94dc050ef6c0417185e3bfa830063ad7805284f9dbd19b54f184b77b9f9972579460cabf7774b482562757690ea055bd363322f799a7f9421357a1415d518132df88a07e4d840a04a593450b1ae28c22c6aa4efe917f3a020d8afaac51676688f9138d9efc94814232ea65938b471c26a6abecbb317a2cedc93b53ab39e65d43ffb1340b8579b30779532f5463c4d5088fd765209b2a52dab4d7ce6b52905d80db9d046c0e62cba64b21645f4bf0d5b1a2d1782b1b4c4c4377a12f4808fe38104fd6730d3910c8a0df55a82fc15f3b892f20f150bfeb816d1270d62c3c147fa327dfd3ddcf09e2f4d5c37791cd5fe34b56"}}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000001e80)={r7, 0x20, &(0x7f0000001e40)=[@in={0x2, 0x4e21, @loopback=0x7f000001}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x19}}]}, &(0x7f0000001ec0)=0xc) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000001f00)=""/104) ioctl$KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000001f80)={0xa, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) sched_setparam(r6, &(0x7f0000002040)=0x7) ioctl$fiemap(r5, 0xc020660b, &(0x7f0000002080)={0x6e9d83c4, 0x9, 0x3, 0x7f, 0x4, [{0x3f, 0x4, 0x5, 0x0, 0x0, 0xa00}, {0x7, 0x200, 0x6, 0x0, 0x0, 0x3381}, {0x3b42, 0x6, 0x104b, 0x0, 0x0, 0x402}, {0x6, 0x8, 0x13, 0x0, 0x0, 0x100}]}) fcntl$notify(r0, 0x402, 0x10) lstat(&(0x7f0000002180)='./file1\x00', &(0x7f00000021c0)) 2018/03/02 11:09:23 executing program 0: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x80, 0x0) r1 = getpgrp(0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000780)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000880)=0xe8) r3 = getegid() r4 = mq_open(&(0x7f00000008c0)=',\x00', 0x40, 0x48, &(0x7f0000000900)={0x4, 0x9, 0x3f, 0x2, 0x1, 0x8, 0x240000000, 0x590a04e8}) r5 = syz_open_dev$midi(&(0x7f0000000940)='/dev/midi#\x00', 0x10000, 0xc0000) r6 = eventfd2(0x2a47, 0x80000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = userfaultfd(0x80000) r9 = syz_fuse_mount(&(0x7f0000000980)='./file0\x00', 0x8000, 0xffffffffffffffff, 0x0, 0x100, 0x10) r10 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/rtc\x00', 0x10000, 0x0) getpeername(0xffffffffffffff9c, &(0x7f0000000ac0)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @remote}}}, &(0x7f0000000b00)=0x32) r12 = syz_open_dev$adsp(&(0x7f0000000bc0)='/dev/adsp#\x00', 0x80, 0x101000) r13 = socket$bt_hci(0x1f, 0x3, 0x1) r14 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000c40)={&(0x7f0000000c00)='./file0\x00', 0x0, 0x8}, 0x10) r15 = eventfd(0xfeb) r16 = perf_event_open(&(0x7f0000000c80)={0x0, 0x78, 0x7, 0x7f, 0x400, 0xbc, 0x0, 0x5c, 0x1000, 0x4, 0x200, 0x6, 0x101, 0x400, 0x9, 0x1, 0x9, 0x7, 0x8, 0x0, 0x7c, 0x6, 0x10000, 0xfffffffffffffffe, 0x6, 0x28c, 0x9, 0xfff, 0x6, 0x4, 0x10000, 0x70079a7d, 0x9, 0x400, 0x4, 0x38000, 0x2, 0x3, 0x0, 0xffff, 0x4, @perf_config_ext={0xfffffffffffffffd, 0x3ff}, 0x2, 0xfffffffffffffe21, 0x0, 0x1, 0x9, 0x8, 0xd1c}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x8) r17 = syz_open_dev$loop(&(0x7f0000000d00)='/dev/loop#\x00', 0x59b9, 0x0) r18 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/loop-control\x00', 0x0, 0x0) r19 = syz_open_dev$binder(&(0x7f0000000d80)='/dev/binder#\x00', 0x0, 0x2) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000dc0)={0xffffffffffffffff}) r21 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/sequencer\x00', 0x200, 0x0) r22 = accept4$netrom(0xffffffffffffff9c, 0x0, &(0x7f0000000e40), 0x80000) r23 = getpgrp(0xffffffffffffffff) getresuid(&(0x7f0000000e80)=0x0, &(0x7f0000000ec0), &(0x7f0000000f00)) fstat(0xffffffffffffff9c, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) r27 = syz_open_dev$sndmidi(&(0x7f0000001000)='/dev/snd/midiC#D#\x00', 0x0, 0x400000) socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}) r29 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r30 = openat$vnet(0xffffffffffffff9c, &(0x7f0000001080)='/dev/vhost-net\x00', 0x2, 0x0) sendmsg$unix(r0, &(0x7f0000001180)={&(0x7f0000000040)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000000740)=[{&(0x7f0000000200)="6bd9d8162413c34e58c6a9a12a8bfb6139749304fb44abd0902de21c4de9638b3dc5a7638981fc75eb25a4ccb4cccdbde0cb358d5b9d262d50205f9d71f5480fc88938526338294b7cdcc97810ce1c1bd55b3cb53f4b34979be8b87fb44d306636e2fe1d5e4dca45cba17db5c38bf43054f6ab8f16d77934e467216720f07f9fb0b58dc8f78a96", 0x87}, {&(0x7f00000002c0)="d6511ff650cabc7e5209400c5d2f5bfadfe9a4a4530a31985fb6a9e1faea043bc0ad06b9c897b0512fa9a970a2b3a2ded392248dd82912cd5d88c1ea1772c6cb8224c9a9a47863a99a632b3ad611935f", 0x50}, {&(0x7f0000000340)="fbec4fd6c775aa5d08818f317464f85e3de4e0b9792b4e186155a5b7c3fcfde6d898c9eb9b26912a01e5731ac39241ecf24523edc6f03e2b4d2c1b1a3f479d128a27c697ceb3b3de91639f3801c3f85fcd991db291feec0eb9c8a26983fca2b675354f69ca03a4264f3e52abe6cad48c30b4fdfca48c1d3ea0f5068a47ec53ff8d224b62d4b5d9ab172b4e4ba4e3af971016b1d9a935476bae7038fdd40b7ac8ee53260046a38fa3f0cc69e6811f796833f254f4b81903b3f8bc758199b0ece1f5048de0459f89245f017c5258d4185cade0df42262b17c8027940ef457ac72bad7a62bedf6a473f00b86c6cba880783cd32e02ae9beac", 0xf7}, {&(0x7f0000000440)="f0aee3b39c5284a17041a5d28142b70bcb24810dc1de9ff043a47e22f51a4f630a89ee", 0x23}, {&(0x7f0000000480)="fefcf6cbb3efb3f5345d37199bb228671ff6bd3b9c698985ca501407447d573878399589b30fc9dbab993a9c3d6ecf4de7d158b8b515545bd7e758c4a0fc1f3a40f775548ce1ab5480d76da27a2cde92b8d415cf7a1c701ceaee21a20839f21cce5577bf1d84677e653462b3b854e20d96f529191dac9c4848dea65bd71fdcd1c5cce4fa7a3d176edcabf52f6cade9fab0467dbb20e4e111d81cfe8ef29636a27f16da293a64bc4252561730e5c0fd767a64f2c321a8b5a0db3f63ab3614ed408d9710fb10457809293426504485bae6f87cef396e9213d516d655d732a05121a96f", 0xe2}, {&(0x7f0000000580)="b27fda9f4c75dbad8708348aed717bf23afe23258b83c368fb7f7cecaa8243444dd51782acc3315df58d29ba8f05b5bf636340e39fdecddacc3e90fcf943839565ae37e60e8b3b2c7a0a49da5d42e2390217b9633fd7d310aed0cd5c44e2bda78e7d8bffb8e069e8f6146017987ddb560d060cf96ce12d12593e28dc79906ddebb16420147ecd495bdcbcc3309c09a9bace475a5a9b2607dcef89c7f20211df0b0ec605027d9424694d9e2d431926502ac0b3b047d96739898f0aa8bb025", 0xbe}, {&(0x7f0000000640)="24eae78538285a5139d9610b2eafcbd825dff1d981f34b1dba2cad517508873d26f55d8f4cf26bb1f6daf79cd89eaec1d5b97ac075d8a45f4e189135afe6d01639b435a27907a3bfbdb3c0ca8add61f8b36b99dd524431512e20b9216ce37508d27f9dac49ea8440ba535494485762238773002e4aae3d714c3a08f1e53c7f187d42ce88229f963a4786c69880c77564c04f6ce3ca327ce90f2ea69b5fffb224dfd598fb1b4aa3f892bc91abfb35256226b172a54e1cebf2d6f0f65f138f498f45c1fc4057a3fbc8c581a547d3", 0xcd}], 0x7, &(0x7f00000010c0)=[@cred={0x18, 0x1, 0x2, r1, r2, r3}, @rights={0x18, 0x1, 0x1, [r4, r5, r6]}, @rights={0x24, 0x1, 0x1, [r7, r8, r9, r10, r11, r12]}, @rights={0x34, 0x1, 0x1, [r13, r14, r15, r16, r17, r18, r19, r20, r21, r22]}, @cred={0x18, 0x1, 0x2, r23, r24, r25}, @rights={0x20, 0x1, 0x1, [r26, r27, r28, r29, r30]}], 0xc0, 0x20000004}, 0x800) r31 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r31, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:23 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xeef000)=nil, 0xeef000, 0x4, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000200)=""/246) r1 = memfd_create(&(0x7f000001cffb)='.\x00', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000043ff3)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000041f74)={0x0, 0x0, 0x0, "717565756531000000000000000000800000000000000000360a0bcf00000000000000000000000000fffbffffffffffff8a2a00"}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000080)={0x0, 0x0, {0x1, 0x0, 0x0, 0x0, 0x2}}) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000b33ffc)) 2018/03/02 11:09:23 executing program 3: mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f00002cbff6)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) umount2(&(0x7f0000000040)='./control\x00', 0x8) r2 = creat(&(0x7f000078dff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000f3bff8)='./file0\x00', &(0x7f00006b3ff0)='./control/file0\x00') rename(&(0x7f0000812ff0)='./control/file0\x00', &(0x7f0000d98ff8)='./file0\x00') lstat(&(0x7f0000000200)='./file1\x00', &(0x7f0000000240)) fchownat(r0, &(0x7f0000000000)='./control/file0\x00', 0x0, 0x0, 0x1000) dup2(r0, r1) [ 114.169235] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. [ 114.185971] binder: undelivered TRANSACTION_ERROR: 29189 [ 114.204318] binder: undelivered TRANSACTION_ERROR: 29189 [ 114.212725] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 114.253756] binder: 16053:16066 got transaction to invalid handle [ 114.260153] binder: 16053:16066 transaction failed 29201/-22, size 0-0 line 2848 [ 114.275629] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 114.309650] binder: release 16053:16066 transaction 534 out, still active [ 114.316725] binder: undelivered TRANSACTION_COMPLETE [ 114.321893] binder: undelivered TRANSACTION_ERROR: 29201 [ 114.322503] binder: 16060:16080 transaction failed 29189/-22, size 40-8 line 2848 [ 114.327396] binder: send failed reply for transaction 534, target dead [ 114.327408] binder: send failed reply for transaction 536 to 16060:16062 [ 114.357724] binder: undelivered TRANSACTION_ERROR: 29189 [ 114.363806] binder: undelivered TRANSACTION_COMPLETE [ 114.368965] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:23 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x7e, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x4e20, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}}}}, &(0x7f00000002c0)) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7f, 0x60400) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x6}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000000c0)={r1, 0xffffffffffffffdb}, 0x8) 2018/03/02 11:09:23 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:23 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x2a8efa03, 0x50000) 2018/03/02 11:09:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)='cpuset[\x00', 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000100)={0x800, 0x2, 0x7, 0x3, "3427f4844d7a38a1b39311cc922e5a7be6dc7054a1d2610ad5578e56fd6e5bba2ff208a1987d21b10ab2defd", 0x4}) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000140)=0x0) syz_open_procfs(r2, &(0x7f0000000180)='stat\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000030000000000000000000000000000000000280000000000000008000000000000002d9d0731cb4ba46cca4b01f6e6ab644564", @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000000000000000000000000000000000000000001434174e4c7664d2d1d1e901f125bb1b6ffa02345fb218d84a7d67dcc01534761214ee9fd908d12bdb44b5344026a7a8b603dc33041973abca813be87fc82dab1981eebf0d6f9891e22d87fbc6484f310630a69eeea278261d6d9cdd"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:23 executing program 6: add_key(&(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a}, &(0x7f0000000140)="6e9a69efcdbc9cdb9953a6f0c1849225b1fe931d492ba46ce3312837e1bb5ffbe438b84b90111f5dbe0c5b89351102f97a7e7eda5c516bd8d1f8997d6868d2c8a19d7abb9935c054a55648a5b3960b5f5d277a82a46c3bb20c30c3948ebe0754186902e07bf224edcfbb7bc4624669ec9f3c70e20ce71d74d309ac90930543b6006ba325c3798222e469f41d5852590a9f81300451d98795390a293f8d779e7139232399194d40abaf2b3bd494d5cadf6a3348f65743a9dcb461672d45cea3a4ae98e455ec162f50f883b79915d67200", 0xd0, 0xffffffffffffffff) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffff9c}) ioctl$sock_ipx_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000040)={"18d6a7f68f4a74d144e6509fe4751c93", {0x4, 0x101, 0x7, "5fda7c1d0957", 0x3f}}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc00c64b5, &(0x7f0000000300)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000000240)=0xffffffff00000000, 0x4) 2018/03/02 11:09:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000afa000)='/dev/sg#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0106434, &(0x7f0000000000)={0x200, 0x0, 0x1, 0x1f}) socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40086437, &(0x7f0000000040)={r1, 0x5}) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x280da14, 0x0, 0x80000020000000}) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 2018/03/02 11:09:23 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000500)=ANY=[@ANYBLOB="0000000000000000000329532796000000000000000000000000000000000000000000000000000000000000845f00ffff00090000000000000000000000000000000000000000000000000000000000000000000300000000000000000000ffffffff0000000000000000fb3b8394633b94363afda9844ce19fd3000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c7d3a5ef73df522ed289f2870ddbb9cbc300000000000000026dbda9bec4db300000000697036746e6c300000000000050000006e7230000000000000000000000000000180c200000000000000c9b9c600002a97e74a12af00000000000000007000000070000000a0000000736e61740000000000000000000000000000000000000000000086ae516c8cec85de577b080ecc0000000000000c000000c9c37ee3085f0000fdffffff039c339ccc9d3a48ed928df372ea580c4e1342916ed33e3695d7d9834be51e927b9530d5748436bfa29d94f7cc9026cdc616841a24885cefe55ae2b41459017d53fb65e65f2c5e9499b9d9a457128682facd7d03c4ac5eb28790cab48460ba9a2e5f4008ad2918031a13543b2c5c0a55a15e16a2140fa22fe5ca69eef20981998d28d2db4397540578a940697dc372a009"]}, 0x27f) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000001c0), &(0x7f0000000200)=0x4) getsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000040)=0x4, &(0x7f0000000080)=0x4) r2 = syz_open_pts(r1, 0x80000) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000000c0)=[@in={0x2, 0x4e20, @multicast2=0xe0000002}, @in={0x2, 0x4e22, @empty}], 0x20) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r2, 0x40a45321, &(0x7f0000000100)={{0x3}, 'port0\x00', 0x2, 0x0, 0xffffffffffffff64, 0x8, 0x4, 0xfffffffffffffffa, 0x4, 0x0, 0x1, 0xc2}) 2018/03/02 11:09:23 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) gettid() r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0xcf, 0x40000) ioctl$TIOCLINUX2(r1, 0x541c, &(0x7f0000000080)={0x2, 0x1, 0x400, 0x13078c47, 0x1, 0x101}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000002000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) accept4$inet(r1, 0x0, &(0x7f0000000140)=0xfffffffffffffda2, 0x800) signalfd4(r0, &(0x7f0000000000)={0x3e75}, 0x8, 0x80000) 2018/03/02 11:09:23 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x400000, 0x0) ioctl$TIOCCONS(r0, 0x541d) socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f000000dff8)={0xffffffffffffffff}) setsockopt$inet6_tcp_buf(r1, 0x6, 0x0, &(0x7f0000000040), 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000006, 0x42132, r1, 0x0) [ 114.463277] binder: 16090:16092 transaction failed 29189/-22, size 40-8 line 2848 [ 114.466456] Empty option to dns_resolver key [ 114.474637] binder: 16087:16093 got transaction to invalid handle [ 114.478587] Empty option to dns_resolver key [ 114.481863] binder: 16087:16093 transaction failed 29201/-22, size 0-0 line 2848 [ 114.496085] kernel msg: ebtables bug: please report to author: Wrong len argument [ 114.508385] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/02 11:09:23 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x8, 0x800) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x100, 0x90d80}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000200)={r2, 0x3}, 0x8) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000001600)={{{{0x2, 0x4e24, @broadcast=0xffffffff}}, {{0xa, 0x4e23, 0x9ed, @remote={0xfe, 0x80, [], 0xbb}, 0x68e5}}}, 0x20, 0x8001, 0xfffffffffffff7d0, "ac487eba85512d248a2366987c84284803c377328ca1992bf05ccbcc0cd5d92f9a961b5e032e430f1d06e90adb5219d0bc04a6fdf94147da24ff943b0a6fdb888227ef770b6d83da31c4958799d6e122"}, 0x160) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000001540)) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f00000000c0)={@dev}, &(0x7f0000000100)=0x14) fremovexattr(r1, &(0x7f0000000140)=@random={'system.', 'GPLuser\x00'}) ioctl$DRM_IOCTL_MAP_BUFS(r1, 0xc00c6419, &(0x7f0000001500)={0x2, &(0x7f00000002c0)=""/4096, &(0x7f00000014c0)=[{0x3f, 0xf5, 0xffffffff, &(0x7f00000012c0)=""/245}, {0xedb, 0xc1, 0x2, &(0x7f00000013c0)=""/193}]}) ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000000000)={'bond0\x00', @ifru_names='bond0\x00'}) 2018/03/02 11:09:23 executing program 6: r0 = perf_event_open(&(0x7f0000536000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000000c0)=@int, &(0x7f0000000100)=0x4) r2 = gettid() r3 = getpgid(0xffffffffffffffff) setpgid(r2, r3) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00006ee000)='/dev/kvm\x00', 0x0, 0x0) uselib(&(0x7f0000000040)='./file0\x00') r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f00000b1000)={r6}) r7 = dup3(r0, r6, 0x0) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) 2018/03/02 11:09:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000144b8d1ef6a2c4c8000000000000000000000028000000000000000800000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) [ 114.508927] kernel msg: ebtables bug: please report to author: Wrong len argument [ 114.522442] binder: 16085:16099 ioctl 40046207 0 returned -16 [ 114.546312] binder: 16085:16112 got transaction to invalid handle [ 114.552653] binder: release 16087:16093 transaction 542 out, still active 2018/03/02 11:09:23 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda") getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:23 executing program 0: r0 = socket$inet(0x2, 0x7, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x200, 0x0) ioctl$KVM_GET_TSC_KHZ(r1, 0xaea3) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x9, 0x10001, 0x20, 0x3ff, 0x6}, &(0x7f00000000c0)=0x14) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000180)={0x100000000000000, 0x100001, 0x8, 0x3, 0x20}) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={r2, 0x10001}, &(0x7f0000000140)=0x8) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x8, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f00000004c0)=ANY=[@ANYPTR64=&(0x7f0000000400)=ANY=[@ANYBLOB="8411359e59f7578efdb10c76dcc9cc39becc6a49edd7924ec1a7bfa1", @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES32], @ANYPTR64=&(0x7f0000000280)=ANY=[@ANYPTR, @ANYRES64=r2, @ANYRES64, @ANYPTR, @ANYPTR, @ANYRES32=r1], @ANYRES32, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYPTR64, @ANYPTR64], @ANYRES32=r0, @ANYPTR, @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="83b00dfba9bd7e96f682e70b70a0dd501efb1fa0daef1205927a0f3f5d94b551fe8c04cbf00e23998907e57f3e5de2945b96185552147b15efb8a7b4dfb480876a75d3d3f0e4bba1d1d432dd65c48d5082bec23859c30256de02898a83124ca7d6fa2b52846bae7f3384f77d64868527e8789405c0ee17e2353dc0ed46ae7868aab08be0069f226ea60d01ca9bb3fa97b4d48fe36a7915585069585474a19d4b5fdbc27b051ee46a52f7b96868e5df37c2447b5423d16c96ca7d2e381159d016425e075f16e961368d401d7dc66c5dd8d6b12abf5d59419fd127a96f6acc26afa726820d4e1b88ac824d7ef1723bab54c4f49059495015"]]]}, 0x58) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000480)=0x8000) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000040)=@sack_info={0x0, 0x7fffffff, 0x3}, &(0x7f0000000200)=0xc) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000240)={0x3, 0xc, 0x10000, 0xffffffff80000001, r3}, 0x10) [ 114.552662] binder: 16085:16112 transaction failed 29201/-22, size 0-0 line 2848 [ 114.567234] binder: undelivered TRANSACTION_COMPLETE [ 114.572380] binder: undelivered TRANSACTION_ERROR: 29201 [ 114.573140] binder: 16119:16120 transaction failed 29189/-22, size 40-8 line 2848 [ 114.577867] binder: send failed reply for transaction 542, target dead [ 114.577881] binder: send failed reply for transaction 544 to 16085:16112 [ 114.607834] bond0: cannot enslave bond to itself. 2018/03/02 11:09:24 executing program 3: pipe2(&(0x7f0000f14000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_setup(0x7, &(0x7f0000a8aff8)=0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f000071cf90)) io_submit(r1, 0x1, &(0x7f0000b52fd8)=[&(0x7f0000587000)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f000096f000)="060063efff", 0x5}]) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000000040)={{0xffffffffffffffc4, 0x1}, 'port1\x00', 0x14, 0x120000, 0x100000000, 0x9, 0x1, 0x0, 0x8, 0x0, 0x0, 0x400}) [ 114.613862] binder: undelivered TRANSACTION_ERROR: 29189 [ 114.637328] binder: 16123:16128 got transaction to invalid handle [ 114.643742] binder: 16123:16128 transaction failed 29201/-22, size 0-0 line 2848 [ 114.669571] binder: undelivered TRANSACTION_COMPLETE [ 114.674808] binder: undelivered TRANSACTION_ERROR: 29201 [ 114.680317] binder: undelivered TRANSACTION_ERROR: 29189 [ 114.690605] binder: undelivered TRANSACTION_ERROR: 29189 [ 114.698869] binder: release 16123:16128 transaction 548 out, still active [ 114.705907] binder: undelivered TRANSACTION_COMPLETE [ 114.711062] binder: undelivered TRANSACTION_ERROR: 29201 [ 114.716553] binder: send failed reply for transaction 548, target dead 2018/03/02 11:09:24 executing program 5: r0 = gettid() exit(0x0) setpriority(0x0, r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) sendto(r1, &(0x7f0000000000)="eb26d6edbb48", 0x6, 0x1, 0x0, 0x0) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000003c0)=@nat={'nat\x00', 0x19, 0x1, 0xfd, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f0000000280), &(0x7f0000000c00)=ANY=[@ANYBLOB="d0d3e0d308697fe6fdd107adf45916d8ce3a00847dd5630e7196cbd700a35d2f0c93f066da556ba0e9cac0897c1da1b71f07", @ANYPTR=&(0x7f0000000980)=ANY=[@ANYPTR64, @ANYPTR=&(0x7f0000000440)=ANY=[@ANYRES64=r0, @ANYPTR, @ANYRES64=r0], @ANYRES32=r0, @ANYRES64=r0], @ANYBLOB="13b04fee93048889809a36484fa7e2856e82f513d34c66506100a9c2b7a9ae34b449e9ca4381ab20f02475fdd2ce8c783b99538cf6c01294b8d618bb4ab59eaef1c891b8156ce753f39fe2e2b9f45c513953aae91c7b68e3bd00000000000022e12f3b9e9dfd9f8b6a8ee37af85e04f3c6728cd94b15a071b262e646ccbdfab918d273af82b0417c7c975cd752cdb71fdd5f1cd406b549b0229e38", @ANYPTR64=&(0x7f0000000a40)=ANY=[@ANYPTR=&(0x7f00000009c0)=ANY=[@ANYRES32=r0, @ANYPTR, @ANYPTR, @ANYRES64, @ANYPTR, @ANYPTR64, @ANYPTR, @ANYRES32], @ANYRES64=r0, @ANYBLOB="d18b8e8e10e75478f6338be145fb9db648cd45bfb3b898ce254fecf46346bd0d4c87995beb2dd548211da0cc5b60a82db550bba3e35e553ad640e09672799c4691e32fd11dade2ad0fb8cbe1bd3620525ce76868d8393e1f6d5d4a8656da504970", @ANYPTR=&(0x7f0000000a00)=ANY=[@ANYRES32=r0, @ANYRES64=r0]], @ANYPTR64, @ANYPTR=&(0x7f0000000bc0)=ANY=[@ANYRES32, @ANYPTR64=&(0x7f0000000ac0)=ANY=[@ANYBLOB="ce804cb90689c89b81167001300ba889a0fa8bc874055aa76a093af38537273a9dbd231b5af563700736bc93c79de68073f880241a9a4433c01df1df195d9963eeac7853cc96dc445f4e5f5740e93c129acadb6ebe46ff01978e00e0fcf54ebabe1ebe60b4418cb9c6b0d636cdd6e9c93b"], @ANYRES32=r0, @ANYRES32=r0, @ANYPTR64=&(0x7f0000000b40)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYRES64=r0, @ANYRES32=r0, @ANYRES32=r0, @ANYRES64=r0, @ANYRES32=r0], @ANYPTR64=&(0x7f0000000b80)=ANY=[@ANYPTR, @ANYRES64=r0, @ANYRES32=r0, @ANYPTR], @ANYRES32=r0, @ANYRES64=r0], @ANYRES32=r0, @ANYPTR, @ANYRES64=r0, @ANYRES64=r0]}, 0x14d) 2018/03/02 11:09:24 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) perf_event_open(&(0x7f0000348f88)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xfcc, 0x2000) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xb) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000703000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00006f4000)={0x80fed, 0x11, 0x0, 0x0}) dup3(r1, r2, 0x0) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:24 executing program 6: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x28000, 0x141) openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x400002, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f00000000c0)=""/99) r2 = dup(r0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000040)="e74f2df755be1c40aa15aad0e8a27167", 0x10) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000180)="3aac42d848d635e890fce26bb31116c9", 0x10) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) 2018/03/02 11:09:24 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x0, &(0x7f00000003c0)=0x200) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000100)={0x920, 0x6000000000, 0x2, 0x1, 0x3, [{0xfffffffffffffffb, 0x2, 0x5a, 0x0, 0x0, 0x800}, {0x20, 0x7, 0x7, 0x0, 0x0, 0x4}, {0x8001, 0x8, 0xd10, 0x0, 0x0, 0x800}]}) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@empty, @in=@multicast1=0xe0000001, 0x4e24, 0x1, 0x4e22, 0x401, 0xa, 0x80, 0x20, 0x63, 0x0, r3}, {0x5, 0x400, 0x2, 0x3, 0x20, 0x7ff, 0x10000, 0xffffffffffffff7f}, {0x100, 0x1000, 0x3, 0x80}, 0xfffffffffffff800, 0x6e6bb1, 0x2, 0x1, 0x1, 0x1}, {{@in=@multicast2=0xe0000002, 0x4d6, 0x33}, 0xa, @in6=@dev={0xfe, 0x80, [], 0x14}, 0x3506, 0x3, 0x3, 0xbf7, 0x100, 0x1, 0x8}}, 0xe8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000b4e2a7b2d838198cba30ff151d5355064a00295e105de2e0eae6bc437a15bf1bc672d28d43ab1d50a64f934185c7209de6c4ef4aef22cd194578593a838960319a4a41ff5d9ee677e94903ada0cfed6fe49741c693c26ca64a1529add581fcb8bbaddbd4ff781b0bd8d06e53778f661649c2411d1e3db242b3bf82be1e6d50bf148357cb0bdf91a30e12e30a0e63bb03d6684dfca6686dc399849124c13b3abd45ef149bc659b0f5831ec017ca13e0892715090d1fc6"]], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:24 executing program 3: socketpair(0x80000000000026, 0x0, 0x0, &(0x7f0000000080)) setrlimit(0x9, &(0x7f0000000000)) memfd_create(&(0x7f0000000040)='I\x00', 0x1) 2018/03/02 11:09:24 executing program 0: r0 = socket$inet(0x2, 0x1ffffffe, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) uname(&(0x7f0000000200)=""/201) r1 = dup3(r0, r0, 0x80000) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000000)=0xc0, 0x2) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = memfd_create(&(0x7f0000000000)='\'%\x00', 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x544, 0xffffffff, 0x274, 0x274, 0x0, 0xffffffff, 0xffffffff, 0x478, 0x478, 0x478, 0xffffffff, 0x4, &(0x7f0000000040), {[{{@uncond, 0x0, 0x100, 0x124, 0x0, {}, [@common=@frag={0x30, 'frag\x00', 0x0, {0x4, 0x3, 0x5, 0x0, 0x2}}, @common=@unspec=@cgroup0={0x28, 'cgroup\x00', 0x0, {0x4, 0x1}}]}, @REJECT={0x24, 'REJECT\x00'}}, {{@ipv6={@empty, @mcast1={0xff, 0x1, [], 0x1}, [0xffffffff, 0xff000000, 0x0, 0xffffffff], [0xffffff00, 0xffffff00, 0x0, 0xffffffff], 'ifb0\x00', 'vcan0\x00', {}, {0xff}, 0xb7, 0x6, 0x1, 0x10}, 0x0, 0x110, 0x150, 0x0, {}, [@common=@hl={0x24, 'hl\x00', 0x0, {0x2, 0x2}}, @common=@unspec=@helper={0x44, 'helper\x00', 0x0, {0x0, 'tftp-20000\x00'}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x1, 0x1, "9ee150f5bbd5a6cfd2cfd30d9079a3d1f4428fa0246f1c0c0caad7f1962a"}}}, {{@uncond, 0x0, 0x1e0, 0x204, 0x0, {}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x3, 0x1000, 0x7, 0x7, 0x0, 0x2, [@local={0xfe, 0x80, [], 0xaa}, @loopback={0x0, 0x1}, @mcast1={0xff, 0x1, [], 0x1}, @dev={0xfe, 0x80, [], 0xd}, @mcast2={0xff, 0x2, [], 0x1}, @remote={0xfe, 0x80, [], 0xbb}, @empty, @loopback={0x0, 0x1}, @dev={0xfe, 0x80, [], 0x10}, @ipv4={[], [0xff, 0xff], @empty}, @empty, @dev={0xfe, 0x80, [], 0x14}, @local={0xfe, 0x80, [], 0xaa}, @remote={0xfe, 0x80, [], 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, @empty], 0x9}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x8}}}], {{[], 0x0, 0xa8, 0xcc}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x5a0) 2018/03/02 11:09:24 executing program 0: r0 = socket$inet(0x2, 0x4, 0x0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000200)={0x0, 0x3}, 0x8) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:24 executing program 3: r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x440, 0x0) mmap(&(0x7f0000df5000/0x1000)=nil, 0x1000, 0x3, 0x2000010000031, r0, 0xfffffffffffffffd) lsetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@known='com.apple.FinderInfo\x00', &(0x7f0000000100)='/dev/binder#\x00', 0xd, 0x2) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000140)=0x2) pipe(&(0x7f0000ff5000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000001c0)={0x0}) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000640)) r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x300000b, 0x10, r1, 0x0) r5 = mmap$binder(&(0x7f0000df4000/0x4000)=nil, 0x4000, 0x6, 0x30, r0, 0x0) munmap(&(0x7f0000ba8000/0x3000)=nil, 0x3000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0xe0, 0x0, &(0x7f00000003c0)=[@decrefs={0x40046307, 0x2}, @transaction={0x40406300, {0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x58, 0x8, &(0x7f0000000200)=[@ptr={0x70742a85, 0x0, &(0x7f0000000180), 0x1, 0x3, 0x3c}, @flat={0x776a2a85, 0x100, r3, 0x3}, @flat={0x736a2a85, 0x1, r4, 0x1}], &(0x7f0000000280)=[0x0]}}, @transaction={0x40406300, {0x0, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x28, &(0x7f00000002c0)=[], &(0x7f0000000300)=[0x48, 0x38, 0x18, 0x18, 0x78]}}, @exit_looper={0x630d}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x38, 0x30, &(0x7f0000000340)=[@flat={0x73682a85, 0xa, r5, 0x3}, @fda={0x66646185, 0x6, 0x2, 0x10}], &(0x7f0000000380)=[0x30, 0x38, 0x0, 0x28, 0x78, 0x18]}, 0x1f}}], 0x38, 0x0, &(0x7f00000004c0)="b35899e26ee85429071cbca3c01fe675bb757443851648972f8f30d4b326435a4bf1970f0b7ccb42713eba5eed9d671aebef0af726d589dd"}) getsockopt$inet6_tcp_buf(r2, 0x6, 0x16, &(0x7f0000000540)=""/106, &(0x7f00000002c0)=0x6a) madvise(&(0x7f0000a44000/0x3000)=nil, 0x3000, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000005c0), &(0x7f0000000600)=0x4) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) 2018/03/02 11:09:24 executing program 6: r0 = socket(0x10, 0x802, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x1, 0x202, 0x401, 0x3f, 0x0}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000140)=r1, 0x4) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000080)=0x4) write(r0, &(0x7f0000000000)="240000001a0025f0006bb404feff051c020b49ff6e10b500200700eb0800030001000000", 0x24) pselect6(0x40, &(0x7f0000000180)={0xbf, 0x6, 0xfffffffffffffff8, 0x6, 0x7, 0x9, 0x8, 0x9}, &(0x7f00000001c0)={0x8000, 0x1, 0x5, 0x0, 0x5, 0x4, 0x4, 0x4}, &(0x7f0000000200)={0x6, 0x2, 0x200, 0x9, 0x3, 0x5, 0x7, 0xff}, &(0x7f0000000240), &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) 2018/03/02 11:09:24 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pwritev(r0, &(0x7f0000001400)=[{&(0x7f0000000040)="46eb861098856380c827d68ce7ad9abc24f04455812bba68793b17f22dd23e2fb45c55b648a2bc95a9fc5c6868d9f2851559dbc719c3c2a55b852c0c2b5c46c662fa9a200e71d2fcadfcd2199c11e68b3ae9f6ca9956b6dab11400eced1b6f3900d749f828a4ee3f593874a5b59b7722ab95546c0af9793ad7ed5d513d5015514a7d9b9b47c528cdc18640f7e9a4edeae63613ba4b7781c07026037c21bc147033c405", 0xa3}, {&(0x7f0000000100)="6f923d2f0850dca551915a60bf8e3915ff4562d1bba221c89ec3afbe527b2ded35fe752c4f089e4fb8765404a5aa8967e177", 0x32}, {&(0x7f0000000140)="391fc9ee80fa00f4c9bfdea3cbd13948236ef49731bf2b5c299a90e35b7f02e63eec3bd753b35c545c80c182db1b123a56ee55a7fbda2dcd546b50ee33406cb8460753d2c6eebb69271e61e5e5de8ffefc37ed149fe7629f265721fb0fa076639c423e5a86b9d462e5c1ced2245175c5e257a57d1d8a5802f52b43c37a0584c026f5e0da4f64abf44bb5ed44da28493ca0659f26025c1fc435e40435f5203f8240b28e8acb183f1b45271c686705cc60b3721ba9613beacefdf02fc5fa060b06580ec0e74ea35f8140b5bebb4381e3e824f992312abdd69dd897a38f719e6ca177dc0b68e141e334b70a6becdd03a57c77dca291cb5500c69179a46ff7073ac6016a9346c14572e43590f06fdd109e83f27464f414b01265100ebf8b48b913f6625b1a3bdc68d1e41541e11a975166a58eea7f27b6a3b260f1e39e7636c64efc9cf364183c7dc1b9e96b8db349f0ae80a1a3e340c0d7ad6ce40ee75db6e105578926a512bb6aed3bf3cef45b0de0439d45c2a06f9819fe8a108812c2d0559a4354622b524dc1d1438805c3c827fbceab96b3dc8d750c889c38a03618ff43a285539392716531107b19eb2da6f18ac93bdfa91b677c512d99f70c40e02a0c60528cbf9e78ef279ee5691dfea098f7b407d971aad1cdd9de49780a4e15721e33f8e910e6ada063bdaee6d1c0487db0f7a4151c91a7df03ec78892314656517da92dac919f2a61c9f7e622cc16998c5c9c007f8533833ac2ba9f7efdc67f19d81c4876f95210885e4d66bfb402e1e86e91c473f006ccd37c991724e57e05ffa222247b0b31deb666104dc1fd1d475acf29d053b421c8f9082666472d26f2a2704e89f6a91643bc0cb772bc2b2b32fef2928c57ebdd7d2e7c616d584b24fdb0fc781898199f423f46e5a0ad20aeedee290f131a90a262d7a8e26afd9f3f70994b315b3ea85a37b3075b0ba99861cf78e419fbc40a73158c8d136d23be63c4768ed667e1e03a12150b3135ac5df6432a0d142a9313dbc0347299311ace179a61cb7dafdb94cfa3579ce29fe654f293ebc5ad45e8837e909bf27f292eb06b568bc333757a3a75dbf1f1f319fa58b7c6a32778e05f6737a2d91eb9d6e92f2bb70a3cc21cfc7e0a2db932e6c5eb6ab1fe9d486a5bd19a0bfdedf22bd6e0f8bb2cc8a2760f853a8e1adb16c809bde3b34e304769afeea417e72ec2cf37e808ec9dbaf72f308998104610274b8f755e2b080c9abf65c035fa6154d26dc86ea4efb6d42e68c84e0ba9940a4cbdb58b69e49a041b5566c08a84f97d555603da94941b42cde2ce595c246a4ee3478923d8c3ce7b71454b8962b457b299c59bea2f63cfdfde5cbc56253639b4503c405c696f41d8b0533281f8d9bbb1fdbc49b6d87afb9cce326a5d4848a7dd58bb298d474097475c84e8eda47c106be1506c9347e4e6ce141ad67f1f99c1b1a3a41ddbf92f73f32f812e0730b23aeedb8173edf86b688cb84034da36e62a2cc7654bb6d338ab324aba5937a98ae7cb9dca677adcc1e3d1dcd6fb6a4c640239b8d098e2e570862c42f3c7d89fa88e59929f5a4b043a04bbe96506417dde89b126a8f1f40ea268ea4707aec5cd1b4b08dab6ca7d3bdd34e018d3265f124682bf92492d7c6196c81565e2ecb844c87d109353d2aaf97fd44c363fc06202694b6f8da317f0f7dbeeda6c9e46728b251d7265599ea64acb764eba0b4bf4afa670647a0c71c7155252c2625ab498239254b625cd948b7167204e40d8fb4c213b0902979e596a65c65914abe15d0b0fab1050cfb3a8c8bcc7e9d278a7b39137dc3f17b6ed0a04f5175ddae80feee0f225265ec510d7cc4fcd9602d987730e3142d74620013dd1d44b8575a0d2d358b6072aacc5f87019ce6d9a76affa85fdf74ce274ae2da0cc7d60ada98f12cf7ed8dd0ff4b8d20f494e3bfc595fb87e024e7baa705cbc99a302cadd3c34d9b47d7920b7987afd92111fb5aca5bc63f41cdfead47dffa092353f2a6a8d4a74b4b05b103474eb693a16379e6f7a8b756817466f9393d8ad11b66e47b02ba5e62e7489f9880e2eb59b20ed9596e5f9ad27de92c14534cde4ceecd142c800fe2fcb81ff010b52c2326b26a6cc26813b3aa8b031c79c9163eb590e701b7b3b93a7a985d12aa85e589b78fdfe710917076a3ab92f69ea039848d7719c8b336b27c43126559f9ec8dd52d72968c4e72c37945604173be9868b157d413b819656560c096bd7fcf4c4f269b8164cdfe853a80b302ba15dd47357ff75c76a65a4f70b98d82a7a07a8c3d50ac0f8a1543eb1c45581df189a9eb3a8c6be0868c23f2bda8dcfaec4896a7601c09a921e6b57858c79b3fb63a34d7f0db6a46549cae7f76005ab9da7b7a66248571b6ef7130c376435def1245d49ed55745c1f96bdcaa27e534e07cfc4c9263322e825f072f3a980bc37ac4303babea720b999c3567feded9872e4f9ddda2feb98620aba1632e0e4248eedd871c09dabefaedccd7ed18c7417f2fd78bed83ff54696527e4467a17b6409bbef1c8a3601609c60c9ed4b75b55decb5de4cec5f5d36ff224d02c9fd6663b8e0dcd5f408d55f29ec8bcb975986ec3c89966be21f542fa0fea85bcfd73f41583a96d0ff9c635bd42ddca5f4843505063fc6c1ae942700b8329f44481d9ecf3a1006a92f6fa0df0fc60fff3f16c1b34674043ee953d48082fdc60ec518a34d8c00f19bcf9a873f927edd93d0f8685fd269f28e4013678dc072c2e44197f1f60392ea8a3c549fe92398dfa4cc8b4a23b4a7de345202cf64cd9a5b93171a6afc559c837a4515e2ccd5faf0ddaf38734529a0ccfaac25ac3931d94f700c3c51e1b542dfce5bc9c08dcd913524937d6598e4e9fe0ce6bc06d605e66b2cf96cf1dc3f395d0c52a0ed070cf49a2e601d9799d893b5771ab8fb9c917a0660d34522dd3c7f871371aa442c13c0751513b82d21f5b7e1d828c63b3085d0b8b25cd2842fac7e4132fd55faad2e111a2397638ed8d729554f3f4837dc59d29ed5cd0bfe7fbe35a9b0c546ed0e8244bdc2af6fd1dff59faf9561fcc28808788ae71b66bb17b75dafedc5747941c1ce8f6c552b24bcb953fdf660c1f44f45ef4ec5f78903988b73b7d7019802ed553ad877db5d30ca207daa835e015f50e1c4fd1e6690e0dc02cd426cf80ac97d6d266c9abee1a83a9b1a15edf046e67d5ee46648532ba227308d541a69b9dc40ae8ba437776c31fd8f5d0a86309420ebfcc4b4315c07b3348a194747fa4c2052e59c9425cf77c04fe40f0e263285c3d53cfd679dc7f0d9cf361ba76025c1d9b52664c0764ec0ed95c2265d51336d42b626ddd6a805f7dcac1fce29b275c4b5ea1d435f9a4ec0fa871d153d2972f29c80ffac6571c502c79894b635ef8530b8c44d13bfea5b8259db358c728610128ddc20cf5777c005d39ab0c265a3ae475bfc6494442240a242e7915db9820d19941a407a1a5f43947c7ce74034fd82c42dc86d1295434a3c9e09c84235667b28a8bb1fe47f10957a1c6aea3716c9f30ee06f16e1b42c3528442740070c3bc0cc8b5c6b332521a3623f243b9cb5e588778688fc3c884740cb8b7481331b942dc137acc3717ff5df6962459069e736dac08d4474dc6970cca63b77ec584d994ab9a0fdfd413fbb403a6415ec6779434c154299c02dcb06c64b35f37003064385c20b1b8e75d4cca2a0a292e891f4b92b03fb00575bf27a156b80b1960dcb106e8c9abbc0886058f7409d39c07a218fca5ff9a98599dac58f5cac902c4a2d509870dd5a3e4384832f7e5f865abcafe430644e919ca5e47b3fed37c942a2aa8e69d977d1cd1d4690f4c4c1ff55e280b6d807b6c23b5a9db1b2c27d43964c9f7445ba9077ab0bf8524f38bc4c3f7202fabd58372b0fddb71e80775a020a89dc88c6c586f8d7a1d8df82e03ffb84fff4c1a03a1e4d1aeaaf8a5cc81ee888398316b77cb6dc783b027fc0445406f8490a1d3c30ae8cd79be95b43003392c34afd35483a216f1961ead011bd723e353ec5459414271e1469dbfe9ce8650f300255698a2292a18e26662e3278627680c41d600d6212a9a722bd4c38e49e31ffe318254d4befe7d50b9d5e81d8a01adadd55b55c9eef805864be3fc0b7808138ce9064059e2526a6ed2792c6592bd2abc3aa53127225f3bf0ec9d3441d0421bcb81de351731a757f734dea631c9947877c6520531fb395251ca78551ff5bdf04830bf3a97498b66e90cc62b47a5b01f9cc3c14b4fe7eed9b5ae643e49913e1d8b1f8231d3b2467fa5755771454020ad4603d7ac022b1fb9d2bd41971d5d7d1493e71f1db44545ec73539e31ec9350638cd3705dae54523ff0d8e4cac5e5e2c592daf7545d4fbce7156bc7ec55f7b1dc9ea04f04438994850dd8e1ff855e4c245416a96022f609251499b7f50dc1ca09bf5e7dde110bb8eee066da6f9bdfce3a9ac584b31351ed62b17288cb5ab3a3eabe729e2f5da9064b43e8c6a04cd409c731876a07f0d8cdcc198100e6a24dd6cf8b201dc794837e55461e3fdddfc5c9bd5b21730251d8db47983db7c73f6bffcb3a16138e74c8361c171fd6355f3de2f55528cd3acfddb741d9565aec5ff291c593612d653a31e1e5039665bcf511a874c271cc4958248bd211fee05c2441f7eae789638876bdcc10deed285645c1d54bd8efea74448048f08d3bcd8ee43c53db3d9f559f992168fa964f6fcb59c0cdb52d8417cc07b5ce02fe76fcd8558aa8d9e6c286ccd7d0ffb9c28653cf61f6185a7a662dbc5cb3170fa39ad1100385169b23a031ac0106c8b8cf0d3e8476fc494ea1f0caf5a97ed23c9e0763deb5db4e52cb3b9848befc1f67204626b9ce93dfd79a92c721d1739a9c6af1e9e17870b85cb485e1ab4a61ba146ad86bce6df241d6f4e2b9c0f1bf9b60bba9016764072ed5ff322149237c724e726d004611238afdfdbd6be84d734587d6ec08f3c061ea90cab17d9628c8e23d8dbc53666567051eaf99a187478d9b4fb87dc2ca4eb33c64af68a3f46cb8607cbfaf33222c665cc26cc5bf7aba1d15c444bd935a1fd93a4c112af51b707ed299bb0691ec84a22d9c0cfddaede9258851075c7ab77109e06a78efcf67b4f68f84b063b4456a94a733f968f45a7f1e50a52f19f8990f82a45e5d51132fe77b6ce9cce432ee6d819aaa8343bee6f247f33c0c6e3f2a18c760d621124e784afbbdc21483d228c397a1e12dc290f6977ae334d2e8337cb17f707d78e9960aab66f9a8754cf16f3fc4940c725de603a25386cead21cd789037fc013572c0cbcbaaad7cc696189d463242c89a84e5359a11de24c0fb385af9b40d49709cecc89253be89709c8d54c7c9281c1735b86d6ff695fbbf8da3f5b43c37903fcc61360ac5e2e26ef75ba29017719885226af5cc4700f8b97677738d2c3297d97f543343f03a2ce41af2f39702ce8f75df64c4f927c0abf016f2f0de1567c0fd3962151eca0a8be76c1870c9197ea3dc4538288c3fc9a18391bfd887627f8fbd5cf06a184b2e2e9258703d5ae5ce7d4e47c658af2f6cf9249a73162bc15dd74ad9e358075a41898b7b3998ebe57c8e5a39de562e19febc39105b28b36c7187a4b48f68c79734a5ba26b79573c9daeae4a5a5f2bdc2759c42475cf5f45660b8ada309e80a6b0c56dbeba64475da859ef2006869499de64b842975cd7995850d0433cca331ba78ff6be6b406eed98ca7db37bebe3c2cf0297a5a7d05c48025dca2f9e102cf290affd42a5c10e8f6122b72f98d52f5a6269e8c705ebfa9beec71", 0x1000}, {&(0x7f0000001140)="6c8d713f957266b9bd889618292f544468a2a788781019ec0eb25482929940f2768d8ddc654d68437d5858e43416599ec0aaa2ba19c209a9376623057d2e0b7f39a4e1ecbc8850b6b3ec3ee425eb557dd7aa872d0f72eb26b28f169532e0a7436336d682c928ffb686f7b9585d69d524c6cc7e8fab49e50633aaa1cb4ff57d2aa0924cbd9dae20ed56c6bd5aa06bef980e0e86173d64bfb3bfc7181728373cf8d58d6e29ac4281", 0xa7}, {&(0x7f0000001200)="ca768e01e3fb6c89fc2ffda818c51a15be0bd6b0a7b04079b2650760fbce575238651a76b3cf9429641e15ee4be89e6266865e560491", 0x36}, {&(0x7f0000001240)="692536d566756bc9bdca598c983988fc835656f8b721a1a3ec48e4f7489e33c458fca223ed34a50da4f2eb8787f5afdc079f5063556d9e14b63da4619acc410dfaf5", 0x42}, {&(0x7f00000012c0)="e8aca641d67c7d9eaacef960e58322d824da", 0x12}, {&(0x7f0000001300)="31948f7573e3bbd4cb70859c87ba644bc77e959d0350757406ece1e575ffc72a4018717bfe6ba9b11b9bc159f38dde1a4a92e525a7bf0c085c", 0x39}, {&(0x7f0000001340)="2dba3ef2a6650d20195aa23839e496891b93b5fe77fcc4206e2c3bb6532cd2155e2040dfc6dd283ce95ec7e002275ab446cfbc2ff01aade695767f025084bdda23d1dcf48c618bd3664bbcdec4915671863394feb201a488640be08f97a7cb63c4990b2a7f05a5d7a11a675ffcf1fb53baa9719f34d52f60493aa93764002c9ad217add160bd142a113a3c437107ef62acd4a2c7e519c6", 0x97}], 0x9, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) [ 114.879318] binder: 16142:16155 got new transaction with bad transaction stack, transaction 551 has target 16142:0 [ 114.890105] binder: 16142:16155 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0xfffffffffffffffe) accept4$inet(r0, &(0x7f0000000000)={0x0, 0x0, @rand_addr}, &(0x7f0000000040)=0x10, 0x80800) r1 = socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 114.931790] binder: release 16143:16161 transaction 556 out, still active [ 114.931800] binder: unexpected work type, 4, not freed [ 114.931805] binder: undelivered TRANSACTION_COMPLETE [ 114.932160] binder: release 16143:16156 transaction 552 out, still active [ 114.932167] binder: unexpected work type, 4, not freed [ 114.932172] binder: undelivered TRANSACTION_COMPLETE [ 114.959172] binder: release 16142:16155 transaction 551 out, still active 2018/03/02 11:09:24 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:24 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x20, 0x55717e1047824778) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000100)) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000040)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffff9c, 0xc008640a, &(0x7f0000000080)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f00000000c0)={r1, r2}) ioctl$DRM_IOCTL_GEM_CLOSE(r0, 0x40086409, &(0x7f0000000180)={r3}) syz_emit_ethernet(0x3e, &(0x7f00003e4f72)={@random="cd390b081bf2", @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "0f2902", 0x7, 0x11, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr}, @dev={0xfe, 0x80}, {[], @udp={0x4e20, 0x4e20, 0x8}}}}}}, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000140)={0x100, 0xc6, 0x3ff, 0x7, 0x9, 0x912c}) [ 114.965648] binder: 16174:16176 transaction failed 29189/-22, size 40-8 line 2848 [ 114.967083] binder: undelivered TRANSACTION_COMPLETE [ 114.967093] binder: undelivered TRANSACTION_ERROR: 29201 [ 115.009744] binder: send failed reply for transaction 551, target dead [ 115.016468] binder: send failed reply for transaction 552, target dead [ 115.023179] binder: send failed reply for transaction 556, target dead 2018/03/02 11:09:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x6, &(0x7f0000000240), 0xfffffffffffffe33) bind$alg(r0, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x6d) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80000, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000040)=ANY=[@ANYBLOB="070000000000000019000080020000000700000055000000008000000200000001000000000000000000000000000000070000c093b800000312c800ff07000001040000ff0300000400000000000000000000000000000093ea786a0800000006000000ff0700000800000008000000010000800000000000000000000000000f0000000200000001000000d50f000052d700000800000000020000000080000000000000000000000000403ffb2854060000000700000005000000f9ffffffceae2c2f000000000000000000000000070000007f00000004000000080000003f0b000000010000ff000000000000000000000000000000000000c0010100000400000007000000070000000800000000000000000000000000000000000000"]) ioctl$sock_bt_cmtp_CMTPCONNADD(r2, 0x400443c8, &(0x7f0000000180)={r2, 0x4}) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000002c0)=@int, &(0x7f00000013c0)=0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000380)={0x0, 0x1000, "a9789c85ed9a9ff23147ef028639b465559aea4a04afe99fd8b6667c69a8f8728ca7317b336ce48dee874946e6337b8c1bf4f5f0fd0c5a3d7eb075c0f940edc69c4741e2c5234caabaf2c555ebae0cfbbede491656d44ce9cba334a6ec5d2ab2299c9acbf811f2dbbcd9ab910b2e95a565515fbb7bff4c44ad3b766086eaada75b752750311263161551eedb70b32e47ec3a939f270663d194e1162e0eaf4165b0cb42eefb8e10295a961c5e95643bb0c8245b195511d6bb047a49b155ef3362f7437ade2534c4c9e9100d8ba3c1ffafba79a5909c88ccb4383ed143c69d2e8015041418a3e7cc3ca747cc0321448b5a058e0059e7df8650f78fe3821d5d538f054baa7f3894475702ada3894a8c61e30c47dcafcd5d467094058fc1ccf553270c30a192ecd3b5263059fbd95748d3c62d6756ced7973708c7263be05142f64a53ab6d3e21760e0bfbb17194ef5174bb098f420f7761657bd14a7b75ae26d8781ccf1399b4d74681640caad716e047cc96834b389c4753884fd8972eac8989704cce5d33dcd4263a3af99311923b20490eab349e777fec54261a895dfad3707e41ac58ce73c07ab5d57738aeb598cf54119b349452302f1ba31c1ac9c5538efd866cf0a2d7d6d1e122bb04ee45cddd77b6a1633bdbc88211fb8230b3199adade5d2cf52877963f2830bcb473adee187df347b7b859f5d0ca3fb4f3f554325b359580c3646ed75a79df0c39438282c529bba4fa64d21a1e59326322b04186c6116c4ff4f21282d2cf66819af0a46e8612eea5b3e5c4a4e698a9d73010e72bc98edf7b4be3a4289c2a8fade1e03d4ea1d8c90b4c1335e85c46e655153245e24e1e33a6142fa9165397c2c14c01af628c2d12071a17499e771e38cb8813800f52d474c8fe7ea581d5410f981f7e612716a46442be5b3f3612a5eaafb98c528002bc90508ef9c1c32aa647ec6f740c06ce2e5d8bc2aea3c0aa46590a1e250bdf4bf8f1ab672ca6450cecf44fad25f85bf9f34fe5276ca1241b7e1c991c8ad8f27538eddef1954e3fde9863e95da06747e1c718f1cb1d2fda68d40946ebc223ee53c9493636b2476a1f2a615b1388598fe22459f09a197545925ff328be8e33b6e4bc6d3582209897e3086a40eec5714035818b12e0907bdf360a0d38c4608dd2ee9c1703bd56cc90e18edf76da51557385cf1ddfd532c22a7894ba7230fe3d90dea724738b84a77d3f5ef489de5fbea7c65a651055e28df087e89c528319f7038a985eb49906ebfec4a87833a4e05c54d67f3bca96d516dc899c674b7970c058726a4fd280e0d24d420d565b44a9dec73b0c4cd260055b273efcf0c2621e9be47febfe70257786e9410f5203e1350553ace27b3ce30474f9cd5bc48c7d59af81cb46c2ad180440c75e5577afabaec5f93b83e4217d69143b9405b3ec475874d7c6237371bf3fdeaa903e4c41f5a05bf24264647eca88e27685c2477b25d9dce78d69914a9272f04727b51bf817035c102d9b5ed1715ee81ba8df8a9bf4085f4c1f92ad813b5727ba0767c7c1ab724fa650e2e3cebc174c9d5b2143d36b2e84b1a81a50e14443091da358a0f3b6b28102ba994b1ed85e9fc6d671c216391fe584b933aa5a0368645fbfed6a364227877d15793e119a5eaad1966d7fa9438c0b26e2b5fb86ae3afeb307184a492bb6be62303b769be5b6c82e9428626b8e8a8b2de56fb261020a1baebe01bd3dc41280271191f218886e15fe0879dadb176144572721aa7aba8885493bddf4e40adf81c52630888008573b526c4805313cfd2fc7b6ccd4721b3f2c3fe1dbf22360535f420623ae361f63ff88f0e9486a660180a6ea3310ccab70cdee627a12f4a01d34d5dbdc4eb9b633960bc5434f3782eff5d2481a7a4f66bf9ec7b40bc9e83c5b4f41143883789f6a318f8e10aeb284ce60a26f9a19198003816bc7bc7d565cc5be67d5020aebfab9899c7c97805e82ea6865bf27cece3f71f582cf41b2b0dbab601a0644458aea7e479a69cc262e97d0fa751a2c7dfc6867ef8c6076e359fb99ff90f50095d0b870657747c18b7a4868479c0954af01208d33078d88b140ca4c3151884b7f08438ffaa3975b534056bb150bc06f468c1f736ddaa681ad7fbb74b61bd763ec4050d0650fe6a2286d54ca38f33075030961daa57d5fc2a44ada1ac46ad4029f347776666b3bd29e5441fc37de2e0594d4aea64d419742ed2a9f6c552c886670f4d11f6a9b492706904e509f001c9d8966bdf6fbf4613df3fae648e831562d3cf7b87bfa32cd67f71140b033166487a943b87d14c2cdda52a353dfc1a307d418e3a2637a062e0e37a22f39ac4bd0674d9d5dea01b05298909762dffb96011df83f2c288c9d6259dca6b93bf87fadb3c681e212394e01318ed1a1e6764a58fdfb3913b4044aada34a4f88804aa8ab46e1d914c28e08cfe8b5422cc96b01365573875fc0540979509eeb60b0d1ea8432a58370a7eeb99001929567dd392b85fe81e1eaca450448252bf00bc79a98d0d2e99a7b4e846c2830ec5324132d692fa611e8bf290939a6c22d32d46648aad98663a13e9325256cf80f6266c2244970211d1c42c4a555bb721e058ce4c37c4d33e12a7d5669a5783e0b106fcf16c530a41d92bef849673d666f30f715109efd2a9f5736e5badc0ebf8a58659ff33a3a13bec9a7b80505ab1545b8a4d385abd717a1c3547051dc804003d8c0630f87281e2003d1f3f6c6f4a2cf128758b144b17b6d5effcaf040a92c421802097c0cb7312c65eb14a1c85fafe412a00188e6e472177b3d941fcc062afaa61446e71faab631dc939e5f0aa04f47372c952f2a280423b3f95542234a2b007a97c0cad72fcabd9002b7425886b73029656253535702faea48d956a57b2c7f26890b58909866a3a20be0c5cb2eb3aa34bc6bb036bedea73276f23197c15803f87f05b8d0f5598ea7313936bc80bf38651d7ccde5b9b6ad3d90b09e4cd768f2d97942ff9be0397431fbe2664f48a0ab60dba8c3463b34ad7e6d6375a92ae2b0494bbc80e4a09c5e16cd9d50f6aeac14cb549d7e213fcee76c6ff4f99d489840e425f9000e12470b72e3bf0b9b0487d051285f632b25b285ddfacce75704e89cb65b6f890871ed7226dafafdbda8a03d82c8351fe1936074e4e200d66fa3b15337f161a590bafd55badfb79b4edb3ecc29dfc191b787f7538ec6944eb1a230e7a917272b304821444fdc85f2a57d27d1bab58f3f788bf54b9fa23b06448a1588d10fdcacac51533c0e9e4d240449c57b07a6d4b303d77a3fb76499e994b3e3f5d7fd276ce68c326607f2cafcaae7604364a851f03c029bdcfe4e1ff2c7bd1255a04257a753e33b989807d5b4e7720259fea014dacf6ec9d4ef807f4f8e8034f4cf730811f2ec4d1c6ca8769c1b6b571484b09366596b043e9da9f3c2bdeebd0e7b8d79e6ee435deb2a30154ab410669dccc8e9764d41f37188c94d6483d90f9740213e2494cf424443d5433325bd731894cc6b0e87321044a90b95d60b7c32f9a222bb705af451291c9ce8068185e86af80b770d7ca75bc1aa2a30941c8ede168d8dee48bad6a7fb2482bd5b435372436f01c96bdcabb580431accc69bd1bf3fd4c3329bf7a9b75b37b4440365f46e2729d398c2911e69cf7aa2be192a2e436c904e8ef35db90956d355c4a48ae4fb1b226d2c5195ebafe55f5c35ed46d5e8dada2473281f07c02bdeb69178797eed3cbb0395abff55de25e1725d7b3013f128e309f8a57336116bdfd0464b7d412b68b03a233fd0d1947f935fd90e5e736f50948a68635cb3f9ab6fd6e0af427d27232cf75b5ea0a5f09a7bdbcf61211c023f170ec7845687b5256d6b2f9dac24856f72e8e4845fc87dc1b2a64bec5d076ebc64504c4faf23912612465c8b85b891fd4e3fa0ddaf29dcbe991096864e1ac5cc8ff20b8620c3b2cda56935cc98a35e303fecf1196d6c5b84f5f069155f2cf0289ede8ad1dcc91edb5a3d17896e3c0f41070ae2132f571e9c3e388ab4a71647a6198b78287c8f7423ae323e0cf569fb6c4c51e0467b550c981d68a47546bbcca43249985d9ab62fffc2e54fda6a6ea7a2906a64ebb4155360ce1abcd5028f07bf4c97af42fc5292ecc42e9661c4f58ff9cfb7bdfc7ced76c8d078b9dbff60370366d8a70acb02379b725d5b83f5beb7d3f8e57aa466f790f8fa8fc9a76d55d2c866849eae42dc3d89a15190b6d4237501e02be897f3205ca5a5edbabd1de11854e37bfad771ace5ea6a28436758b51cf36cf7b7a6bab3622fd006081a7943c60c8ac7268e200c1406eeae5a4b97b4b79195786959c813353b97f2ceb9a6a83b9f517e1086e9b0b19f5a39248fd2d24584f50aed1104ed0ec7e7ef132306a135b164c37a3c0781813a39273e0b398f8040b19199f4d0d8501e4ddfc65a9bd37f88fa3a9a9a1c2250311adac3e8c9b9ff3ba5fcb575084f3672198eacebac2aad7c65c2065c956c708a14121e21ca70b73192e459416066210c8f8348c190076120475eab1bb58543491e941c43c0fa7b5970932a3df57ae897f7a84ba259dd9992f86b0e99ac26226faf8b0743255b918dcbfc2f9d0321021efbfecdc0cac54c580ad9d05ccd048c3b75ec3837ff494ac98f06bacba8052c79494336a1dbc805b07dd45a1359b45fd105b0b54b97a166f303e626c73311a790e1bd107b679af4ce9f5dfdc0e17e39a3a6c68f7add2b17ad8835026f4f66726345a6268296418fa9d541599c359614210d447a98db979e83f104a12965e33f1a4ad0ae8d26ff5c0f32bd18b9b883a6f68883ab5ffef903bf74ec54080778a7462284ef2214b9e29d1a30ce923f272b91af31181b27bb6cb58648d535b3b309afc39ec7c5371216d1bc0a0dd6d1d489d03ece903d2a8b74ad7127a42670c21d60b1c20a63ff8c9eaea308f0c4f4247aaa7c4783b61001802afc5d57c2afff86f0896b6109d22d1add257b3e2cf0960ec74c926091b559bf1b0fc7d54c4944cd5db32fc73798374cb0a1371186cde0a09ed6a4c72c60929bfe95f879c00aeaad5960cf5823a06a69cc77a19468a3719a48e27174e49fdd9bd5fa88f5f0e03d23de906084ad5cf680fa29820c741c3450dd8c890d7e37b234fca08ce7145097c5e427165ef4dba2a3294b1793c2367aea2ec9a51b4542dd90f1879c17e0cdedbe3de8563c51073999543d85723eb9b917017f4713c2f5593ed7a70742d37f4dee1380c3551ebc5d6dd0780084ddb735ee42d702aa0055b852c86255fedeae22f2d7af05282b11aa146fe80cc2c048c1f4373b74aad41cfec844ab587df9132a96933929322fe0bd7de5ed02b9ec2e20899a03a88d2b7a895eacc27ebd9e9212a39d4a9554f099177a0779bbe38ad28d8debf1d07387311490bc44cb740601b67798472246210afa24946aa39225e72d595ce568127e7e32f735c8a73f9889a58f9647af323eaaeb36a6aecae4c3f46d7999cbc89884f6a6bf1001e44db47948ad9a20c32ae9473d62b2d1fba041c8af69cb95dd61f6954296a60f71dec7d3dd0bccecda2183df36ac304f845cf85e0690650378d11a7d1ee6218a40f5c1a52c1d5da8a6c9a9048502141801a47869936ffc58fb5c30b65be15ed51a2aeac1f74f3913858fd0ffb1c785857b0fb76154187b5b5a6426251569895b3d14c938ef0716bc2a97bf8eff9ce37479eabc203fbb46c551445aeb4c72032ec3386da037cf4d39ca6dc53d915a1ab7d0558e721ce2e26bdbd27e7c0ec5ec2f1ee1534defee"}, &(0x7f0000000240)=0x1008) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000280)={0x1, 0x200, 0x4, 0x7, r3}, 0x10) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0xc6c) umount2(&(0x7f00000001c0)='./file0\x00', 0xa) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000580)={0x5, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404001"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000004ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff000000000000000000000000007bc998fe1cd9ec0a00000000000000000000000000fcffffff01000000050000000000000000106e723000000000000000000000000000ffff0000697036746e6c3000000000000001006e723000000000000000000018b71a4aa0000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000004400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000d000000c9c37ee3085f0000fdffffff0000000000000000000000ff25c3f3456107b7c32ba52f4fd4c555a102cb66db763ebca6cb5fb4b04851329c18ac89c06b782d3a1a24052612b810202a437e3fb389"]}, 0x238) [ 115.038180] audit: type=1400 audit(1519988964.404:136): avc: denied { map } for pid=16169 comm="syz-executor3" path="pipe:[39819]" dev="pipefs" ino=39819 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1 [ 115.088728] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.094608] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 115.114457] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/03/02 11:09:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/raw\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) preadv(r0, &(0x7f0000331000)=[{&(0x7f0000723f20)=""/127, 0x7f}], 0x1, 0xfd) ioctl$PERF_EVENT_IOC_ID(r0, 0x80042407, &(0x7f0000000000)) 2018/03/02 11:09:24 executing program 6: perf_event_open(&(0x7f0000220000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x2, 0xb9, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_TRANSLATE(r0, 0xc018ae85, &(0x7f0000000080)={0x6000, 0x5000, 0x0, 0x81, 0x5}) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x400) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x1011, r1, 0x0) lseek(r1, 0x0, 0x0) 2018/03/02 11:09:24 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000005c0)=0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000600)={{{@in=@empty, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000700)=0xe8) getresgid(&(0x7f0000000740), &(0x7f0000000780)=0x0, &(0x7f00000007c0)) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3000000, 0x10, r0, 0x0) futex(&(0x7f0000000ffc), 0xb, 0x0, &(0x7f0000fd3ff0)={0xffff, 0x4}, &(0x7f0000000ffc), 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000800)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000840)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@rand_addr}}, &(0x7f0000000940)=0xe8) lstat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r2, &(0x7f0000000a80)={&(0x7f0000000080)=@kern={0x10, 0x0, 0x0, 0x110000}, 0xc, &(0x7f0000000580)=[{&(0x7f00000000c0)={0x194, 0x1d, 0x2c, 0x70bd27, 0x25dfdbfd, "", [@nested={0xd4, 0x6f, [@generic, @generic="24f5866a0668aabc03e64581544b2fbc50c15842a0d043d3", @typed={0x8, 0x8e}, @generic, @typed={0x10, 0x26, @u64=0xe2b}, @generic="b04c243ced659b02414e7aab745a34198e9eafd7f3cc05c24d273edb9f8b8a54692732f66fbf07afdfc63db9e23827068602238762ec45bae83d3b7082ab422002bb6c3ac7a954ccf47ee2358022e4656812e48762f03c60464290b3766d830938b7795c30674ced589885327fc4d22ad8dc538de49bd74c150e0da6c640a104977a71eeb885f1ef7775332ac2b8021556debdfe69e2d8a0b02ac820e427"]}, @generic="63376d9f882c61e6cddeae15f4257ffc4d04f80be7765fe33a94c9a03352850844434df22364051fef591b30c90a6c958357ce05bd16e00ef1fc1787c3a336a9d7c1ea43738d65badc6c1150cd41beb6fc7e1921720dec6bcf4d5ffa1a1cb810e8bfa137eddf8ebfb51a2ecd2f52613b38068988b5e330a0459fef207b4716fe049e760234e4763d4c92e88dba264cae5db51010b951ecd5868549c13f96be344041162dc8f966d342df74aa6742cc"]}, 0x194}, {&(0x7f0000000340)={0x228, 0x1f, 0x400, 0x70bd2b, 0x25dfdbff, "", [@nested={0x124, 0x77, [@typed={0x8, 0x55}, @generic="abb260caec6b5796128bca0f70a1b9297a548256c2c1698366d9f0eae87e6e88af41cb92271d", @typed={0xc, 0x2c, @u32=0x80000001}, @typed={0xc, 0x44, @u32=0x3ff}, @typed={0xc, 0x61, @u32=0x2}, @typed={0xc, 0xf, @uid=r3}, @generic="6a9585bb867714e390460357b2f7aff7119af5284d433fa7c627c9ae47ac73fd5b2a2aaadabc37f6be5815864aa7218b3c97a2e98564301fad7d3b4e3608f05cf306c1c96a4a335ac7c38c26170d8f6633e55e3a1e213e51a17f86776b3b21bae357785aa3ca3efc612c123b9d463b43568606f21860d25ed04cc6afc4b5cb2ef3bdc783987261468f520267a18881a9fc40f1315e82ffe26854faf4fabf87fac1aa0a08af71311c345fff0fe8eed04d97ae7898cdf705d71af6861df836b8"]}, @generic="ceec79bd774cd8bacfcef2d27f0895a0de5c7b57b5063fee6210253053f6dae540f99ca6a1df71311510af7fc43c18dcacb92fa4caa08f24fb62a9bb33fb18bb5316cc193b03e3192ba8b9a1bb90e6dcb8341ebee5b36cbca7e92490a6c4eb361af175523c4b8f3d87ade8db761431aeaf32ee1d0a2a1a235e3476a4c352544704386cdc3235ddc45e4940331f7720963d6aa12c3576ce54294603841fdf3375a315379c3b5f", @typed={0xc, 0x2d, @u32=0x1}, @generic="bbd1f0b7740973a9e8412a1eea5a13b37c66f463a5eba93ad4c58736e9637a74c83fb333700e64238da08f13920f9bba40cf7b7f09493a58693e49f1875fe42e"]}, 0x228}], 0x2, &(0x7f0000000a40)=[@cred={0x18, 0x1, 0x2, r4, r5, r6}, @cred={0x18, 0x1, 0x2, r7, r8, r9}], 0x30, 0x20000000}, 0x8000) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x3) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000040)={0x10003, 0xfffffffffffffffd, 0xe}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x40, 0xceb, 0x80000000, 0x6, 0x43}, &(0x7f0000000080)=0x14) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000000c0)={r2, 0x2}, &(0x7f0000000100)=0x8) 2018/03/02 11:09:24 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x80000, 0x10) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='reno\x00', 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) accept4$alg(r2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x400) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) getsockopt$inet6_tcp_buf(r1, 0x6, 0x11, &(0x7f0000f86000)=""/4096, &(0x7f0000000000)=0x1000) 2018/03/02 11:09:24 executing program 0: r0 = socket$inet(0x2, 0x3, 0x100000001) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000004900000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e723000000000000000000073434b5d05d6d51980000000000180c20000000000000000002a97e74a12af00000000000000007000040070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff00000000dd3636f61004da7d146c2f000100008527eafd3515498126039d4442ca6b4f43e960e9cf148d0a00b676c5f5944481c01463b6f581fe6a7c00b9049c1d7253c18441cc9c2dc6c9191146294ae81090fbee40480caf80be22ff0d75af798c43d1e2d6326e90a4621cfc46fad98e512f9c8886191f7eeb3d6677b67bf805e1c003591d74525c202c4bc98e388a9692f6ae89611e877660772437bd58dea98f34a09d7ac311354d71"]}, 0x260) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:24 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) socket$bt_cmtp(0x1f, 0x3, 0x5) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000000)={0x0, 0x17, "2e07c2ca2cc892ff31bb43576147126a1b941ae7843ee8"}, &(0x7f0000000040)=0x1f) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f000023f000)={r1}, &(0x7f00001d5ffc)=0x3) [ 115.142703] binder: release 16196:16203 transaction 561 out, still active [ 115.149710] binder: undelivered TRANSACTION_COMPLETE [ 115.154883] binder: send failed reply for transaction 561, target dead [ 115.186988] binder: 16206:16216 transaction failed 29189/-22, size 40-8 line 2848 [ 115.187725] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/03/02 11:09:24 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x40004e22, 0x9, @mcast2={0xff, 0x2, [], 0x1}, 0x3}, 0x17) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14}}}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000694ffe)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x8, 0x11, 0x0, @empty, @mcast2={0xff, 0x2, [], 0x1}, {[], @udp={0x4e20, 0x4e22, 0x8}}}}}}, &(0x7f0000775000)) 2018/03/02 11:09:24 executing program 6: socketpair(0x1d, 0x0, 0x2, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000040)=[@in6={0xa, 0x4e21, 0x20, @remote={0xfe, 0x80, [], 0xbb}, 0xa880000000000000}, @in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e22, 0xd0, @dev={0xfe, 0x80, [], 0x19}, 0x20}, @in6={0xa, 0x4e22, 0x1, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x337}, @in6={0xa, 0x4e24, 0x4, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x8}, @in={0x2, 0x4e21, @multicast1=0xe0000001}, @in6={0xa, 0x4e22, 0xffffffffffffffff, @mcast2={0xff, 0x2, [], 0x1}}, @in6={0xa, 0x4e24, 0xcdc, @remote={0xfe, 0x80, [], 0xbb}, 0x8}, @in={0x2, 0x4e23, @loopback=0x7f000001}, @in6={0xa, 0x4e20, 0x1, @ipv4={[], [0xff, 0xff], @rand_addr=0x84a}, 0x7}], 0xf4) 2018/03/02 11:09:24 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000140)={0x3f, 0x8001, 0x0, 0xffffffffffffff55, 0x100000001, 0x3e8c0f95, 0x9, 0x0, 0x0}, &(0x7f0000000180)=0x20) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={r2, 0x7}, &(0x7f0000000200)=0x8) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f0000000080)={0x7b, 0x0, [0x7, 0x4, 0x6, 0xe368]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:24 executing program 3: r0 = socket(0x11, 0x2, 0x0) setsockopt(r0, 0x107, 0x400000001, &(0x7f0000d52ff0)="010000008000060000071a80000001cc", 0x10) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000040)=""/230, 0xe6) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) lookup_dcookie(0x1, &(0x7f0000000140)=""/78, 0x4e) 2018/03/02 11:09:24 executing program 5: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xfffffffffffffff8, 0x100) r1 = socket$netlink(0x10, 0x3, 0xb) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) poll(&(0x7f0000000040)=[], 0x0, 0x30000) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000080)={0x4, 0x100000001, 0x80000001000, 0xffff}, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f00000000c0)=0x9, 0x4) fstat(r1, &(0x7f0000000100)) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000180)=0x80) sendmsg$rds(r0, &(0x7f0000000b00)={&(0x7f00000001c0)={0x2, 0x4e22, @multicast2=0xe0000002}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000200)=""/65, 0x41}, {&(0x7f0000000280)=""/92, 0x5c}, {&(0x7f0000000300)=""/56, 0x38}, {&(0x7f0000000340)=""/195, 0xc3}, {&(0x7f0000000440)=""/152, 0x98}, {&(0x7f0000000500)=""/84, 0x54}, {&(0x7f0000000580)=""/190, 0xbe}, {&(0x7f0000000640)=""/133, 0x85}, {&(0x7f0000000700)=""/199, 0xc7}, {&(0x7f0000000800)=""/146, 0x92}], 0xa, &(0x7f0000000a40)=[@mask_fadd={0x58, 0x114, 0x8, {{0x3bd, 0x10000}, &(0x7f0000000940)=0x6, &(0x7f0000000980)=0x20, 0x4, 0x4, 0x8, 0x10001, 0x1, 0x8}}, @mask_fadd={0x58, 0x114, 0x8, {{0x76, 0x10000}, &(0x7f00000009c0)=0xfffffffffffffd60, &(0x7f0000000a00)=0x7, 0x2, 0x103fec00, 0x3f, 0x100000001, 0x3e, 0x2}}], 0xb0, 0x24048010}, 0x800) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000b40), &(0x7f0000000b80)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000bc0)={0x0, 0xb4c}, &(0x7f0000000c00)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000c40)={r2, 0x5, 0x7}, &(0x7f0000000c80)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000cc0)={r3, 0xc1, "41979c6213c2e749c2bf51c5c3ad326d70afbd65c6ee6d6bf60ae4f02d145c70dd6a1df6c15fb636b8524fdc6cef950c2a3e13f17cc086b635ff5afce526eaf50d62012d27ab53d972a5037b3223a580b1657b9e556ddadfe5ba5f2d641871854090eebe348db5d6af396eae7c2345ec3aeeb4e996f2eaa718712dd6ab533bfc8175b3e7dd3623674c5917d782726c274c1956027be2ddc632b4ec97f2c1a672c3946854bf3736efdff84494bc118424fccdbaa793f801a7d8e699213c13e663b8"}, &(0x7f0000000dc0)=0xc9) setsockopt$inet6_dccp_buf(r0, 0x21, 0x0, &(0x7f0000000e00)="b2b3ff631ebdda496450f8cad13353266b5edf722f1af629c5c0090e8c338732627651845f3aa5891a9e664451f979eb26f30bd13fed5ece23c6bb66f64bde36ed13bad66b16350f9531dff72d0c33658105b352ac190f745dab302a4f19d7958ea12bca99a1630143fbf5ee4a2550ce85f12501307eeb0704289b170b74a22f54e6acb9b2cda68b1ddfe01bef53d45d74e3eb0716b5e131369dc383b7574cfc209e37c19e07b7ccf7", 0xa9) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000ec0)={0x1f, 0x2, 0x0, 0x4}, 0x10) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000f00)='/dev/vcs\x00', 0x2800, 0x0) bind$netlink(r0, &(0x7f0000000f40)={0x10, 0x0, 0x25dfdbfc, 0x2000000}, 0xc) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000f80)) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001180)={r4, &(0x7f0000000fc0)="31722e1917700c7193e45f62305fcdcfc36a156f7d4b6de97f3a80e29bee376d475a2bdd310215640b7102be8cb3872c557771ec126982060bb23c1beca9d08d4d308d6de1b854ab498b4e0e65dabb266f12f12eef18866515308905fe97d896df38eaaf2d0f3b752248c8122ffadf87e4ae75f9669ddc70d015cc068fdde2601ab5c85624c3e4402c47ec797d8cfdbbd7f7f2f5ac2110b8b8c5dbe9dbe1e006a9a6fd4f5df0957d481cc6908dd5e09f32e0b20007cae492a96ddda34e9d2ca8a873e46ba96cfd0955b860676d02", &(0x7f00000010c0)=""/180}, 0x18) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00000011c0)) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000001200)) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000001240)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) setsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000001280)=@hopopts={0x7f, 0xe, [], [@calipso={0x7, 0x18, {0x80, 0x4, 0x7f, 0x200000, [0x3, 0x9]}}, @enc_lim={0x4, 0x1, 0x2}, @pad1={0x0, 0x1}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x6}, @enc_lim={0x4, 0x1, 0x3ff}, @jumbo={0xc2, 0x4, 0x400}, @calipso={0x7, 0x38, {0x5, 0xc, 0x781, 0x200, [0x4, 0x3, 0x22, 0xfffffffffffffffc, 0x6, 0xffffffffffffffc1]}}, @jumbo={0xc2, 0x4, 0x1}]}, 0x80) syz_open_dev$mouse(&(0x7f0000001300)='/dev/input/mouse#\x00', 0x8, 0x410000) tee(r1, r4, 0x8b96, 0x1) ioctl$sock_bt_bnep_BNEPCONNDEL(r4, 0x400442c9, &(0x7f0000001340)={0xb6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000001380)) getpeername$unix(r4, &(0x7f00000013c0)=@abs, &(0x7f0000001400)=0x8) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000001440), &(0x7f0000001480)=0x14) ioctl$TIOCCBRK(r0, 0x5428) [ 115.250128] binder: release 16206:16216 transaction 565 out, still active [ 115.257188] binder: unexpected work type, 4, not freed [ 115.262503] binder: undelivered TRANSACTION_COMPLETE [ 115.285873] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:24 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0xadf, 0x4000) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) bind$bt_hci(r0, &(0x7f0000000480)={0x1f, r1, 0x3}, 0xc) setsockopt(0xffffffffffffffff, 0x7fffffff, 0x908, &(0x7f0000000200)="223cbf2ff2d56bd2d97ed5d57b21e2ebb485e3dbf20429bf1342d5879e8ceb63a41101b8264d5938155c809740df5ec544a8a80f09b7", 0x36) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:24 executing program 6: r0 = socket$inet6(0xa, 0x5, 0x0) io_setup(0x20, &(0x7f00000000c0)) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000000), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)) [ 115.298688] binder: release 16211:16221 transaction 564 out, still active [ 115.305764] binder: undelivered TRANSACTION_COMPLETE [ 115.310952] binder: send failed reply for transaction 564, target dead [ 115.317650] binder: send failed reply for transaction 565, target dead 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000000)={'TPROXY\x00'}, &(0x7f0000000040)=0x1e) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000080)={r0}) connect$l2tp(r1, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x4, 0x3, 0x4, {0xa, 0x4e20, 0x6, @loopback={0x0, 0x1}, 0x8}}}, 0x32) 2018/03/02 11:09:24 executing program 3: r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0xffffffffffffffff, 0x7610fd) ioctl$KVM_SET_BOOT_CPU_ID(r0, 0xae78, &(0x7f00000000c0)) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}) bind$inet6(r1, &(0x7f0000fde000)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0xb5}, 0x1c) openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x800, 0x0) connect(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="0a004e2000000000000000000000000040000000000000000065eccacfdb1c7124f24c7f0c76e49c3de7a9dad39ef168a8d7593101db8a92e8a8c29d60cc543f6747a34460b5ebdb5d490e30b92f9b17bde312a7ad49a0622010b65c592ce608b01de1b3b7c1eeaebbd787cc6e2fdd083527bad30cb4eb1f96e4303246e30ff1f0d586593759998e4b30630523d56fce5db427942a04e46867e1bca5db7a66b89cc47a0f7e543e7ad2bbc909c8de5a68b70c376e9f2ed016ba69f66a6e5383767dbd676d0a9478190da3460d8f"], 0x1) 2018/03/02 11:09:24 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x60480, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000040)=0xbbe) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) r2 = getegid() setregid(r1, r2) r3 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r3, &(0x7f0000a66000)={0x2, 0x4e20, @rand_addr=0x7fffffff}, 0x10) listen(r3, 0xa36) r4 = accept4(r3, 0x0, &(0x7f00004a8ffc), 0x0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000526000), 0xfffffe16) [ 115.341708] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 115.355626] binder_alloc: 16236: binder_alloc_buf, no vma [ 115.361827] binder: 16238:16255 transaction failed 29189/-3, size 40-8 line 2963 [ 115.371089] binder: release 16236:16246 transaction 569 out, still active [ 115.371096] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:24 executing program 6: ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000040)={0x6, 0xffffffffffffff9c}) accept4$alg(r0, 0x0, 0x0, 0x800) perf_event_open(&(0x7f0000fdef88)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) 2018/03/02 11:09:24 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x40080, 0x0) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f00000000c0)=@pic) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f00000001c0)={0x4, 0x14, [0x100000000, 0x5, 0x6, 0xf76, 0x9]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x21, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) lseek(r1, 0x0, 0x3) memfd_create(&(0x7f0000000200)='%!em1\x00', 0x2) [ 115.371133] binder: send failed reply for transaction 569, target dead [ 115.371145] binder: send failed reply for transaction 570 to 16238:16248 [ 115.384457] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.385282] binder: undelivered TRANSACTION_COMPLETE [ 115.385290] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.409350] audit: type=1400 audit(1519988964.776:137): avc: denied { setopt } for pid=16241 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 2018/03/02 11:09:24 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f000000affc)) r1 = syz_open_dev$sndpcmc(&(0x7f00006a6fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x40400) ioctl$TIOCSBRK(r1, 0x5427) ppoll(&(0x7f0000346fd0)=[{}], 0x1, &(0x7f000097d000)={0x77359400}, &(0x7f00001b1000), 0x8) read(r1, &(0x7f0000cb5000)=""/72, 0x0) getpeername$netrom(r1, &(0x7f0000000000)=@ax25, &(0x7f0000000040)=0x10) 2018/03/02 11:09:24 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000001580), &(0x7f00000015c0)=0x4) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x10000, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0106434, &(0x7f0000000280)={0x8000, 0x0, 0x0, 0x5}) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000300)={0x0, 0x1000, "087c383d98b796d40257719a892b65c864d9b005ef8463c69abaa79717fe880002f103f58dcac6b4276374d0e653216614d13e2e2cf395ed9633e15658a83c339fe7a824c927c62703e94814adb18d652a04a34db39f8e192eaa70cba1e103848f2e26605b14544b8d2bc5cfd19431a15bdb1a56e53cb17e9dd50a31672c8d62209fcdb8d8b0cbb43f9745e15576d04fc97edadf58e4d694ce4b77af4f732e041b2959e98f458e1f49433663e69c3f9bc21e6f9d9fce527f8193ebc48ad3c1443cfcd9b3d4bb5be8e4141bfda5d4a08a0cf90e988f8a38a18aa5cdfad3d0ad684f428de44e4900f8870abc30ce48118b27a8ce170f08f543c21ef22c21a95eaa9fb5f38fb606290d36b4a470a2ba231788af12e9bd1afde54b60c8aebcf3d90cf579a834f24420cd7663bf5d58e71bafceab22ede2ff2f59068b13d67c90f408e301718843f4e6ffb26bb0deced3b7e328ec52cadf398e00e6cc9bbc57f90e933bff1d233e4c584f7aa5cda149cf5a6378875d912838e747ba451cca0847c12e878463b40b16e2e8a0d99539233d975f3b9e74a234fa92b668c57a20d45a9f8f630b53627ee5cf3a38e04c2fd59dcc661a77a9f0296ea35364f2eb466d9df9e5a0d083854b7f27e5bf48acd4688d0a90fd67ca89c81235fd9881ddd0ba91e729e2ede776b18d494cfac7a17ea5961f3a947108ccfe9242f09383d7472a40c048ea344cae28467dd9aec886c6dff135e0f70fb8cc146c7cad84d13d7cca32ed8ed4f1a2149b458624c709cc21a5a94a17b719c597177679ce6a7ae63ee0ab842decee0d61810739d7eabb898476ce52006d3f18da378d186556b1f130457935bf5f6129eb81750e9157576624e7bdc1736deb040da8a113f20a213ce4a0d1cf5d547b7deb5befed0faa2e15021e2aadd600c6b390a8a004781c8130ede160703647e4c33ec9fa2296a0b0d928d162bfc994065906010cfefee4a8abed11d9215c9541d805057eb9317e2ac1bddb9e3f54c0bb2669c2fdfec4bbca791400f5ef2a30cb20a33993c77494dd6332468be1b0a7bdcd3f5a872117977176f1f2d39b3a64ed5b97118cb28b33cae7bde369dc83675ad1eb7d7ac6ff6d9a8c119aa03572dcd1c28d87705460c1a0cfe2516abcfa88e389319ed3e711c994049ff15312995945fd13e0186e01d926abb486f236abd5ba051c69764afbf6dce7ab2ed479f2b660cecfe1609a4f19fa2194eb6990be6e724ae7067f5b59f11f062318c0cab7ed1520f751c86f8956ca7e94ccbb819d0977685fea8a48f49bbd059293123291d8714ff6848e9fb6e4cc60fec19944992299aea27858fa08623c6c3122e0f5fac8b22a9753595c78a4b24af5bd6b3c9ae3f3d2003eedc574769bf5c9049dcdc6d9246f327fa5e69e9e50039d5197552bc9a56d549dcc4a2f390ffd378ce51b44bcfb1f4b242ac15af8e4a14c8fbf3ab6b20dde8505b5e0167e1f10555add4e7c53eadf1d6ba4608647196ff59ea53133d9a75a8aa0bd6dede29f708a7439949fe86f593abee720e1d86a13a936108ea60b6111fba622090285b06dd5f5473a21df21682e63e750f9c47da3c79c64b571016f2de33b5d0d1f205677ecc6d8f765af1086e52d8ca32263be40accd62d882d0b2ac386ecb97d9033d085f4051e86d8c16d9ea66246232b025427c61e5139fd0f04c86839df3f568d6fda677f658a3fa4b84301886e95260c86153efe35462e6cdbfd339674c679ae097eac68dc9911660de2def2bfd6fa38c9d13f3b273ce8d8cb517d2831e0220ce3ee5fec2cd9c108ce4374fbf62ebdf1337ce9a4baeaf4b150221582329a603a3d2b225b01bcff78a13e403bfe65e413fddebf399310f377a54a21b69691c50c12e6fea8ed061fef94a941d673102ca46d1b71555e93b5cb5afb4c2e0ffb8524f5c057cd24bf29466f9228859ae3dcc6c6e503ed1cba27bb10de6a92ae6bd93518e3e67d2d69242c3fcb55390becfbfef39c85783d37f48384124b9149e6cb6675e3100dffc31c7cdc68d50ddcd7000aff28f5277fcbe2792334260b120590f97d07151dad7ca009fbf2de71eec0def8a6ae80f08b5c71544328ab073e0da7167eb7a14b99a417806c4119ba9f0a331187564a5472ad2087ec0c9b83720982da81e312626444b3fdc8339a6713a02cf81cdff7e425bef36be2f5c8f4ac8c4274c4559af9046776175ad567bb49bcd584d988f1d614bfec2ca8b51d1c8335cfa3609e288c1600b34a7acd4470108086c545f7f0740ba99076b4ee86168966b11c87d5e9d3099a6367b01d3de833af79cf49bebc4b689fd0073ebfed768702c5cddc1c82d8d4e1f8c5bce788a09b12ed702462de39905af399c4e9d72c17da06e3079ad01eb22bbefa173000cd9f577d7c91095428e860793d8c96daf59df52216d84e7d68d98dbe090c1972ab1aae4d6b35f6dd5064bd93a2d83fa8bf53d0c64667631c1076d64d89c295f1753954399b113b9dcec3b6bf3243e32dc3383f4e03978b5b58eb5b7e9e16827ee1b6ad0be70247f163ac6153c8c6306d69a67a3d8cd2745f6d7e6553bbbef47e3799d298d89a0343d03f32c452148e6bdc71b35aeef385f1ce7f2615fa1f77a7cce38d6e99849fd94fc8fee98e9bf7f57650428d7aa3a5d41d5ddca25eba39ea8c353767e489718aa4bdfe4bb399d59f7082a3d9b6ea6c09cdf8681881358eebdbdc7b16b39c8b5625f9c8699e0fde9e1f42602ef067230bbb4fb03a984316c04a3c347e640e78f02eb277e709e5635e00c9148c633ce8c678d811a6d8dfb51c65d96acbf8fbec3b8a22f148ded766ac1106f3e3565f1c73fab988e9c37e2d68b49c5fcfc9d2fcdb49487b69d19c1e374b5c04caaf7e31398d81e0339bab18f10a9a383a4d2c8cb2db14cdd4a1c24c9d80e747a688fe1755aee04c7b4fbba4a24c3a7572d43b5374dab9efc996e469fbbc3540e907903b4eed8446b330932e48fae6b4c4e2353dea747b9fbdf1f6bb0b29d67667f08c97024d948cfca1b2365f19268d4a9a4aab8a09cc51389554832e971887bc3c4a246a8f1c3415a688f180d92d6828b34fec422e7de494b13642ab7f11ac1e7741c5176c36bd12d46b445ebe9fc92564e857971764d026ff86d92d49b0ed410649f84bf9c915efa727234b91a042e3c621f9343f08b818e588bd3ba3689f3898057eb5107c1bc6f5b650174733e46407b92d560455bd22aebd4549708ea332d764b31b9d64f7658101acdbc692d9815bb8c25a21ee0b2db032761e9effcc4f029ba9f58c58d2c6d0bb44f7a83f24b2dc7fcb67ca6c73ef538f6454062d00cbea375763ebb0f7698c3cd5df35107edc0a332e0a12a433890713c0e1713a34b86c7d9096c5cffa3dd484659cb1c6d25d6a488dfaaeaee855b2e21faff583641a1d1e9a09087f200ce789c2bab869a160463f9df499b1d0862a34f4ce029c88472c4931aab15483dea438ee1f8f0c804593072b04e06b103baecc50caaef11d33d90acc74f4e4173ee1297155628118d1da77c49d09f814d9797cb693de358a09ce322bb72c9721395e647499081e7f52d5236ba4bed8d5b9c6d4546f59a752e4cb3ac4d895b4805575c57d8f85b50d17414054e1ce155c015ae46fada4eb2f3cce447f4b223394d3fd654edbf809cbb54afec734288da1a19e4767560eac128b01f8e3c6215346475d80e818e055fccaaed71290bc571ac9059a64113b39db2e4a3b7cab8c02d7df242004cb8bb96471e4f9206bab93949c002121f674097d6b4b71ae2ceaeb2a380167846bda7af63845608374c2e838b6e141857efff952a8f0718e7b88e0650129487dffa4b7617a8c6a23a626510285d56f3407f6056470c22a0968a96d57c1edd51b69f12c3bb77e8494d641462cac836458186dea3d551bfed253a94e0dbb626b0d9fc1366e4d49aa745a25112bd27fa10ff3aab42ce6a49a3ac7db6bebaa151b2312ff22dcb7dd22c1ec4d75eb7fec4ee2c73072f60351399c5eaae3f4f3288e3ff15df7def56eb788be53ea5c7a6cba90e234873253cac9b3d7a034449767fe6eae99e3002a442f4ef81bee85f4f492ca68a79388c43f51f2b005b3ccabdaa2763ab404cb36d71c95ae99972098019a3e93cb5808770d9efebcc48e6a75574518da25a8bc59db16e968995eda7db775bb8a88db36d07facd47f35ba51b4f3c720ba8f6ed55cec2e7ba12fbc697c24fa39ff29e97fcde81cf0f976108ee71a3afbf5dec862ceb94024b81781b31aa40d7510fd554648d6189d9d4561431436561f00721f5a8384a9f37c0589c437e05739102c598d8a967b5535aea8ffd00b5db09ef02af9cffdcfaf2b32eba79a7675e5d2041c56b5c2a997b6c054a4dca96d9445485954d07b25d69646bfbd7e7fef120e36e7f19d378a6eb5457513aaeee143a900b3ea1777266e62b075fe1b7bbc5dc855ecd7db551907e4bc9c43fbba6222501da4aada149433b0c561c527803a502b15e341898b5657c7d22e6b2e0d5066269d871d4365d4c3173a662008ccbeab17763833be42cedd0acbdf9627feaf9eabe075a5d5b7924d80d65083675f57e86bf46a9d1f9868ca07a4079b8d9c29b5c5a88e5b64c71888ac9d1abc8f083c217fff4c33ae30577d0f9331b9c47238695f8bf38d8bb9699d50857e283455bbd50f09c4b84af513257c5c7a8afd806e56edd79dc409f4ca217b96b12ec53f3f65a6a454abcbea072848989abd857f91efe70e4fd3d53a678fe90ced013830f176023f75ae70df5d898fe4547b2fd98d7ee34495253b47abe493c66147934beed4ee6d2d9a8eb1b1fe39deac200326aedf5ceb22a4b50e26f5455aa81c203aad2962d313a80c03a0e2eea4ca64fda5c03bae12e4e8a0410404aba23ea8d7d89e32aabddfead80d19bc635b7f0d87f73b6d350a866277dd91c6f8e941d49acac908463f6939d527aa42434492fc6e19d582ac70bf91642c2e07639ed49f9d17dacd811db0f568f3b5c54d2af78013d421165728ab961ec519c0066e6daf714a3dc2e22ab2d40d388dd8c31ae7331bfb8676647ddf21a46970b45538b5f6bfe7ba6d70c7476bbc26e5b3979c159838f03b35347f0713550c1ebf3fda5bb55182e4a2dd3c4498a9fdc804c54a5ff1478e5001f81189f9331ac2c99f09b89c6b77129dab3cc22fcbb69ce1833cb64152e10c8dc51966ed985e50dd2125763696891c80d37941d8775ea5edc5aa0f74c59ddee271bc27f42331ea47399e6238d4dcc7ce72860482103aafb94a10c5d987b91c47435e97f751fe6b7c6ce9498a794454f3c311e261b790e58673953d3d8efced2925eaea434e696b6b17b509ba8ca869f0a88fb2391cca83e5d9820a029ced8df16b182af45b3db6dcffa34b005cd27f488c9f5c69e8dda2248be5f495ae10e8d9a367d0888b9f761eaf13ae4e9273e3e26acf0afeba0d3388685cc44382d9ad80060f22bc22c4af9250a258a4a07521ab2480a2b553bc891e527184103789ec342ec0c9d052038b189a4372845703536f1bccd9d4fe56404f160994a61cc9ddf0654900dc1485d81878346b7b709246b32229b522d79f86a965bbd30ba62868f38f234d1712dede8eeaa2ab37a5b703e121e76a98c370bb6a2b9e198212525bab1317bb4fd9cc1f337fbb685925669e0ab460f926a913eca55b19095cb12813a1eee5b6976fee862ad11bb15d782c265ffc4992e656ff5c4a0fd219f7604ce408039d68627a10cf2f88082ad1db3b2038bf4af2f2f174ea2a387eb0d2f"}, &(0x7f0000001340)=0x1008) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000001380)={r3, 0xfa, "44312f1c4478a949b1dddba8f6077292f191ca1a5b035d1b95342100c5867f680531a607f2ad804a7274cec615b5da72e9dc7048bbfe899fcbd48326c78d18b78c3d026c17a7d8c9f7cc021056a655cde6ed194c708dfec5e2371869e8fed79c7dcfaee8e4e7f1a9577dbf0448dd7274ec7aca4bcf30a397fb49ddca47bbbc78b32294d1a3ef65ec673b171348e9adb463fd3cbf704dad3a3d93aa3e2b5f5c8fbf2bbe0adb3864a4a73d42a750924eff6e7e54776f666ada27035fcbb4a31f453141b5e818509e11ddad14fafd5cda8f71b20ce2de615cc4bd4d08076eb571e980c243db618313685e8720aeec4281b568e181f789d29da19404"}, &(0x7f00000014c0)=0x102) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000001500)={r3, 0xfffffffffffffffa, 0x9, [0x4, 0xcf84, 0xffff, 0x7, 0x0, 0xfff, 0x4, 0x80, 0x3]}, &(0x7f0000001540)=0x1a) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40086439, &(0x7f00000002c0)={0x1, r2}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000240)='./file0\x00', 0x1400) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000500)}) [ 115.415303] audit: type=1400 audit(1519988964.782:138): avc: denied { getattr } for pid=16241 comm="syz-executor5" path="socket:[41101]" dev="sockfs" ino=41101 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 [ 115.437308] binder: 16268:16274 transaction failed 29189/-22, size 40-8 line 2848 [ 115.462308] binder: release 16262:16266 transaction 575 out, still active [ 115.517257] binder: undelivered TRANSACTION_COMPLETE [ 115.517285] binder: send failed reply for transaction 575, target dead [ 115.526190] binder: 16268:16279 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:24 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000)=""/1, &(0x7f0000000040)=0x1) setsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000adafa0)=@hopopts={0x0, 0x0, [], []}, 0x8) getsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000ae1000)=""/221, &(0x7f0000ae1000)=0xdd) 2018/03/02 11:09:24 executing program 4: socket$inet(0x2, 0x1, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x4, 0x2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[{0xb, 0x4}, {0x4, 0x2}, {0x3, 0x9c66}, {0x2, 0xffffffffffffff7f}, {0x0, 0x5}], 0x5) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1c7, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000400)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000800000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000b7a9912e31ab02570000000000000000ffffffffffff000000000000000070000000c8000000f800000800000000000000590000000000000000000000000000000004000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000fb0000000000000c0000000500000000000000fdffffff5286cfc956e53d56dcabafd59d9a87"]}, 0x217) 2018/03/02 11:09:24 executing program 6: capset(&(0x7f0000be6ff8)={0x19980330}, &(0x7f000032e000)) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x4000000000000003) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) lsetxattr(&(0x7f0000712ff8)='./file0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="6f73782e0000000201000000000000010400000000000000e2344da93351a1aeef5ce21609d6732fd5c9b7e4c43ec3c0cf9439e02312f0cfcf969403303bac83d61f44b1c3f74f2d28c420be153ae79f140b7846d461113dbc9c5aefa4432b1ae5f27a33ecf0ea7fb526325ab46429045153ae8b55fecaf33b2c2c4ed2b5bee4abd57f10ea5b986f1dc84324d4afd3a1744eee1c9ce87445a6b55fc67de18207b6dfaae9d3bd4eaa22951cb1a06654cd4b18992893641528955d150c133c87ec38dd6899194a7c45d8d2f63f97d356c26dd9c35e90d5b0ee2012a73217ab93398c942d62f4dfbdf0fefb1abdb045d87d6731d06982f66d32997b41e76ca2477c9bee41a5c146069575"], &(0x7f0000d9ffec)="0000000201000000000000010400000000000000", 0x14, 0x1) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000500)}) [ 115.537120] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:24 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x1) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x80, 0x0) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000100)={'bcsf0\x00', 0x20}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680)='/dev/hwrng\x00', 0x12994a333e373989, 0x0) getpeername$ax25(r2, &(0x7f00000006c0), &(0x7f0000000700)=0x10) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000000)={0x0, 0x7ffffc, 0x20000000, 0x0, 0x1f}) 2018/03/02 11:09:24 executing program 4: r0 = socket$inet(0x2, 0x4005, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:24 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x1ff, &(0x7f0000000040)) io_setup(0x2, &(0x7f0000000080)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0xffffff9f, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYRES64, @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\r\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) [ 115.581391] binder: release 16284:16285 transaction 579 out, still active [ 115.588490] binder: undelivered TRANSACTION_COMPLETE [ 115.593655] binder: send failed reply for transaction 579, target dead [ 115.608299] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 115.649346] binder: BINDER_SET_CONTEXT_MGR already set [ 115.656586] binder: 16306:16310 ioctl 40046207 0 returned -16 [ 115.673142] binder_alloc: 16302: binder_alloc_buf, no vma [ 115.678809] binder: 16306:16318 transaction failed 29189/-3, size 40-0 line 2963 [ 115.686775] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.692796] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.699203] binder_alloc: 16302: binder_alloc_buf, no vma [ 115.704857] binder: 16312:16316 transaction failed 29189/-3, size 40-8 line 2963 [ 115.705310] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.718309] binder: release 16302:16303 transaction 581 out, still active [ 115.725250] binder: undelivered TRANSACTION_COMPLETE [ 115.730549] binder: send failed reply for transaction 581, target dead 2018/03/02 11:09:25 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sync() setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000040)={'raw\x00', 0x2, [{}, {}]}, 0x48) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x2, 0x8000) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000240)=0x0) sched_setparam(r2, &(0x7f0000000280)=0x7fffffff) statx(r1, &(0x7f0000000100)='./file0\x00', 0x100, 0x20, &(0x7f0000000140)) getpriority(0x0, 0x0) 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0xa, 0x10000002) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000200)={0x6, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}]}) 2018/03/02 11:09:25 executing program 2: r0 = socket(0x11, 0x4000000000080003, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000ea2fd8)={'vcan0\x00', 0x0}) r2 = getuid() setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000000)={{{@in=@rand_addr=0x80000001, @in=@broadcast=0xffffffff, 0x4e21, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0x80, 0x0, r1, r2}, {0x30b6, 0x4, 0x3, 0x20, 0x1, 0x2, 0x9, 0xd8}, {0x400, 0x8000, 0x19, 0x224}, 0x0, 0x6e6bc0, 0x2, 0x1, 0x3, 0x3}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x4d3, 0xff}, 0x2, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0x34ff, 0x0, 0x3, 0x2, 0x0, 0x4, 0x7}}, 0xe8) sendto$packet(r0, &(0x7f00003c2ff0), 0x0, 0x0, &(0x7f0000123fec)={0x11, 0xc, r1, 0x1, 0x0, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x14) 2018/03/02 11:09:25 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000100)=0x14, 0x800) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000140)={@multicast1=0xe0000001, @dev={0xac, 0x14, 0x14, 0xb}, r1}, 0xc) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000440)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000005500000000000000000000000000000000000000000000000000000000000000000000000000fcffffff0100000005000000000000000000000000000000ffffffa0300000000000000000000000697036746e6c30000000000000000000000000ffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000090df67f48551303600000000000000000000000000000400000000000000736e6174000000000800000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffa47e000074000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff0000da4817f6be3a01f8b177343b3d6a96bbf4ba843934f47faf7a37b2634511e712f8da780bc0f450d39dbea77263e685b40f7649dbb2bacc4def6fc5b0a66b9a7370bbc2fc3865e29b5775f93f328897fd714f353f3a23edf2c71be2413f408d76b2c3f313963215ac1b04aeacbd977e4041ce8c5f9356dbaae27121c88741466f163826cc4747181aa5ecfc70fae74a121a47dde7797067"]}, 0x275) 2018/03/02 11:09:25 executing program 5: r0 = socket(0x200000000010, 0x2, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @remote}]}) r1 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x0) write(r0, &(0x7f0000000100)="2400000026007f8b15ae58baf63fd64c000000000000007701000000ff01001038c18c00", 0x24) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000), &(0x7f0000000040)=0x4) sysfs$3(0x3) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000001c0), &(0x7f0000000200)=0x4) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/policy\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000280)={'teql0\x00', @ifru_addrs={0x2, 0x4e24, @rand_addr=0x5}}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) 2018/03/02 11:09:25 executing program 6: socketpair$inet(0x1e, 0x1, 0x0, &(0x7f0000001ff8)={0x0, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000080)=[], 0x0, &(0x7f00000000c0)=[]}}, {{&(0x7f0000001b00)=@vsock={0x1e, 0x0, 0x0, @reserved=0x1}, 0x10, &(0x7f0000001bc0)=[], 0x20000000000000c2, &(0x7f0000003000)=[]}}], 0x2, 0x0) getsockname(r1, &(0x7f0000000000)=@ax25, &(0x7f0000000080)=0x10) accept4(r1, 0x0, &(0x7f00000000c0), 0x80000) 2018/03/02 11:09:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x143000, 0x0) accept4$inet6(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, @mcast1}, &(0x7f00000000c0)=0x1c, 0x800) 2018/03/02 11:09:25 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x3, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, &(0x7f0000000500)}) [ 115.745660] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.776918] binder: 16321:16326 transaction failed 29189/-22, size 40-8 line 2848 [ 115.779235] kernel msg: ebtables bug: please report to author: Wrong len argument [ 115.806122] binder: 16328:16334 unknown command 4219648 [ 115.817984] binder: 16328:16334 ioctl c0306201 20000580 returned -22 [ 115.822770] kernel msg: ebtables bug: please report to author: Wrong len argument [ 115.851707] binder: release 16321:16326 transaction 587 out, still active [ 115.859101] binder: unexpected work type, 4, not freed [ 115.864435] binder: undelivered TRANSACTION_COMPLETE [ 115.873449] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.881296] binder: release 16328:16334 transaction 586 out, still active [ 115.888596] binder: undelivered TRANSACTION_COMPLETE [ 115.893782] binder: send failed reply for transaction 586, target dead 2018/03/02 11:09:25 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) arch_prctl(0x0, &(0x7f0000000040)="8c94a47bc03feb517e05d118225275e1e099d7da7948892be5503c93c8990550ee052952514ffb1de7a073") prlimit64(0x0, 0xe, 0x0, 0x0) 2018/03/02 11:09:25 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x3, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:25 executing program 5: r0 = perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x78, 0x1e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = dup(r1) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x7, 0x716c, 0x6, 0x7229, 0x2, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x10) fdatasync(r0) sendmsg$nl_netfilter(r1, &(0x7f0000aba000)={&(0x7f0000791000)={0x10}, 0xc, &(0x7f00007d8000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14004a68404bb209bb3600002400000002000000"], 0x14}, 0x1}, 0x0) 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x3, 0x3bc, [0x20000780, 0x0, 0x0, 0x2000097c, 0x200009ac], 0x0, &(0x7f000092cff0), &(0x7f0000000780)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x7, 0x4, 0x0, 'sit0\x00', 'ipddp0\x00', 'bpq0\x00', 'bcsf0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xb}, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x15}, [0xff, 0xff, 0xff, 0xff], 0x98, 0x98, 0x108, [@state={'state\x00', 0x4}]}, []}, @common=@nflog={'nflog\x00', 0x4c, {{0x3, 0x100000000, 0x4, 0x0, 0x0, "c98acd9a6ef7b65a0cb88547cd988ca6c3c7877dd9e08de45f654032ab48f120e5d29cbbcd4b390fe0850db40177e9c6d2af9f4819a33b7bfe63000b6363f725"}}}}, {{{0x9, 0x4a, 0xb297ab1065fcf460, 'gretap0\x00', 'tunl0\x00', 'ipddp0\x00', 'ip6gretap0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0xff, 0x0, 0xff, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0x9c, 0x9c, 0xc4, [@vlan={'vlan\x00', 0x8, {{0x2, 0x6, 0x9bbe, 0x4, 0x4}}}]}, []}, @common=@redirect={'redirect\x00', 0x4, {{0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [0x0, 0xff], 0xa0, 0x100, 0x130, [@mac={'mac\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}]}, [@snat={'snat\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x16}, 0xfffffffffffffffd}}}, @snat={'snat\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x40c) 2018/03/02 11:09:25 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e20, 0xfffffffffffffffe, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x40}}, 0x4, 0x4, 0x9, 0x2}, &(0x7f0000000640)=0xa0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000680)={r1, 0x81, 0x10}, &(0x7f00000006c0)=0xc) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000003c0)={0x0, 0xfc, "8818ea9301b41e13f3611c9782c169a5c06d105ca6f9e47fd09015e744b810656cc170aacb85e23330754e247dfbc7920961344dfe442c68934b9e332139f013f0d490c321ca9a14f90fa707d9ce1e4e2e2d131b90b5d94f81ac5ad0b54b29329c2979ebd3b9317bcb3de79dc448dfbfb1a1ad008c0b3f313cf215f4a7e16e496b9a4b2dbb82572a3111d59fd00cd2e23eab360deed427386ee0c8612bf9e6981130ce38538af81365898060d2e26e52ca2050c9989eb6841a87bc5f8a2351307318259275be214439c2e8d5c346dbbbd011e81db324424382bfff778de64f71e47c44f0b8d0292e0a198c95be31a679e3afa10b29c56687a478f531"}, &(0x7f0000000100)=0x104) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x6c, &(0x7f0000000140)=[@in={0x2, 0x4e20, @loopback=0x7f000001}, @in6={0xa, 0x4e20, 0x10000, @dev={0xfe, 0x80, [], 0x14}, 0x10001}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, @in={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xd}}, @in={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}]}, &(0x7f0000000500)=0xc) r3 = syz_open_dev$audion(&(0x7f0000000700)='/dev/audio#\x00', 0x7fffffff, 0x100) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000740)) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000000)={'raw\x00', 0x2, [{}, {}]}, 0x48) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000540)=0xfffffffffffffffe, 0x4) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f00000000c0)=ANY=[@ANYBLOB="04000000000000000300000000000200040000000000000006000000000000000400000000000000"]) 2018/03/02 11:09:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x4, 0x400000) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000977013ac3b358dde32a9a9e801637432a3f20c09e4bf307b7ca092d29b46d16f01804cff21660eb9591132b97a6a7d2c565af258a377e3e2065c6764174e91a1ccb7c76d129d51735c011f836b2ad65e1d0906a544c68a3c08d7416f2d8edb7aa41472ebaeb8f5ab2e05c206284c51f0b06f7b2fd8196a8581f3b75a7b0aee32b12b8c52e09c9cf6b788300b8bffb5b840b0b3331b9dfd1097998271cba0cdd7f04d406d5d403895f559a352ee9733fee832381153b5e7f40011219e019f629420c01c4fa3b5f7cdc2aef9ebb078048f5743265fd69c502485f84c372270c04cbc45128798d1bf39aaead67598c44213effd191d2a16dda79874cbd7797b"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) socketpair$inet_sctp(0x2, 0x0, 0x84, &(0x7f00000001c0)) 2018/03/02 11:09:25 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x3) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000040)=0xb, 0x4) r3 = dup(r2) ioctl$DRM_IOCTL_FREE_BUFS(r3, 0x4008641a, &(0x7f00000000c0)={0x0, &(0x7f0000000080)=[]}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000100)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000200)=0xe8) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r3, 0x80206433, &(0x7f0000000280)=""/239) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000380)={0x0, 0x15, "df38806d1059c8e04fec4bbb2df9931ad8ec0dbb17"}, &(0x7f00000003c0)=0x1d) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000400)={r6, 0x8, 0x6, [0x4, 0x7fff, 0x7, 0x7, 0x400, 0x3]}, &(0x7f0000000440)=0x14) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000480)={r6, 0x2}, 0x8) bind$netlink(r3, &(0x7f00000004c0)={0x10, 0x0, 0x25dfdbfe, 0x42}, 0xc) ioctl$sock_ipx_SIOCAIPXITFCRT(r3, 0x89e0, &(0x7f0000000500)=0x1) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000540)='/proc/self/net/pfkey\x00', 0x400080, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000001900)=@filter={'filter\x00', 0xe, 0x2, 0x1314, [0x0, 0x200005c0, 0x200005f0, 0x20000e9c], 0x0, &(0x7f0000000580), &(0x7f00000005c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xf54aaab2705f9323, 0x1, [{{{0x3, 0x28, 0xeaff, 'teql0\x00', 'bpq0\x00', 'bond0\x00', 'bond0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x1a}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], 0x854, 0x854, 0x87c, [@u32={'u32\x00', 0x7c0, {{[{[{0x0, 0x1}, {0x9, 0x2}, {0x7f, 0x3}, {0xce5, 0x2}, {0x5, 0x3}, {0xb65, 0x3}, {0x8, 0x3}, {0x8}, {0xbbd, 0x3}, {0x9, 0x2}, {0xffffffffffff8001, 0x3}], [{0x2, 0x1}, {0x8, 0x2}, {0x6, 0xfff}, {0x5, 0x7fff}, {0x1, 0x401}, {0x9, 0x3ff}, {0x1, 0x80}, {0x7fff, 0x3f}, {0xffffffffffffffe0, 0x6}, {0x5, 0x1}, {0x9, 0x401}], 0x9, 0x9}, {[{0x212, 0x2}, {0x45d, 0x2}, {0x0, 0x3}, {0x4, 0x3}, {0x2, 0x3}, {0x61e, 0x2}, {0xff, 0x3}, {0x100000001, 0x3}, {0x0, 0x3}, {0x1f, 0x2}, {0x100000000, 0x2}], [{0x40, 0x800}, {0x2, 0x3}, {0x10001, 0x4}, {0x0, 0x1}, {0x80000000, 0x7fff}, {0xfffffffffffffff8, 0x8}, {0x16, 0x8c2}, {0x7fff, 0x1}, {0x6, 0x1}, {0xffffffffffffffff, 0x7ff}, {0x100000000, 0x400000000000}], 0x1, 0x3}, {[{0x400}, {0x8}, {0xff8000}, {0xffffffffffffff00, 0x1}, {0x32, 0x1}, {0x7, 0x2}, {0x79ca, 0x1}, {0x1da3, 0x3}, {0x7, 0x3}, {0x9, 0x3}, {0x5, 0x3}], [{0x5, 0x40}, {0x46, 0x4}, {0x1, 0x9}, {0x6, 0x4602}, {0x81, 0x100000000}, {0x123c0000000000, 0x9}, {0x6, 0x3}, {0x77, 0x9}, {0x5, 0x100000001}, {0x77, 0xffff}, {0x5b6657ee, 0xc6fb}], 0x2, 0x1}, {[{0xf01f, 0x3}, {0xffffffffffff3f37}, {0xd4, 0x3}, {0x6}, {0x8000, 0x1}, {0x1e2, 0x2}, {0x4}, {0x8}, {0x8000}, {0x9}, {0x4, 0x3}], [{0x80000001, 0x100000001}, {0x859, 0x3}, {0x8, 0x3}, {0x7f, 0x2}, {0x3, 0x4}, {0xd421, 0x99}, {0x9, 0x101}, {0x28e, 0x1}, {0x7, 0x8fdc}, {0x80000000}, {0x7ff, 0x5}], 0x3}, {[{0x8, 0x3}, {0x0, 0x3}, {0xc963}, {0x0, 0x1}, {0x1, 0x2}, {0x90c, 0x2}, {0x8}, {0xfff, 0x2}, {0xffffffff, 0x3}, {0x1, 0x1}, {0x10001, 0x2}], [{0x9, 0x800}, {0x1c, 0x401}, {0xffffffffffffef4a, 0xffff}, {0x4, 0x1}, {0x1, 0xfffffffffffffff8}, {0xa71a, 0x7}, {0xbab, 0x9}, {0x3, 0xffff}, {0x6}, {0x2, 0x200}, {0x6, 0x1}], 0x2, 0x1}, {[{0x0, 0x3}, {0x9}, {0x9, 0x2}, {0x2aa, 0x3}, {0x7, 0x1}, {0xffffffff, 0x3}, {0x0, 0x3}, {0x9, 0x3}, {0x4b, 0x1}, {0x3, 0x3}, {0xffffffffffffa2ce, 0x3}], [{0x9, 0x1}, {0x8, 0xbc5}, {0x7d9, 0x81}, {0x1, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x3, 0x7ff}, {0x0, 0x9}, {0x0, 0xfc}, {0x80000000, 0x100000000}, {0x9, 0x3f}], 0x1}, {[{0x1}, {0x1, 0x3}, {0xfffffffffffffff9, 0x1}, {0x6, 0x1}, {0x2, 0x2}, {0xffffffffffffffe1, 0xc590c72bc8bdc21c}, {0xb80, 0x3}, {0x957, 0x3}, {0xd4ea, 0x2}, {0x6, 0x2}, {0x100000000}], [{0x6, 0xffff}, {0x6, 0x8}, {0xadd, 0xc48}, {0x0, 0x6}, {0x6, 0x3c}, {0x7, 0x1}, {0x1ff, 0xfffffffffffffff8}, {0x3, 0x1000}, {0x9, 0x20}, {0x52, 0x40}, {0x4, 0x6}], 0x7}, {[{0x8, 0x3}, {0x3, 0x1}, {0xffff, 0x2}, {}, {0x7f, 0x2}, {0x8001, 0x3}, {0x401, 0x1}, {0x7f, 0x3}, {0x1, 0x2}, {0x0, 0x3}, {0x9, 0x3}], [{0x1}, {0xa7, 0x7}, {0xffffffffffff8000, 0x3}, {0xca2d, 0x40}, {0x8, 0x4}, {0x0, 0x8}, {0xdd6, 0x6}, {0x513, 0x1ff}, {0xfffffffffffffff8, 0x576}, {0x7, 0x5}, {0xa, 0xa0}], 0x9, 0xa}, {[{0x100000000}, {0x3}, {0x7fff, 0x3}, {0x1}, {0x17ca1378, 0x3}, {0x4}, {0x8, 0x3}, {0x0, 0x3}, {0x5, 0x2}, {0x2, 0x1}, {0x7fffffff}], [{0x3, 0x1}, {0x401, 0x6}, {0x1, 0x7fff}, {0x4, 0xff}, {0x800, 0x6}, {0x2, 0x100}, {0xfffffffffffffff9, 0x200}, {0x9, 0x8}, {0xc5, 0x79}, {0x80000000, 0x101}, {0x0, 0x3}], 0x4, 0xb}, {[{0x3, 0x3}, {0x1}, {0x80000000, 0x1}, {0x5, 0x3}, {0x6bfb, 0x3}, {0x0, 0x3}, {0x9, 0x3}, {0x2, 0x3}, {0x2, 0x2}, {0x9, 0x1}, {0x808000000}], [{0x7fff, 0x8}, {0x7fffffff, 0x4}, {0x0, 0x6}, {0x7, 0x96ac}, {0x7f, 0x9}, {0x7, 0x81}, {0x100000001, 0x7fffffff}, {0x5, 0x4}, {0x6, 0x3f}, {0x6, 0x80000001}, {0x2, 0x4}], 0x5, 0xb}, {[{0x2, 0x2}, {0x4}, {0x445c4a8d, 0x3}, {0x69}, {0x5, 0x3}, {0x0, 0x3}, {0x2, 0x3}, {0x1000, 0x3}, {0x1f, 0x1}, {0x9, 0x2}, {0x2}], [{0x5, 0x5}, {0x29, 0x8000}, {0x7fffffff}, {0x67}, {0x0, 0x4}, {0x8, 0x2}, {0x80, 0x7}, {0xc03, 0xff}, {0x3, 0x80000000}, {0x2, 0x9}, {0x81, 0x100000001}], 0x0, 0x9}], 0x9, 0xf78}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x2}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x15, 0x2, 0x0, 'syzkaller1\x00', 'ip_vti0\x00', 'tunl0\x00', 'syzkaller0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0xff, 0x0, 0xff, 0xff], 0x998, 0x998, 0xa08, [@among={'among\x00', 0x8dc, {{0x6, 0x0, 0x1, {[0x6, 0x1, 0xcf7, 0xffffffffffffff4b, 0x0, 0x7f, 0x9, 0x9, 0x5, 0x7fff, 0xbf, 0x100000000, 0x0, 0x8001, 0x5, 0x2, 0x3ff, 0x2, 0xf0, 0x8, 0x7, 0x8000, 0x6, 0x2, 0x7fff, 0x98, 0x1, 0xf4b1, 0xd0, 0x5d, 0x335, 0x100000000, 0x81, 0xae1, 0x101, 0x5, 0xff, 0x9e, 0x80, 0x8, 0x7, 0x1, 0x401, 0x7, 0x3e8, 0x37b, 0x4, 0x47, 0x9, 0xfffffffffffffffc, 0x5, 0x1, 0x6ba, 0x8, 0x1, 0xb2f4, 0x0, 0x80000001, 0x100000001, 0x0, 0x1479, 0xcead, 0x8001, 0x9, 0xbf5, 0xfffffffffffffff9, 0xfffffffffffffff7, 0x3ff, 0x3, 0x1, 0x2, 0x7fffffff, 0x10001, 0x10000, 0x9, 0x7, 0x0, 0xffffffffffffff4c, 0x2, 0x5a7517e2, 0x100000000, 0x3878, 0x2000000000000000, 0x200, 0x7, 0x3277cb01, 0x9, 0x4, 0x2, 0x4, 0x2, 0x266de4ba, 0x1, 0x5, 0x80, 0x1, 0x3, 0x2, 0x0, 0x8001, 0xec, 0x9, 0x3f, 0x5, 0x9153, 0xffffffff7fffffff, 0x0, 0xfffffffffffffffc, 0x7fff, 0x7, 0xffffffff, 0xfffffffffffffffb, 0xb10e, 0x2, 0x386a58c0, 0xfff, 0xfffffffffffffffa, 0x3f, 0x6, 0x10000, 0x0, 0x0, 0x6c, 0x8001, 0x101, 0x5, 0x8001, 0x7, 0x7, 0xf8, 0x6, 0x1, 0x7fff, 0x0, 0x7, 0x0, 0x101, 0x100000001, 0x4, 0x1, 0xa7, 0x3, 0x9, 0xffffffffffffffff, 0x0, 0x1, 0xfffffffffffffffd, 0x10000, 0x200, 0x90, 0x9, 0x9, 0xfffffffffffffffc, 0x3, 0xffff, 0x2, 0x3f, 0x0, 0x3531, 0x3, 0x3, 0x7, 0xffff, 0x0, 0x10000, 0x6, 0x9, 0x0, 0x20000000000000, 0x7, 0x10000, 0x100000000, 0x1a88, 0x5, 0xfffffffffffffff8, 0x7, 0xffffffffffffffff, 0x80000000, 0x400, 0xfc83, 0xfe2, 0x4, 0x73, 0xc17, 0x2, 0xffffffffffff131a, 0x7fff, 0x47ae, 0x5, 0x8, 0x20, 0x101, 0x8, 0x7, 0x2, 0x8, 0x8, 0xcf, 0x8001, 0xfffffffffffffffb, 0x7, 0x7, 0xfff, 0x8, 0x5, 0x20, 0xb64, 0x5, 0x8001, 0x1, 0x8, 0x800, 0x1ff, 0x14, 0xc7f4, 0xb9, 0x0, 0x1f, 0x27e, 0xe58, 0x2, 0x39, 0x4, 0x800, 0x8, 0x3, 0x9, 0x5, 0x8a, 0x4, 0x2, 0x5, 0x5, 0x1, 0x8e3, 0x0, 0x400, 0x9a, 0x8, 0x400, 0xffffffffffffffff, 0xbf15, 0xff, 0x1, 0x101, 0x200, 0x4, 0x1, 0x2, 0x2, 0x1, 0xac0, 0x1, 0x4, 0x0, 0x5, 0x5], 0x7, [{[0x6e0, 0x1], @rand_addr}, {[0x1, 0xffff], @rand_addr=0x5af5}, {[0x996b, 0x100000001], @local={0xac, 0x14, 0x14, 0xaa}}, {[0x4, 0xbaa], @multicast1=0xe0000001}, {[0x5, 0x6], @dev={0xac, 0x14, 0x14, 0x17}}, {[0x32f, 0x5], @remote={0xac, 0x14, 0x14, 0xbb}}, {[0xfffffffffffffffb, 0x38], @broadcast=0xffffffff}]}, {[0x0, 0x3ff, 0x1, 0x4ed, 0x4, 0x688, 0x5, 0x3f, 0x0, 0x7fff, 0x7fff, 0x5, 0xffffffffffffff7f, 0x98, 0x40, 0xe1ac, 0x80000001, 0xfff, 0x6, 0x10000, 0x64, 0x6, 0x6, 0x4, 0x1, 0x4, 0xc8f0, 0x1, 0x7fff, 0x1000, 0x58, 0x100000001, 0x0, 0xffffffff, 0x2, 0x9, 0xc3c6, 0x52, 0x10001, 0x7f, 0x6, 0x6, 0x8, 0x4, 0xff, 0x14, 0x51e, 0x3f, 0x2, 0x7, 0xff, 0x8, 0x8, 0x8000, 0x3, 0x3295, 0x0, 0x1, 0x85, 0x71, 0x20, 0x2, 0x4, 0xc3a1, 0x5, 0x80000001, 0x0, 0x8d, 0x31db, 0x1, 0x5, 0x401, 0x1000, 0x2, 0x49, 0x41, 0x200, 0x5, 0x6c10ab65, 0x7, 0x8000, 0x6, 0xffffffff, 0x79, 0x5, 0x5, 0xcb, 0x0, 0x80000000, 0x1f, 0x3f, 0x6, 0x5, 0x3f, 0x400, 0x18000000, 0xd0a, 0x7fffffff, 0x2f9, 0xeb, 0x80000000, 0x1, 0x7, 0x8, 0xffffffff, 0x80000000, 0x6, 0x6, 0x3, 0x8, 0x4, 0x800, 0x2, 0x7, 0x8, 0x400, 0x2, 0x7ff, 0x6, 0x2283, 0x80, 0x74aa, 0x7f, 0x8, 0x5, 0x4cb8, 0x100000001, 0x4, 0x5, 0x3, 0x2, 0x3, 0x6, 0x4, 0xac98, 0x7, 0x10000, 0x10001, 0x2, 0xffffffffffffff01, 0x1, 0x4, 0x1, 0x1ff, 0x0, 0x7, 0x5, 0x4, 0x4, 0x8000, 0x200, 0xb2, 0x80, 0x6, 0x2, 0x381901d7, 0x4, 0xfb, 0x4, 0x5, 0x90, 0x2e6f, 0xd3, 0x5, 0xfffffffffffff9cb, 0x40, 0xfff, 0x0, 0x9696, 0x3, 0x1, 0x1000, 0x800, 0x1, 0x7ff, 0x2, 0x6, 0x60a, 0x3, 0x100, 0x401, 0x2, 0x4c9, 0x3ff, 0x9, 0xffffffffffffffc1, 0x2, 0xffffffffffffffff, 0x9, 0x1ff, 0x7, 0xc16a, 0x3, 0x9, 0x0, 0x7ff, 0x2, 0x69cd, 0x9, 0x4, 0x4, 0x5, 0x9, 0xd5, 0x20, 0x3f, 0x1, 0x7000, 0x8, 0x0, 0x1, 0xffffffff, 0x8, 0x1, 0x9, 0x8bf1, 0x800, 0x4, 0xffffffffffffffff, 0x0, 0x6, 0x400, 0x80000000, 0x800, 0x100000001, 0x10000, 0x6, 0x9da, 0x7, 0x5, 0xff, 0x0, 0xb86, 0x2, 0x7, 0x4, 0xf34, 0xff20, 0x3ff, 0x1, 0x3, 0x9, 0x8, 0x3, 0x5, 0x7, 0x854, 0x3f, 0x1, 0xc484, 0x20, 0x8, 0x80, 0x7c61f021, 0x2, 0x7, 0x1], 0x9, [{[0x3, 0x8], @broadcast=0xffffffff}, {[0x2, 0x9], @remote={0xac, 0x14, 0x14, 0xbb}}, {[0x0, 0x7], @loopback=0x7f000001}, {[0x7, 0x2d], @rand_addr=0xfffffffffffffffb}, {[0x7, 0x4], @dev={0xac, 0x14, 0x14, 0xe}}, {[0x5, 0xfab], @dev={0xac, 0x14, 0x14, 0x12}}, {[0x59, 0xffffffffffffff80], @local={0xac, 0x14, 0x14, 0xaa}}, {[0x2, 0x20], @empty}, {[0x24e, 0x7f], @rand_addr=0xfbdd}]}}}}, @state={'state\x00', 0x4, {{0x100000}}}]}, []}, @common=@nflog={'nflog\x00', 0x4c, {{0x5, 0x8001, 0x400, 0x0, 0x0, "1f001ccfb8c2055e0ba6e3025a5ad5a5a700ec9b4f7ad5b67946661cb129ab325c83061cf458fb727786b9f5667d27edc744d722865ef60e215e6744d1009b43"}}}}]}]}, 0x1364) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000001980)={r6, 0x6}, &(0x7f00000019c0)=0x8) ioctl$fiemap(r3, 0xc020660b, &(0x7f0000001a00)={0x2, 0x2c, 0x6, 0x400, 0x1, [{0x3, 0x4, 0x4, 0x0, 0x0, 0x1000}]}) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r8, 0x84, 0x18, &(0x7f0000001a80)={r7, 0x5}, 0x8) r9 = syz_open_dev$admmidi(&(0x7f0000001ac0)='/dev/admmidi#\x00', 0x8, 0x8000) ioctl$EVIOCSABS20(r9, 0x401845e0, &(0x7f0000001b00)={0x9, 0x8, 0x5, 0x43, 0x5, 0x9}) flock(r2, 0x2) setsockopt$ALG_SET_AEAD_AUTHSIZE(r9, 0x117, 0x5, 0x0, 0x171) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000001b40)='/selinux/create\x00', 0x2, 0x0) getgroups(0x1, &(0x7f0000001b80)=[0xffffffffffffffff]) fchown(r1, r4, r10) r11 = request_key(&(0x7f0000001bc0)='keyring\x00', &(0x7f0000001c00)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000001c40)='bdevsystem-\',security\x00', 0xfffffffffffffffa) keyctl$get_security(0x11, r11, &(0x7f0000001c80)=""/217, 0xd9) close(r0) ioctl$SNDRV_TIMER_IOCTL_INFO(r9, 0x80e05411, &(0x7f0000001d80)=""/118) ioctl$DRM_IOCTL_AGP_ENABLE(r8, 0x40046432, &(0x7f0000001e00)) 2018/03/02 11:09:25 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x109000, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r0, 0x0, 0xdf, 0x89, &(0x7f0000000040)="fcab7c95033a1c28b4a1a708e13d449c2a4d0f6d83fb4e04a2d3514cc9429bd92e1e11ed8e8959148eece555e22caefd2c27685f18c22f55dd447f181f2cd3a3d9c03434dd0d323b813d95d5fa2e6acb6420f071ff005b30a62cfdf0fdc5841203316b12782ae520c27a3f87e19c922b60ac45402397a87544353e31206324e2c2ee2d8e738338fbf93c66332757d2946686460f5f0d6b4566d77f0b51c5d5a4bcd510cd9c08bdd93d2d80ffe8a43af5b8495ee0e55a0b841729ef34be6ec5de898215c4da08a17bc2d21c6f71e3a6dae0a8aefa0eafe616d84daf8c5edf41", &(0x7f0000000140)=""/137, 0x6, 0x2}, 0x28) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000240)) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000280)) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000002c0)=0x0) r2 = getpgrp(r1) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/autofs\x00', 0x84000, 0x0) tgkill(r1, r2, 0xd) getpgrp(r1) sched_rr_get_interval(r2, &(0x7f0000000340)) ioctl$PIO_UNISCRNMAP(r3, 0x4b6a, &(0x7f0000000380)="290ce38accc61c1a73ad88dcf5ee6679fdc8100aef6cc4f711df06bdf44986836a14e6b74ccdf608bdb740650fd6d1e9ead6e4d993f9fd8fb97431cd1fce05d04901a7e103750c21b7f5202ac0147eb926748683e28af6e43bc8793410ca27f3db599624ff0cc5fd8e9201eaf816e7617f38241a902096666d3ae285565ccc69976604d4b207e211749a457219893762c70da142a40e3da4c31fa0ae550dd9ef63af4afee9e5b93d874d2046418e4c32793671927d3c13dae0362a515e6515671943") getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f0000000480), &(0x7f00000004c0)=0x4) socketpair$inet6(0xa, 0x800, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000540)=""/252) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000680)={0x0, 0x0}, &(0x7f00000006c0)=0xc) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000700)={0x0, 0x0, 0x0}, &(0x7f0000000740)=0xc) r9 = syz_fuse_mount(&(0x7f0000000640)='./file0\x00', 0x6000, r7, r8, 0x0, 0x40) getsockopt$inet_int(r0, 0x0, 0x0, &(0x7f0000000780), &(0x7f00000007c0)=0x4) ppoll(&(0x7f0000000800)=[{r3, 0x1009}, {r0, 0x200}, {r3, 0x1}, {r9, 0x1110}, {r5}, {r5, 0x104}, {r0, 0x3001}, {r5, 0xeffd91a394dc49e6}], 0x8, &(0x7f0000000840), &(0x7f0000000880)={0x7}, 0x8) r10 = openat$autofs(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/autofs\x00', 0x400, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f0000000a00)={0x8, &(0x7f0000000900)=[{0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @local}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @dev}]}) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000a40)) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000b40)={r4, r3, 0x7, 0x10000000, &(0x7f0000000a80)="6f925a010cd90106497593782ce7d1a76179e7535accfa7e625b17362a81392020fc4960e3fa79ecdf99293496768a8c9364e46cd873a69a9f71fa15e633559b9bcee134b3f6f2d0db6d1898995376732b20b9f269b108749702091d1dca120a002fd24dd2705f6a88b3c1bf39ffe071d010f65999d9db71069aa209fdd8068271b0c52d56ed4f7b0d02d770424e6bb2fd456e192da2289fd02345f2df2d2f7e0299f6e9ea23f34cfe0ae783a99a21e9a911987b98f015decb78", 0x0, 0x9, 0x4, 0xfff, 0x4, 0x18, 0x3f, "a3b02390171c880cc92efdf38c021894af635308255b3081088f8ebfce8e17d1a58ffaf40d64d75d8ad732"}) ioctl$sock_FIOGETOWN(r10, 0x8903, &(0x7f0000000bc0)) ioctl$TIOCLINUX2(r3, 0x541c, &(0x7f0000000c00)={0x2, 0xc5, 0x1, 0x9, 0x24, 0x1f}) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000c40), &(0x7f0000000c80)=0x4) ioctl$TCSETSW(r10, 0x5403, &(0x7f0000000cc0)={0x1f, 0x10000, 0x8001, 0x2, 0x1, 0x0, 0xfffffffffffff313, 0x80, 0x0, 0x1, 0x2, 0x7}) timerfd_settime(r3, 0x1, &(0x7f0000000d00)={{0x77359400}, {0x77359400}}, &(0x7f0000000d40)) setpriority(0x2, r6, 0x6) setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000d80)={0x3, 0x163, 0x2, 0x800, 0x0, 0x8001, 0xffffffffffffff7f, 0x3ff, 0x100000001, 0x3, 0x79}, 0xb) [ 115.900516] binder: send failed reply for transaction 587, target dead 2018/03/02 11:09:25 executing program 6: r0 = eventfd2(0x5, 0x801) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000200)=""/161) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendto$inet(r1, &(0x7f00000000c0)="d74c48ba96f9b55c1f12a698541dd727494a49796247da7bc7338c53480a0738745de23c572fe1481138c458851725c2e9d05e7e02312ecf143d6f989488c70168f06599cebf354cd4eee56a7621175ec9eba44efa33087d60a61be12b56d46a4747b4fc5185cbb69aace3caaecbcc42ae2195691fa9aef65129cd2a01eec05ec9a74e1d63cfd4f7c0aa17e4715f29187d35707548e3b733fe2e7df4822ae0da704146516a54c6e8261b7a8fec5b1ce24f3df6a9bc0b4d4d0e199de5c719", 0xbe, 0x0, &(0x7f0000000180)={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) read$eventfd(r0, &(0x7f0000000000), 0xffffffffffffff71) syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x6, 0x80) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000040)=0x100, 0x4) [ 115.948486] kernel msg: ebtables bug: please report to author: NOPROTO & 802_3 not allowed [ 115.961676] binder: 16347:16353 unknown command 4219648 [ 115.974131] binder: 16347:16353 ioctl c0306201 20000580 returned -22 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000200)=@security={'security\x00', 0xe, 0x4, 0x310, 0xffffffff, 0xf8, 0x0, 0xf8, 0xffffffff, 0xffffffff, 0x27c, 0x27c, 0x27c, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@ip={@empty, @loopback=0x7f000001, 0xff000000, 0xffffff00, 'bcsh0\x00', 'nr0\x00', {0xff}, {0xff}, 0x2f, 0x3, 0x9}, 0x0, 0x9c, 0xf8, 0x0, {}, [@common=@addrtype={0x2c, 'addrtype\x00', 0x0, {0x81, 0x44}}]}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x1, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0x1000, 0xb, [0x3e, 0x27, 0x13, 0x5, 0x2c, 0x1e, 0x28, 0x2c, 0x11, 0x27, 0x26, 0x1b, 0xe, 0x1d, 0x33, 0x24], 0x0, 0x28000000, 0x80000001}}}, {{@uncond, 0x0, 0x70, 0xb4, 0x0, {}, []}, @common=@unspec=@LED={0x44, 'LED\x00', 0x0, {'syz0\x00', 0x0, 0x401, 0xab}}}, {{@ip={@remote={0xac, 0x14, 0x14, 0xbb}, @multicast1=0xe0000001, 0x0, 0x0, 'lo\x00', 'gre0\x00', {0xff}, {}, 0x62, 0x1, 0x2}, 0x0, 0x70, 0xd0, 0x0, {}, []}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xc1, [0x7f, 0x621, 0x310d, 0x3, 0x7, 0x5], 0x1f, 0xffffffffffffff00, 0x101}, {0x5, [0x8, 0x80000001, 0x9d, 0x37, 0xfffffffffffeffff, 0x9], 0x100, 0xffffffffffffff45, 0x80000000}}}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x36c) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x20540, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 2018/03/02 11:09:25 executing program 5: pipe2(&(0x7f0000864ff8)={0xffffffffffffffff}, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000009aff8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x7}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000100)={r3, 0xcf}, 0xc) unlink(&(0x7f00003b3000)='./file0\x00') mount(&(0x7f0000e07000)='./file0\x00', &(0x7f0000d14ffc)='./file0\x00', &(0x7f00009cf000)='ramfs\x00', 0x0, &(0x7f000081f000)) link(&(0x7f0000000040)='./control/file0\x00', &(0x7f00000000c0)='./control/file0\x00') dup2(r0, r1) 2018/03/02 11:09:25 executing program 4: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20000, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000ff0f0000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) [ 115.982354] audit: type=1400 audit(1519988965.349:139): avc: denied { bind } for pid=16351 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 2018/03/02 11:09:25 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x3, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, &(0x7f0000000500)}) [ 116.038935] binder: release 16347:16353 transaction 591 out, still active [ 116.046053] binder: undelivered TRANSACTION_COMPLETE [ 116.051251] binder: send failed reply for transaction 591, target dead [ 116.057970] binder: send failed reply for transaction 592 to 16348:16357 [ 116.066455] binder: 16348:16357 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:25 executing program 6: io_setup(0xbc, &(0x7f0000000000)=0x0) r1 = socket(0x2, 0x806, 0x0) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000100)}]) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ashmem\x00', 0xa0800, 0x0) 2018/03/02 11:09:25 executing program 2: mmap(&(0x7f0000000000/0xe62000)=nil, 0xe62000, 0x1000004, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x25000)=nil, 0x25000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000014000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x403c5404, &(0x7f0000024fec)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x8000, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) 2018/03/02 11:09:25 executing program 4: r0 = socket$inet(0x2, 0xf, 0x27cd) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff00000000000000000000000089e81da8e3bd445b92a4748245450000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c30000000000000000000000000000000000180c2000000000000000000ffffffffffff0000eeffffff000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000001800000000000000000c000000c9c37ee3085f00"]}, 0x208) [ 116.084408] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:25 executing program 1: prctl$seccomp(0x16, 0x3, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0xa6f, 0x2, 0x1000, 0x6a000000000}]}) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x3, 0x340, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000440], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x2, [{{{0x3, 0x20, 0xfbff, 'ifb0\x00', 'ipddp0\x00', 'lo\x00', 'bcsf0\x00', @random="ac63dbda40fa", [0xff, 0xff, 0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0xdc, 0x104, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz1\x00', 0x551, 0x2d, 0x40}}}, @arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffd}}}]}, @common=@redirect={'redirect\x00', 0x4, {{0xffffffffffffffff}}}}, {{{0x11, 0x2, 0x8917, 'syzkaller1\x00', 'gre0\x00', 'gre0\x00', 'erspan0\x00', @random="3203422377f9", [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x64a872cf79df5868}, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xac, 0xac, 0xdc, [@quota={'quota\x00', 0x18, {{0x1, 0x0, 0xfff, 0x3f}}}]}, []}, @snat={'snat\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x4], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x390) 2018/03/02 11:09:25 executing program 4: r0 = socket$inet(0x2, 0xa, 0x8) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000040)={{{@in6=@loopback, @in6=@remote}}, {{@in=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000000140)=0xe8) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x100) [ 116.117738] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 116.129432] binder: undelivered TRANSACTION_ERROR: 29189 [ 116.149406] binder: 16389:16390 unknown command 4219648 [ 116.154631] binder: undelivered TRANSACTION_COMPLETE [ 116.160072] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000025bfc8)={&(0x7f0000b9343a)={0x10}, 0xc, &(0x7f0000b4b000)={&(0x7f0000000040)=@ipv4_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x2, 0x20, 0x0, 0x0, 0xff, 0x4, 0xfe}, [@RTA_DST={0x8, 0x1, @loopback=0x7f000001}]}, 0x24}, 0x1, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) close(r0) 2018/03/02 11:09:25 executing program 2: r0 = socket$packet(0x11, 0x10000000002, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x15, r1, 0x1, 0x2, 0x6, @empty}, 0xffffffffffffffc2) get_thread_area(&(0x7f0000000040)={0x874, 0xffffffff, 0x4000, 0x6, 0x67ba, 0x7, 0x7e5e, 0x1, 0x1000, 0x4}) sendmmsg(r0, &(0x7f0000003080)=[{{&(0x7f00000000c0)=@ll={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14, &(0x7f0000000480)=[], 0x0, &(0x7f0000000500)=[]}}, {{0x0, 0x0, &(0x7f0000002940)=[], 0x0, &(0x7f0000002980)=[]}}], 0x2, 0x0) [ 116.169444] x_tables: eb_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 24 [ 116.178543] binder: 16389:16390 ioctl c0306201 20000580 returned -22 [ 116.206922] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 116.218331] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 116.228946] binder: release 16406:16408 transaction 598 out, still active [ 116.236042] binder: unexpected work type, 4, not freed [ 116.241364] binder: undelivered TRANSACTION_COMPLETE [ 116.246510] binder: release 16406:16411 transaction 601 out, still active [ 116.253483] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x41d, &(0x7f0000000040)) io_setup(0x6000, &(0x7f0000000080)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000002800000000000000080000749f305a00", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000080)) getsockopt$sock_int(r0, 0x1, 0x38, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xfff, 0x101482) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000100), 0x4) 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:25 executing program 4: r0 = socket$inet(0x2, 0x80000, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f0000000040)=0x6) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000400)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffffffffffff9000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c3000000000003f76e25308e1b3ce00000000000000000000002eae250e3623f1120000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff51dc448d0acd0846d3f3dd438e1e76f6"]}, 0x218) 2018/03/02 11:09:25 executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000942000)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x40a0000080044dff, &(0x7f0000001000)) fsetxattr(r0, &(0x7f0000000000)=@known='trusted.syz\x00', &(0x7f0000000040)='\\\\\x00', 0x3, 0x2) 2018/03/02 11:09:25 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffff9c, 0xae01, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000100)={0x8000, 0x4, 0x3, 0x5, 0x81}) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)) sendmsg$nl_generic(r0, &(0x7f00009f2000)={&(0x7f000007cff4)={0x10}, 0xc, &(0x7f00009f5000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001300ff020000000000000000000000000c00000000000000", @ANYRES32, @ANYBLOB="0c000392090000000054e00983b1e30639647744c2846a4f1cd292a45337212c971b210020297e41b75af000996752fe2458d415fedf606e4db19812ad1e883351d248963cd592c9d7c69ab8cb03ba9e46e75244dc7389887871020b693b8bdb68d7d1f045ad143ee103"], 0x2c}, 0x1}, 0x0) 2018/03/02 11:09:25 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:25 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000d92000)='/dev/kvm\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f00000003c0)='/dev/ppp\x00', 0x1) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000440)={0x3, &(0x7f0000000400)=[{}, {}, {}]}) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000100)={[], 0x100, 0x2, 0x0, 0x0, 0x3, 0x0, 0xf001, [], 0x6}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000500)=ANY=[], 0x0) ioctl$TIOCSCTTY(r1, 0x540e, 0x2) socket$nl_crypto(0x10, 0x3, 0x15) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) statfs(&(0x7f0000000480)='./file0\x00', &(0x7f00000000c0)=""/23) mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000040)={0x555555555555743, 0x0, []}) [ 116.277756] binder: release 16389:16390 transaction 597 out, still active [ 116.284792] binder: undelivered TRANSACTION_COMPLETE [ 116.290102] binder: send failed reply for transaction 597, target dead [ 116.296810] binder: send failed reply for transaction 598, target dead [ 116.303600] binder: send failed reply for transaction 601, target dead 2018/03/02 11:09:25 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff3d2a8eed33aaeed4490b26ded3"]}, 0x1bd) 2018/03/02 11:09:25 executing program 6: setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in6=@mcast2={0xff, 0x2, [], 0x1}, @in6=@empty, 0x0, 0x0, 0x4e24, 0x200000000000, 0x0, 0x0, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {{@in6=@mcast2={0xff, 0x2, [], 0x1}}, 0x0, @in=@multicast1=0xe0000001}}, 0xe8) madvise(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x19) [ 116.327394] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 116.342915] binder: 16434:16437 got new transaction with bad transaction stack, transaction 603 has target 16434:0 [ 116.353575] binder: 16434:16437 transaction failed 29201/-71, size 0-0 line 2875 [ 116.381091] binder_alloc: 16434: binder_alloc_buf size 25386209308049456 failed, no address space [ 116.390365] binder_alloc: allocated: 40 (num: 1 largest: 40), free: 12248 (num: 1 largest: 12248) [ 116.399493] binder: 16425:16428 transaction failed 29201/-28, size 40-25386209308049416 line 2963 [ 116.408658] binder: release 16434:16437 transaction 603 out, still active [ 116.415726] binder: undelivered TRANSACTION_COMPLETE [ 116.420713] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/03/02 11:09:25 executing program 5: mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000080), 0x8) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000c81fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000028f000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) unlink(&(0x7f0000000040)='./control/file0\x00') open(&(0x7f00006a8ff0)='./control/file1\x00', 0x40, 0x0) unlink(&(0x7f0000000180)='./control/file1\x00') close(r2) [ 116.420877] binder: undelivered TRANSACTION_ERROR: 29201 [ 116.434066] binder: send failed reply for transaction 603, target dead [ 116.502584] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:26 executing program 2: r0 = socket(0x1e, 0x4, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0x10) bind$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x2710, @my=0x0}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x1}, 0xfffffd97) writev(r1, &(0x7f000069c000)=[{&(0x7f0000dbd000)='T', 0x1}], 0x1) recvmsg$kcm(r0, &(0x7f00008a6000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="04b8d104753afeeb"], 0x10, &(0x7f00009b7fe0)=[{&(0x7f00001bcfa6)=""/90, 0x5a}], 0x1, &(0x7f000089f000)=""/4, 0x4}, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000180)={0x101, 0x2000}) close(r1) getpeername$packet(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000240)={@dev={0xfe, 0x80, [], 0xc}, @empty, @mcast2={0xff, 0x2, [], 0x1}, 0x1d, 0x3f, 0x6, 0x500, 0x4, 0x0, r4}) ioctl$sock_ipx_SIOCIPXCFGDATA(r0, 0x89e2, &(0x7f00000002c0)) 2018/03/02 11:09:26 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x3, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00@'], 0xffffffffffffff37, 0x0, &(0x7f0000012fc7)}) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000001bfd0)={0x0, 0x0, &(0x7f000000dff8)=[], 0x93, 0x0, &(0x7f000001bf60)="6d7a89dd9a5138112feb36a1d2bc292aac227d2f3e7a2bf963a9a19329a6befe986ce01334e710fc585ac3e7b591c94af18d66811663f61820557503f01e53e9c58e25cbe43e214b8f530e001d7eb0f908dc1a7f2f0ea2d9c611a0163fcbc2e36b85b042e448e0c687e703209387ee8215413de087b5325e0c3552a8c45a5d0dce1303d8a738e1ed6c370d801bdcc28987ec72"}) 2018/03/02 11:09:26 executing program 0: r0 = socket$inet(0x2, 0xfffffffffffffffe, 0x9) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x3, 0x4ac, [0x20000940, 0x0, 0x0, 0x20000970, 0x20000b8c], 0x0, &(0x7f000092cff0), &(0x7f0000000940)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x1, [{{{0x3, 0x40, 0xdada, 'erspan0\x00', 'irlan0\x00', 'ip6_vti0\x00', 'vcan0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x11}, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], @random="52f3dade931d", [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x1bc, 0x1bc, 0x1ec, [@connlabel={'connlabel\x00', 0x4, {{0x10000, 0x2}}}, @comment={'comment\x00', 0x100}]}, []}, @arpreply={'arpreply\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x2, [{{{0x3, 0x1, 0xfbff, 'ip6gre0\x00', 'nr0\x00', 'bridge0\x00', 'gretap0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xc}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x15}, [0x0, 0x0, 0x0, 0xff, 0x0, 0xff], 0xcc, 0xcc, 0xf4, [@vlan={'vlan\x00', 0x8, {{0x2, 0x5, 0xe917, 0x2, 0x1}}}, @mark_m={'mark_m\x00', 0xc, {{0x80, 0x26c, 0x1, 0x3}}}]}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x2}}}}, {{{0x3, 0x1, 0x88ff, 'ip6tnl0\x00', 'ip_vti0\x00', 'bcsf0\x00', 'ip_vti0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0x0, 0x366704a803a0b19e, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], 0xdc, 0xdc, 0x10c, [@m802_3={'802_3\x00', 0x8, {{0x4e, 0x1d9, 0x2, 0x5}}}, @ip={'ip\x00', 0x1c, {{@multicast1=0xe0000001, @remote={0xac, 0x14, 0x14, 0xbb}, 0xffffffff, 0xffffff00, 0x7, 0x67, 0x20, 0x14, 0x4e21, 0x4e20, 0x4e23, 0x4e22}}}]}, []}, @arpreply={'arpreply\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}}]}]}, 0x4fc) r1 = getpid() ptrace$pokeuser(0x6, r1, 0x40, 0x100) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000040)=0x8a88, 0x4) 2018/03/02 11:09:26 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x2, &(0x7f0000001580)=[&(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f00000000c0)}, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000001100)="f3fa6bdd0abbcef0", 0x8}]) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x880) mq_timedreceive(r2, &(0x7f00000000c0)=""/240, 0xf0, 0x8, 0x0) 2018/03/02 11:09:26 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000280)='/dev/snd/pcmC#D#c\x00', 0x4, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f00000002c0)={0x8, 0x0, 0x2, {0x77359400}, 0x81, 0x800}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x109000, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x7, 0xc, &(0x7f0000000040)=@raw=[@exit={0x95}, @exit={0x95}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x400}, @ldst={0x3, 0x1, 0x3, 0x0, 0x576055d2d7bed0ee, 0x70}, @exit={0x95}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6}], &(0x7f00000000c0)='GPL\x00', 0x0, 0xe8, &(0x7f0000000100)=""/232, 0x0, 0x1}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) ioctl$void(r3, 0x5451) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000340)) inotify_init1(0x80800) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f00000004c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff9cbf18aa48035d06380f0953e5dfa83812c71d03483f50bcc5741d7761c4b595c50af9816007f1c1013ff98509f8237e18ef6b50b06576b1a9bd837d5d3d5f0870bf42e7b15771fc6ab27f8e99c437fbcc99ecd3751584c1ae8d0fda04af9df8763e7d2e666a9e26e02249efaadd2ee13cc8152afe4080187647002d051e141fa94c5252d8a2bb05990d68dc59039be66aab9e8691dc78945246c91f89ca84193a37a25ad309c9b84c9579212eade7198b34e597ddaf5bdf3b2d3b32a188fa5e4f09012158e30d51f290"]}, 0x2d2) 2018/03/02 11:09:26 executing program 5: openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0xa02, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000b76000)='/dev/ppp\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000002300)=[{&(0x7f0000000080)}, {}, {&(0x7f0000001180)="a245956091af3261358a2a168c5b373e30df4ee00b6247da1a5e6f2219bc33fa5cfb92a05823856032a70d952a1ca05cefd4f8d8e8db55697914cdcfb8edb08405d4bfad248e6fe109fb78a30aaec2e93848f50685b6e527a93675d0a53c5287c154088cc984f9c1ca970145067e2a285358da66468929714a1838184f9a9c930ca27057f9f99b56a01bc6691b8568a9d57cb6a804f10af31cc5fbbb58a4c87ab58aec80a09ef32883d8d63c68208aec80a70909d23f2e7c9178e6", 0xbb}, {&(0x7f0000001300)="dd8c05c744622e739608bc73cdfeadc26e83b247b05ec6b7c27deabe906826d0bac7fa97194328d46c43a7e9a3a8c67bc70a03d755cdd735b44340a2d0fbeae6ef6a3e1bfb42199ff21bb3294957c04a7f6307e682032e334fbe04cd004513661847c05f7d53f811699af9686c9dc5ff84bdbb313063efcb4d8d8b1a9d4b7f99fd45dc754d90eb76b1873af05b60c5d1ef571ee7f246bf16512664af49f74ba22350f4d7e136c6a8b609ed10bba06873852786b8966c472a7ce6391aba7c76cd43e08e3a7284c754cbab1ef0d8cc0077aa2bc5b5777fa01c8c73f615d6dacb2d037801fe838fa5a55d771dda184f93caac44a7899bfc64ec8e9ac47cb378b82abcd4b618b9cece36e731a87eda8ba9dfa4d6172d507c2da0c866859c9faca1f357ce15627a129350e2d90946f5cf98051f9ad35ddef45e87448e5c641c9d04c20d6863265db5007f434a6e5c432ceabedec7531a7165bb2e6dc2d4a0d9cd5d94092c889655630d29acf2c9b290ea7e5b5b1fcc7744a4fd2e873a3f36bbf35f1a081086402bf12d87cc92940945c69fd774648c669ebfdb04aec9d6d48dee6d67424651178248e7daddbb42ea18f3ccc759cb55e5e2d5528ba3726292d83555f25f06c725abbeef2000b94f59a4a6fc1ed64db3ce68ee163f3a216e7b0a0d0b013cd5b56d91949ae7b82c12dd3d378bbd29eb3e4429806a4164b29c1218dead915562682ff80d91431092b141fe4cbbce32e1e727d270e406d787ec93720fc68fd7e147da2bdd84ce08f0bb89475160a281f94ab1a8bc5e026b8e0ba21714a7b42c90b48ff8754565710c78e1bbf221635b99f9aae829dc49297d5840a70debc74be38f987d9fd951362a35a29f878fcb18bc7439f51b1bd0a697b0591ab6ba382356b6e6ba6d7969712e24e3df816f27240be8dc0e0227e2ca0c3564042fac8e42b38088a8b85ece2062f3202b4d39eccb4a2cd31bb07c3699e189422f2b59e50f1a2bd339dae6bc269ddace2f9e35d9b01b38f8889b8a3dae8cd3eda52340fa64b2c2005f5465c7c77411c9dccfdefa595abda8b450abec0e1cdc5cd589daaf0e1dc3207aef29214b51c258b3805133b9dc1aff9c40370e2a4aac6bbe7519ffafc11b59ab9ac5afb2f577c560738770bb9c96be5acbf91142fe069263137e641b82f8cd404e61bc7a896924f2aade53f9d4194f8b5c62d40035892c5a731ddd3712b2b278b660c37bd2fc32cc50ec909e6210e014aa40a1b8bbc6d54f417ae79a2d1eee4b896bfda9b0dda628b3bcd9d3f6b395da19f4bdf8ce934180e3437d8f883245910e816b2d38697890efee8b5695cdf1ed63e6cc90f403cced89e2421853e0813629da282862931a2dae87b504db916f7736096df766d395c28fb83dea375b63e9b62257d0429618b444fab45ff01861bf3a5814919e499eb849372141aa723ff09b2b89a85006f44fa250337b6302a5f5cc7bcc93ade39b8d0973b0398101c6be8b6138c879a45012bb93f04c628f8448c1d9ffd0217181d26b75c345700a2853f4b3b13d54dc43caefd0a74f59c7214eab90c66e169c81029f3c33b66204125d1d9f7366b177887815424fbf1f3984235cbd374a67656f4292e0c371e53d3bbd9879489273450e26afe3fbe1e4dec6aaa98bd78cb453f5bacf68e9698785ac0b207e65ca70b04e34a2469f1689321a6f6d58abe8857910857cb6396fe52d4b91c7b51df6c697a2537d54faff8c8cd69c52f980bfd9bbaed1e7e7aa0bbbc24bdcf1a07b9c1b49b31731b6dd49d3136a651198ec6405a79a4861d23c67df78c01a1e08787684be75ecf235036b6d7e8df06dd2c56a32933620a8885f4ea6363c80db89a26a6e7b1339c2e323cb7179896148c910c49b67497352b6f7a20e62eed8ae89a074e2eb4d51b165ce1e0218be79ffe1c1ce1ab0b2cda49edec51379411177ccdb18316e4f0153d2f60fd061a053942cc9bd121d36fd9214f110da79e51ee80c702dc22dc5e2c9029b6008a39707b7aabb479806a921a514fe7ed9b11f150c660560f5d845a0982361bd83d711086ef47f9b549d0ac2517f7eb1c83caad1cf31d37de5b84560720c549b7fc541f6d1696dd8bc9be6e3ce64ef271d7bd85f0750a2319d7fe4618dc1baa1bf519c64d1ae9849305dca965baf46667b19a579e77cc625cd7e388a36ec29d235d1662400ea986d7951abfece354e574cefb5b7ca95fa28fe4cc0e5a75e8d3bdf16ae738a4980083e043ea3f200ce5a27d4633f83a099535ab41b8d6e0715e8bb70222830c21a3ebd81a49789d2a7799142095aa5888a11d50e00541ed81942c8b96e0e8c446088fbccfc5974040b7711961f2cb5cdf44362622ff190836154a05fc2a6f8e8dd919f440031588d480c6a31f78cbb69e81023dcd098f24d645845fa00caa5d2d41cfc76dae5dccbd9c4c196342ea8e15a3013dc152004a03f9deb4d60078f067c3be354fbd741367e3ad8bb83da6f1afbe11ecbc296c7c945d406e42581eadfdc57859239b3ca762b42276c5cbce3377909fa7e916cddfac5cf98958812d192654c9fdd04b4416f5b0fff81622ed91ee05e041ca52853c834dbe3228b07b04b55d3e3ad1da7cc526948fd2bf39f1305e69c51f11b6f5ad049a16d923a74d870049efaf5fc7c60ab6ff5607c8a4031a8389ffd336d96cd8c3e14f71f33762c6af2bca40b2ea9dc7e26bf7904394a972eaece040f05bf3c98d07df19af868f5c5918fababd682a7882670b68e377030995cc07ded96b29727ac4b2429aaf66d7c3702c1d6a97536d01277d1860c779680ea068b4c782eb7d3dbaa2561e9c95a729f6d4d49d9a835f6b11916d16c481400343e68a937c5d9dc9786de70c33b842b6194e7c7ed67aac6481e8625f931e7f03fd130cb32d1d72c34ae1a3874cbb162d2cda60540e2ec5cac8e0c43675744a4104a04e43e77c0960bdbd54177349746f69dfaea00738d42f05156bb819357537df253c80eab6987f3299a9a90c44eac4f16f91c87771ea036c4ba120b21f19f95d11c327f3369897da4c6c7a08b2ac915b2f0a8313bcb1be38a03acd6fe0c2792f10864f1d6076ab906d62877c4931837ecd242b2f8bf0af2f75154da7b088e18ec44c6394589bd70e1e0d9b767324ad81a4121841f843ea03e8d2e844f7ef88e0d11c12ac74e5013db303f9599bbf609e6d287a5ed32c34aec41458d9f964eb601d07d3a6a2b964a5178d8786531f191d38369da8f5322e902b7d5fc7ea46d3b8570b85fdfb50e1e8d1986ef9f04bc0d3c480bb00f9db1f0f5454e671dac0b93e5a9bc2545832bfa98dc6c4bf65ec0e0f39fffbb80ad3ed0e497581be64e92271568bc81c83dd316f6367b3d6c7233aa02858c7bd92194c91b95f75673fbc7b64a958a886572e470ce5a4225ddb456eb34af21e6c1a2c5987d2529f579a90b281acf96d18404fff6c7ac8fb4864961fb769e250cbd2971b3b731c9c88bca7ab489ddeeb20cc809ac608a8cc9b3eb0c2d12e1414399f0f9b2d15d6b19e8106bead54daeb751acc252985dc1a5b0ba71b432193f6a074575108cdf6a892dc869c50ef6d847e28502403c8739ae836428de61ada6ffe2f2510601e0b049a8fe8eb10fc0191b71b6ff6d0e2b62cb6afadc6ffc5b1a2d96b0c886f01426fd851fefc29888c03968e3785b16572f18c2904c79e12f83655b3b3445106949b55ff692ff489cd7c4955d44c5ae545a93a012b0270fdc56242b8e85f29d1b30ad255db105daceb85e53055643e3540ac207d6cd955c4fd66d74c11f737c12c29a6a81c4a1f019ee98a757aea06dbe9d5d8cc0a0a82205d0095fc7f4514c832e220bd9c7544e3eadd075441d9a4d51c18d16371a91ada56565d1adffce667395aeba5381de4a456174ad236e9e7998fef743b2261dda7e7fea826c904d564533bfb2d74d63bc970a167171ff7be6b4572f1d45ff569751a9d007ed78fa929062b4b6117c142328e6ec89a06333e7da98187bf3d6a8f3304539a0af573dfb3cafb24a6289e980bd85e27be6c4a3b62faabfb97c29d595202eae6c2c2d649d5be5ceaf11464e495e6aee91f18686bee9e2aee651886683b2766717b746477d8350d8380d4d3597c73b35da3aad130b230acfb1e26aed4de67ec8fb05f54c8832bb286f1369b33f19751cf09fbcb750e95db9f82a62b841f0d46e45e6279237c6da84ac1fe8b511df86984732deea88c8c19a953f84c9d9dbba86f20a0e383044a83588deed6426382dcbd7b61dcd29a9997262113eb68e6b2b221772bcecc4a38e78a04edb41ec715004ee826357f9e5f9b90913d3c401e2a4c73fe225b6acaf7de2f998f988338503b6991099d9841e5a15a0c33e8ff5656c80dc8253349153f38129e6ddacf6a2e896e56301ef9abce260", 0xc34}], 0x4, 0x0) connect$llc(r0, &(0x7f0000002340)={0x1a, 0x0, 0x0, 0x0, 0x9, 0xf3, @link_local={0x1, 0x80, 0xc2}}, 0x10) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000002380)) close(r0) 2018/03/02 11:09:26 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000280000000000000008000000000000001be6e4f00ce2a4b6e395cbefdad6307e7310e9d93e6ebc491aacb180305ff2757ec3f88d52ee829770c947033111c9cbc5cd5f3ec4f38740c8020342f342319fd21640edfa0c2cf77cd2f439dde3f5a47ce309f46b972a19c76e33e417c9a57d66cf62a5b1e2bf25897271cf8fa657f6f718da5b01a4d048abc2dc1c903512b413afd0a8cd16e68900607b69c235fa9907141761a11e1734aa", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:26 executing program 0: r0 = socket$inet(0x2, 0x7, 0x80000000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000130000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c30000000000000006e7230000000000000000000000000000180c20000000000000000002a97e70000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1a6) 2018/03/02 11:09:26 executing program 5: r0 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x108) r1 = syz_open_dev$sg(&(0x7f0000000300)='/dev/sg#\x00', 0x5, 0x408200) renameat2(r0, &(0x7f00000002c0)='./file0\x00', r1, &(0x7f0000000340)='./file0\x00', 0x2) r2 = syz_open_dev$sndseq(&(0x7f000087bff3)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000200)={0x41169ca6, 0x0, 0x9, 'queue0\x00', 0x5}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000000040)={0x10000000000000, 0x4, 0x808}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f00002f8000)={0x0, 0x0, {0x100000000003, 0x0, 0x3}}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x4002, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r3, 0x28, 0x2, &(0x7f0000000100), 0x8) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a45352, &(0x7f0000000140)={{0x5, 0x1}, 'port0\x00', 0x4, 0x800, 0x8, 0x9, 0x81, 0xffff, 0x40, 0x0, 0x0, 0x7fffffff}) [ 116.656613] binder: 16477:16480 transaction failed 29189/-22, size 40-8 line 2848 [ 116.662098] binder: 16474:16485 unknown command 4219648 [ 116.669193] binder: 16476:16487 unknown command 1073741824 [ 116.674702] binder: 16474:16485 ioctl c0306201 20000580 returned -22 [ 116.678349] kernel msg: ebtables bug: please report to author: Wrong len argument [ 116.691794] binder: 16476:16487 ioctl c0306201 20000000 returned -22 2018/03/02 11:09:26 executing program 2: r0 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x0, 0x2) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000140)={0x6}) clone(0x200, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f0000804000)) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) r1 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f000000d000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000008ff8)=0x3f) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) recvmsg$netrom(r0, &(0x7f00000003c0)={&(0x7f0000000040)=@ax25={0x3, {"4a34961f7659e9"}, 0x16500000000000}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000180)="6311841693f6cced3f2fc406b70ccd2058bbfac756b4496149e09e4550e6c229ebf1a82fa59eac74d1eccc35e5c473ad74a7dc5a685b39d5cfea29a5b7d4a93a9d09611a5536677109948420535bcfa1c9ea0ee88eefa35911b735e6cbf92eeb59333d35363f62a8e6a11693e5cca1ae47a0efbb26abe4d1739958769c65a7fc4771ee1888295675110194030f7820b04fd57551cf00c361c4a158b7c4dfadd007a462d807ff4336daa0076142a1d5c4", 0xb0}], 0x1, &(0x7f0000000240)=[{0x9c, 0x13b, 0x8, "73003939dbce9fe05027513013a439e03c3b3b0c25745fc46ce62e210ee818e3f22e6bc596d76d714d87b690592d32d06cf3484b0d58d4daf6d25fd69b4b6871376ac2df6af1f6c3eb8350eb7788f81b57b5b2e4f27e06017c99fca93b26044ea881aeab925b48d2c0b307547951663d30cf28cab0a4a06c264e9fe32b81a10ca7193667eb3fdfa8aa7b152b59"}, {0x28, 0x11f, 0x7, "7b0816249dd88fbf9bb6362ffb6d262cd9c1c544af183a565b1c09"}, {0x1c, 0x11f, 0x6, "23dab5e0a2d5702a1d2eb7e70dbf3f"}, {0x94, 0x84, 0x4, "96beff07483308b66ced26194298f1a9c5a81b193aade4828ac47ed70c0e13a64bfe7dfb181083ae97f719bd63ad86ff8cf286b39dd9d5245c3f54b02168e3f884a7f72b9791afed1f791e77d140b6377f0bf44b3eb7f6fa6894bd38840f34d8ac96da77e48f4693f8c0435263490b4a1481ce32e80b575127cd95d287ba7caa6129164244"}], 0x174, 0x20008804}, 0x0) fcntl$setown(r2, 0x8, r1) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)=[], &(0x7f0000000200)=[]) fcntl$setsig(r2, 0xa, 0x12) dup2(r2, r3) tkill(r1, 0x16) open(&(0x7f0000363ff8)='./file0\x00', 0x401, 0x0) 2018/03/02 11:09:26 executing program 7 (fault-call:8 fault-nth:0): perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:26 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000c40)=@broute={'broute\x00', 0x20, 0x4, 0xa14, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000200], 0x0, &(0x7f0000000000), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x8, 0x65ff, 'sit0\x00', 'syz_tun\x00', 'erspan0\x00', 'ip6tnl0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xfffffffffffffffc}, [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], 0x29c, 0x29c, 0x2c4, [@bpf0={'bpf\x00', 0x208, {{0x1a, [{0x1, 0x619, 0x1, 0xffffffffffffdf55}, {0x0, 0x81, 0xc35, 0x401}, {0xe38, 0x9, 0x3, 0x6}, {0x6, 0x55810d06, 0x1659, 0x81}, {0x400, 0x8000, 0x0, 0x4}, {0x7f, 0x6, 0xfff, 0x6a12}, {0x2, 0x7, 0x9}, {0x8, 0x5, 0xcde6, 0xcf8}, {0x4, 0x81, 0x0, 0x2}, {0x81, 0x8, 0xc0b, 0x100000000}, {0xfff, 0x79, 0xffffffff, 0x1}, {0x7, 0xfffffffffffffeff, 0x20, 0x100000000}, {0x2b2, 0x2ea73fff, 0x1ff, 0x9d}, {0x1f, 0x7fffffff, 0xb5f9, 0x1}, {0x0, 0x5, 0x7, 0x8}, {0x4, 0x4, 0x8, 0x4}, {0x1, 0x1, 0x1f, 0x1}, {0x12778c0f, 0x0, 0x8000}, {0x4, 0xfffffffffffff93f, 0x8001, 0x709e}, {0x0, 0x4, 0x1, 0x4}, {0x29d, 0xfff, 0x2, 0x768f}, {0xffffffffffffff01, 0x9, 0x2000, 0x4}, {0x0, 0x9cd, 0x9, 0x3ff}, {0x100000001, 0xff, 0x1ff, 0x200}, {0x7ff, 0x1f, 0x132, 0x5}, {0xa3e8, 0x1, 0x7ff, 0x2}, {0x7fffffff, 0xcc80, 0x100, 0x9}, {0x10001, 0x200, 0x0, 0x401}, {0x3, 0x6, 0x5, 0xcc4}, {0xfffffffffffffffa, 0xfffffffffffffffc, 0xfff, 0x6d083b14}, {0x4, 0x2, 0x0, 0x5}, {0x80000000, 0x8b37da4, 0x9, 0xd90}, {0xef16, 0x0, 0x3ff, 0x8}, {0x2, 0x4, 0x4, 0x5}, {0x3f, 0x4, 0x2e, 0x8}, {0x2, 0x5, 0x970, 0x8f02}, {0x1, 0x7fff, 0x7, 0x8}, {0x20, 0x5, 0x7fffffff, 0x8}, {0xcde6, 0x2, 0x13e, 0x9}, {0xf98, 0x9, 0x200, 0x400}, {0xaf7, 0x5, 0x100000000, 0x8}, {0x40, 0x9, 0x4, 0x3}, {0x0, 0x9, 0x6, 0x4}, {0xffffffffffffff01, 0xffff, 0xfc3, 0x1}, {0x0, 0x400, 0x9, 0x2}, {0x40, 0x2, 0x1, 0x1}, {0x1, 0x0, 0x10000, 0x6}, {0x5d6d, 0x3, 0xffffffffffffffff, 0x8}, {0x2, 0x200, 0x3f}, {0x1, 0x6, 0x5, 0x4}, {0x0, 0x8, 0x5049, 0x9}, {0xffff, 0x400000000000, 0x6, 0x5a72}, {0xfe, 0x800, 0x1000}, {0x0, 0x100000001, 0x80000000, 0x3}, {0x100000001, 0xff, 0x8, 0x1}, {0x6, 0x43c, 0xfffffffffffffff7, 0x80000001}, {0x10001, 0x5, 0xff, 0x2}, {0x3, 0xffff, 0xffffffffffff0000}, {0x80, 0x401, 0x7000000000, 0x48000000}, {0xd8, 0x2, 0x309, 0x68}, {0x2, 0xa6, 0x100000001, 0x2}, {0x100, 0x0, 0x0, 0x7}, {0x392, 0x401, 0x1, 0x381}, {0x0, 0x64f, 0x7, 0x9}], 0xc2ce}}}]}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{{{0x9, 0x1, 0xe80e, 'sit0\x00', 'sit0\x00', 'irlan0\x00', 'syzkaller0\x00', @empty, [0xff, 0xff, 0x0, 0xff], @random="452bad53a225", [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], 0xc8, 0x14c, 0x1bc, [@arp={'arp\x00', 0x34, {{0x18, 0xfacc, 0xb, @empty, 0xffffffff, @local={0xac, 0x14, 0x14, 0xaa}, 0xffffff00, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0xff, 0xff], 0x80, 0x90}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0xfffffffffffeffff, 'syz1\x00', 0x1}}}, @common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x3, 0x40, 0x3}}}]}, @common=@nflog={'nflog\x00', 0x4c, {{0x1, 0x9, 0x7, 0x0, 0x0, "f5f847388df0721a82c1e66637e60e2ed55e584017f7b4eb0952da76f2ced6fe99a49ed36d00b7bb7b9f6c50cf04b64e29b104460116fdea5b84a478aa19109f"}}}}, {{{0x9, 0x10, 0x0, 'irlan0\x00', 'gretap0\x00', 'syzkaller0\x00', 'sit0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x2c8, 0x310, 0x338, [@bpf0={'bpf\x00', 0x208, {{0x5, [{0x1, 0xfffffffffffff27a, 0x8, 0x80000001}, {0x5, 0x0, 0x2, 0x3}, {0x72, 0xffffffffffff8001, 0x8, 0x3}, {0x8, 0xfffffffffffffffc, 0x8, 0x33}, {0x20, 0x10000, 0x8, 0x4}, {0x3, 0x6, 0x1, 0xff}, {0x100000000, 0x5, 0x800}, {0x8001, 0x3a1f, 0x9, 0x4}, {0xfff, 0x8001, 0x2b1, 0xb1a7da8}, {0x2, 0x2c, 0x141b, 0x8}, {0x40, 0x7, 0x8, 0xfffffffffffffffc}, {0x1000, 0x0, 0x438e, 0xb0}, {0x54d, 0xfffffffffffffff8, 0x3, 0x8}, {0x1, 0x2, 0x200}, {0x3, 0x81, 0x6, 0x7}, {0xffffffffffff0001, 0x8000, 0x100000001, 0x1000000000000000}, {0xdb, 0xffffffffffff301f, 0x80, 0x400}, {0x2, 0x5, 0x0, 0x1f}, {0x80, 0x2, 0x3b, 0x5}, {0x5, 0xfffffffffffffb93, 0xcf0b, 0x9c}, {0x8000, 0x4, 0xe7, 0x8}, {0xc73, 0x7fff, 0x0, 0x6}, {0x7ff, 0x316ba3f4, 0x2, 0x2}, {0x400, 0x6, 0x1, 0x14}, {0x72, 0x200, 0x40, 0x8}, {0x10000, 0x7, 0x7ff}, {0x7, 0x3f, 0x200}, {0x8, 0x1, 0x1, 0x80000001}, {0x0, 0x5, 0x4, 0xffff}, {0x1, 0x80000000, 0x5, 0x2}, {0xfffffffffffffff8, 0xa53, 0x27ef04f2, 0x8000}, {0x2, 0xb45f, 0x7f, 0x8}, {0x1, 0x0, 0x9, 0x401}, {0x100, 0xe0, 0x7, 0x10000}, {0xfffffffffffffff9, 0x1, 0x0, 0x4}, {0x8, 0xffffffff, 0x7ff, 0x8}, {0x5, 0x8001, 0x3, 0x2}, {0x0, 0xab, 0x7, 0xe90}, {0x4800000, 0x4c6, 0x1fb1, 0x4}, {0x20, 0x5, 0x1f, 0x200}, {0x2, 0x5, 0x3, 0x9}, {0x3, 0xe3, 0x2f00}, {0x7, 0x1, 0x83cf, 0xa9}, {0x101, 0x5, 0x6c, 0x7}, {0x0, 0x2, 0x8000, 0x6}, {0x2, 0x647e531b, 0x6, 0x62f}, {0x3, 0x100000001, 0x100000000, 0x1}, {0x4, 0x7fd, 0x7ac}, {0x1c600000000000, 0x5, 0x1, 0x7}, {0x0, 0x54, 0x6, 0x48000000}, {0x50f, 0x8, 0x3, 0x6}, {0x6, 0x4, 0x100}, {0x3, 0x5, 0x80000000, 0xfffffffffffffffc}, {0xcdd, 0x101, 0xfff, 0x1}, {0x7, 0x90, 0x1f, 0x2}, {0x2, 0xffff, 0x5, 0xfffffffffffffffe}, {0x8, 0x7, 0x0, 0x6}, {0x0, 0x7f, 0xdd81, 0x80000000}, {0xffffffff00000001, 0x800, 0xfffffffffffffffc, 0x80000000}, {0x0, 0x8, 0x9, 0x1}, {0x2, 0x8, 0x6, 0x7}, {0x80, 0xc807, 0x1, 0x4}, {0x4, 0x20000000000, 0xb93, 0x7ff}, {0x1, 0x9, 0x8, 0xd5fd}], 0x101}}}, @cgroup0={'cgroup\x00', 0x8, {{0x5}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0x40, 'syz0\x00', 0x4}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0x44}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x10, 0xe8ff, 'teql0\x00', 'vlan0\x00', 'bcsh0\x00', 'ip_vti0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @empty, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0x70, 0x19c, []}, []}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x1f, 'system_u:object_r:auditd_etc_t:s0\x00'}}}}]}]}, 0xa64) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x200000, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000cc0)={0x7, 0x5, 0x1, 0x7}, 0x10) 2018/03/02 11:09:26 executing program 3: socket$inet(0x2b, 0x1, 0x5) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x800) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000040)) 2018/03/02 11:09:26 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa030000000000000000000000069703636587695e1f2d50000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff00000000000000000000000000"]}, 0x208) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x6, r0}) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000040)={0xf, 0x0, 0x2}) 2018/03/02 11:09:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) poll(&(0x7f0000000040)=[{r0, 0x1244}], 0x1, 0xffffffffffffffc0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x2, 0x4) ioctl$void(r0, 0x544d) 2018/03/02 11:09:26 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x16) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x3}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)=@delpolicy={0x98, 0x14, 0x221, 0x0, 0x0, {{@in=@rand_addr, @in=@broadcast=0xffffffff, 0x4e23, 0x0, 0x4e20, 0x0, 0x0, 0x0, 0xa0}, 0x6e6bb4}, [@algo_crypt={0x48, 0x2, {{'ecb(arc4)-generic\x00'}}}]}, 0x98}, 0x1}, 0x40000) [ 116.713079] binder: 16476:16493 unknown command 1073741824 [ 116.719797] binder: release 16474:16485 transaction 608 out, still active [ 116.720146] binder: 16476:16493 ioctl c0306201 20000000 returned -22 [ 116.726829] binder: undelivered TRANSACTION_COMPLETE [ 116.738469] binder: send failed reply for transaction 608, target dead 2018/03/02 11:09:26 executing program 1: io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000858e8d404bca84a0cd60000000000000000000a5fef4023124590000000000000800000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x3f, 0x40000) socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$bt_sco_SCO_CONNINFO(r1, 0x11, 0x2, &(0x7f0000000080)=""/130, &(0x7f0000000140)=0x82) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @broadcast=0xffffffff}}, 0xffffffff, 0x800, 0x8000, 0x3}, 0xa0) [ 116.790219] binder: undelivered TRANSACTION_ERROR: 29189 [ 116.798957] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 116.815157] binder: 16505:16510 got new transaction with bad transaction stack, transaction 610 has target 16505:0 [ 116.825809] binder: 16505:16510 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:26 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e617400000000000000000000000000000000af995ba600000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) socket$inet_tcp(0x2, 0x1, 0x0) r1 = dup(r0) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f00000003c0)="48ab7c5d261634d21cdf8ac19648691ac34bd4c56c3e70e34cb335d80d20946f523b4e7505f2faf80f63ce5e0f88ad395be7a8f477449f6ca1d6c918cc97a4ae0e947bab6a7365c7877b79a1b509ebc82177de8e8fdd62d29eec8934f06037722e170662acde44c463ebf66f69503c4da070ba804fafb68fb1cbea33b39fbccf80040b7f1bb7593d837083b0e72dff42eb03e6831bd9ae514c21e587a6373302b861757a8659af46b15046f872d796689bd8e07bdc39e47c3e7eb5d7dd70919ab065ec5b6552975c8daa18e3769bf6914ab321f51e5938379b3f340f5b2e81bc59fbddf38cf660053eb209fdddb8527b20def766e52f7a257290f7b301d451728cdab13197269556f82eaacca0cc5ec4c747ebfd769c5e340021fe9ee14094bc6d9bee8fcb054bd8c0a6b7d0bf77cb32f6e418c7095839c417992e537849c050932ff072adc3da188dcf83b13157cb8946ec44d78ba6a1a0f9290474ff0412ecea795aecdf816ee6d84b6841f3e931e079a114c07c0b4979154924d3767b2cf90347319a403efc8b647b2f36bcf5a4f164aea7439b6b5c5d81b9b7abe18d440751e5745810578e0acc277f9a03600ed6b75234a575be3fd2a0fe5e90d6783ac877c46672df8ea5225ba3290ebfb9135217110aad075a1a1baaf17e7527b0879179088328ff35043fe534cfd083453c9a2e767bff93c853cb6c8feccecc2850e21c4bfe6cd644f6961693d8a23aa2035758f67e0288fa2d3776b9262dd2c7c6618046b39c782abb3f2bb074bc615bb2de42ef2b7a3d51b6651e8688a3894ec43415d80899b31fefc60c2da18b666da6349826a036e5bacd5ee52b8f1347e0f51334c24a6bedbf79be7f83eb9bbc681fd638be3fc62a5065bb9a0d2375618758841bc8161ab3760359dce4a7345c23b488e1ab3ca9dee0ab9d612e93fbcd60a4b286e05911b70033e4d8fa5a6db4cc56657e30730336732a2df6565b6ffa3bd33cedbeb4e183b982a3be976dc7e013c6da393144b622961d56ed46d7dcae7b8994562391266561989e8c2ea166a327f37295608c9f01ae875161cabc7607b648f4fca4f10159420e041cb2885ea56290ecbafdc6daa6bbc03415cb6ab612cb3db4bc4551e4551f56bbe18e9d9cc9c8591114a23bd2f6b161567e60c0cfeae3180cda20e2b8709d57f5182883665cdbc9e5130c3fedc92d45625703e1a260b8e0320f4957385c7b11c68c90f72fdfa5a5bc5a20bfc0074bf379df7d22ccdb50248c71274e0acc7628266152dde3ec2dba4e69348f1f72ed3a1af20a371f7d1c7447b7d21ee96cb8f9396de5dfc55399eaea9ecab7e4b859a12c0edd6f5972c7b940dfd91c5385a45a02785f974f592c1b4dde017f30eccd3297ece36ae3420d0dc9226acb85f41e2182d21d7c93d2526cee43fe672d92c2be195743d982f3e72f445809b89cf790b85479e064bfd6168cff46304a66bf9815af027b425ed6e02a07b02070a6684cde1cd83ed92a70251d55c5c7f2583f6f3b00ac5f04c54d505ad21997ca3b07faf1478b4e304315277e4782551f7581c369c38404f64f8eadbee63011781631bfc45bf630a51b44630f38288d4cdf3289b2877fb2bec9f7a50626030ebd38ebc38a1f29543a83288d2f677c9da18b5b83db46aceaf56631b162cf2771cd433f62b3464894969d8d24500c6e580803a43a17de64fcf826a648ac1fade835a5a4311721b0f9782bc2919df2ff1fa046a3ea60f40f9bd4f9d7b1b13715f51c32a7ef260f7b9417c707f795ee755e14aa65a0bc83b066184af47605f2cf9d0f1f2dc5a69714b2b18e4f4a4dad75cb0def0f21bdafabd5505ffbaa5379bdfb11ce20423bd346704223719dbb6439f5d6923c86a2cc62af1b88a5f9ba747957ee58bad70dc72e4ec5a7ec41c2ef32a637cbe98f4c521147c537f95d1b7aeb745779b88fc886750c629cb11f9978e4f7eb1ed1f2f4da2661e6b7e68217cc7d7a72a1fe894593151c4f879250b61ac83ee0b3e94d19097fe9242567409909875e551229b278f36f30505242fb9675dc665e977184c40b4a2936f7556d565f55c690647fb500a36f5b2cd7cb4b05073f6ca93df098aaf79ed2c5537ce71e0f194d296dbccc11c146ed7fc12692001a6ba4158e20e10a1919b2b495e37b3f4dc0934880635ed92a68902b6ce3df60a3bd8682c878cff2b575830c2355088b2d87911f92946923350e4324a98c16f7327b3c2cfd9b52d928b6b05385307e66ddcf057acbb15e0975e9de43edda11e7fd72e084801a79f0650b08d0b98f1b861bf9eb422e5ca1e4c53376079c4e855d62ab35da1711cd3fcb01b86b397cdc264a99559e546aaf0ecc18008b56dd04d7dd9370d3b111398af1f31ae29dd7ec23d0b2937ae8aedb94a558af2c394ce5871c5fa7d4d6d69375fcf7657fdfff00e1c787547c905635dfba3bef447b5b64a57feda2a5c3ee323c80562d25237dd2720816fda595007bb7d44bd856eee1ab4e9aacbbd984f09813bdac3c54b0738861288b39e754f1d32853adb05041b93487ada5c897ecbb7a3d3e2760b6d2b490fe0d8cf32c26f98ff0a2aeedaeceb5f3fa8a4c28d8c27df45e32d1e33cfc5b3d4e0c27976fd3edc26155bdce775b7cc56ddc3ce3b0df6c6ee1b9db01283864df04b69a82ffb246c1100518bc962004dcc9fbe707da524f19518f9a83d60246a2ff1a5dbc04fa594da0853b44dbddd63740603f70e8dbdb0d7b707c348930509878503482c88d891e01b93fb9c1cede9adc5676ea5e6378fa2da5ec1de7269767607391b6208c669e1aeb095a0131ff9879c6bf73734e834a0f061b22a72bfe733123f95f43a44c33c5529da5b4b87434ec3a47f6b08fe21a8537be6ffebe2e7bb5d5f801cd0337688b82eefd8e97ab0afe3d8eead058d8b5df727ce4a7a5af0f94dd73362d16a2bb1dac9a5337821eb9973e7a36311cbea4878f7574412bb5d30214d87595958f8fb6a52050a5638e5c58bab13d268fb5f8dc7b0871635bd7bb132e6f8464133e46994949076e0b17c483c13d1c4a77813876868824e0ec288f0a508c069a6fbc734e5fd2bf2d62193ed47a578aba9f4d337557368fca0b5c3d150f65ba3c993ae483644ec02163423795eb31b902e30679840cc1107350e965b5d641b919ba055cc0611cf3b935acf4ca0ba86bce3259a56a1ca375937e0e26e3121b5ec8defd91172807a778852fd550c594cc1154ded625b96c7f438ca597059fcdc1df5e6a76bfdde6eba84aa3b598157dcdd8a497ad6583e76ddc8e988dd186920b7b278eb8701a62c160020a558f817f19f91b48de3c73d9c077b55490c2ad3b20cb31977678d268cc6222d7036eaed0b2fa862da24d62e1740018ecef84e3f398911763de4b8a2c58b31c8f5e69b8f707711f8d7b84c0aa00d9229c15d210b56a42440771da257337f295df2319567965c918631ba61f430fbb899f684afc12c65da762af883225aeeb46d1c91a51f3159aa8081b9d5f6677f8854347ee2f6e306b48a4177f9cc95731772db2609cdd1c0b69d456ec5ae4f2f600d7ac0f28c7ac66277ffa2ba5607e526ab64e862383043aa3ec7901935c90d7c81da82685475d599a73e08f65732e4d212681ed7b892c245758981cacfbce1140b2042829cc9d593e43b1996fdee99edc27115491fa0659fe729ebf8c3c0aec5e753b7988e1c3be454f0e31d9198e78ece941ca09a4ebafae4c1dad3641668a919e8dd967b09db632eeb9243b5f700bac23eb2d13cec4f16acd4251c76fd3fe622c233cdcee241e13daab281e14e183f7dc33534d47e68601e88e005099b562a869e138f2cc0efa58a719c0c66fe97249e6f722fb39385513a03e2b90a48909c202e4f889d65729d8eea165e766d4830f4ac7082c4cb9a8ec811a9d07c0a94459063703eda3788bc8dc22b6be1a12540f3eac2666b2824cb45af45161352a8aafa8cb5eecddbf9d748770de50537ef41a00b394573e4a406014f8ec5075e67f3787dc582f35a2e72ab419f9389fb504be357c0fd1959acfb2e4adcd3ce47168ac020a2470f0c2e5578f89c7c733b5901c34c6010d55f2189c1b74c89d585c1a1d83eee198ca844919240cfa9421eab02e4636a2563489424ddf533c0ca83cfea33af571c01e4aeb80233d5db488cfd509b8bba5bcf6e74067f2171f01df8c97d7879ee18e6d13181e786061691cfcd739acd89008a4c79427fbf47ba23a70015e396bdb1694ca4fb8f1ebc857e958a599216b9cef914776b75473610fe840f71f251dd7be968ffdb05e5b3f113eb33f237d208e7c526c90eee38241facdd59cf47789a8392c102aae64e227771020715b79c21c51027768a68f25cf45c74c043861efe30288aa93e4779395b6a8a65eadeae879354b410bbb80a074de2b95b5db6a44a4d77efcc14ead0f532ebb37dc1efb882da7742a65d1d0911d24580b7eaec45b4b486baf8c8c7cabd93ccca67e419f716a6ac5efdba2b240b8f662332b62326f606ef48dc885ff78c31af6471825b58e866bc778485d1ee2c99abe752e4b4531448680b42d8f7623f039905778811952a7867a1cc1643b2697a2cfa68d76c6853f41a65af983e01f30da13461d2549667ea9da86351dfb43b2372be7bbd2bd5d488b13af5b51637c9276f16b38d453796a1fa41d91e63e5facd9c6a15ba905b5135b8b4dc43808a448b1e3401f82ec9a85e1718223caec8f73cb0019e2733f714cf2a82b505647f50c361a4a5b4fff6a1b2fbc309714ff159a5660ec0064e4edd61cadd709e8de375e8ef07fa5f38890aa5659cbb11b43ff71885845e685e95a740a67129eec42afe170a24d257e6159b28a93ab0fa08569fb4f224bde051df7a09f0dac198fbcab7857ab66f160df4141f508c440ac32ccb5a78c5ef41a30d9ff762daccfd8e7e5aafd4f4f916311463e9a79985148033fc14996ab74fc6ffaeb720ac436e57036bab98d7fd4d4ad69dc74cae8a8d9d71d2cd91712ea571abb279df3c606585a58f73b0701f0738e631a3f7353164d68827e71028843c0733508d732bc3b0947a0c8c8d59edb078195bdb7232074bf2c84468322e59e58edc7b019acc13a15b5b5e75d23a6b303dfdc60dd3a1fe2a5caa905f5771169816cd728b2bfb9e0f5703e26d909a0107e85736a29883ec6ec6a20312c648c741d7c30c9d766837a15fe6a7681a9caa05f4705ac7782cfb82e1111f4a9bda785866d455b3b35269087331a20a4f680f8c8ed972cece119689a303089a4ed60425ba48318c0f2ca13eebc86fb70de697df0a25d8173a1937ea06a04090208cdfe56be5d8faa490525cef3dd7b8df014ec136eda65b061e666e825292c1decb8e206440dd7d102926da7529a3823202f379fe6a027ee153c24243b24f3b6b1354c36a4d3ea9af3a0e38d7159bc0ec97b095c131bbb82f3f321762fde42986e6214a28dc1d663121da355df5d5e59ca3f0ae8bf6b718b9fe1de365868ec1245df7971612867748d957046215d20f661afe6bcfad6f6cccf50a01f551c17ec7a6549153398cef5764d76ce90b3d1146c830f60b701113b598a4d67a57236779b8b3ee0d094f855a2d32600231e470ff318f784f18975186bcc3b8f9cce708091f7e5ddb5c4b3dac4ea0146d18ebe7a239354caec4fda728ca3e657ed2e0f54b6c4ee664a1768e8853f7fc04f4b75ac4f2e4c5faf71e8225559a6aa38ef2c9ed9ce1a0a0b0e7a725d7b7622949e80d784dd19c1488503e096423fa0740741c48215496879e51755") preadv(r1, &(0x7f0000000080)=[{&(0x7f00000013c0)=""/4096, 0x1000}, {&(0x7f0000000000)=""/119, 0x77}], 0x2, 0x0) 2018/03/02 11:09:26 executing program 5: openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000242ff8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x7, &(0x7f0000010fe0)) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/checkreqprot\x00', 0x800, 0x0) r2 = openat(r1, &(0x7f0000000280)='./file0\x00', 0x820, 0xc) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r2, 0xc008641d, &(0x7f0000000100)={r3, &(0x7f0000000180)=""/77}) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000080)={0x5, 0x6, 0x800, 0x7fffffff, 0x5}) fcntl$lock(r0, 0x6, &(0x7f0000003fe0)={0x2, 0x0, 0x0, 0x8}) [ 116.827053] binder_alloc: 16505: binder_alloc_buf size 213075067022156856 failed, no address space [ 116.842577] binder_alloc: allocated: 40 (num: 1 largest: 40), free: 12248 (num: 1 largest: 12248) [ 116.851662] binder: 16514:16516 transaction failed 29201/-28, size 213075067016314880-5841969 line 2963 [ 116.868937] x_tables: eb_tables: bpf.0 match: invalid size 528 (kernel) != (user) 520 2018/03/02 11:09:26 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e7200000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000001000000000000000000000c000000c9c37ee3085f0000fdffffff00000000000000"]}, 0x208) [ 116.883767] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 116.897548] binder_alloc: 16505: binder_alloc_buf, no vma [ 116.903276] binder: 16514:16537 transaction failed 29189/-3, size 213075067016314880-5841969 line 2963 [ 116.911166] binder: release 16505:16510 transaction 610 out, still active [ 116.919795] binder: undelivered TRANSACTION_COMPLETE [ 116.922195] x_tables: eb_tables: bpf.0 match: invalid size 528 (kernel) != (user) 520 [ 116.924938] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:26 executing program 6: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x2, 0x30}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x2, 0x7, 0x200, 0x2000000000, 0xd92f, 0x6, 0xbb5e, 0x1, r1}, &(0x7f00000001c0)=0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r2, 0x8994, &(0x7f0000000140)={'bond0\x00', @ifru_data=&(0x7f0000000080)="38e33310e87044f21e13559eb24861865136eed191f2864d54a9c60dc92c69c2"}) 2018/03/02 11:09:26 executing program 3: pipe2(&(0x7f0000fbd000)={0x0, 0x0}, 0x0) fchmod(r0, 0x13) execveat(r0, &(0x7f0000005000)='./file0\x00', &(0x7f0000005fd8)=[&(0x7f0000005000)='\x00'], &(0x7f0000005000)=[], 0x1000) ioctl$KIOCSOUND(r1, 0x4b2f, 0xc) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000040)={0x0, 0x80000, r0}) ioctl$DRM_IOCTL_AUTH_MAGIC(r2, 0x40046411, &(0x7f0000000080)=0x3) ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f00000000c0)={0x1, 0x10001, 0x1}) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000100)=""/120) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000000), 0x8) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) 2018/03/02 11:09:26 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x80000000, 0x0) setsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f0000000100)=0x5de, 0x4) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f00000000c0)={'dummy0\x00', @ifru_flags=0x200}) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x40, 0x80) ioctl$KVM_ASSIGN_SET_MSIX_NR(r2, 0x4008ae73, &(0x7f0000000040)={0x98, 0x7}) 2018/03/02 11:09:26 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000200)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xf4, 0x0, &(0x7f0000000700)=[@free_buffer={0x40086303, r2}, @transaction={0x40406300, {0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x48, 0x28, &(0x7f0000000280)=[@fda={0x66646185, 0x8, 0x1, 0x27}, @ptr={0x70742a85, 0x1, &(0x7f0000000240), 0x1, 0x4, 0x1b}], &(0x7f0000000300)=[0x78, 0x0, 0x0, 0x20, 0x0]}}, @increfs_done={0x40106308, r2}, @reply_sg={0x40486312, {{0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000680)=[@fda={0x66646185, 0x2, 0x2, 0x3f}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000500), 0x1, 0x0, 0x1e}], &(0x7f0000000540)=[0x18]}, 0x7}}, @acquire_done={0x40106309, r2, 0x1}, @decrefs={0x40046307, 0x4}, @increfs={0x40046304, 0x2}, @acquire_done={0x40106309, r2, 0x1}, @acquire={0x40046305, 0x4}, @exit_looper={0x630d}], 0x42, 0x0, &(0x7f0000000840)="2d7c93e9c8aeb4298c03479da4c37ff2a9df47f304fde2f543b63dac3eaa37492797eddc5f3f11a8c854de32cc7e4f0723b76e79878d1987bc0739b564e142e494a5"}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="016340eb"], 0x0, 0x0, &(0x7f0000000500)}) [ 116.924962] binder: send failed reply for transaction 610, target dead 2018/03/02 11:09:26 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x5, 0x0) write$selinux_create(r0, &(0x7f0000000140)=@objname={'system_u:object_r:mail_spool_t:s0', 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023', 0x20, 0x33, 0x30, 0x20, './file0\x00'}, 0x5b) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x3, 0x0, &(0x7f0000000040)="0000000056ad2a03c9f4896d034793f4142ee4ebf9a913c1da1ae65a744060a8a0e660a8f336ec51c25384e1a7d9d577d99326607a7a0d9b22dca9d7712acba172fc34a8a35a8d93cc886fdfd5adcc279fad72756e770e72a5d959b2d31ad5e1516d460514b726e6af3709cdc2420a948b418710a363cb2b121fb6e4bea2303babe011fe9c55874ef2af4f0863f956c40a6a998c"}) [ 116.978887] binder: undelivered TRANSACTION_ERROR: 29201 [ 116.984487] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.006924] binder: 16552:16554 transaction failed 29189/-22, size 40-8 line 2848 [ 117.008832] binder: 16550:16557 BC_FREE_BUFFER u0000000000000000 no match [ 117.020831] audit: type=1400 audit(1519988966.383:140): avc: denied { execute } for pid=16549 comm="syz-executor3" dev="pipefs" ino=42331 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1 [ 117.022462] binder: 16550:16557 got transaction with invalid offset (120, min 0 max 72) or object. [ 117.069510] binder: 16550:16557 transaction failed 29201/-22, size 72-40 line 3026 [ 117.083245] binder: 16550:16563 unknown command -348101887 [ 117.093711] binder: 16550:16563 ioctl c0306201 20000580 returned -22 [ 117.111482] binder_alloc: binder_alloc_mmap_handler: 16550 20ffb000-20ffe000 already mapped failed -16 [ 117.126660] binder: BINDER_SET_CONTEXT_MGR already set [ 117.136425] binder: 16550:16563 ioctl 40046207 0 returned -16 [ 117.152553] binder: 16550:16564 BC_FREE_BUFFER u0000000000000000 no match [ 117.167293] binder_alloc: 16550: binder_alloc_buf, no vma [ 117.172955] binder: 16550:16564 transaction failed 29189/-3, size 72-40 line 2963 [ 117.199341] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.204931] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:26 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) modify_ldt$write2(0x11, &(0x7f0000000000)={0x2, 0x20000000, 0xffffffff, 0x81, 0x5b3, 0x3, 0x3, 0x39ee, 0x9, 0x1}, 0x10) r1 = socket$inet6_sctp(0xa, 0x2004000000003, 0x84) r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x3, 0x80001) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x6) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) syz_open_procfs(r3, &(0x7f0000000200)='mountinfo\x00') setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x9, &(0x7f0000000f68)={0x0, @in6={{0xa, 0x4e20, 0x0, @empty}}, 0x0, 0x9}, 0x98) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff6f2c5c88a303a4"]}, 0x1b7) 2018/03/02 11:09:26 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'security\x00'}, &(0x7f00000000c0)=0x54) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) lsetxattr(&(0x7f0000910ff8)='./file0\x00', &(0x7f0000faffe7)=@known='system.posix_acl_default\x00', &(0x7f0000d48000)="0200000002000000000000000100000000000000", 0x14, 0x0) 2018/03/02 11:09:26 executing program 6: io_setup(0x3ff, &(0x7f000035d000)) io_setup(0x3fe, &(0x7f00008c1ff8)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x40, &(0x7f00009f5ff8)) r0 = creat(&(0x7f0000001280)='./file0\x00', 0x45) mkdirat(r0, &(0x7f00000001c0)='./file0/file0\x00', 0x100) setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f00000012c0)={@dev={0xac, 0x14, 0x14, 0xf}, @dev={0xac, 0x14, 0x14, 0xe}, @rand_addr=0x5}, 0xc) io_setup(0x80, &(0x7f0000209ff8)) io_setup(0x7, &(0x7f0000000080)) renameat2(r0, &(0x7f0000000200)='./file0/file0\x00', r0, &(0x7f0000000240)='./file0\x00', 0x6) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000000c0)={{{@in=@remote, @in6=@loopback}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@loopback}}, &(0x7f0000000040)=0xe8) 2018/03/02 11:09:26 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000001ff0)={0x1d, r1}, 0x10) sendmsg$can_raw(r0, &(0x7f0000001fc8)={&(0x7f000000a000)={0x1d}, 0x10, &(0x7f0000000000)={&(0x7f000000a000)=@canfd={{0x1}, 0x0, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5f700000000000000004e2f9663a918fa1efd9b0b"}, 0x48}, 0x1}, 0x0) getpeername(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @rand_addr}}}, &(0x7f0000000040)=0x2e) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:26 executing program 2: unshare(0x800000000080004) r0 = epoll_create1(0x0) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x0) 2018/03/02 11:09:26 executing program 3: clone(0x200, &(0x7f0000fbf000), &(0x7f0000c53000), &(0x7f0000f8b000), &(0x7f000025e000)) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000f8aff8)='./file0\x00', &(0x7f0000ca5fe8)=[], &(0x7f00006fcff0)=[]) r0 = inotify_init1(0x0) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) r2 = getpgrp(0x0) kcmp(r1, r2, 0x6, 0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f000025c000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x80001, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r3, 0x80045300, &(0x7f0000000080)) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x0) setsockopt$inet6_dccp_int(r4, 0x21, 0x3, &(0x7f0000000100)=0x1, 0x4) pipe2(&(0x7f00000000c0), 0x84000) 2018/03/02 11:09:26 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x6, 0x40440) ioctl$DRM_IOCTL_AGP_RELEASE(r1, 0x6431) 2018/03/02 11:09:26 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fanotify_init(0x10, 0x2) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x49a, 0x0, &(0x7f0000000200)="dc9b114338421eda162c54210a83a520788e7256775eb73bd90b4eb9a8abaafb9467b742972669b8e8db7c6abfc4ea997d0787518af49ebda08a16827ab620ca5cd6741f5d1cc34d1338df34054fd1e8673664197c15cb9f0457062a7e898cf3237cc0a606000b9e75fcdae46404a03bc1c5869509b49a0271ac643f8a472747908232493d41dc2c37c2b477cd8dddec536299982f63c840495d2627295518baf1b429276ed52172f2b0a2cae20adc49690ad60ef8d0da32e8390f6d8d088a83ccca3b29cb74913bf5766cc3578a20cf971ada3ad39661952d8a1aeeb6e17575929e00f2f34d725e68fb49f43348ddfb0c984a0e261c4824f410f8ad7f3472031dc1a741c93010cc6e95aacaca256efedc09ec11ce1853585c909c4d501c85e888de2c81c1fd31705e7c9244ad738786ec2ac092"}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") sendfile(r0, r0, &(0x7f00000000c0), 0x100) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:26 executing program 2: r0 = socket(0x10, 0x802, 0x0) sendmsg$nl_generic(r0, &(0x7f00005e8fc8)={&(0x7f0000765000)={0x10}, 0xc, &(0x7f0000572000)={&(0x7f0000000000)=ANY=[@ANYBLOB="c5e059277a9f26795b66d91d0000005ee1061df2245917d4086663"], 0xfffffffffffffdff}, 0x1}, 0x0) 2018/03/02 11:09:26 executing program 5: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0xc0000, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x11) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000080)={0x7, 0x9}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={0x0, 0x1}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={r3, 0xfffffffffffff001}, 0x8) timerfd_gettime(r0, &(0x7f00000001c0)) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0xc013, r2, 0x0) readahead(r0, 0xa6a, 0x9) 2018/03/02 11:09:26 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000000)=0x67, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000011effffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee308740000fdffffff"]}, 0x1a5) [ 117.433067] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.436615] binder: 16570:16575 transaction failed 29189/-22, size 40-8 line 2848 [ 117.458837] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.503193] binder: release 16570:16587 transaction 621 out, still active [ 117.510332] binder: unexpected work type, 4, not freed [ 117.515677] binder: undelivered TRANSACTION_COMPLETE [ 117.515848] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.538282] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.550236] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.551747] binder_alloc: 16571: binder_alloc_buf, no vma [ 117.558111] binder: BINDER_SET_CONTEXT_MGR already set [ 117.563538] binder: 16571:16599 transaction failed 29189/-3, size 40-0 line 2963 [ 117.577096] binder: 16571:16589 ioctl 40046207 0 returned -16 [ 117.584153] binder_alloc: 16571: binder_alloc_buf, no vma [ 117.589780] binder: 16571:16602 transaction failed 29189/-3, size 0-0 line 2963 2018/03/02 11:09:27 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0x8, 0x4, 0x4, 0x100000001}, 0x1c) ioctl(r0, 0xcd, &(0x7f0000000000)="693419df5d58d676ea9d3478b559db1c386ae9df4ec74626e90f097aaca1aacc5ab061351245c3553ad248eaa92afe9de427748bebeeff27736ea30c25131960ea7193fb4f580d87c589d8d56f582c1e0a23f690acd5eac1269f33a3ae694399a3f79bb2a83e801e3e35f6227609c7d6d6172f08a2960e31faf770f4e0634a53da1497d1ca1766447ec8e0dd694bb64b8a2740ae7c3562ea13ac1217398574658a5a07f893afdb412ae4e441b836a3e7965d0d8b26db3fc833961052751411a964c02636861ed3f03794b0b8b8c17a4c328743f8662415c96c0917e59620b7f88c637f8f1e92aa3f32b847417005ec83") bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00005f1000)={r0, &(0x7f0000eed000), &(0x7f00008f7fba)='#'}, 0x20) r1 = dup2(r0, r0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000100)=[@in6={0xa, 0x4e21, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0xade4}, @in6={0xa, 0x4e20, 0x9, @ipv4={[], [0xff, 0xff], @rand_addr=0x1}, 0x100}, @in6={0xa, 0x4e23, 0x9, @dev={0xfe, 0x80, [], 0x10}, 0x6}, @in6={0xa, 0x4e23, 0x1, @empty, 0x3}, @in={0x2, 0x4e23, @rand_addr=0xfff}, @in={0x2, 0x4e21, @broadcast=0xffffffff}], 0x90) 2018/03/02 11:09:27 executing program 2: perf_event_open(&(0x7f0000fdef88)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000040)={'gre0\x00', 0x354ce722}) r1 = syz_open_procfs(0x0, &(0x7f0000a92ff7)='net/unix\x00') sendfile(r0, r1, &(0x7f0000000000)=0x100, 0xff) 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000079bf63dd220143c7ffff09fb00000000000000d7850000697036746e6c300000000000000000006e7230000000fb000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffff"]}, 0x208) 2018/03/02 11:09:27 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f0000000040)) io_setup(0x5, &(0x7f0000000080)) io_setup(0x3, &(0x7f00000000c0)) io_setup(0x8, &(0x7f0000000100)) io_setup(0x6, &(0x7f0000000140)) io_setup(0x100000000, &(0x7f0000000180)=0x0) io_destroy(r0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:27 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x100, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="02060000021b7779f91324ec4c1ee8f7"], 0x10}, 0x1}, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x5) 2018/03/02 11:09:27 executing program 0: r0 = socket$inet(0x2, 0x8000e, 0x20080000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:27 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x400000) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000680)={0xfffffffffffeffff, {{0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1, 0x9, [{{0x2, 0x4e21, @empty}}, {{0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}}, {{0x2, 0x4e20, @multicast2=0xe0000002}}, {{0x2, 0x4e21, @multicast2=0xe0000002}}, {{0x2, 0x4e22, @broadcast=0xffffffff}}, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1a}}}, {{0x2, 0x4e20, @loopback=0x7f000001}}, {{0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}}, {{0x2, 0x4e22, @multicast1=0xe0000001}}]}, 0x560) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x81) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0xff, 0x80000) 2018/03/02 11:09:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f000067efe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f00005a0fff)='8', 0x1, 0x0, &(0x7f00007bcfe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000bd6ff4)={0x0, 0x0, 0x4000020030}, 0xc) write(r0, &(0x7f0000cbdfb8)='v', 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000f0cffc), 0x4) writev(r0, &(0x7f00005a8fe0)=[{&(0x7f0000b44000)="3d879584d44d7d43e8abb80895a5c573a349be69840da2006d847cbcf6b0a87ae4b77e61db84728865436e30b18d74b8ceef03abf8a0045b61852466ea308f2b7e2fe35544f2452b7998d41aecccd721361e4ba2c5a3a001ad9b7e855ff7f7c80a0e23b9568ee52fa1dbe54811e3de7e160d36cd6b5b07ce29c53317c1da02f268398715dfcfb5291a2af0c17c77479381e4c025560f66490b639cee27020cde26ed97a994ca6032ea9d2fee9381d9ed1ef2986f5c9c4d8e7e64c079d37b575ec416748a8a68d9160212a0f8a8bab91041eee02859d22a40995b1e52c3c47f8c9e9195ffb51ff758ded8d0215052217861a7f51baf70d761ac6d7758512f05d8982705b8670ef5371b76716757ddcb1d3690e6fb742006e46ba28befb8ea1f23cd26846d8f3c8eb3cdb9c27799106309d81f00232af8db95e32691ccbca393d93954eaf35a6883e550d83a2c94744371ce306b562ba365512e77267706788beaa2d643a844b4a1a5dddccf5d0d0b9900be7668a80d606378522cc522a4edc3f038e4078661016b52264252676c4d3a75ac249457d22357d86da9a6deb6bd42f91f352d33b2e29cccc0d344d9d8bee343d23543aa745433602b294b05caeed1f6b2497bbb0408dd17e83b9ddb8a1da2874f45b8bc84ddb942df84bdb9904bc2d05b31c3a31a1d36b2b79c3bd1545147d1b962c41bce854102de2b377322decff664a7df9ac3e80a8ea44c699b412086d4dac699517fd3fe2aa3eaeb8b76273bd57d3130f6cdb4f2c8197b7e11bfd311e511a041eadc6bf1a0a84363fc800d5b5d2e3eb57b60a7bf01648ca18ab882c702996d1d84593d254f10cd566a1b64a180f863b43fa3a8e74efce780bb1dcbeb2e34603fc7b5e6b40e2a5998c50db5867eb83dd7442c80e8c8bbc15d77b018a591e03b90ff27665cccd74aa93d98fc78b9a58f79d949174ed17141c492ab8dde78176bd8f2d752e349673f59a4d1d086ee52f5ef9a395983d43b10725de8a86de704e817e7160bd707dc1c525eb58d0f0ac0d65b988b3a06d46dd0463931d7df43b41c571ab380674115548b63d3612f6ebf500c58e62eb82ba00d19caf5fbcbeee8fd173b37117788f265c53d17997e4aea4f5123b959ea013d44e294452f377dc45d5a8ac9f7f48c2337ce41d53f60af77a7a0f609d3c3d0787864b34ea186bc04245964eb37086b6fdce5f3babe5b602a9e2685924e7540c58235ad47e681d811de5f2860a98d52f088d638a53deeb854b9cecf04449981c8ecd032d670bf5f9eb860023c0815ccef4d8d1a1a44f2dfe6cb2feb67ab4bada511773db1db6d46e910e6a47caf687c4998b9ca0b3678804e5a131ca678f8c125369d67b06bd14564ba9dfcfa9cd1d6010133164bab99a5cc0b6f78e8815dfd492e84bfabf002bc2f542e2dbbe313737d14aefcf673d1ff79e24f09fc4f4d28155a2e6321b6a402a402fb80ac198ee355ec13e3b8c6f27d3864b91b4414285fc39040505ab920cd8fa30bd600739cca86fafe73df080092af880174a8ffaaac295f0823931d1019123bc26f7c4ad6a2fbb0ec87911e98eb64e4be1d4df6c6adb8d877271340923527c3f0a6599179182ab00dabd483bcff0942d52cdd5372a6cd6e99960cb723005995a3aa3af6e441c42be8514031ceee9d5333c1a9fb097a5890d8469de2468b4d034f89288cfa5b7afb7c92a2525c66aa9d4f8a4d63fd6564c953d696f664ace18e22c9025b86221abefbaa1c37e989823cfeca7ce3658d975f79e32ff03d7ae15c0b97de444e3547f36b1cbb24aaa74ca92d774409b585b442a6598ad5ebe96a51d4265be099b4676eff0034a8a5f6f7939d34da30eecaf4c74afc8c26aef6664f4bd0271b1b047c16eef6dd69c4e1a4ea3b97110747099acc342f4abf4cb5af06a2b4f50f41bf00b4c2dc84c38bcf6a1f94a89d347676af147ae1835d0d80e97b20f52ec47eb8127d158fc0928a7d8479e7aaff4393b75d0d4553db0c01805d63cc9e24d2df96de9cb06fd56d669aa7fa8cac7efec65dba29de37f2c6eed312f7b81ff9b26778563e839205f84271297389e2d89ecdc0ddafa9c379242b6d4509c6b034dbb6eeee3a02f91485afb965af5e260d9cdc4e0febf0d11bdc968742e33e3bd392af55db2579932721d023451147724229f2f346be301cf7286a94b7324eaa27ad86fe1d6e0cb29002563a447e6e7b9e53a1bfeb04d5af6b06ed09b1958f97d0ac06f0cb27de95a825cc7a02d6c833518418653300d59ae7df26f436d217f77a247bc41d49c92ba21cbec597ff0f9e044237561a2f18e39329c52fd265a041c22b18cb63c3f833a775db45e5a297640a5724424853ce7049e1601a21904fe81d9c0e19b15b80245cdc9eb0085ed8749ece7e09f5e7bf438ce58778d66a6908f754a0c10da6b070568bb253b7d0140515bf5f1f51ce6597d2972e6a35191ae27452b6f871eb5b7e47352334af1a36a403a682845c87d10fb03785094e0859981cf2dea17af83c3103eaca33db75a4e836dc0c08e5b36b17766eac1d27959b70ff3d856deec351d26f538e143107bc9c0d2413eac87044a3a8f4af37c9664770d72576bc7de6aff2e6548f7045b05f0c7a363a9e4f440b0e86e59fadd70d6ea678a0b960589f1c91be9287729d644a5c0130a93007c4a353018e0528176c256b7f9df79fc5192f4d8c381fbcc26f997a72b1f50c93adbf8459556c41953072be7f255ba059374aabda0dc305045d2760ef64a5a8e6e68acbe3a8914eb7aa13ce84df8e7fbdb7c4440617b5f1986b13073c6ecb50d6878733cd630c9bced7c643ca9477729d675d252a5d15b2e31cc41a2607091305b63f378a48b680987bb95a76e33c61200cf6a67c17d22d04dbb5d796e34f98cb592f2ff7f1bddc2b93959d9b9e5563466946700fb9e0d690b078730ecdfd631c9887cbf79ac1d31ef8b7f077c4120125cb6a592858ad14e7278d540db47485a86eb8cbcf7ddcd15384eb329e2a8b15c3c9d8332f5609e5bf1e80b0d06a93001f89bc14ba29263fa4ec0e7109872ec69e1476345657c949a785e8c4bf215de2a49bc99a537942d15151076a2778a1c134724267a925d06e185d64c443988b8fa02fd2328b0002f9d81c54a2856b29c3f2af112de7a26e294dc6491710bc36a8aed59b576dcb46885638acd532543a2e13cebb2fa9a9a9f13d653bd09aefd7c0c66bd7a7078a7736433305e1b63420ba6f86db9b1429f9bfdf71f05729f5ec3248e050828c0390a8976ee3ad2c36a45c3f7bc986bba94575ad4099aa5cfbbea731ac0119083d2315f0aa93ecc5c5c56e4e7816ce011acf70ee549cbb97f9486f88f7da1b90ae62fc1d41c0aa46eb55ee7de5a0bbb599b1b747f76d220fab3271c92ee04ea2dc73307a5a8f7fee55d782c4705c2c68493e584661881c961c72f737e3b71f28058f92b0eef6bfea35dddbc8548eb0efe3ea8781b15e82a16117f1063f80c94d48d3a77c8604dc64fdf8e32ebdc091c413739f5e227855d22e9b3087960312bbedcb86967332c9b5075bfbc2de22278f8d8809f8f0b21e872861cddcd352148515ea3f21b024bbf6f68f30f81017b2b5ca8f7c936b93f5455bdd06a1f951bf44a677b06af23f7537b875a9ea0c24569a42f42813aa75201bf8877ae4c7af97e9c745134c7483643fd46d5b0e8fd22b761df00732b4c4b9f4ced9cb248db0a017b79b68eca7ae139ed45a687c7f9d563362db66d7d219568d96842048ad1497ad7376dc4bdc9508c1650e79db0f9ff00882b304e1f3cd9d4cebb8f41a4b3c53c7291c5c50fe5200e0a91d98c2a23cdf78d61977ba3e4303735ebb854a811f5d2dccb43d0c6de4fdac2c77dabbdf73b01f572d92c6fc37d447f8fe176debd27abaea52178c6c9481dd01f53944feca596a8437720c7e38f1ea12eaff968b7876a1d15eda5b005bda9729ea953f1e3bfc3a5584039c857467538186305fcb42a3b2b7c46799e80e18606f1fd0b6b2263961b2cfc477b40a50316d60247f85639122e0cb4b60c080a87556279a49a0f6594093b8837988451e53169533c7e636d9b5ee54343a38957bee15894851ff28c4c910777adaddffd8088a06a348cc012a59c30a73d4bb80468d31f3c39c1133d041f2e8231ce487f1037f0c4025dc28a72e2b98a3af74df93621259076d31193d6d969a0bb0edb9e9fa2819a68f9cbecc8ddad336b87ae88aefc94d386aea3cd5f7de83fc357a8ff3a8df9e40099c2e168c9388a8ed557c252a1e7bc288c9173ac3f942997914892b9e50f82c1cfc1df35efa17e861023d2227c7edb253253c68598b59e08bb982fd3bae1bf1d5c0e788450dfc0189a062d9644c65b5ee205c07b72557228a123de147fba0a767b9c5e2262c396538a97dbf588c682302a2acf31faae9c33c13df07d0d623036d9bb47b6f2bd2da339e433b15e3468e44df98eca3456be79fcd2ddbd7cb1c2a41a2be6c6a41c0e16d195237907e34f0b06c239b6d4eeb1e1e49db9b3e14acd88a4ca91d9787063597a048c7c671da1bcff7079fc51e32cb58742ed4623bdd7e941dd130f409ff86b35f0058be559195252df2f12f6941ab09d1d1752073e995e67f82ea486dbbcfd9ca835159b6597950a88c36984098699bbbf3c910e313960dc41dde64e0559397cb156ad5bce8bacf59dc96ca7871d126a406b081e24d3734738269340ec9664d70b62f29b289d6d0497007df73a0c3fec175a9d26263d2a0c09a17f1093de38f1f931be23c35e5a5311330665e9e45e4709b67d2428cffae7b184ec57d8544c398ed7731bb6c6322a898efd0f42f6e5fa80597bd9b14a65987834ba367ad04cfade68d4bf69bd2dd68dc1f1f3a063795776a83a4f1a2b37614fe457c389a4cdf9ef150f265aff67881a5eab04f0a80bdddbe9bdd5ba5a20106d1bd8e19526c03eeef1ce9eb832f7dbde19b416b83d963b33809e3c4f8d96227584cb43adc156689175fa7133686a7194fc3dd3191d7b361bc86d066f77f557850ba6131e447de7b4e55db6aeb80c727018b75feec0680", 0xe01}], 0x1) [ 117.616008] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.621617] binder: release 16571:16579 transaction 620 out, still active [ 117.628570] binder: undelivered TRANSACTION_COMPLETE [ 117.633688] binder: release 16571:16589 transaction 624 out, still active [ 117.640622] binder: undelivered TRANSACTION_COMPLETE [ 117.645754] binder: send failed reply for transaction 620, target dead [ 117.652433] binder: send failed reply for transaction 621, target dead [ 117.659130] binder: send failed reply for transaction 624, target dead 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000440)=@nat={'nat\x00', 0x19, 0x1, 0x4, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f0000000140), &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRES32=r0], @ANYPTR, @ANYPTR=&(0x7f0000000100)=ANY=[@ANYRES32=r0], @ANYRES32=r0, @ANYBLOB="5d82065429606cf6dabe155a7bab31553185ae979e89018374ad84a11caa8289c602b6534f9ff8fb8d8254630fb93fed00b131013304f49a6798f2bb9fdbcaf96b099f143997c0f04624a5ffc9e4cb9a4dca20756e0719943a52e60c84726c18c8e5b022df6ab7a9022016638a8f59681f381728a616f867d20df17fcb436d5e58f8dc4b445c36f4ca654c31bede3f92b01953e84b4b59a6441a2317ea83757da834d8251a04af4ccc5512bf458d0ce735119966028c92250c20d3d29892011e2935c32ee41c6550042de3def867d9d5ca85c037585d6349c8a42de30f0f024bccf1e5996181b15df4ce2f0c6a23d0a79d3cb18c61a2bc9101d2c4d27a7259d651566fb16cee0bce62dc207003b680d55a7fc50c97c2bee8da482248a06492fd87d4d768d5160358820174cbccf53c2f745dd3ce9587600365c323a01e0634b2fa36279db6cb28988170fe4461d91559490efdb24b8b9f946cadff6da3acbd943a1ced9f19df600b96e97b6f17de592c36acd23a784c36629a53122c4d9832ac3f562c1134811220cfedcbef146c4689ea2752fa9ad37af3253c98c0b637cee9bbc4d87445e5afb6bf814ef564ac2f424150aef9c68f6f016db9922c4a1df972eaf134a0feb25d8ddb3361c9d95177c382d9ede1850853d24792189b1d66f9ab19bfb7150c0d18095474c276c9f0eac6a46014046bf8895295f02abbd180ca23c5e0aae9539b6002f248c76f7cac6d8046c9769eb172dbd1c9bb950889883690e943a9d61030197af367fe8ba0b340564447683e0f27fc581531f12178def4f7087ce25cc9df022fe6a2fb5659804f495d298dcd410b48ed63568f9fb92c4e72dc4f632612b782795381087a18d501ef19e9b48c291b63d5b91b8b981999681f2fedff22d97048c3e4efb621e68d86335e70586016281c7ab9c2a96acbde65b292893c8c925ac4c117ca3b61a482d21cb4db39477c5f79ea08a58dd367d1c4f728f1738d637d387121831c1cbba48518ab0219dab7f71a2f9acdb32d0d46afcfbb5f24323ebbfc1d3793c3d7795df8a9c56da7036066b35c23788cacf93e6e92fb7d852e081b4556a8a7b07048dd67ff355e47acc5dbcb47437ce376e6c06c23c51a60017eca97b509f85bba17c2dfffad9a8d70635d0016aa7a01337479e11e214b0e9ba2ff0d482ae1c9c0c084f126443d5c4549869233ba0844ff86700401aa7476c883c792563a01a9f2a15cfae8d19f5dc175caa8deaad289c4f15289a22d74e5d62de6578d56c9dc7d02bb95a93a73ae870790d4271a408069860e0e2b3ec09debb7060a43e038aec0903c871831ef316e1638df0e62160c38a27b5227dd6b0fd38415a5b2c1fdfaa4fa2cecda9ae0d3c433af6ab5ee50c46fd7144e5cca17e91d65bdc79954d09af70e59be06b9ae2259cf537a0f4846b36d9ee2ede8101c72dd726ef1582881afe3a9764bbd771cb20f3ad3fa8d425052f169ff465fd3739ca0858ff4b179414d70a3eb7d630de909721849b8f4690f77c0cebf870f4b7dce56e09714fe8569a36d5c2e4cc24a1319e151000edc0f6c4b72dea35cdf5f89624cc91af12236339d6a176b8d6c971ea3675f8b501b8ccbebec9b776c2b024b93c5c0016a5c1f0117d12c3061b19f858916c84f5f35814ed2595f5f8574ac6a5a50825de95576649daaf7534f1a742c24f47a56c037925214fe24b64f3e9aab42b3779150b40f5130f6ec2ea46e8ab2242a5e1c2f3f1be02ce8a31c065c225dc5c27b5595f83b21af35c7382a767845d0abc6d088a6fe066323349beb19ca7ac6ed9530f8fde164fb8fa6e65f4c61fa25186a45d5c21d20a9a05736dac9f6e93e352c578f9f125bfb540a44b73d79030e6a53b39c3a6148fdac95d52a39602b219d36efc215ec13d4e568d120eec2a8a046e38c91526d186420f28a376807a0bcc192c149ec440fa1aaba8b1a429fccac2867291b6feccee9a7637326a42e771d5001edfbb4798de296679dabe0a5e46ab410cf9c0d5b2c4941b2f6f0223690acce542494a8bb13828c62a35f0ce5b06b05c4f8269dad17046b86f10f9cf31ff7a7bb0dadfb393c45b65a1f9f20def86db87d2070fb869915224876d1d1e26f885211b5aa8508f85d2fa339c540d0d0e4cc524f7cb039bb8b3544d6636937163087b1d11368deadc7f360bcb31d08fce9dc25743f5a13ee9d9e0af90d3cb770cdaa2d10f896bf18c4a3cd431174aac9ae71e5970c7ef0d7cad36858a08154622073271a4df10afb400c0653dbe3e88385f1f1b0ff0b5ca08073c855b9300b348512b5d4e5bad31cfc0d973e48ae85b9b0f6958c4f8b3d96000ba900eaedb63c6c31b75bdb94b13a3f8c92e0d7348e38e9359abae265c3f14eb055efacf65d733a4a4b24cd2276fe9aa670ffb83b355072fdcf6200a31407866030be82be9547fc341fb61a5dd14b821cd6135da7ba978657320c283ac72429e12dc74aa16b71bd2db9e87c8ffd9e6a4152a92871576b8651a170eb2cd3da51bd8e29ae71aa2b20672a3ca5f314d765838993f0d7965b0aabde7209a6bbf3abeba9affb4ec84aaf616e75284fab44e48acdae6797eedc9b2cc75c4f1377eb0068bfd39f33d26f8c29c67b8f479f9f0d920b93cf19c6240de743afc04cf76d1f74a7f26da65eae701a22e9ade170572f275927a21b2b304df0588b9602da7cbd534471073e98c3eedd4e252c62e638eb0b4f603d64f0c4a6bfe454953cddaee7d462bd1a375fafd61f255ccfcf7898d6b68276dd6f9ffeba1dd7dc763b3ada1f8c30a767bfdcf21204bf184f45b2b6b140ec4a01228b4170645e3a26072bbaf2e58ffcb78c1ed8e888452ec0a2c7a9ba917ed9a7ef86d625cdfd55f5d7bc47e01c3743cb5e01033ada753519a7405667b360ed3593221630e55f51da520b1942ec75992fe4f78d02c6b88b6d42e300a9060a49cfd94635022d81de71afe8c1672c019f804a06772eace171e2570bd41ba4a285137004b73cde79432bc8032bd551686efd072ff7abbfb957179ff9bf607f305a0f75a2488b958e6144c1cf0df63a216663598cf8db7a005122551b9e208a9655e6b1084635d4745aa31c3ab10b5464f0e291c61138cdda3145a0381dbaed283da003bbe4a0c7d024682b6ff80b9f0c3ba7e8a324116ff1bd964a5736e7b6ca7956ed798de8a7910fa48cdbb3c15b40d738b75ef87327bf39cfd7416a4785c6663045c5080d824227938493155910802bd00563c12171f1cb776bd656ed501bf07f01ae7300093d76d92eaec6b79872e3accadb1e4b4f9b7aaeab9d8d3518ffd240ea7b7de435d3e1c634660ce1d7cd55eb3b4b0363bb15fd6e6e4d5202b9d62910d8b68cc8cf1dcd9db6325d91a9cd50f7be9b251f661a1e36409f69ae5ee5594693623aa28a32c2fed292a5ab0a2f2ca8d7bf52a9fa0bb7b0f006b497c3e989fd51362725a2d74f6599411b07e05d3689b9219470fc4f04a243bb484317e73309a8b6d4f87b7d9a7d3d0e589261df95e4ffb22bfec2b07e05d8839f2064c6ae57d219f1156afa88c070c7158a2c28d2b7eeb0686a37cdbd718bc5c7be11bb7e3b287c05b8587c5576ad86283ea942e09e90f59b2732df12f60b1c6accdb865d9a6f031edef84e6806b246f5e31ef883af5bf3c077c0228cbb8ce46007a3e27305380c4b83aa8ac281da659072c515b75f5fc26306296393838dde219d60b07545711170d060110bd52ab62e6f3afda28711dbf0663d053774dd0c9a11f29703e419d5cc0a7eb8f4704159e25523f7153d3d2065015b169f04e1d23cabb554ff05ee0dc27f2ad87c6698b16de1986269d304c964d40613b9a7716e5cc0a96571a78d715d72e93f7acca66e9099ac85e43a399f6294b2d3943a77fd6ed8c3bbee0a87473ec18d23f440d5e57ad941ca2a08e3cbf56b16bb1cdedb0fe79f21810f83bf35e63cde9170d9ab3cd11b22019d100139b4d3928ac2f5afcb401667e7e3e459759562f857473e6604270ad9172d463e94158ed0b6e4b35de92eabad974e7029e8dc6809cfc619973fa6bb487a1b2b6430807342e35a99c244ac15382b46fc2567cfe54951f71717a337311e8c807aa93232e2c22b8977ac81a47f8b2a7da43685dcfaa4b3de6523a3c33283d543cebf38201ba6f867a00ecf8ffa55f638ffb9bb059ad43cdcd46beeb414780b3f3a50f1717e952846ebb4ebb427b7c2724189909134f2d4b070d9ceff068df95d3043b290c48d0776ba6c0f1dee7f05cc789d7342ecc674d167cd1ca87907ef64c6cad9f038cd44d4e5478a7d3dc2cac77c3e0bf097436620b61ff716c7fd580bc8a554a5e28be234b394f380e803560b46c6d6322f502d080003075ea2f5fccbe29685735813775d1fc205258bd0876fff602fa97f895976557a73735ad4804f3d2191531335c64152de5efeb777c6b643a769e8d8f0985a081feb83565819cad6f2c08f02c45b470334827013b87c27f07ec7112b302b323bbda165c2770fdad897f7fd9c1d306f6b4983ab6615f7db7bda0bbbcba6687941059e41550f0c5697c21cc12ffe68c06ab28c8c14c5ed50b04cc1c2d28fa0fe71a2e25bee25594a841d79f7cf3929488e7c74dff29d91dd77050fbd0f7c8278b8144e6541e69443099802759d026579b33a09c75ecd06f552d48d591b1049ab6c96b46b16a02c9dcb45a3e0f7abfd0d91247cb7bf2d6eff993a02c78f2206afda22258d2d6ee89145e6286ae403e4677ffd72e0215ee4075229d446017c08b733053cdf6655fb9052cb559bc03ba5375265621295dce3040f7208cd31a5a69fec8fb07a21b915d6b77d5c3d7a63b28d0ad36001ea3d3bfe244b8723875a0c9aad075b8c492be6c265849355e2e214de9024eb4d1359c68003c17460066ce44a06aaef3ff3e1302240ac5b7ffeae01023c85b2b47a8156097bfe92020a80f580d80deabeaaa04668f9e37fa385fe1817aaf34661e719a2fd8009f9749b83188e6b3240a662c8e15f9daf262b6408e3228687a449ba381e93fcc49e9d49d9df3ae4a1ee1e40690c414544450bee4356355f584adc22d9136e275cd7d7d2cb5c6de760248345b98b9e424ccbc6549799c01cea3f140c333a602eb928153159d44c349ca5ece711c2aad12b1a0c134650edfebd837aa2311d77cf5dbbecdf265c5c574a7b2a0fede7aba96318eb5814da5934e010987d77c55b9c8eb08c8da86bb291113102f7e7081e94a9bfe037ffb72b5db32ce65dd19ae522952e13de3b596a590398462193a903a295148895ccad362964a9a7b6b99773caaa94346f960909222809080c944b2cfb3c8e94c766c7f9b45a7efd7626c836e6c1f4abd4b13054d44c5808d9f6f37b9578069691ccf283d8efdda7bb59a35d3aa96bf1d1cc82252825c9f959c68fb5551985cd9bb19a49ec712e03e42dbabd8e0706189b8e41c8d742b339017c23978ca154a611fc13eaea5b3f1620d69702a45109da43d70f51d56a5081faa07643f9312ec51897d288863e6303baee06147e5e85351c5df1bd84b3289a1acecfe9bc733db297dc34ed80d3013b577eec80e6ab2aa70d5ec4b47c5a6e3d0665090a41c5f9958f720febaf04f15360dbee5b4868f0c15c40b6eb319993933c5862ecb07831ee4e8472abcfbb152d220497b876aa62462d3c6c9ac5d9deca60cb904ff126e70f97212413dc8229f44648926f78836016efd30175000fe7c7285ce92dbb7a16d68de990c078c0996b629f76f73c0ad80d037517f82ec82ed088", @ANYRES32=r0, @ANYBLOB="a0d2cfbeaadbd9447aafd00ab4e71b904e91317257d62fd8a32a95b4a00dab8c16b4a5ecbb1ea49b52a479a3a18515f029298b7f1c2a01a2de023535b2ca7d6de326fa96d979b40aba1834730897ce779ef7d1b729745ca36dc72f4c59c46a737873935115cf8f4b73"]]}, 0x54) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7ff, 0x10400) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000300)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) sendmsg$nl_netfilter(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, 0xe, 0x8, 0x800, 0x70bd2d, 0x25dfdbfd, {0xb, 0x0, 0x2}, [@typed={0xc, 0x8, @pid=r2}]}, 0x20}, 0x1, 0x0, 0x0, 0x8080}, 0x4001) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000200)=0x9) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000340)) fcntl$setstatus(r1, 0x4, 0x40000) 2018/03/02 11:09:27 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000098ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000400000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000200000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000004e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000016e72300000000000162f28ba9a86707a0180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e617400000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffffb8b44cf59b5d3502f62d1b79faeecd8ed2e764391df5eab412fb3817750483291e7b332072d51421f9358a0f5f204512cfdf8a10a824a0d1655c88937cef45b466c732a4f4ede79f43ca85676d2a32efaaa87cda537949464ecfdc0ebbce0c1540779c2be2425f3840a3a8889066d2901e828b1c0475630e80214201639a323b6f8d743609ca3430b597ba23018b67eb67742db9f60684ebc5c330bcd6b4b756467b8f3c627a9f3fe1c13f69ffeb9e31cb6c561bb13b0f4d4d21bfd2528703ad0b3e835db6a6f8200033435e700abe7270d2b39f8c3f00683d27c78ef5570d066920084a6478e0fa4d55a229389d569e6b50ad0517663417077a2f187b8bcd375fcd890adf17b965ee29b36f6aadb6f7b594c95069a775c4362493e4f7f03d99fedd612651f5a4b0216079e4362c57f88c96de8c1ad4be9e8af5e4a5484587c87e9f7b3b11e931b33cf70270efed6a405782d6d5f720f5bf2b186928a6342e40e1ac13dc3f1e48b0b456380d783598576526e234c3eef072"]}, 0x326) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x4000, 0x0) bind$vsock_dgram(r1, &(0x7f0000000000)={0x28, 0x0, 0x0, @my=0x0}, 0x10) recvfrom$inet6(r1, &(0x7f0000000880)=""/4096, 0x1000, 0x21, &(0x7f0000000140)={0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x17}, 0x1000}, 0x1c) [ 117.695649] binder: 16608:16611 transaction failed 29189/-22, size 40-8 line 2848 [ 117.706338] binder: 16615:16618 got new transaction with bad transaction stack, transaction 629 has target 16615:0 [ 117.717096] binder: 16615:16618 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:27 executing program 6: r0 = perf_event_open(&(0x7f000002ef88)={0x2, 0x78, 0x1f14, 0x6896f02, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x101403, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f000093d000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f0000000140)="66660f7444000f23cc660f116f3d0feed3260fae70a7440f01cbbad00466b80700000066ef1fbaa10066b80000000066ef", 0x31}], 0x1, 0xc, &(0x7f0000000240)=[@dstype0={0x6, 0xf}], 0x1) pipe(&(0x7f0000000200)={0xffffffffffffffff}) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000280)=0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x78, 0x53, 0x2, 0x2, 0x7, 0x0, 0x4, 0x0, 0xa, 0x7f, 0x6, 0xffffffff, 0xfc2, 0x1, 0x900000000000, 0x1, 0xaa, 0x20, 0xff, 0x6, 0x10001, 0x2, 0x2, 0x92, 0x1ff, 0x8, 0x8000, 0x2, 0xffffffffffffffff, 0x6, 0x1, 0xfffffffffffffff7, 0x6, 0x7, 0x8, 0x3f, 0x80000001, 0x0, 0x7, 0x0, @perf_bp, 0x10b00, 0x3ff, 0x2, 0x2, 0x7, 0x0, 0x6}, r4, 0xfffffffffffffffe, r0, 0xe) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 2018/03/02 11:09:27 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x400400, 0x0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f00000000c0)=0x100000001, 0x1) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:27 executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r0, 0x9, 0x101, &(0x7f0000000040)="f498927f661c4a2acb1198f3d90d82a6e39046cb6cf60f2ba72b673833e83fc59d9aa871816102084ae129ba554edce8d305b1b96ba533574205597df75841ab15cb57bfa4af36997315074e298b476fa4b32a88ebd23ed32b538a4a0aa7fc3bc91e69a1379613b1add053f0e8d2f640b0cea9600c94c7f537b4527d12f0777bc1ef825a33bfa550e4360ccabb690b199359827ee50d7bb6b4937dde8ea1c710edae5759b13a8bb82246a0932cb0d8669af8ca1af6396c5bf65c840d985c13070502173df145d9a2b3", 0xc9) r1 = socket(0x2, 0x802, 0x0) bind$inet(r1, &(0x7f00000a9000)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) sendto$inet(r1, &(0x7f00006ef000), 0x0, 0x0, &(0x7f0000af3ff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000001c0)=0x50) fcntl$setlease(r0, 0x400, 0x1) recvmmsg(r1, &(0x7f00009f2ed4)=[], 0x800000000000267, 0x0, &(0x7f0000000000)={0x77359400}) [ 117.747135] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.762684] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.781207] binder_alloc: binder_alloc_mmap_handler: 16615 20ffb000-20ffe000 already mapped failed -16 2018/03/02 11:09:27 executing program 2: r0 = gettid() r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x4000) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f0000000400)={{0xbd}, {0x6, 0x5}, 0x1, 0x7, 0x8}) r2 = syz_open_procfs(r0, &(0x7f00000002c0)='net/xfrm_stat\x00') sendfile(r2, r2, &(0x7f00006c7000), 0x27) readv(r2, &(0x7f0000000080)=[], 0x45f) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f0000000240)) getresuid(&(0x7f0000000040), &(0x7f0000000080)=0x0, &(0x7f0000000280)) setsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@loopback={0x0, 0x1}, @in=@multicast1=0xe0000001, 0x4e21, 0xffffffffffff8e6f, 0x4e21, 0x49339a65, 0xa, 0x80, 0x20, 0xc, 0x0, r3}, {0x4, 0xe1e, 0x6e, 0x4, 0x0, 0x3df, 0x0, 0x1}, {0x1, 0x8f, 0x7, 0x3f}, 0x4f8359d4, 0x0, 0x0, 0x1, 0x3, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x14}, 0x4d4, 0x3e}, 0xa, @in=@broadcast=0xffffffff, 0x3500, 0x0, 0x0, 0x3ff, 0x0, 0x187, 0x5}}, 0xe8) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xa8, 0xf, 0x0, 0x6, 0x15, 0x4, "c8558347fde19f3bc7304a365dd357bf99889347591d48fb985511b1c0d2d63bb0ed873f246dcd523dfa2dd4099c1e7a26e5f858bd4e9c7cac9bd8bdc9323da8", "d88881086cc3d9f73177f5e6029b5fb58a9e64524f6adf2b08e0edd6a067bae38fc2eb54b8b1555eb739025aa527781617f5824b43044c3dd56fe9074a0e3580", "2871021233d3ff1e621d9f4bd8261b7bbd4c1af8a627f6f5628208396267a161", [0x5, 0xfff]}) 2018/03/02 11:09:27 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x10200) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r0, 0xc0086421, &(0x7f0000000200)={r1, 0x3}) r2 = socket$inet(0x2, 0x1, 0x0) mq_unlink(&(0x7f0000000240)='\x00') setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:27 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwrite64(r0, &(0x7f0000000040)="5320cb5e8f9efcf164794b5c2301b381196c6e518243928a830f36234113cf1abe83391c66e8e95b2ba999b51b589c43aa4d29cb412f2fe326ec7f68a07082178320e93139efae6d98c18a32fdd4debd0a9f35f41de022715eff51e271489886ed3d0b66092f029adf2eedf6650201fbea3e2507015d5deac90bfd46d377", 0x7e, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={r2, 0x1, 0x6, @empty}, 0x10) dup3(r0, r1, 0x0) 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f00000004c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff4ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e72300000000000000000000000000001800eddf5111de0bc330000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff461f0f1ca81ca7bd1bad636efad1bdfc825f6fde1dbc4e3a654c22bba2720dd149ce8a8c8e656a293940be283c6b93c90891c796c5c9979b395c0c91de34778dbb771d8ce5c181d68cb4564ef8f54bef3d681ce785bf68f12ff4c1c1ec4481eb59abc86b38041f0c97926169d14f2f0494448ca4881ffced4898609df7873da3088b96eb4536a41a1fbd12fae91378c24b3068f2d73641e6c7ee83ba1761e6fccaaaaf9008f9c0d7cc9230f8bcc1329cfbb0f384f4d7dc79849223a5d93f2ac095c319c3ef98c0aa454b711a3ba2d1af1a70506d75ad61b934bdb87311a82a2e6b35544ea7596bb6f88b8bf5b49dfd01e9991cf68c6c4668cd0781"]}, 0x303) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}) [ 117.799225] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.799506] binder_alloc: 16615: binder_alloc_buf, no vma [ 117.812537] binder: 16629:16638 transaction failed 29189/-3, size 40-8 line 2963 [ 117.814784] binder: BINDER_SET_CONTEXT_MGR already set [ 117.825762] binder_alloc: 16615: binder_alloc_buf, no vma [ 117.831357] binder: 16615:16625 transaction failed 29189/-3, size 40-0 line 2963 [ 117.868106] binder: 16615:16618 ioctl 40046207 0 returned -16 [ 117.869392] binder_alloc: 16615: binder_alloc_buf, no vma [ 117.879738] binder: 16615:16646 transaction failed 29189/-3, size 0-0 line 2963 [ 117.889953] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 117.891255] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.902119] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.923333] binder: release 16629:16633 transaction 631 out, still active [ 117.924194] kernel msg: ebtables bug: please report to author: Wrong len argument [ 117.930352] binder: unexpected work type, 4, not freed [ 117.930359] binder: undelivered TRANSACTION_COMPLETE [ 117.934830] device bridge0 entered promiscuous mode [ 117.963560] device bridge0 left promiscuous mode [ 117.967723] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:27 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00009f2000)={&(0x7f000007cff4)={0x10}, 0xc, &(0x7f0000226000)={&(0x7f0000000080)=ANY=[@ANYBLOB="1400004f00000000007f"], 0x14}, 0x1}, 0x0) 2018/03/02 11:09:27 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x5, 0x800) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB="27000000546fb26570b315a867c7ca4e242d5d716e8b8e1198a4aedd27e1d126bf630c377b9573ae509751"], &(0x7f0000000080)=0x2f) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00000001c0)={r2, @in6={{0xa, 0x4e21, 0x6, @mcast1={0xff, 0x1, [], 0x1}, 0x3}}}, 0x8c) sendmsg$nl_generic(r0, &(0x7f0000018000)={&(0x7f000001a000)={0x10}, 0x4d, &(0x7f000000e000)={&(0x7f00000000c0)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="2c50c3a5395cce0554ff0b908ac2220a250879ded708a9d04e6c6387374f5943c3a9b63566ea60d4ec15de7fa8bbe70bf8ba768e01fdc1af30c4f32f2fc942e41fc071d048376a111a2683454b371d8d66c25408d237dc6e00008df96283ae06b730d28cd8eedc6a815a24296c7dbaeedd9a339f975f4762a04c0d4b3931147d8bdfbf37a8e3c1d9daf0"]], 0x1}, 0x1}, 0x0) 2018/03/02 11:09:27 executing program 1: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x4}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f00000000c0)=r1, 0x4) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) pipe2(&(0x7f00000003c0)={0xffffffffffffffff}, 0x84000) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x9, 0x10}, &(0x7f00000001c0)=0xc) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000440)={r3, 0x906}, &(0x7f0000000740)=0x8) recvmsg$kcm(r2, &(0x7f0000000700)={&(0x7f0000000400)=@in={0x0, 0x0, @empty}, 0x10, &(0x7f0000000680)=[{&(0x7f0000000440)}, {&(0x7f0000000480)=""/157, 0x9d}, {&(0x7f0000000540)=""/55, 0x37}, {&(0x7f0000000580)=""/230, 0xe6}], 0x4, &(0x7f00000006c0)=""/61, 0x3d, 0x4}, 0x40000021) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x9cb, @mcast2={0xff, 0x2, [], 0x1}, 0x2}}, 0xb22, 0x4, 0xa7be, 0x401, 0x3}, &(0x7f00000000c0)=0xa0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000780)={r4, 0x9, 0x39}, &(0x7f00000007c0)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r5, 0x6d4}, &(0x7f0000000140)=0x8) 2018/03/02 11:09:27 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) 2018/03/02 11:09:27 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x3) sysfs$1(0x1, &(0x7f0000000200)='tracefs\x00') 2018/03/02 11:09:27 executing program 5: r0 = socket$inet(0x2, 0x6, 0x4) setsockopt$IPT_SO_SET_REPLACE(r0, 0x10d, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="7261770003000000000000000000000000000000000000000000000000000000090000009efdffff44000000ffffffffffffffff70000000ffffffff00000000ffffffffffffffff000000006910ffff0400000000000000", @ANYPTR64, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000d80000000000000000000000000000000000000000006800435400000000000000000000000000000000000000000000000000000001000000000000000000000000736e6d7000000000000000000000000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000d5ff000000000000000000000000000000000000000028004e465155455545000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e0398000000000000000000000000000000000000000000280000000000000000000000000000000000000000000000000000000000000000000000"], 0x3) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x1) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000300)=""/4096) 2018/03/02 11:09:27 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4530, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0xa, 0x0, &(0x7f0000000040)=[@clear_death={0x400c630f}], 0xffffffffffffff59, 0x0, &(0x7f0000009000)}) sync_file_range(r1, 0x1, 0x7, 0x6) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000000500)}) [ 117.973926] binder: undelivered TRANSACTION_ERROR: 29189 [ 117.979493] binder: release 16615:16618 transaction 629 out, still active [ 117.986465] binder: undelivered TRANSACTION_COMPLETE [ 117.991605] binder: undelivered TRANSACTION_ERROR: 29201 [ 117.997095] binder: send failed reply for transaction 629, target dead [ 118.000333] device bridge0 entered promiscuous mode [ 118.003795] binder: send failed reply for transaction 631, target dead [ 118.014268] device bridge0 left promiscuous mode 2018/03/02 11:09:27 executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000498000)={&(0x7f0000f76ff4)={0x10}, 0xc, &(0x7f00008b7ff0)={&(0x7f0000f3e000)={0x18, 0x0, 0x1, 0x800000005, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@nested={0x4, 0x1000000000000001, []}]}, 0x18}, 0x1}, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x800000000000006, 0x202) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000040)=""/35) [ 118.049706] binder: 16661:16666 transaction failed 29189/-22, size 40-8 line 2848 [ 118.070345] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.070935] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=16668 comm=syz-executor3 2018/03/02 11:09:27 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x8929, &(0x7f0000000080)={"626f6e6430050000000100", @ifru_map={0x100, 0x3, 0x9, 0x0, 0x170, 0xc23}}) recvfrom(r0, &(0x7f0000000000)=""/79, 0x4f, 0x0, &(0x7f0000000100)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) 2018/03/02 11:09:27 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384-generic\x00'}, 0x58) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000040)) socketpair$inet6(0xa, 0x802, 0x7, &(0x7f0000000000)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340), 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000280)=ANY=[@ANYBLOB="02000000000000000700000004000000000000000000000038000000040000649b42332c866f1f0000fd0000000000000000000000000000000000000000000000000100070000000000000000000000090000001f00004300000000000000000000000000000000da2d301f96bcb7040000003c051f3564b350703d81852daa2606694ced45d1403d1bd908b54359b709f01e4c0780e46a559c7fc1e2fd21e971943c4556e182d5ec2462d777fae7e9d1d26a0f721e14d9b84a65d0262455043a160aa6b3912eb415621e7ed337d5ea3a2a5ad56b43c4e926f4cbca5517d6d82c390b0a75677197afdc9cc421b6f19850ec536101fd4bcca9433f124f142f1bdc62675207867e8d80dc671f5074"]) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000180)=""/173, &(0x7f0000000240)=0xad) 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x400000000000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000200000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff004800000000000000000000000000000000000000000000000000000000000000000f00000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c30000000935d505500006e7230000000000000000000000000000180c2000000000000000000ffffffffffff0000a174e10ccb4050db00000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff00000000000000"]}, 0x209) r1 = dup(r0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e21, 0xa34, @local={0xfe, 0x80, [], 0xaa}, 0x1000}]}, &(0x7f0000000180)=0xc) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000003c0)={r2, @in6={{0xa, 0x4e24, 0x9, @loopback={0x0, 0x1}, 0x1ff}}}, 0x8c) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x100000000000023f, 0x0) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f0000000040)) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000e40)) getresuid(&(0x7f00000000c0)=0x0, &(0x7f00000001c0), &(0x7f0000000200)) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000240)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000340)=0xe8) getgroups(0x6, &(0x7f0000000380)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff]) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f0000000f00)={'nat\x00', 0x0, 0x3, 0x37, [], 0x4, &(0x7f0000000e80)=[{}, {}, {}, {}], &(0x7f0000000ec0)=""/55}, &(0x7f0000000f80)=0x50) getgroups(0x3, &(0x7f0000000640)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000dc0)=@broute={'broute\x00', 0x20, 0x5, 0x714, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000680], 0x0, &(0x7f0000000080), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x1f, 0xa, 0xdadf, 'gre0\x00', 'nr0\x00', 'sit0\x00', 'rose0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0xff, 0x0, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0xb8, 0xb8, 0x100, [@nfacct={'nfacct\x00', 0x24, {{'syz0\x00', 0x7b}}}]}, []}, @common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0x77b, 'syz0\x00', 0x9}}}}, {{{0x1d, 0x1, 0x60, 'tunl0\x00', 'erspan0\x00', 'syzkaller1\x00', 'sit0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x2, [{{{0x13, 0x10, 0x8864, 'dummy0\x00', 'sit0\x00', 'syzkaller1\x00', 'dummy0\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0xff, 0xff, 0x0, 0xff], 0xd8, 0x14c, 0x174, [@connbytes={'connbytes\x00', 0x18, {{0x2, 0x5, 0x2, 0x3}}}, @vlan={'vlan\x00', 0x8, {{0x4, 0x6, 0x8895, 0x6, 0x4}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0x3, 'syz0\x00', 0x9a}}}, @common=@mark={'mark\x00', 0x8, {{0xffffffc0, 0xfffffffffffffffc}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x15, 0x42, 0x22f0, 'sit0\x00', 'gretap0\x00', 'bcsf0\x00', 'ip6tnl0\x00', @empty, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x17}, [0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x1e0, 0x208, []}, [@common=@ERROR={'ERROR\x00', 0x20, {"d88740bd35796e818f6df7660bcc22274128430f7eef5d60a7f8a3ac0ed5"}}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0xfffffffffffffffe, 'system_u:object_r:syslog_conf_t:s0\x00'}}}]}, @common=@STANDARD={'\x00', 0x4, {0xffffffffffffffff}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x1, [{{{0xb, 0x4, 0x88ff, 'yam0\x00', 'vlan0\x00', 'gretap0\x00', 'ipddp0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x0, 0x16120d74aa8f8dfc, 0xff, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff], 0xa8, 0x118, 0x140, [@owner={'owner\x00', 0x14, {{r4, r5, r6, r7, 0x6, 0x6}}}]}, [@common=@STANDARD={'\x00', 0x4}, @common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0x2, 'syz1\x00', 0x685}}}]}, @common=@STANDARD={'\x00', 0x4, {0xffffffffffffffff}}}]}, {0x0, '\x00', 0x5, 0xfffffffffffffffe, 0x0, []}]}, 0x764) 2018/03/02 11:09:27 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000200)=""/209, &(0x7f0000000300)=0xd1) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x40, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000040)={0x1}) [ 118.094451] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.117627] binder: 16661:16682 transaction failed 29189/-22, size 40-8 line 2848 [ 118.129542] binder_alloc: binder_alloc_mmap_handler: 16671 20ffb000-20ffc000 already mapped failed -16 [ 118.159658] binder: BINDER_SET_CONTEXT_MGR already set [ 118.167636] kernel msg: ebtables bug: please report to author: Wrong len argument [ 118.168108] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.178957] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.180877] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.190404] binder: 16671:16696 ioctl 40046207 0 returned -16 2018/03/02 11:09:27 executing program 5: r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f000001cff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = syz_open_dev$mice(&(0x7f0000001300)='/dev/input/mice\x00', 0x0, 0x2000) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000001340)) sendmsg$rds(r0, &(0x7f000000dfc8)={&(0x7f0000014000)={0x2, 0x4e20, @rand_addr=0x31a00dfb}, 0x10, &(0x7f0000001fc0)=[], 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="580000001401000009000000000000000000000000000000", @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="092693e0a832535988a8292a337fe59c90188493696de2c5f7c3121b673ff9f258e2be82ffca14b5126fad79102d0ff8f323ed27675e7ba41ccfe6b8a829f64ad9cc878967720d65393df6f1fd05e4a23eb25a152c934eba8c4602e43fecfd82bb08b9000030186da327b033fa1332d307fa780ce69241b5ab1b172d048952023ee68698158c07703150f7199539c95eee9aefac3b217bf2c285b3"], @ANYPTR64=&(0x7f0000001b40)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x58}, 0x0) 2018/03/02 11:09:27 executing program 6: r0 = syz_open_dev$evdev(&(0x7f00002cd000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000a75f17)=""/233) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000040)=0x4, 0x4) 2018/03/02 11:09:27 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xcc, 0x200002) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:27 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) getrusage(0x0, &(0x7f00000000c0)) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cuse\x00', 0x40, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)=[@acquire={0x40046305}, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x2}], 0x35e, 0x0, &(0x7f0000000040)="45c280c89cfc9b7e237a018405005d0000000000003bdde0d19bd0b5378e3f25cf8a3370cd3de2262266a34d00852776ac513560"}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000200), &(0x7f0000000240)=0x4) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x210900, 0x160) getsockopt$inet6_tcp_int(r1, 0x6, 0x1f, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) statfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=""/32) 2018/03/02 11:09:27 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000240)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000efc20000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000040000000006e7230000000886f000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff0000c147c7d2303244ec00f3468d47437b00799b970b7609cedf0426dcada670b6b1617bcd9b38a879dbadd50ca84d"]}, 0x1dd) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) execveat(r1, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=[&(0x7f00000000c0)='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000100)='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000140)='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000180)='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000001c0)='.eth0\x00'], &(0x7f00000004c0)=[&(0x7f0000000400)='\x00', &(0x7f0000000440)='posix_acl_access\'em1security\x00', &(0x7f0000000480)='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1000) lseek(r0, 0x0, 0x4) 2018/03/02 11:09:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00001e0ff7)='pagemap\x00') sendfile(r0, r0, &(0x7f000010f000), 0x0) r1 = gettid() ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)=0x0) ioctl$KVM_GET_EMULATED_CPUID(r0, 0xc008ae09, &(0x7f00000000c0)=""/142) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000080)={r0, r0, 0xfffffffffffffc01}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80000, 0x0) fsync(r3) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000180)=""/88) 2018/03/02 11:09:27 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000000180)=[], 0x0, &(0x7f00000001c0)=[]}, 0x0) r0 = socket(0x10, 0x2, 0xc) getsockopt$inet6_dccp_buf(r0, 0x21, 0x8f, &(0x7f00000000c0)=""/132, &(0x7f0000000040)=0x84) write(r0, &(0x7f0000000000)="1f0000000104fffffd3b000007110000f30501000b000100740423ca0000cf", 0x1f) [ 118.203956] kernel msg: ebtables bug: please report to author: Wrong len argument [ 118.220614] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.274637] binder: 16713:16716 transaction failed 29189/-22, size 40-8 line 2848 [ 118.285558] binder_alloc: binder_alloc_mmap_handler: 16715 20ffb000-20ffe000 already mapped failed -16 [ 118.292185] kernel msg: ebtables bug: please report to author: Wrong len argument [ 118.312472] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/02 11:09:27 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x8000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) setgid(r0) r1 = syz_open_dev$sndseq(&(0x7f0000003000)='/dev/snd/seq\x00', 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f00000001c0)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x92, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180)}, 0x1ffe, 0x0, 0x3ff, 0x5, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f00000002c0)={0x4}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'vcan0\x00'}) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000040)) 2018/03/02 11:09:27 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000feffffff2071c4a3cca7752e70680ecbcb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffff165e5408fda6ba50bc5d35c30c0f8dffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffffce63cd899e8ef9b51d1617b4dbe8ffa18d0e67f91aae384ca92e30e5479c9b342edfff8b705fcb1fdb31c6458f"]}, 0x248) 2018/03/02 11:09:27 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000816000)='/dev/ppp\x00', 0x8000101005, 0x0) r1 = dup2(r0, r0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f000050ff0a)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f00004a3000)=0x600210) ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, &(0x7f0000000040)={0x0, 0x8000, 0xfffffffffffffff8}) ppoll(&(0x7f0000544000)=[{r0}], 0x1, &(0x7f0000f31ff0)={0x77359400}, &(0x7f000056fff8), 0x8) pwritev(r0, &(0x7f0000f65000)=[{&(0x7f000024ffb9)="80", 0x1}], 0x1, 0x0) 2018/03/02 11:09:27 executing program 5: r0 = socket$inet6(0xa, 0xa, 0x80000) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'lo\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x37, 0x0, 0xffffffff, []}}) 2018/03/02 11:09:27 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3fb, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:27 executing program 3: fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400781, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000040)=0x5, 0x8) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000080)={'ah\x00'}, &(0x7f00000000c0)=0x1e) 2018/03/02 11:09:27 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x400000, 0x0) ioctl$KDENABIO(r0, 0x4b36) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) ioctl$TIOCSBRK(r0, 0x5427) [ 118.324268] binder: 16715:16718 ioctl 40046207 0 returned -16 [ 118.342922] kernel msg: ebtables bug: please report to author: Wrong len argument [ 118.345512] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:27 executing program 6: r0 = socket(0x1000000010, 0x800802, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="bd2f9a3f3e1c000000520025ab3d560ae114e4009b968286", @ANYRES32=r1], 0x1c}, 0x1}, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000180)=0x5) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000140)={r0}) socket(0x5, 0x800, 0xfa) 2018/03/02 11:09:27 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000380)={0x0, 0xfffffca2, "417aa92b8639caf956959ed440a9f2cef680d3e51a1e22484a8864ddf136e1fcf8675e02d03c1d14086434dae22f4a462dff52b088cda88b1f081e65e57fcaf376bc6898aea7390655de9d260bc19f114bb3bee451052a1f82c699cf501c98de0be1a2252e8180776ee1066382392d82f827ff19799d35335fb1a70a9f03ad67e7"}, &(0x7f0000000440)=0x89) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000480)=r3, 0x4) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="85b4064daa008300", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x25f, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:27 executing program 5: pipe(&(0x7f00004a8000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) r2 = getpgid(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000cb7000)=0x75) sched_setparam(r2, &(0x7f0000000000)=0x4) readv(r0, &(0x7f0000002300)=[{&(0x7f00000012c0)=""/8, 0x8}, {&(0x7f0000001300)=""/4096, 0x1000}], 0x2) writev(r1, &(0x7f000000b000)=[{&(0x7f0000c01f96)="2c267e242481c30c666d158d944f0d89d0b24c02deea35d5f9772f8dae1cd41446cde1fbd5331eb8ac66abe4cabe3d1e42910a6a97054224ebde680a2c55c3eb196263fff503b9a83e01ec52bb3c81701958db38fabf47e496cf0a9432989b7476733757dc1062021181e6ac4f656a7b7be4ace9d1d96fb9cf322fa1916986285493f75f8787212d0ccbd4c3fa28fda762b68fbf35cc9e334d419c9d9fab1b0a5fd501e429ef862e908502d31b442c89b8e728b222c35ef07ca658b0c27225da062e195f29b1b2ba25d4099813dcd2f613c79466432b6c36fa3b2e7822aa51458c4d5cea7abdba8e2f129daff37f27487e477a5c5ba0f214c0ba7845e146c8689525e3a923e35014b6ddb9b85e35ad7590abaf67c006c4b1feb963d9eab378801359edbcdd410f113b39b11b5f7a420a080df102df54c169372e0e045640619942d91cf198369418515e484ee19965db6d9ff1b76561d8b60216afb1b236d5b56cbdfe8a3166c2cb934bd953d7d4989e899f871d0892bc9cebe86962d59c65881ebf3edcfb52180ff5795d2b5abefefbc7d122a20dc5b32465da34213a0c623d7a9b2f3339fa63ddc561a45ac96a68c4f21423a05ea2235b6df0ed19019d07d9b0e9cda2f58709b494a46ebe64722863d67a846b829f3e3ce4c9f0ce5a37d93fb1d07a420bde1c678ab8ad546c5a1f295baf92e543c4da2dabfb9b15b89e2875c06d7dfcb2994a68fefbdfa07991c1222403482c5b09928214d1d4369ab817d15838538566a0176cc12e72bdac913ea4ad953e4ef72e338c9abb074e45389d831d29eb0c2147ccf7cd404c7c71e77fa9e44a1dcd4bb893211bfd9a2c25214e9202ebc41539286e3f2417a34400bfbfa668b8c0dc75673bbb42c3d88870ace8de6b6b9b5d51264a690396cc342012bba7192829d5e13d7603ed5e8489811daa185e2ad017a5c66df226512cef5ebc7d7b9556d42af281defaadcff6d6f264dedf38296b00b0c1a534dc539c3c7f6b1882be5cd29f7c6541d9efc446ff28ea9a7cf7ced90bf2a3cd4b08b98debf758df3bf64090af0fa91269a827554d0088657fff5d93bcd5c9f26ab2aeceb659e427e05ce81fa0bf118ac60e56aca2129e6bc8513e6372de0ec4b7561d69e7126daf2a98ed9f96b0d3d611a8f0a69468fed7caf20980b80cb2bd629e376aface6d811ccb978546ac135b8cb146862ec33a4f14cec8f340b09bcc49fed4b5f861d397de3eb153841bfeda6cf888f18df77940d2ff55759d1e7c7976f5f4de3803b3b6f1eb5d6e7bb1138f8198119a237482acfe813619c20b7656c76236ad6622e6f917b74fe13679677d7008d603de253372e93994e10590b44c71468723cdaa8a0368c04773926d5d901d46b671d9e5f43641fd39cef19474375343f0a0be26e5614d1970e7d1a6c832253cdbc7f859955ad62674c9a97287d7cb4d811fb7694d579322fdf25ff824605aa0c8cf5460bed8ca2a8b1527c9c51f6b7c1510143b024142d6a9e5111c4aa98147ecc41febad60fb132faa75cc3b61ca564412ef8827327a85efc37ce6df695d394c2399f6e24189499438e0f77b598891e6ffbf855d741817f44f4a431ee11ad30a50b178a5ef179137ba24336b9b9a6a459d1f361eed683da46ccc51081331fc422471a136d31ad7698fc27d0a5cc2e48d0c0af32c91489e03647a9e9771c4fc62d3877079fb037b641a5fe7bda287ab1a049ee5dadaa2f971566dcb708e351e0f937993696fd31a1d999addd76127e97ad684948d0d5e6bd21b0b68986295d7cc71be683e448b1e3016ae3e98ee83512c398376d52bb0ab50674a886d34a7c123748396498581ff22aeb3052d01b3f6dc473b6ce27d359dc9077a68a2abe4b17c3dfbaeb7f90f1be19c89de6753620f33e31cfe27a3a18b333e548836e38920a3459b5407268f0d41c58c6f5091172cf0a508c1d73f2aa9e953496bbe8ab03533f89e2b4dafb37b89d25e0efb75ff84bb1cbd60a33dddb627e88efb44138b40ffad9bf70111f7e8f6b01e89b3a74b9cf71191f2bd026ba01e16a21d0abca2491351475a08fb593cdfb40047e896457af4c3a61f4fb7ad570080193954b62a7839127ddfb8d93018978fd3e642658213571246308454cc4195cead295f6f72c10def5930930e44782edd916230fa99423def58b780f6936d55aa952baea0c58630526df65f0ebf91b0e01c97f9b3bbca8fceff87ffc945c972b51b11954a476967b52c2fa3247a6e6bba9cef9ff5efd4523a64e11005128003b34251108d8f3dd62c3db158fec915546db1db5f02300b3f5baee8ac9a498d00a1bdb1cfab31dffc4506c799a269b6be101c0e8a2907c5464733a06d8f855c619befa9b77cbceb48da086ac09e510c609cb5c95d0f69d053ef35c32a7b96e6ab7297fdf211e198bf90087433474bffd8fe0d1e77934d8848d2d6a5ce21124e8c2af71e28026950caa63c4b0f6648e41225b384d5ee21701659489ccc2017d48463e0dcf97361c538c8b47d049f2b36d0584cb786215400ce18e285c1dbad47dda87c28d3f5f7fb15c560d1b28472f787b4915300364ce08acf3747d0020731e81dac8c252ed2cb5e096268f6d3e363620d92f272bd34c240eb4aba3d01904d897723345234ccbc4610a3a2259b244397b1f1db4094dfbc765aa212dd09a9197c9ff51e0f07c3547fc3f2f86e2d996b3bb4a6ebb282a10e2738b1e945ce3f33bd3979bfba6edb830341f6eb997cab67f9eb7a57fc1a8bf0ce64d9300e622a144bb424ecace72f0d16ef443de9ba89d8ac38e2e88f0a3ed23ec851dfb45df034532169cca827c88081e7fd2354819d9c20ea39f2932787246d8806e089ec1c70cca020f898602f211eb2504aadc3090d85a3ec9483451058d6caba71806f3f494d73755774296a67511572eb801b188dfbddf065be196febbfbce5af895fdc7278a1ede609f9af86f208aeef20001a9fc0bc04eef1a84229dda539e6bcc31479321036f162e57f41b1991cddc88179be2b1ada532eeb770aab9ec82399b80879ed2cdda07b061b0f0ee35002209d9b5afa9836efd2cad153227f4af2c1b4f60c21573c35faec09c45467540dbf3cabee5a2918b4a9432ebe672306f1acfdae1a3c3d8be48c58621c0b16312ed7777f81fc9084eeddf26e68c5d7f0d83347897a69e9b293c1e93b17448fea811d13af456f30f4f5b0ed0ec8b5876ab2dadeff381093f16f5013cfff76f2c77fdaf87d0d82697e070131831054757ac544aab5801ca1dfa665ded0e9de3eedb8cb6f17485a92eceac1b2b33927bb410c9369a4b7f3fc186828693a92fc07f415d244ee972b25c2d42b69c5e03ba57a1037d59f02a098fe62536e7af192233d86e8fae5d17fc7bd13b6e54d59941edeb975c85667a743ad4825e68cd00c707ba80bb0902d7f7fabd7c8e6a6df462b210528ce8378a6255c1da496305c84e741c5a5175919b44938f969bc2cf50e0ea4569e0dc523118e7b4d8165893f610a49a215f0945f0c177d1fc348cfbdbe1ef33bd8f1f41f761b9f8bb23172315bbd451d729f823d20559b3535d01173c92dd4b8c151d1e9be2eeb62d133f050bea021e75e41d8eab2678f0bfb40e134d8a60029a9ee4332316e1665360f477255915f344e1c56ed620431e9e4371c983abef24ba800c239b2273b14b342339a374a0fc3aa30898ef0e69040ef4dd6c298dc90e03242118eb824bd23044c87783085533e19445b43ef341c4372ac4545ac03a3adc532475947d63ce67e1e3763cc7f9ff9d103c434570c02c7b811a648b5bbfadb847d29311b6589a4864fd8af8e354b221fc78e407c95160460cd74d5966ba405da1f496950a6ac1e79ab6dc511ecd726d05d38e0fd65bd66c58c11280785a302aa00ddc03cad93833bd357b30ec13e91d632ec8d5565ed6a5d0554f17b4d7efa147fc0d9035d8a96213e9465da1d3b94f56d3f2b12d7e394a5fff25873c591cee50c5c14273d4b1c645d5ded4a0ad5d8a1296f40c2b65cf457a5780c4a4569927bd896c0d71498f2d31f4f61282540105f5845326aa61ceb01c10be922a2fdeaa1a9689922e255e053be4c4cb45f5c6bd8af4f93f8362bbf54875ddbedab4b97e8cec478e4ceda8121439523839abb6e1cdc7ba2eb34c1fe9931585e1e0d8c326276bab83170752a30f2a3a250aad1cc1f72155457dd3ab40e4c2f1454084683f8bfc92fd87af76a73dbbf06f8d4f18dffbff0c8310eb96303c60401e4efa54def27c4e023aaaee24d525d1d98822eaeb33bbc5d40e8845b6ae1b29ede30c6675f5aab93b2b28391008e62d9d9bd1224116d9874233c57f3524e34a2737f74daa1bb9051ba8e2564fa2f3e5462bd67a7be796c682ba55d0f64331b1c0c3e45aec99548e65b61420f25cad6d3ca9063db31fe16b7157249cdc2e592188efddd0161314104615509ee1ff212c98a448a5b2b7a931b01b1ed502135f324f3b58906591ce181010e9c62ce9cfab26d4ddf9ab43fbc277d15b8bfb93edbcfe276e5646fde162dc926487440cdcc90a92ed03662ec04ab9ec1b1647707b43c7fe18a030e3001cd7915013e0196c4609aa8475fc85302b963f4be6a16b8206b099c81b6bf4619389f6df538813a2ad08183e97750b35b1ced267166f4f39b13d9925db22bdc6dd7c3ca8d0aab439040d42952e62eee9a2728c9b7e45f7463f8447ec2ec435bd7e91bd05ad09ec013468f4ba54437da9b8db677f4eaf10c5746da05bf12359b3aa915be2999e2bce629dd4ad01ce0b6229e4b49cca0157abb5221488a785af2d71a149f096b0c564a6d36ca92d36ea15c54dc44eaafed114a858f1c126f68888eba594dcd52ae7f233e2ec88d2a2fc95da3385e02f30746a844f8d6e05b724aff933c15088cde099f04f4228745bdb51180d4e6114a364cb6ef32a71872dfcb86278df4a20423c354699cdb4c63b35dc4fa04a5d456c65e72b20be53f302e8ccbe6873e76e0adabdca405c50a9d933be9046c616c8e6ada9949de0db64bed0b6c8c8d6250a2589896ebbdaa5e7d254130c4b5fd7e9b57da57e5491aad4aa5f81d73a220332abf1e7a5ccc360bc1ac342408f8d5335e97a3c2f8353498946bfbbabf386459423c4e2af0c908b4724df1f97b92991a937a955ac45aa3b130768c49d550cfdacd2e7753950f336d9ce6f367fb566c935bb940f9beedaaa4348efff216e201a9e5de2c65ac43f6c3d0e8d5f0b960b65c3285c99b2f7d747657bf77afb9057a6d28bede1a72d45cb2125a8902150685e3ca7171212e01d224e876feb972d5ded4313c48164034bc0244ec73e687d87b44c33a16e8471e25e1a58094dfc509a007a3f2c010dfffeb80f36febb448fc40fe301e897bbe1aeb2a7a7ca968b22bb5d5ad5b366a4377ae441937f2b60a4e3ec6c8a90dd415cc47ae6dad270eaadab63c7f321b3af28d9079759da8b18167608a4ae2e08a84f84eeccb08c56cc476ed0db598c174437c1eace848c717a7e5aaca4e35d861038326bae04ebac9bc451fa4c5d60bd52eeeac89e01e11b3719f07b33a4192709713d120b0f7bddd82cbb13c321ccd87880993eedb0e2a8ca88dd7ec9af1367240b20209f96c237e067889503fee6bf3787a4d90570de215fb02d11a82a379303bbb5ed40d0432a317b50ff1ef21bcdf57f894a6938ad35396b6bf8dc24287cea55c472b6bcd7a2e3fd4a6cdf3435e54170fac4f116fdd3817240c940fea9b0509b5e047f23e6f7ef05d04ccdd39bd8d70e1a130e72fdf6c1e", 0x1001}], 0x1) pwrite64(r0, &(0x7f0000000040)="8155fab4518909109a8f26bccc892353154f90df6b80ec4a46102b75d26adf5609b098acf1a26b3fa586", 0x2a, 0xc) name_to_handle_at(r0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x33, 0x200, "295175ed22c951742423f84eb749f5095c9f39bd73fa8b2b6a44472e6ed0ba18657a3d0a9a9900417368fd"}, &(0x7f0000000100), 0x1000) [ 118.390787] binder_alloc: 16715: binder_alloc_buf, no vma [ 118.396563] binder: 16743:16745 transaction failed 29189/-3, size 40-8 line 2963 [ 118.398049] binder: release 16715:16718 transaction 642 out, still active [ 118.411153] binder: undelivered TRANSACTION_COMPLETE [ 118.416313] binder: send failed reply for transaction 642, target dead [ 118.431651] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.459766] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.466840] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.475744] binder: 16758:16764 got new transaction with bad transaction stack, transaction 645 has target 16758:0 [ 118.486416] binder: 16758:16764 transaction failed 29201/-71, size 0-0 line 2875 [ 118.499317] binder_alloc: binder_alloc_mmap_handler: 16758 20ffb000-20ffe000 already mapped failed -16 [ 118.523860] binder: BINDER_SET_CONTEXT_MGR already set [ 118.546485] binder_alloc: 16758: binder_alloc_buf, no vma [ 118.552189] binder: 16758:16764 transaction failed 29189/-3, size 40-0 line 2963 [ 118.560470] binder_alloc: 16758: binder_alloc_buf, no vma [ 118.561365] binder: 16758:16767 ioctl 40046207 0 returned -16 [ 118.566183] binder: 16758:16770 transaction failed 29189/-3, size 0-0 line 2963 2018/03/02 11:09:27 executing program 6: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000080)={0x13, 0x6, 0x7ff}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @empty}}, 0xffff, 0x4, 0x45ad, 0xfffffffffffffffe, 0x44}, &(0x7f0000000040)=0xa0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={r1, 0x6}, &(0x7f0000000200)=0x8) clock_gettime(0x7, &(0x7f0000000000)) 2018/03/02 11:09:27 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:27 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000140)={@dev={0xfe, 0x80}}, 0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@mcast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@empty}}, &(0x7f0000000080)=0xe8) getresgid(&(0x7f00000000c0)=0x0, &(0x7f0000000100), &(0x7f0000000280)) syz_fuseblk_mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0xe000, r1, r2, 0xa52, 0x9, 0x1000090) 2018/03/02 11:09:27 executing program 5: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x100, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x5) r1 = socket$inet(0x10, 0x3, 0x10) sendmsg(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000010fdc)="2300000024009115460000000000001201000000000000270500000000000004007352", 0x23}], 0x1}, 0x0) 2018/03/02 11:09:27 executing program 2: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000ffc)=0x3, 0x4) 2018/03/02 11:09:27 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0068b440"], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:28 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x8, 0x64b}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={r1, 0x58, &(0x7f0000000200)=[@in6={0xa, 0x4e23, 0x800, @empty, 0x1000000000}, @in6={0xa, 0x4e24, 0xad, @mcast1={0xff, 0x1, [], 0x1}, 0x7f}, @in={0x2, 0x4e21, @empty}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xe}}]}, &(0x7f00000002c0)=0xc) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:28 executing program 4: socket(0x1, 0x806, 0x7f) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x40100, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = socket$inet_smc(0x2b, 0x1, 0x0) socket$inet(0x2, 0x0, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@nat={'nat\x00', 0x19, 0x4, 0xd78, [0x200003c0, 0x0, 0x0, 0x200005fc, 0x2000062c], 0x0, &(0x7f0000000000), &(0x7f00000003c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x17, 0x20, 0xe0ff, 'syzkaller1\x00', 'bridge0\x00', 'bpq0\x00', 'bond0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], 0x9c, 0xfc, 0x12c, [@cpu={'cpu\x00', 0x8, {{0x7fff}}}]}, [@snat={'snat\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xfffffffffffffffe}}}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xfffffffffffffffd}}}]}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}}, {{{0x3, 0x6, 0x890f, 'tunl0\x00', 'bcsh0\x00', 'ip6tnl0\x00', 'bpq0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xb44a1bef3d800b84, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xf}, [0x0, 0xff, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0xe0, []}, []}, @common=@nflog={'nflog\x00', 0x4c, {{0xffffffff7fffffff, 0x80000000, 0x2, 0x0, 0x0, "905c8203ce7dc7090f89516a9c338a8e7dc23afe4cd2135abbcbed053e047eafbca669c570fa4efb3ee100f130b158648794dfc9c104768a32e0a7a93a686ab7"}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x2, 0x0, 0x2, [{{{0x9, 0x1, 0x8b7f, 'vcan0\x00', 'ip6gre0\x00', 'tunl0\x00', 'bond0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xc}, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], 0x70, 0xd0, 0x100, []}, [@snat={'snat\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xffffffffffffffff}}}, @arpreply={'arpreply\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x14}, 0x2c4790f1c6e76c11}}}}, {{{0xd, 0x1, 0x22f0, 'dummy0\x00', 'teql0\x00', 'lo\x00', 'ip6tnl0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @random="cd093869daa9", [0xff, 0xff, 0x0, 0x0, 0x0, 0xff], 0x94c, 0x97c, 0x9ac, [@realm={'realm\x00', 0xc, {{0x50, 0xffffffff80000001, 0x1}}}, @among={'among\x00', 0x888, {{0x9eb, 0x1b12, 0x42dbb953, {[0x3, 0x7ff, 0xffffffff80000001, 0x0, 0x3, 0x1000, 0xd804, 0x7ff, 0x4, 0x7f, 0x3, 0x1, 0xd3ba, 0xfffffffffffff57c, 0x7f, 0x10001, 0x3f, 0xfffffffffffffffd, 0x100000001, 0x8, 0x6, 0x956e, 0x20000, 0x8, 0x2, 0x4, 0x6, 0x3, 0x7fffffff, 0x7, 0x8001, 0x1ff, 0x2, 0x20, 0x100, 0x3, 0x9, 0x2, 0x1, 0x7, 0x4, 0xd8, 0x4, 0xe5f, 0x30f1, 0x9, 0xfff, 0xf000000000000000, 0x3, 0x0, 0x5, 0x400, 0x9, 0x81, 0xffffffffffffff81, 0x7fff, 0x3, 0x0, 0x0, 0x9, 0x7, 0xfff, 0xff, 0x1, 0xfffffffffffffffa, 0x2, 0x1, 0x1, 0xc42, 0x100, 0x80000001, 0x80000001, 0x1, 0x7, 0x10000000000000, 0x2ad, 0x0, 0x80000001, 0x29aa, 0xbcd4, 0x6, 0x10001, 0x2, 0x2, 0x5, 0x0, 0x20, 0x2, 0x6, 0x9, 0x0, 0xcdf, 0x1, 0xffff, 0x1000, 0xffff, 0xfffffffffffffffd, 0x0, 0x2, 0x3, 0x100, 0x7fff, 0x46, 0x100, 0x13, 0x90f, 0xff, 0x9, 0xfff, 0x5, 0xffffffffffffffff, 0x10000, 0xffffffff, 0x6, 0xffffffffffff1a46, 0x2, 0x2, 0xfffffffffffffffe, 0x100000000, 0x100000000, 0x80000001, 0x81, 0x1, 0xfffffffffffffffd, 0x1f, 0xaef, 0xce9a, 0x5, 0x9, 0x8, 0x9, 0x5, 0xff, 0x1, 0xb79, 0x10001, 0xe40, 0xffffffff, 0x80000000, 0x4, 0xcd6, 0x1, 0x80000000, 0x5, 0x60000000000, 0x7, 0x7fffffff, 0x7fff, 0x9, 0x3, 0xffff, 0x295e, 0x7, 0xffff, 0xfff, 0x5, 0xd9, 0x0, 0x3f, 0x8, 0x3, 0x7, 0x4, 0x3, 0x4, 0xe1e, 0x3ff, 0x8000, 0x9, 0x5d, 0x8, 0xffffffff80000001, 0xffffffff, 0x8, 0x10001, 0x7fff, 0xffffffffffffff7f, 0x164c, 0x0, 0x0, 0x6, 0x100000001, 0x4c, 0x71, 0x7fff, 0x6, 0xffffffff, 0x3, 0x6, 0x9, 0x4, 0x401, 0x6, 0xa400000000, 0xe88d, 0x2, 0x8, 0xb9, 0x800, 0x8, 0x7, 0x3, 0x8001, 0x5, 0x10000, 0x2, 0x8, 0x8b5c, 0xfffffffffffffffd, 0x8, 0x800, 0x4dd, 0xffffffff, 0x14fb, 0x4, 0xfffffffffffffff9, 0x9, 0xfffffffffffffffd, 0x81, 0x0, 0x0, 0x2, 0xfff, 0x73d56d44, 0x8000, 0xfffffffffffff801, 0x2, 0x0, 0x6, 0x401, 0x4, 0xa828, 0x5, 0x8001, 0xac9, 0xffff, 0x3, 0x8, 0x3, 0x9, 0x8, 0x53d2, 0x32, 0x800, 0x1, 0x9, 0xfffffffffffffffa, 0x9, 0x93, 0x8, 0x9, 0x80000001, 0x40, 0x4, 0x2, 0x0, 0xffffffff00000000], 0x7, [{[0x7, 0x2], @multicast1=0xe0000001}, {[0xd45c, 0x5], @rand_addr=0x7c}, {[0x7, 0x1], @dev={0xac, 0x14, 0x14, 0xa}}, {[0x0, 0x7], @remote={0xac, 0x14, 0x14, 0xbb}}, {[0x7, 0x7], @loopback=0x7f000001}, {[0xa5b, 0x5], @dev={0xac, 0x14, 0x14, 0xc}}, {[0x3ff, 0xbe], @local={0xac, 0x14, 0x14, 0xaa}}]}, {[0x7ad, 0x101, 0xffffffffffffff55, 0xffffffffffffff7f, 0x0, 0x7, 0x7, 0x899, 0x8, 0xfffffffffffffffb, 0x400, 0x4b, 0x8, 0x7, 0x40, 0x6, 0xba5, 0x5, 0x2, 0x7, 0x2, 0x6, 0x7f, 0x9, 0xf40, 0x3, 0xffffffff, 0x1, 0x1, 0x1, 0xffffffffffffff80, 0x8, 0xc0b, 0x7fffffff, 0x4, 0x2, 0x1, 0xd506, 0x7, 0x63dc, 0xfffffffffffffffa, 0x80000000, 0xf243, 0xf4d9, 0x0, 0x6, 0x3, 0x80000000, 0x8fca, 0x6, 0x1d, 0x40, 0xfffffffffffffff9, 0x101, 0x40, 0x0, 0x6, 0x4, 0x8, 0x7f4, 0x9, 0x0, 0xc4, 0x7f, 0x1, 0xffffffffffffff7f, 0x5, 0x0, 0x634c, 0x0, 0x4, 0x0, 0x80a4, 0x1b, 0x4, 0xfffffffffffffff7, 0x1, 0x80, 0x76c, 0x9, 0x9, 0x80000000, 0x7, 0x53ea, 0x6, 0x2, 0xfab8, 0x6, 0x8, 0x1, 0x0, 0x1f, 0x8000, 0x4, 0x7ff, 0x3, 0x0, 0x8, 0x5, 0xffffffffffffffff, 0x8, 0xc1, 0x101, 0x200, 0x40, 0x1, 0x2000000000000, 0x3, 0x4000000000000, 0x3f, 0x2, 0x10001, 0xffffffffffff437d, 0x6, 0x6, 0x6, 0x3, 0x4, 0x4, 0x6, 0x1, 0x8, 0x7f, 0xddd, 0xff, 0x9, 0xc33, 0x1, 0x4, 0x10, 0x2, 0xde, 0x5, 0x6b9972e4, 0x0, 0x400, 0x8a, 0x8, 0xfffffffffffffffb, 0x2, 0x7fff, 0x3, 0x9, 0xffffffff, 0x9, 0x5, 0x5, 0x5, 0x22, 0xd, 0x3ff, 0xde2f, 0x3f, 0xe3c1, 0x400, 0x5, 0x4, 0x1000, 0xcc, 0x174, 0x8001, 0x6, 0x2, 0xd17a, 0x7, 0x8, 0x800, 0x6, 0x2, 0x1, 0x6, 0x5, 0xaa, 0x6, 0x7, 0xeec8, 0x7, 0x6, 0xd6, 0x1, 0x5, 0xf64b, 0xbf, 0x8, 0x2, 0xec38, 0x9, 0x2, 0x800, 0x2, 0xfffffffffffff2c2, 0x4, 0x1, 0x9, 0x8, 0x0, 0x3, 0x8, 0x3ff, 0xa93, 0xf7, 0x9, 0x0, 0xcc4, 0x6, 0x8, 0x40, 0x1, 0x3, 0x3855, 0xd9, 0xfffffffffffffffe, 0x76, 0xffffffff, 0x6, 0x5, 0x4, 0x7, 0x9, 0x3, 0xb5, 0xfffffffffffffffc, 0x3, 0x9e, 0x879, 0x3d, 0x8001000, 0x2, 0x101, 0x7, 0x4, 0x4, 0x9, 0x0, 0x8111, 0x7, 0xfff, 0x9, 0x3, 0x5, 0x3f, 0x9, 0x1, 0x10001, 0xfffffffffffffffd, 0x401, 0x8, 0xf69f, 0x10000, 0xa493, 0x7, 0x3ff, 0x7, 0x2, 0xffffffffffffffc1, 0x4, 0x40], 0x2, [{[0xb382, 0x3f], @multicast2=0xe0000002}, {[0xbe54, 0x7], @local={0xac, 0x14, 0x14, 0xaa}}]}}}}]}, [@snat={'snat\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xfffffffffffffffe}}}]}, @arpreply={'arpreply\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0xfffffffffffffffd}}}}]}]}, 0xdc8) [ 118.605424] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.618320] binder: release 16758:16764 transaction 645 out, still active [ 118.625352] binder: send failed reply for transaction 645, target dead 2018/03/02 11:09:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000380)={0x0, 0xfffffca2, "417aa92b8639caf956959ed440a9f2cef680d3e51a1e22484a8864ddf136e1fcf8675e02d03c1d14086434dae22f4a462dff52b088cda88b1f081e65e57fcaf376bc6898aea7390655de9d260bc19f114bb3bee451052a1f82c699cf501c98de0be1a2252e8180776ee1066382392d82f827ff19799d35335fb1a70a9f03ad67e7"}, &(0x7f0000000440)=0x89) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000480)=r3, 0x4) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="85b4064daa008300", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x25f, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:28 executing program 5: r0 = memfd_create(&(0x7f0000000040)="7d7d9574686f5e707230630100000400001e0070ff6f630ff8", 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20001) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000042000)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000036000)=[{0x0, 0x0, 0x71, 0x0, @tick=0x2, {}, {}, @addr}], 0x30) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000027fb0)={0x203, @time={0x77359400}}) r3 = getpgrp(0xffffffffffffffff) sched_rr_get_interval(r3, &(0x7f0000000000)) [ 118.658269] binder: 16779:16782 unknown command 1085564928 [ 118.669979] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.684678] binder: 16779:16782 ioctl c0306201 20000580 returned -22 [ 118.694986] binder: release 16772:16789 transaction 651 out, still active [ 118.702332] binder: unexpected work type, 4, not freed 2018/03/02 11:09:28 executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f00000000c0)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000140)={r1, 0x5b}, &(0x7f0000000180)=0x8) r2 = fcntl$getown(r0, 0x9) r3 = syz_open_procfs(r2, &(0x7f00000001c0)="6e65742f6970345f71f5abe40a936d725f636163686500") preadv(r3, &(0x7f0000000000)=[{&(0x7f0000011fc2)=""/62, 0x3e}], 0x22b, 0x0) 2018/03/02 11:09:28 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x100, 0x0) write$fuse(r0, &(0x7f0000000140)={0x12, 0x1, 0x6, @fuse_notify_poll_wakeup_out={0x10001}}, 0x12) io_setup(0x9, &(0x7f0000000180)) io_setup(0xfffffffffffff001, &(0x7f00000001c0)=0x0) io_destroy(r1) r2 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x8d, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="77af9208f9d2bef30616f430e20b5dcef2061f548216361b751e0d8c064af11800bc75d0361cf3b737b3a6dd5604ebf127ba05041946b3a6cbb039f1da5ad6a9e411bd030b14be7439476398c5cf65d0c8", @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:28 executing program 0: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x80, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000200)={0x0, 0x6, 0x27, 0x1, 0x3ff, 0xff, 0x0, 0x4, {0x0, @in6={{0xa, 0x4e20, 0x67, @loopback={0x0, 0x1}, 0xc922}}, 0x6, 0x5, 0x9, 0x8, 0x8}}, &(0x7f0000000040)=0xb8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={r1, @in={{0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x6, 0x3}, &(0x7f0000000380)=0x98) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 118.707652] binder: undelivered TRANSACTION_COMPLETE [ 118.708633] binder_alloc: binder_alloc_mmap_handler: 16779 20ffb000-20ffe000 already mapped failed -16 [ 118.728305] binder: BINDER_SET_CONTEXT_MGR already set [ 118.734721] binder: 16788:16793 ioctl 40046207 0 returned -16 [ 118.743419] binder: BINDER_SET_CONTEXT_MGR already set [ 118.747760] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/03/02 11:09:28 executing program 3: r0 = open(&(0x7f0000aa0000)='./file0\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(r0, 0x800000000402, 0xffffffffffffffff) sync() dup3(r1, r0, 0x0) 2018/03/02 11:09:28 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/qat_adf_ctl\x00', 0x40400, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000300)='/dev/vcs#\x00', 0xfffffffffffeffff, 0x10000) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/mls\x00', 0x0, 0x0) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f00000004c0)) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000180)={r2}) getsockname$packet(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000200)=0x14) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', 0x0, 0x10}, 0x10) r5 = syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000400)={0x0, 0x0, 0x0, 0xfffffffffffffffd}, &(0x7f0000000440)=0x18) setsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000500)={r4, @multicast1=0xe0000001, @loopback=0x7f000001}, 0xc) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000480)=@assoc_id=r6, 0x4) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000003c0)) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', @ifru_map={0x101}}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000280)={'gre0\x00', @ifru_map={0xcc1}}) ioctl$TUNSETSNDBUF(r5, 0x400454d4, &(0x7f0000000380)) ioctl$TUNSETSNDBUF(r5, 0x400454d4, &(0x7f00000000c0)=0x1) [ 118.750055] binder: 16779:16795 ioctl 40046207 0 returned -16 [ 118.766092] binder_alloc: 16779: binder_alloc_buf, no vma [ 118.771820] binder: 16779:16782 transaction failed 29189/-3, size 40-0 line 2963 [ 118.771923] binder_alloc: 16779: binder_alloc_buf, no vma [ 118.785304] binder: 16800:16805 transaction failed 29189/-3, size 40-8 line 2963 [ 118.791058] binder_alloc: 16779: binder_alloc_buf, no vma [ 118.795628] kernel msg: ebtables bug: please report to author: Total nentries is wrong 2018/03/02 11:09:28 executing program 6: r0 = syz_open_dev$evdev(&(0x7f0000822000)='/dev/input/event#\x00', 0x0, 0x0) r1 = gettid() prlimit64(r1, 0x4, &(0x7f0000000000)={0x3, 0x7}, 0x0) ioctl(r0, 0x80000004000457e, &(0x7f00008d5000)) [ 118.798473] binder: 16788:16809 transaction failed 29189/-3, size 40-0 line 2963 [ 118.803886] binder_alloc: 16779: binder_alloc_buf, no vma [ 118.819794] binder: 16788:16793 transaction failed 29189/-3, size 0-0 line 2963 [ 118.842778] binder: 16779:16795 unknown command 1085564928 [ 118.847389] QAT: Invalid ioctl [ 118.851863] binder: 16779:16795 ioctl c0306201 20000580 returned -22 [ 118.862944] QAT: Invalid ioctl [ 118.863258] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 118.878893] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.897878] binder: release 16779:16782 transaction 650 out, still active [ 118.904970] binder: undelivered TRANSACTION_COMPLETE 2018/03/02 11:09:28 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000380)={0x0, 0xfffffca2, "417aa92b8639caf956959ed440a9f2cef680d3e51a1e22484a8864ddf136e1fcf8675e02d03c1d14086434dae22f4a462dff52b088cda88b1f081e65e57fcaf376bc6898aea7390655de9d260bc19f114bb3bee451052a1f82c699cf501c98de0be1a2252e8180776ee1066382392d82f827ff19799d35335fb1a70a9f03ad67e7"}, &(0x7f0000000440)=0x89) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000480)=r3, 0x4) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="85b4064daa008300", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x25f, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:28 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f00000000c0)=""/82, &(0x7f0000000040)=0x52) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\b\x00@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:28 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:28 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x414001, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) io_setup(0x319, &(0x7f00000000c0)) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB="00000083866a2600"]], 0x0, 0x0, &(0x7f0000009000)}) modify_ldt$read_default(0x2, &(0x7f0000000040)=""/127, 0x7f) 2018/03/02 11:09:28 executing program 6: r0 = syz_open_dev$loop(&(0x7f0000000240)='/dev/loop#\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f00000006c0)='./file0\x00', 0x80000, 0x40) ioctl$sock_netrom_SIOCGSTAMPNS(r1, 0x8907, &(0x7f0000000700)) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000001c0)={'ip6tnl0\x00', @ifru_map={0x8, 0x27ae, 0xff, 0x3f, 0x5, 0x800}}) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000100)=""/188) sendmsg(0xffffffffffffffff, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000004000)=[]}, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "11c7563d16764482aeeada02af9d0e72a39325b9531c23f6a42c27edf3e7c6497c38c9f247b3e39f72ce089a5d22f7c29e0aeac041b06d083036b68eb276ee25", "c1ef8adba246dd310e7897e501c7547553c14c341dcef68c2ccb1d417d217c20"}) 2018/03/02 11:09:28 executing program 3: r0 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x9, 0x70200) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f0000000100)={0x1, 0x0, 0x0, 0x9}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40086437, &(0x7f0000000140)={r1, 0x4}) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000240)=""/196) setsockopt$inet6_opts(r2, 0x29, 0x39, &(0x7f0000000180)=ANY=[@ANYBLOB="34c5bfce0ffcd42ae57d1e4f899f8772f89407cd9b80f51bc4b56dd0dcb02f9ead3b7e696c5a78136f866055a855046678498fd551433280900b1bd475794c24ebf2c0382e5dfb10c3b0bdbbd20429c0b6e88863b557a0e1a92e4be527559fcffc1c7f68888b73d3a075726fd88481a8359ec775d4e328a3392eaced1a00e10879ee81659ceb31bf97e8ebb4ebf5e72919c87da91447a93f0c4057386a1db58903d78d549f21a445d31c140e5cfbad2c47bf3576d8f9680425203113"], 0x8) r3 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x3f, 0x8000) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f0000000080)=0x8) 2018/03/02 11:09:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a71, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc) r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0xfffffffffffffffc, 0x200) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x944, 0x400) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f00000000c0)=r1) syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) 2018/03/02 11:09:28 executing program 4: r0 = socket$inet(0x2, 0x1, 0x9) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000400000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) open$dir(&(0x7f0000000000)='./file0\x00', 0x80800, 0x100) [ 118.910151] binder: send failed reply for transaction 650, target dead [ 118.916839] binder: send failed reply for transaction 651, target dead [ 118.924429] binder: undelivered TRANSACTION_ERROR: 29189 [ 118.930523] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:28 executing program 5: r0 = memfd_create(&(0x7f0000002901)='dev ', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'ipddp0\x00', @ifru_flags=0x400}) sysfs$1(0x1, &(0x7f0000000ffc)="64977214") [ 118.976708] binder: 16834:16837 unknown command 4194312 [ 118.980104] binder: 16836:16843 transaction failed 29189/-22, size 40-8 line 2848 [ 118.987947] binder: BINDER_SET_CONTEXT_MGR already set [ 118.993746] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 119.002759] binder: 16833:16840 ioctl 40046207 0 returned -16 [ 119.005176] binder: 16836:16848 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:28 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x1) name_to_handle_at(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={0xb8, 0x40, "7b2232a34a9bc4861ad3b5ed7dcb1c4d31d114a9c62227b5f4fc5cd598e5d5fc4d5c15e2a01e0f999241555400ec8374a4ef1e1d3da527d67998c7e812b20a9442c211343672b17590fd459f47ab1b06d94cf93f57519950af6a88b260e253f8b1861ff3a96fe9f7c6bb82788277e8fe3a2be7a611612a73c4b69a199759a4b7eb549f8ba79b43669fb06c149822c61fc0fff5daaa9c4be5860cab2fbdb6f683ac25aae1b7e4ffaa5326808e7c5cda41"}, &(0x7f00000002c0), 0x400) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:28 executing program 6: r0 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x40, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f00000000c0)={'HL\x00'}, &(0x7f0000000100)=0x1e) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo\x00') fchmod(0xffffffffffffffff, 0x0) ioctl$int_out(r1, 0x5460, &(0x7f0000000040)) [ 119.022965] binder: 16833:16852 got new transaction with bad transaction stack, transaction 662 has target 16834:0 [ 119.027815] binder: 16834:16837 ioctl c0306201 20000580 returned -22 [ 119.033565] binder: 16833:16852 transaction failed 29201/-71, size 0-0 line 2875 [ 119.042721] binder_alloc: binder_alloc_mmap_handler: 16834 20ffb000-20ffe000 already mapped failed -16 [ 119.086288] binder: BINDER_SET_CONTEXT_MGR already set [ 119.091723] binder: release 16833:16852 transaction 662 out, still active [ 119.095376] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 119.113217] binder: 16834:16868 ioctl 40046207 0 returned -16 [ 119.126124] binder: undelivered TRANSACTION_ERROR: 29189 2018/03/02 11:09:28 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000080000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000040000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff00706174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40000, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f0000000040)={0x5, 0x1}) 2018/03/02 11:09:28 executing program 1: r0 = getpgrp(0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f0000b79ff8)='./file0\x00', &(0x7f0000db0ff8)='./file0\x00', &(0x7f0000f9cffb)='proc\x00', 0x0, &(0x7f0000cde000)) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000180)) getdents64(r1, &(0x7f0000000040)=""/44, 0x2c) getdents64(r1, &(0x7f0000f57971)=""/1679, 0x68f) getdents(r1, &(0x7f0000000440)=""/134, 0x86) syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x1, 0x4000) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffc, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf7d4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x8, &(0x7f0000000040)=0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x7, 0x10000) ioctl$sock_ipx_SIOCIPXNCPCONN(r3, 0x89e3, &(0x7f00000000c0)=0xa55a) ioctl$sock_inet_SIOCSIFBRDADDR(r3, 0x891a, &(0x7f0000000140)={'syzkaller1\x00', @ifru_addrs={0x2, 0x4e24, @empty}}) io_destroy(r2) r4 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='D'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:28 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000011ff0)=[{&(0x7f00000002c0)="390000001300090665000000000000007f0080400300000046000107000000141900040004800000070000000003000000000000000003f500", 0x39}], 0x1) writev(r0, &(0x7f0000000140)=[{&(0x7f0000371fc7)="390000001300094700bb61e1c30500000700001702000000450000000000800019001a000d00000005de280ff4000000fd17e9ffff06060400", 0x39}], 0x1) 2018/03/02 11:09:28 executing program 2: r0 = syz_open_pts(0xffffffffffffff9c, 0x80) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/policy\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000480)={0x0, 0x0}) ppoll(&(0x7f0000000440)=[{r0, 0x1}, {r1, 0x14}], 0x2, &(0x7f00000004c0)={r2, r3+10000000}, &(0x7f0000000500)={0x3}, 0x8) r4 = syz_open_dev$mice(&(0x7f0000000340)='/dev/input/mice\x00', 0x0, 0x280000) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x61, &(0x7f0000000380)={'filter\x00', 0x4}, 0x68) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x480080, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000240)={0x0, 0x2}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f00000002c0)={r6, 0x8000800000, 0x400, 0xd9f, 0x9dc0, 0x4}, &(0x7f0000000300)=0x14) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_MCAST_JOIN_GROUP(r7, 0x29, 0x2a, &(0x7f0000d6cf78)={0x0, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f0000000100)={0x7f, 0x0, 0x10001, 0x81}) mkdir(&(0x7f0000bdb000)='./file0\x00', 0x0) mount(&(0x7f0000e07000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f00004daffa)='ramfs\x00', 0x2000000, &(0x7f000054d000)) r9 = creat(&(0x7f0000f1dff4)='./file0/bus\x00', 0x0) writev(r9, &(0x7f0000017000)=[{&(0x7f0000b22fda)='y', 0x1}], 0x1) r10 = open(&(0x7f0000002000)='./file0/bus\x00', 0x141042, 0x0) sendfile(r10, r10, &(0x7f0000aef000), 0xffffffff) r11 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x5, 0xc0) ioctl$DRM_IOCTL_CONTROL(r11, 0x40086414, &(0x7f00000001c0)={0x2, 0x20}) ioctl$DRM_IOCTL_AGP_FREE(r7, 0x40106435, &(0x7f0000000140)={0x1, r8, 0x10001, 0x1}) setsockopt$inet6_MCAST_JOIN_GROUP(r7, 0x29, 0x2a, &(0x7f0000000000)={0x1, {{0xa, 0x4e1c, 0x208d, @remote={0xfe, 0x80, [], 0xbb}, 0xc000}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r7, 0x29, 0x2a, &(0x7f0000925f78)={0x0, {{0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x88) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) 2018/03/02 11:09:28 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000ffffff7f00000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:28 executing program 3: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) r1 = socket$bt_l2cap(0x1f, 0x100005, 0x0) setns(r0, 0x4c000000) setsockopt$sock_void(r1, 0x29, 0x0, 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x102, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000140)=""/47) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipx\x00') getsockopt$ax25_buf(r3, 0x101, 0x19, &(0x7f0000000040)=""/10, &(0x7f0000000080)=0xa) ioctl$sock_SIOCGIFCONF(r1, 0x8910, &(0x7f00000000c0)=@req) 2018/03/02 11:09:28 executing program 0: socket$inet(0x2, 0x1, 0x0) 2018/03/02 11:09:28 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000647000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)) [ 119.131740] binder: undelivered TRANSACTION_ERROR: 29189 [ 119.140682] binder: release 16834:16837 transaction 659 out, still active [ 119.147741] binder: undelivered TRANSACTION_COMPLETE [ 119.152952] binder: send failed reply for transaction 659, target dead [ 119.159651] binder: send failed reply for transaction 662, target dead 2018/03/02 11:09:28 executing program 6: r0 = syz_open_dev$sndpcmp(&(0x7f0000000340)='/dev/snd/pcmC#D#p\x00', 0x7f, 0x4000) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000380)={{0xffffffff, 0x2, 0x0, 0x6, 0x2, 0x46cce010}, 0x1}) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x140) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e22, 0x286, @dev={0xfe, 0x80, [], 0x18}, 0x9}}, 0x2, 0x9, 0x8000, 0x4477}, &(0x7f0000000280)=0xa0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000002c0)={0xe2b, 0x8003, 0x3ff, 0x800, r2}, &(0x7f0000000300)=0x10) r4 = socket$inet6(0xa, 0x40000001, 0xfffffffffffffffe) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e23, @rand_addr=0x100000001}}, 0x5, 0x8000, 0xd5, 0x5, 0x9}, &(0x7f00000000c0)=0xa0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000003c0)={r3, 0x3ff}, &(0x7f0000000400)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000100)=@sack_info={r5, 0xf5, 0x7f}, &(0x7f0000000140)=0xc) setsockopt$inet6_buf(r4, 0x29, 0x40000000000041, &(0x7f00000000c0), 0x0) 2018/03/02 11:09:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x77, &(0x7f0000000000)="35813c6a042281527ea5d512bae4f108e1dfb77f7d48a316927fe32c9c40a964ab503ecba0489fa0836957078532141941c0a85bf37d6ca2536d5fe58fd4524f1025f107c9bc3032d9a0017e7a860b582f41e11d3b1ab96e7bad33df75643b4d02493510edf0e3768b4b74a392fe8b8e62c606d08fe4f42c7e9d15", 0x34f) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000001000000000002000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000004d72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x1b0) [ 119.196513] netlink: 'syz-executor5': attribute type 4 has an invalid length. [ 119.221355] binder: 16876:16889 transaction failed 29189/-22, size 40-8 line 2848 [ 119.235167] binder: 16880:16890 got new transaction with bad transaction stack, transaction 666 has target 16880:0 2018/03/02 11:09:28 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000140)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000800000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000700434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000500000000000c000000c9c37ee3085f0000fdffffff000000000000000000000000000000"]}, 0x208) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, &(0x7f0000000080)=0x8) [ 119.245872] binder: 16880:16890 transaction failed 29201/-71, size 0-0 line 2875 [ 119.256050] netlink: 'syz-executor5': attribute type 4 has an invalid length. [ 119.256763] binder_alloc: binder_alloc_mmap_handler: 16880 20ffb000-20ffe000 already mapped failed -16 [ 119.277544] binder: BINDER_SET_CONTEXT_MGR already set 2018/03/02 11:09:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000fde000)={0x13}) 2018/03/02 11:09:28 executing program 6: mkdir(&(0x7f0000024ff6)='./control\x00', 0x0) r0 = open(&(0x7f0000dec000)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000a88ff8)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) fstat(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_mount(&(0x7f0000000080)='./file0\x00', 0x2000, r2, r3, 0x0, 0x20) rename(&(0x7f0000108ff0)='./control/file0\x00', &(0x7f0000530000)='./file1\x00') rename(&(0x7f0000000040)='./file1\x00', &(0x7f00000000c0)='./file0\x00') 2018/03/02 11:09:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x1, 0x0, &(0x7f0000000400)="c4"}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) [ 119.291916] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 119.297867] binder_alloc: 16880: binder_alloc_buf, no vma [ 119.305752] binder: 16876:16903 transaction failed 29189/-3, size 40-8 line 2963 [ 119.308783] binder: 16880:16905 ioctl 40046207 0 returned -16 [ 119.314610] binder_alloc: 16880: binder_alloc_buf, no vma [ 119.325246] binder: 16880:16890 transaction failed 29189/-3, size 40-0 line 2963 [ 119.336692] binder_alloc: 16880: binder_alloc_buf, no vma 2018/03/02 11:09:28 executing program 2: r0 = socket$inet6(0xa, 0x200000002, 0x0) bind$inet6(r0, &(0x7f00005d6fe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f0000584f12)='\x00', 0x1, 0x0, &(0x7f00002fc000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, r0, 0x0) recvfrom$inet6(r0, &(0x7f0000ab0f96)=""/106, 0xe74cd316a7aa36a0, 0x0, 0x0, 0x80) 2018/03/02 11:09:28 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000e00)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000040)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in=@rand_addr, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000000400)=0xe8) r3 = getgid() stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d80)=@broute={'broute\x00', 0x20, 0x7, 0x850, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000500], 0x0, &(0x7f0000000000), &(0x7f0000000500)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x4, 0x60ff, 'ip_vti0\x00', 'vcan0\x00', 'gre0\x00', 'bond0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xf}, [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0x0, 0xff], 0xd0, 0x168, 0x1d8, [@owner={'owner\x00', 0x14, {{r1, r2, r3, r4, 0x6, 0x1}}}, @pkttype={'pkttype\x00', 0x4, {{0x6, 0x1}}}]}, [@common=@nflog={'nflog\x00', 0x4c, {{0x6, 0x0, 0x5a7, 0x0, 0x0, "f6fcfdf357696cc8c44d7ce4e24063cef90dbedf05ee9ed59c958c27dd2bfce0b72a2052ae23c5fbab3a803f1104aac16c0a908cc5594d5e5b552af585f7d385"}}}, @common=@AUDIT={'AUDIT\x00', 0x4, {{0x3}}}]}, @common=@NFLOG={'NFLOG\x00', 0x4c, {{0xfffffffffffffffc, 0x80, 0x0, 0x0, 0x0, "3b8afa36a8edfaa36dd7c78ab543cab7a480a42b0c32447733a8a7d37bf68bf1e7c39419dd0410fc67b27546e6558015fa572a0bf8aa235ab48b9eaba2f53b93"}}}}]}, {0x0, '\x00', 0x1, 0x0, 0x2, [{{{0x5, 0x0, 0xe9ff, 'ip6gre0\x00', 'ip6gre0\x00', 'bridge0\x00', 'sit0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x9c57b012f469f9a0, 0x0, 0x0, 0x0, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0x0, 0x0, 0xff], 0x70, 0x108, 0x130, []}, [@common=@NFLOG={'NFLOG\x00', 0x4c, {{0xda, 0x9, 0x2, 0x0, 0x0, "e91167630e63c56d000fa271692f44b93e1e3b350f9034338113cc446212567eb97817dcd3ad71ea3996bf59a0b1b760161a8c88049686754d0bd4450cf7fbeb"}}}, @common=@AUDIT={'AUDIT\x00', 0x4, {{0x1}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}, {{{0x11, 0x40, 0x0, 'ip6gretap0\x00', 'ip6gretap0\x00', 'ip6_vti0\x00', 'gre0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0xff, 0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0x70, 0x98, 0xc0, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x2}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x2, [{{{0x19, 0x4, 0x0, 'ip_vti0\x00', 'ip6tnl0\x00', 'bond0\x00', 'rose0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], @empty, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x6}}}}, {{{0x5, 0x10, 0x6, 'syzkaller0\x00', 'ip6tnl0\x00', 'yam0\x00', 'erspan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0xff, 0x0, 0xff, 0xff], 0xc8, 0xc8, 0xf0, [@cpu={'cpu\x00', 0x8, {{0x9}}}, @cpu={'cpu\x00', 0x8, {{0x3}}}]}, []}, @common=@AUDIT={'AUDIT\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x5, 0xfffffffffffffffc, 0x2, [{{{0x3, 0x20, 0x8809, 'vlan0\x00', 'bcsf0\x00', 'syz_tun\x00', 'rose0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0xff, 0x0, 0x0, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0xff, 0x0, 0xff], 0x98, 0xc0, 0xe8, [@pkttype={'pkttype\x00', 0x4, {{0x7}}}]}, [@common=@STANDARD={'\x00', 0x4, {0xffffffffffffffff}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0x1}}}}, {{{0x9, 0x0, 0x805, 'syzkaller1\x00', 'bpq0\x00', 'tunl0\x00', 'yam0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @empty, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], 0xc8, 0x12c, 0x158, [@cgroup0={'cgroup\x00', 0x8, {{0x4, 0x8001}}}, @m802_3={'802_3\x00', 0x8, {{0xae, 0x6, 0x1, 0x4}}}]}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0xfffffffffffffffa, 0x4, 0x100000000}}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x7}}}]}, @common=@mark={'mark\x00', 0x8, {{0xffffffc0, 0xfffffffffffffffc}}}}]}]}, 0x8a0) socket$inet(0x2, 0x5, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 119.342351] binder: 16880:16905 transaction failed 29189/-3, size 0-0 line 2963 2018/03/02 11:09:28 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063404000000000000000000000000000000036431835b9a995d25f094a69990090100000000000008e0000000000000000000028000000000000000200000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01aa5dd05993ffd64a0000000000bef5dfef3df998100000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:28 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() gettid() getpgid(0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000080)) r1 = fcntl$getown(r0, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000100)='c(\t\x00\x00\x00\x00\x00\x00\x00') pread64(r2, &(0x7f00002a0f6c)=""/148, 0x94, 0x0) 2018/03/02 11:09:28 executing program 4: r0 = socket$inet(0x2, 0x2, 0x5) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x400, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x403c5404, &(0x7f0000000040)={{0x0, 0x3, 0x5, 0x0, 0x8}, 0x6422, 0x1}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x2a8, [0x200003c0, 0x0, 0x0, 0x200004e0, 0x20000510], 0x0, &(0x7f000092cff0), &(0x7f00000003c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x4, 0x88f9, 'tunl0\x00', 'ipddp0\x00', 'teql0\x00', 'nr0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x18}, [0x0, 0x0, 0xff, 0xff, 0xff, 0x40ff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0xc0, 0xc0, 0xf0, [@state={'state\x00', 0x4, {{0x4}}}, @state={'state\x00', 0x4, {{0x800}}}]}, []}, @snat={'snat\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x1, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0xfffffffffffffffe, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @empty, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x2f8) [ 119.378900] binder: undelivered TRANSACTION_ERROR: 29189 [ 119.384577] binder: undelivered TRANSACTION_ERROR: 29189 [ 119.405279] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 119.422186] binder: undelivered TRANSACTION_ERROR: 29189 [ 119.427795] binder: undelivered TRANSACTION_ERROR: 29189 [ 119.437312] binder: release 16880:16890 transaction 666 out, still active [ 119.444448] binder: undelivered TRANSACTION_COMPLETE [ 119.449709] binder: undelivered TRANSACTION_ERROR: 29201 [ 119.455209] binder: send failed reply for transaction 666, target dead 2018/03/02 11:09:28 executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x4e20, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYBLOB="400100003f1f5453f3b185c58fa63d98c2c6448666f7f2137aaf1a14d3b7a6895934139fe950b75dce2bae14893580aa0467eaf5a86cea5fe52d1a776f35195e3b39cfc0562818336304d937ff4e0248b75d712751face85546764f98e8ed5e3a290da84ddb75f66a1bfde4d30f164131ffea02efdb0e42c3c77089e80b5f23ddba961f090eb8178893d8c43cd05257376c750a4cf7733a45ff724a048c8235d39e35bf8ad89b54e5f5f453b3bdde2d5c0fa080c58d2acec91122ccae3d304728674b366a307573ef8802543cfa5c4ffe5675ecb819f520f6770515bd8f005fde802b65916b7b57db1fe1444c8ce92624e1255d6f2df2064b4453a3ea4fca6beeb5bbf782a5d873e4f047a27a12342d769b06337226909bb55173e94b57bc4cd8bac0c63e0192501b64027745fe205e4517c02e2bf37814165ac7e8c509a369434b91b37"], &(0x7f0000001080)=0x148) 2018/03/02 11:09:28 executing program 3: perf_event_open(&(0x7f0000772f88)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x3, 0x1, 0xffffffffffff42a4, 0xffffffffffff976d, 0x4}, 0xc) write$eventfd(r0, &(0x7f000025bff8)=0x20000000002, 0x25d) 2018/03/02 11:09:28 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x29c, [0x20000200, 0x0, 0x0, 0x2000036c, 0x2000039c], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000150000005000000000006270713000000000000000000000000079616d300000000000000000000000006782657461703000000000000000000062637366300000000000000000000000000000000000ffffffffff00aaaaaaaaaa1600ff00ffff000000dc0000000c0100003c010000737470000000000000000000000000000000000000000000000000000000000048000000030000007000080005004e4bc986cd07ffff00ff00ff000000000000ef1e103b06000800aaaaaaaaaabb0000ff00ffff4e224e20d6f0b2370200000004000900780b0500000001006172707265706c790000000000000000000000000000000000000000000000000c0000000000000000000000ffffffff646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000fdffffff00000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0000000000000012000000000000000000000000000000000000000000000000000000001d00000001000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c200000000ff000000002a97e74a12af00000000000000007000000070000000a0000000ac8428af25cb8e7d0955736e6174000000000000000000000000000000000000000000000000000000000c000000c9c300"]}, 0x2ec) 2018/03/02 11:09:28 executing program 7: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x2800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f00000002c0)={0x7, 0x40, 0xc, 0x9, 0xff, 0x7f, 0x8, 0x3, 0x0}, &(0x7f0000000300)=0x20) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000100)=r1, 0x4) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000340)=@assoc_id=r1, 0x4) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000380)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad067394fdb280c26e1cba68f27ea7ea283e962054f628d0fd3b9ed9b515614d53827b4e856ddda3a58bfca7955c9acd44ca45d3b2c68e771ad2fb1b206cbe21c207fa15a7935fdbb4bccc744e07057ac52f68288b8a6a5d887c173bd6c12c61b9ad118f83eac4942c6e53f7c8ab8900a02571ffdfdfefff566ff52606b0a523f3398975e03e148647a9133414826774d6ee0d951bc500076877ba39426") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000580)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES64=r2], 0x246, 0x0, &(0x7f0000000040)}) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x80000000) 2018/03/02 11:09:28 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000040)=0x2, 0x4) chown(&(0x7f0000000100)='./file0\x00', 0x0, r2) 2018/03/02 11:09:28 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0xd7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfc80, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000180000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:28 executing program 5: mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x65}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000911000)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000009fe8)={0xaa, 0xe}) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000003000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0xa}) clone(0x0, &(0x7f0000000180), &(0x7f0000000140), &(0x7f0000001000), &(0x7f0000000040)) read(0xffffffffffffffff, &(0x7f0000009f9c)=""/100, 0x64) read(r0, &(0x7f0000910000)=""/100, 0x64) 2018/03/02 11:09:28 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @rand_addr, @remote}, &(0x7f0000000040)=0xc) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:28 executing program 0: r0 = socket$inet(0x2, 0x1, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:28 executing program 2: perf_event_open(&(0x7f0000220000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) eventfd(0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00005f5ffd)='io\x00') ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)) bind$alg(r0, &(0x7f0000466000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r2, r1, &(0x7f0000807000), 0x3f) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0xffff, 0x1}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000180)={r3, 0xfffffffffffffffd}, 0x8) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0106434, &(0x7f00000001c0)={0x100000001, 0x0, 0x1, 0x9}) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40086439, &(0x7f0000000200)={0x80000001, r4}) 2018/03/02 11:09:28 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:28 executing program 6: mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x4, &(0x7f00001d3000/0x1000)=nil) [ 119.557519] binder: 16939:16951 unknown command 20 [ 119.575899] binder: 16939:16951 ioctl c0306201 20000580 returned -22 2018/03/02 11:09:29 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_mreqsrc(r0, 0x0, 0x0, &(0x7f0000000040)={@multicast2, @multicast2, @dev}, &(0x7f0000000080)=0xc) r1 = getpgrp(0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000100)={'icmp\x00'}, &(0x7f0000000140)=0x1e) syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x9, 0x2200) fanotify_init(0x42, 0x141002) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)=r1) socket$inet(0x2, 0xa, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000010000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) r2 = request_key(&(0x7f0000000440)='encrypted\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000004c0)='#\'^mime_typeposix_acl_access}:\\\x00', 0xffffffffffffffff) add_key(&(0x7f0000000180)='cifs.idmap\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000003c0)="691f7d57f7d12f95d45d4cd9eb62926897f897b4c88b8ce61d078c3d494b7e03da932d70889cbd42b220f1f3e6aa265d476f8623d1875d7cd304c99f4508aa3c42b622815306a9ebf984b95cba5606b1183d0ea79ef4343344d0f367ccc5fad605a3c2ac5ab76d2b17aa5ac486abfbaf07696b566f34d1a3ec", 0x79, r2) 2018/03/02 11:09:29 executing program 6: r0 = epoll_create1(0x3ffffe) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000b86ff6)='/dev/cuse\x00', 0x0, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000040)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00005f8ff4)) 2018/03/02 11:09:29 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) socket$inet(0x2, 0xa, 0x3) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 119.624951] binder_alloc: binder_alloc_mmap_handler: 16939 20ffb000-20ffe000 already mapped failed -16 [ 119.680169] binder: BINDER_SET_CONTEXT_MGR already set [ 119.686976] binder: 16939:16987 ioctl 40046207 0 returned -16 [ 119.693314] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 119.704606] binder_alloc: 16939: binder_alloc_buf, no vma [ 119.704611] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 119.705298] binder: 16939:16987 unknown command 24 [ 119.710278] binder: 16939:16951 transaction failed 29189/-3, size 40-0 line 2963 [ 119.725418] binder: 16939:16987 ioctl c0306201 20000580 returned -22 [ 119.753879] bond0 (unregistering): Released all slaves [ 119.768488] binder: undelivered TRANSACTION_ERROR: 29189 [ 119.780068] binder: release 16939:16951 transaction 672 out, still active [ 119.787132] binder: undelivered TRANSACTION_COMPLETE [ 119.792290] binder: send failed reply for transaction 672, target dead [ 120.482786] IPVS: ftp: loaded support on port[0] = 21 [ 120.768471] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 121.196089] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 121.202191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 121.248566] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 121.293112] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 121.299279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 121.306547] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 121.331735] binder: 17153:17154 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:30 executing program 2: mbind(&(0x7f0000c12000/0x3000)=nil, 0x3000, 0x1, &(0x7f0000092000)=0x4, 0xff, 0x2) recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000001200)={&(0x7f0000000000)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @local}}}, 0x3a, &(0x7f0000001180)=[{&(0x7f0000000040)=""/162, 0xa2}, {&(0x7f0000000100)=""/40, 0x28}, {&(0x7f0000000140)=""/35, 0x23}, {&(0x7f0000000180)=""/4096, 0x1000}], 0x4, &(0x7f00000011c0), 0x0, 0xff}, 0x0) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000001240)=0x518, 0x4) 2018/03/02 11:09:30 executing program 3: set_mempolicy(0x4001, &(0x7f000019dff8)=0x40, 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e21, @rand_addr=0x7fffffff}], 0x10) 2018/03/02 11:09:30 executing program 5: r0 = socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = socket$unix(0x1, 0xfefffffffffffffd, 0x0) bind$unix(r1, &(0x7f000000d000)=@abs={0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000a92ff7)='net/unix\x00') sendfile(r0, r2, &(0x7f0000000000)=0x100, 0xff) 2018/03/02 11:09:30 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000040)) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:30 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000440)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000010000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c30ed91652a00000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c200bc830000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffffd2ad49cffc700e9aec3fb237ca7fd20ed740e0444cbc33b41ca813f7d79291aa9f5f2d610e0c3a9420463b230bb14e4e"]}, 0x1e0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={0x80000001, {0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, {0x2, 0x4e23, @empty}, {0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10, 0x0, 0xfffffffffffffffb, 0xfffffffffffffff8, 0x3, &(0x7f0000000080)='eql\x00', 0x1ff, 0x5, 0x5}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000200)={0xae, {0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x2, 0x4e24, @broadcast=0xffffffff}, {0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0x3d2, 0x9, 0x5, 0x3, 0x5, &(0x7f0000000000)='vcan0\x00', 0xe3, 0x3, 0x5}) open$dir(&(0x7f0000000040)='./file0\x00', 0x3a1400, 0x3b) 2018/03/02 11:09:30 executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x0, 0x400000) getsockopt$inet6_dccp_int(r1, 0x21, 0x0, &(0x7f0000000240), &(0x7f0000000280)=0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x1454, 0x200, 0x0, 0x8000, 0x0}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000003c0)={r2, @in={{0x2, 0x4e22, @multicast1=0xe0000001}}}, &(0x7f0000000300)=0x8c) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0x8) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f00000002c0)={0xd004, 0x5002, 0x65, 0x6, 0x9}) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000340)={r3, 0x3, 0x30}, &(0x7f0000000380)=0xc) setsockopt(r0, 0x84, 0x7d, &(0x7f0000000fc8)="b131e939c714c317", 0x8) sendto(r0, &(0x7f0000000000)="230eef3f87495abb717d8233fa2b63035fc24fd92d6c3ce57b6c8eb196096d4c3cd62a1ef06358a79655e0785f8fc10ef8f68eb1f8eba1ba58a7b9f3d8ce9a3e017ba0e9f8143b24a0960aef2e85e3", 0x4f, 0x4000, &(0x7f0000000080)=@nfc_llcp={0x27, 0x1, 0x435, 0x7, 0x4, 0xa6, "39688869f61aece7339394c6894b5d46ccad4da1ed066bdec0f48b9af8b0dfbeaed6c4db1339e0582f90150a274bc90e369bd9ba5f32e299bae66b389ed4f3", 0x3}, 0x58) 2018/03/02 11:09:30 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) shutdown(r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="00bcac00901b00000000004f4a9ecf47c3f9908ebdde81e0b5dc0514c93eabc090b30ad19bf996b9c27a6dba270645dcaa4c772cf64fc5a642b6"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:30 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) rt_sigpending(&(0x7f0000000000), 0x8) [ 121.345247] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.364585] kernel msg: ebtables bug: please report to author: Wrong len argument [ 121.385784] kernel msg: ebtables bug: please report to author: Wrong len argument 2018/03/02 11:09:30 executing program 4: munmap(&(0x7f0000ff9000/0x2000)=nil, 0x2000) r0 = socket$inet(0x2, 0xb, 0x9) readlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/158, 0xfffffffffffffece) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000100)={0x6, r0, 0x1}) ioctl$DRM_IOCTL_GET_STATS(r1, 0x807c6406, &(0x7f0000000140)) 2018/03/02 11:09:30 executing program 0: r0 = socket$inet(0x2, 0x1, 0x4f7) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:30 executing program 6: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000061000/0x1000)=nil, 0x1000, 0xc, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_int(r0, 0x1, 0x3b, &(0x7f000004a000), &(0x7f0000061ffc)=0x4) ioctl$sock_bt(0xffffffffffffffff, 0x10000000dd1a, &(0x7f00000002c0)="e039555b37934700005f648c23670f8592a27839f7ee8e11ae40e1971b9c325773f666ca4065afd49e142947435682d06971daacd045c332b7cf63cb1d417fe701e2a8d3edf21970a65dd037645e49a965d35414d6ba722b9f24e621bef6923ed5f243c5d2c497fe429a381239c1b718004f27830dc69d4a68a593ae9c8943a6a560d51d9b7721c948375d9a97f359bf7c1a800e83873072dfc3ad5a0f83d4aaa272c11cf0") 2018/03/02 11:09:30 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x80045105) write$selinux_context(r0, &(0x7f0000000000)='system_u:object_r:public_content_rw_t:s0\x00', 0x29) 2018/03/02 11:09:30 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x20200, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000040)={0x0, 0xbd, "8bc5618939ccc24c34897b193c9cb5da591dc1f7a8668848702fd95e42e600b0d392a9571b5e397181fc912f4c2458e3a4a1d035b525d8c56f1ea8eec2602929bf4334387aa83ff80659d0d4978eb21b00309449a501bdc508c9da7bd2b00d6e31885229e1c4576389bdbb925f026582ab26296ed2b35161bb9286dd203469a7f5952b50e92c228d964e89d340eb84e460f38aea3a03d8da0c8916d0d6bee8df61c028780cbd66b5bd73a711e7b647c92cee920540bab8c8cbdda3f9bd"}, &(0x7f0000000140)=0xc5) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000180)={r1, 0xbb, "9cbcc9fcee1eef89b574beec8ebc2f55b374a1adebf9d7c6dd63cae327b8dd27033e374b8b6f4ca05182ebe2f1c18e9ac03f81605e227635af9d33beea7678d0c5bfe0fdcca88c6bfed4380c68a2d8a6cc6e5feef5f9977a596d2780e4d3c341a82dc5f9b922e007119ecb3c9a2a55aae1ff277199b40dc5a91208331c053c9dd9af79dcd46ffb3874c5330a616fe32f134ce990f5e8fe6917cf3405849468084d64ec4e821c1a0ba3d823ac05212d91e7313a31ba05158271af92"}, &(0x7f0000000280)=0xc3) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000009000), &(0x7f0000009000)=0x8) 2018/03/02 11:09:30 executing program 4: r0 = socket$inet(0x2, 0x1, 0x800005e6) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000004070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff"]}, 0x208) [ 121.388982] binder: 17159:17167 got new transaction with bad transaction stack, transaction 676 has target 17159:0 [ 121.404124] binder: 17159:17167 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:30 executing program 0: r0 = socket$inet(0x2, 0xfffffffffffffffa, 0x2) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x6}, &(0x7f0000000080)=0x8) r2 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x354, 0x20000) ioctl$LOOP_CLR_FD(r2, 0x4c01) ioctl$KVM_GET_FPU(r2, 0x81a0ae8c, &(0x7f00000009c0)) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={r1, 0x7, 0x5, 0x5}, 0x10) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200000, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc2c45513, &(0x7f0000000500)={{0x0, 0x3, 0x0, 0x7, "920a1053823ee6caeebfb8a9ab84e1733d12ccfd20c42a69c4bd5cf2d1732a52d29b300958e93fd8ea7ba26d", 0x1}, 0x10000, [0xaf, 0x1, 0xeeca, 0xff, 0x8, 0x1, 0x1, 0x50000000, 0x80000000, 0x8, 0xd8a, 0x4, 0x1, 0x200, 0xc49, 0x2c6, 0x80, 0x3, 0x6, 0x6, 0x5, 0x200, 0x3f, 0x7fff, 0x1, 0x559187a0, 0x5, 0x7, 0x20, 0x300, 0xfffffffffffffff9, 0x100, 0xfff, 0x0, 0x7ff, 0x1000, 0x5, 0x10001, 0x7fff, 0x3, 0xfffffffffffffff9, 0x200, 0x9979, 0xe0, 0x7, 0x10001, 0x8, 0x400, 0xc98, 0x1, 0x116, 0x4, 0x7, 0x80000000, 0x3, 0x6, 0x8, 0x7, 0x200, 0x9, 0x8, 0x0, 0x8, 0xffffffff, 0x3, 0x3a, 0x4, 0x9e3e, 0x5, 0x2, 0x1ff, 0x1baf, 0x7, 0x8, 0x800, 0x0, 0x0, 0x0, 0x400, 0x5c, 0x9, 0x4, 0x1, 0xffffffff, 0x9, 0x6, 0x5, 0xfffffffffffff001, 0x3, 0xfffffffffffffffe, 0x84, 0x0, 0x6, 0x2, 0x4, 0x9, 0xfffffffffffffffb, 0x1000, 0xfffffffffffffff9, 0x8, 0x0, 0x8, 0x0, 0x40, 0x10001, 0x80000000, 0xff, 0x1ff, 0x7fffffff, 0x9, 0x6, 0xfffffffffffffff9, 0x101, 0x7fff, 0x8000000, 0x1000, 0x1, 0x7, 0x80, 0x8, 0x100000, 0x7ee9, 0x5, 0xfffffffffffffffc, 0x8, 0x3f, 0x5, 0x2], {r4, r5+30000000}}) ioctl$LOOP_SET_CAPACITY(r3, 0x4c07) fcntl$setflags(r0, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e72300000000000000000000000000074756e6c300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a12af00000000000000007000000070000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff87304f55bc890778444f41b68bec6e02f486f9d006d44f56a16c141e4eff6446492da970c78a6a06aa7a6ce7c9def111e50d6240a65e9a5c5472493c17716baa2ae9041d2943a177baccf2a7988dceb40e4e59c937912a771395d3b0402df2b70dfd7762532dd30ee91c4232ccac01263e243cf691bbf9a94619e29ca7fefae2a0217934478fcb9c955af4673a8d633f19f2b16b8cd39119a8d64c86bca3ff88a29270f32058147800000000000000000000"]}, 0x258) 2018/03/02 11:09:30 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x9, 0x626a, 0x8}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f00000000c0)={r2, 0x0, 0x0, 0x3, 0x200}, &(0x7f0000000100)=0x18) timerfd_create(0x5, 0x800) [ 121.453945] binder: BINDER_SET_CONTEXT_MGR already set [ 121.462062] binder_alloc: binder_alloc_mmap_handler: 17159 20ffb000-20ffe000 already mapped failed -16 [ 121.468917] binder: release 17165:17183 transaction 681 out, still active [ 121.474419] binder_alloc: 17159: binder_alloc_buf, no vma [ 121.478562] binder: unexpected work type, 4, not freed [ 121.478567] binder: undelivered TRANSACTION_COMPLETE [ 121.483134] binder: release 17165:17169 transaction 678 out, still active 2018/03/02 11:09:30 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000e0f000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000075afd0)={0x4c, 0x0, &(0x7f000092b000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000070000000000000000010000000000000000000001000080000000000000000000", @ANYPTR64=&(0x7f0000bd1fb8)=ANY=[], @ANYPTR64=&(0x7f0000a81fe8)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x235, 0x0, &(0x7f000005af7e)}) 2018/03/02 11:09:30 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e25, @multicast1=0xe0000001}, 0xfffffffffffffd08) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000080)={0xf7e1, 0x4, 0x3, 0x2, 0x0}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000100)={0x4, 0x8, 0x204, 0x4, 0x4, 0x8, 0x7f, 0x0, r2}, &(0x7f0000000140)=0x20) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xfffffffffffffff7, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffffbb, 0x20020003, &(0x7f0000385ff0)={0x2, 0x4e21, @loopback=0x7f000001}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2000000000000009, &(0x7f000013fffc), 0x4) 2018/03/02 11:09:30 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000dfffffff00000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000ea597603f2178dc70000000000000000fcffffff01000000050000000000000000006e723000000000000000000000008f16ab21000074756e6c300000000000000000000000697036746e6c300000800000000000006e7230000000000000000000000000000180c20000000000000000002a97e74a1200010007000000000000000000a0000000736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000"]}, 0x1ac) [ 121.484339] binder: 17159:17167 transaction failed 29189/-3, size 40-0 line 2963 [ 121.489525] binder: unexpected work type, 4, not freed [ 121.489530] binder: undelivered TRANSACTION_COMPLETE [ 121.491458] binder: 17159:17189 ioctl 40046207 0 returned -16 [ 121.513889] binder_alloc: 17159: binder_alloc_buf, no vma [ 121.531280] binder: 17196:17198 transaction failed 29189/-3, size 40-8 line 2963 [ 121.551054] binder: BINDER_SET_CONTEXT_MGR already set [ 121.558814] binder: 17200:17203 ioctl 40046207 0 returned -16 [ 121.562160] kernel msg: ebtables bug: please report to author: Wrong len argument [ 121.578586] binder_alloc: 17159: binder_alloc_buf, no vma [ 121.584263] binder: 17200:17211 transaction failed 29189/-3, size 36028797035741184-0 line 2963 [ 121.584268] binder_alloc: 17159: binder_alloc_buf, no vma [ 121.584298] binder: 17196:17205 transaction failed 29189/-3, size 40-8 line 2963 [ 121.611048] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.616857] binder: release 17159:17167 transaction 676 out, still active [ 121.623878] binder: undelivered TRANSACTION_COMPLETE [ 121.629150] binder: undelivered TRANSACTION_ERROR: 29201 [ 121.634677] binder: send failed reply for transaction 676, target dead [ 121.641366] binder: send failed reply for transaction 678, target dead [ 121.648070] binder: send failed reply for transaction 681, target dead 2018/03/02 11:09:31 executing program 6: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000009000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000000c000)={{&(0x7f0000009000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000004000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f000000dfe0)={{&(0x7f0000006000/0x3000)=nil, 0x3000}, 0x1}) fadvise64(r1, 0x2, 0x3, 0x3) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x4000, 0x0) getpeername$ipx(r2, &(0x7f0000000040), &(0x7f0000000080)=0x10) 2018/03/02 11:09:31 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x5965}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000200)={0x6, 0xe3, 0x8000, 0x200, 0xa4, 0x5, 0xdf, 0x282b, r1}, &(0x7f0000000240)=0x20) 2018/03/02 11:09:31 executing program 2: mkdir(&(0x7f0000000000)='./file0/control/file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f00005df000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000001c000)) mkdir(&(0x7f0000914ff0)='./file0/control\x00', 0x0) symlink(&(0x7f0000747000)='./file0\x00', &(0x7f0000000100)='./file0/control/file0\x00') umount2(&(0x7f0000000080)='./file0\x00', 0x0) 2018/03/02 11:09:31 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='@'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB="e99899a78030ae80"]], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000002000)='proclo}\x00', 0x5) lseek(r0, 0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000080)=0x1e) 2018/03/02 11:09:31 executing program 5: openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x0, 0x0) syz_fuseblk_mount(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000001900)='./file0\x00', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$key(0xf, 0x3, 0x2) pipe2(&(0x7f0000001c80), 0x0) signalfd(0xffffffffffffffff, &(0x7f0000001cc0), 0x8) eventfd2(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) syz_fuse_mount(&(0x7f0000002600)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000002a80), 0x8, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) epoll_create(0x9) socket$inet_tcp(0x2, 0x1, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000002d00)='/dev/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f0000002f40)='./file0\x00', 0x100000000000000, 0x0) epoll_create(0x4) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)) memfd_create(&(0x7f0000003b80)='&!ppp1eth0selfsybdev\x00\x00\x00\x00\x00', 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000003cc0)='/proc/self/net/pfkey\x00', 0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000003ec0)='/dev/loop-control\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000003f00)='/dev/hwrng\x00', 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000003f40), 0x8, 0x0) inotify_init1(0x0) pipe2(&(0x7f0000004000), 0x0) openat(0xffffffffffffff9c, &(0x7f0000004100)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f00000041c0), 0x0) pipe2(&(0x7f0000004380), 0x0) syz_open_dev$urandom(&(0x7f0000004500)='/dev/urandom\x00', 0x0, 0x0) pipe(&(0x7f0000004740)) socket$inet6_udp(0xa, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000004780)='/dev/ppp\x00', 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000004a40)='/dev/hwrng\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_open_dev$tun(&(0x7f0000004e00)='/dev/net/tun\x00', 0x0, 0x0) 2018/03/02 11:09:31 executing program 4: r0 = socket$inet(0x2, 0xfffffffffffffffd, 0xffffffffffffffff) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x2002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', @ifru_data=&(0x7f0000000140)="a39cf9217173ca7ef2f054cfa8b4ed0e50088dff843f65487109e671b5fab52f"}) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0x0, 0xfffffffffffffffe], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000080)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) [ 121.654953] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.660492] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.677884] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 121.694485] binder: 17219:17230 transaction failed 29189/-22, size 40-8 line 2848 2018/03/02 11:09:31 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 121.697230] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 121.714006] binder: 17224:17232 got new transaction with bad transaction stack, transaction 691 has target 17224:0 [ 121.724951] binder: 17224:17232 transaction failed 29201/-71, size 0-0 line 2875 [ 121.752715] binder_alloc: binder_alloc_mmap_handler: 17224 20ffb000-20ffe000 already mapped failed -16 [ 121.755536] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.764874] binder: BINDER_SET_CONTEXT_MGR already set [ 121.777558] binder: 17224:17243 ioctl 40046207 0 returned -16 [ 121.786385] binder_alloc: 17224: binder_alloc_buf, no vma [ 121.792120] binder: 17224:17232 transaction failed 29189/-3, size 40-0 line 2963 [ 121.802993] binder_alloc: 17224: binder_alloc_buf, no vma [ 121.808962] binder: 17224:17249 transaction failed 29189/-3, size 0-0 line 2963 [ 121.836224] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.841740] binder: undelivered TRANSACTION_ERROR: 29189 [ 121.847289] binder: release 17224:17232 transaction 691 out, still active 2018/03/02 11:09:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cuse\x00', 0x40000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001200)={0x2c, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x0, 0x1}, @enter_looper={0x630c}, @clear_death={0x400c630f, 0x1, 0x1}, @increfs={0x40046304}], 0x1000, 0x0, &(0x7f0000000200)="e4a9363ddbf72f0d2e8a2a06c38d5bc043a67adfc124b44912425fe8c20c8cd24a3319181fbcb0f7c5211de3f7d32589ebe023e398dc0e3134d7187885d47ca4a6a417a7a85701665728661140489a30c7efe01be801662d816ef002592f9bdd93393ff6017a41f31763cb0b21c8de98d8024e81e047fe04ac315d1b95986183c2c2db89fb7621bdc9d79aba82896e9af1da0f8032f9d2ecbfb0494880e62ee081856fe987f2f91dbd6934b53730abf40001cb6a4e6e9f046146ffe6ffe75b49418b91e6693431b56a43f9af03797c44ceb1b987c89fdf4788abfe96cd0157e67f60b01bbd5dfbd7c82a2c0fe659638463f98514691f09a168dc6264c206f8fe00e48168b08a63e471a41e2a9efb12cf6d3934a31d566204583ec970d787a775efdbb36604435fe18577792fba58be5fdcd7959abd5d898ecd98d8153c87477a70a30d8f5abc6e906a6e5dce0e446bb26335e8ae603a69546ae0a9ef8aed6851cb0e3614950dae2f3268d168b1d924201be57132b41593681ea5e4728f6ac6418a3551f4e4832661259104af21f0e90967499ef09d2e0cef6ab45d3e361e0f2fc8ee04babe197e6de87f229bcc10a618cd2f755b6c4d33c041083da3f3a3d16a2a4c2868d380bbc717134297b6737bd2d6943a294fbb9375db08adc5e0a5741a9eb1b624ee231c80c8d013629ee4411c6b48d5acc700ffcca4ddaf5015d7f0e59e082ea62d1817385219cf54a5784b6dc9c381ce8a539b40ea80785580e893a5293a442703caea9f9720b13278736837de469f80d31e2d082ee082cd7e757d0c24608daad3c2ccce376fe072531280e51f2d0720c648de4d095256a048e261505c9a72c3a5904897df94e76c7de6adabf846edf8384a56c171915194753dac6f5334fe90ef650d588a3c88db46b5f3b222ae19ead0f2b45b393d0a8a839d958fad7ef147489f956317d0c59d86d14ed71ea80aedbc244600dcd9827bca68ed39510c2677d5ad414a240d135f6cd13caa6d78cd08afd18468f9742fd83017f63d94b11e359f71795c4d76c3304e4e4066f4ae32e91ec10fdc3012199449ccc4c2a1db315c9ec01ebc35d993e681c0ccf0e76a737c14cc1d787e5200ce3b01c18df85ba9ea02bc080583e42f7bcffc2c6156e2c10dc6e311724a96b77e33d059e7988f625cddcff5f5335af06826e1fae006aa74f6c9dc6434aa9ad4a2794c1181c9a196b8aa2a2d4ff2277df59c5bb2cf89913d90190894a1d6a904bef4245b9c86abacf23c982bdc39ebc10bed339c8847e9cfbbed78f4daf06251c4638d2f64552f3d73a73f831fca960b18cfef50f8c5962c5182b1f4ff44c1c0508aef231ae655bd9ffa6b547969ae413355ef88081fc23fdb8c68165ff0097fa3c93313c6e0bf6cb18bd632aafafd2350c91a215d8733a1bc64ac61e311aab4fa4e5e7d0854f868f0029c2ef85c52ade5a4efe592f217369da9d2815fc5737c868a532bf73d0fd246fdd093348cc1eab641b7d397223384f9a69532e40e31a910214416ca130d07af30e363d9435ef9556375ecc52f6d3b295ddc9c99d3e2ab054016c799e93550a20fe015b64e7aee791ac4b9da444b6f200b466b18cf6a7dfddd2f00db09ceb8405a04a72cc287dc7d315c5c3ae3262b801069a059bcbbb93f816a40c1e8d493a27eba472c4ad0d4a5d7e4734e915d5004bc858c8c71203754fb3040ad933859d2e1cb49d3932b2d3d36389b1b60d44df6e9512cc60bba43b671015fdb3d1e532e409ac0a09b79e5c658bde53574f9aa3da440316ce80487a7ee5eaacfdb797bea5bf90f79b3d7473bcb9d359cb15fe52515499d0bd1decd784e9129369e188e0c4bea1da66cd9d2e958c6fd986f0a18821781398ca9bb9a1ace38f468484069246b1ff27f5bd162f85e61aa0b7845f625703fbf93ec5cf3422228388ea061c9dae97b99d27266c92cc50d07ae035cb2656e2d5994084e492a7adc52b235ee3571dd144ceefdffe64cfa099156becadb7f246b76f2c27906104d8b44f4c94682084f055fd4b4ac24df217c4b476b5dcb5d7fe2eff2c61e734df1e8653cef2816fb2fead47fb4ef16d4b0adffc93ed0c873da766c1f7d98e9226191d522c60cc6898e152e65b1ccc630ea0e8aa6c50cd940a73575b102ed3e485487213a65b26d517d275ffb03f31d56963e576f6508cbfe9b4ff9543a7327d22befb71cf16effe09069c306ba12122367d79a49f9def31b75614a0eafec7c9c1c6c8ddd58dcbca4584a2c338acc0b6435f0957c9ceafdced0cc02042a0fcbb057dc69ff03e135f9c29f371be59942983207ba2aa6d7fe72ac6bda5e45efed5380f10444bed6a2af360262e656f3058be14e7474e5b9e7dc070ff85a20a70f079111d4a464c67a0c628745b951bccf6a853a507361056fdfe5eb9e32b65fb164f6e815347cbcffdb3e94993e6cb5978e12abc3a9875f4921419a03a4e932edf303b0890998f711227781a22ea759151b7fbdccb948f18cd6f22e6fea206a0c489b2ad0737b58ae58fbef61bf82d692162cc7d6b397b6b62ad609b4d11c3b481887d6eceaa7bfdaadc9e5238c7f68b05d0bc60a17f03f64e932bd2fcec1fdc98425c7b3d7674c0d34b53602e68794b2d45a02a102d7021a60e489b614371273fac3dfbf71f517d458c7e046b5db714b974e8d791b5ee9074a4360ab09fab31190295c3e594234e44a5cca11463718d9451a7e8a744fd658b9316f8f0ba1f00dd4c3d6b7bcb54fde52fbfa8e542c829f6e683b1c4de95aebeb4c221b311544fff192bdc8f1d42ae0595a7ebe1199808c7771fe9618902e216e089728a28db5df126a645df897bdd126368d8800a3d07fe8fd950748d47476358dee7465a8ae6963a6c3b196ffcafadcdb52032396444a2dc4e7713cd147b62d3aeae127ddf52484ff9104c6dbaeb1e614aa8968c1320ff8c687a02abb6f33b4233504a025698b12efe1e8d124b7c8f3fe6023e19b882eb393b06d78e4418db5692be804d3c6dc065c7b3c07b5445397884485ba0855680a391b4e257ac01570a8c13481290244768605a96a8a5dca97b40767651b0dd67967c4a5373836505aaba7d8c033b3b5f5b1a85ce2510b7ab0035da319d7ad5543c4595254a7b21dae1ffdfeb863f733f74ad23a202e1f54ae8a843e00cb57dc31f94de76ec9d39c8cc435dc040086d40d69764354ee33dd57716b7d7e959340c161ded843b27f9ad8352fe7a9a7b3d710f9d13a6b0e4e80d9bdd3a8c5227718ee9ef637129b6faae0c87a84b98348a94115da1ceef8d122f4c2d3284ddd74833630c23b8c2524d0f280174e739aae2613a950903821cd92ab36c664acf93b840acfbb9a30c3b18dbb226d4b434ca7d0cadd6323e9d1939988a4caea6adb66dd09ce322fd4bd6c6f29a13d16a1f5516ef0e12505f6e4556ddf55cc4eb4e9da60503c911d9aaaef46fd55e3d52863e492fc401a9c0c84456a0690ae8d6055e5870ff753ab33e46b6c5f3aba71da2c4ba7182284cb476c7c0ae58f66b3d92aaf8f8184c3ee990a3569980f358d39b4dde8068d37a72aa3ae1df957d67c141cd9cbef8bf3ea932b47ec0ec700761f6fa3670398199b8d9290d295d3c483132b4621404b161e23c6fa39ccfbd805bd0a2169abac66e80b3d7bc9055e868b1d3a0fc01b40acf3ad1c1a3f2b8ceb75b603bd87ee9a8dbad349f64a067f0917f2431a9623a8b09864ad98032099ab2b0d5a639f2bcd81519afbbd8d690d2591e18896d595b14fa0f53087c1d37385f2c760ffeadc9bd2f90b826e5283d42aa5d7d4044a3477824fc166180a90155a6c731d75ec4f312562415172e2455d78c471b1919826acae92804d11fad33178b2602731ece48b345a60783803f5a4bf747a309456e03371a9450882edb3a6c3e7dcdc6f2616872d2e79f6d5cd1d9f769ba8468b574fcb336fdf60f408c9a02f96afc7d2cf7c97e7d63b9fa6f8f06c6a1a4dcdc5e62c5dea6d433fb03ff293d17de70b5f3e6c1386374d431aa9c4503ad9d015e75362f994d5b1dfd9088d3b3b8a8ca30e1c29918401e1e0fa72b1960a6a0b49437ee9cc72d06c53e3cf803667b2bfa61b2a90f5e21ba7b32d71c0f341714d8573513d210494ed0aa69e55e492de142a32d8eb70ce3d98c6537b83a79cd3d03ce4351a9ed65e1f2f5360d29b239d4086fa17f38508ba718ef8c34156790766aea27fbc0acc5625f2df2e04b3a9bc1018815b758acf976413e79a9f9e1be38ec6043aba16ba0918cce761a432bb6169cb9e85370639688e9a7561437ff478d1b63cc063a7a4c8d8683dd22201759ffe8dd987976a6740f325cafa99772e90eb954fe1c7d0421abaa70b0632aade45479975dd08b02832d9bf4a95ce5847aba8979be1c230021f4183acb2b8fade738dadfdeee19aa0be795ffcd35f64b74fa7666ffda81c7c172c29cd0939b20d29daaeb047170268ff63fd2579a244b97ade06c85b76a61406e1a1edfa6d99f8ff7b6fef1efda30a10d168d3acfcdb70af1824ea4e1997637b5ab2067f086e1d52d68dc4d2d0a858aaa8167a59e0dbb315e15b1d1ec0a31e6d670992185dec828761c94ecd4d3d5c6751e380493c29448b45a7ee170dc52ac5c8ebd4ba0d2491e3438db1e0d68d10c58c861e6b36cfd893356d15d3fcb956fbcea6a406769eec689646a38bf2880ae6194b4b83309bc6e6508f25ff3346fde88e05209e2b112a8eb71d82336dfc2aa393f2aa01aaf21f5875dbef56117a596d3a5badfd3c923f238717bdb168f05f7b161751ca522e9587ba19044db914097f1f6d68c6748ffa66177936eb958ff2b7b6d321bd75a4cd5af79f94dca40170ab3f133c180c74c1a1863e44346ffcde6249fc4ab14ba772c91563c251179179bbefaa7161e73866fc53274113e09d99455c5424b71612d9289b190cad9f4279c5fd8ce5fb8f478e72bcfc85ad13a2bfc520957b520c9e5dd00cd41b8bef52d14971f881d62dce0859b57880d987db03c28b1c675862aaf8611f27c3cc7eaceb2ff5dfe7f106596d1919308508580474c78ac769e65df0a5521739c65f96bede2fd9f87a4f36d957d7ffd2eb9b8a03de61fb75a0bf3c47f4b855bb583d4a2706426f7a544f33655489231361275c4be2e708afbcf07c300a11dac3d720580db838e354e973ccc7ce941493a09cb82154fca5ea67013da21fe6fc675bfdbcd8aaad5ec2d9546853e914f46c7d9d8dcc33496b89a80b70531f6938211f0665721b20e5f6af03ac291a00771351a3ebb750f21bec7ed1c59e880d63c224e9305cb4c66e295e5e6a233cb3d74c6123af0742dcc32305883f49c26d788458fb5428a9a0670e90e8eb059ed940fcf3192ff963a3b244a47eb19d7e217d9fc69971eb565d75929b6fc77ffcceeee4f99475d75794457039c8cdba6f4f74364e45ac7671dcd11ce0c6d2e077061c6506139df32630135941b6797b649c7eede9f961b4c8a64dd02fade4ce2a3846079b2eca5aed92c98ee58a1f0cf98af738e65de0b246b18eadb5338e6899a1577e4fc9a963f3d2832ed7190f92ad1e233a93d4e3b509e202c58893126731d7047e9ac8fae67b3da009c3834788ab5ef0e3c28e17e73a6ea51886e59eb077a781f5d288f7c4ed323736c1013241b0d4197c600bb8f5376f5f83b2f261c0059f8699aeb97822146b9990e7d302377e33526b2905241fb381f0003b12fd01ea48abbdb8c8f8328af39db1bfdb905eceb33c024d0aaba8b5534e23a58cb6189ad248beb3a6360a30b3b2"}) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000028000000000000000800000000000000aceb85a37c9b85c12dfd29aa3de6849bfcc07151848fbfe9edaef0eb82c640c7234bd46e3e6ca1bf354b269d68314d2812b2fc98d07394768c53af9769515f44269e6acb30a1fb9d5ae2056b665a7da080486863071740c485c974fbab42a1d0cd15842405f097811aa4342018aff72eb1b1f3f240b64474cac39d4c22a211", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627300000000", @ANYPTR64=&(0x7f00004edf8a)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)}) syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1, 0x80402) 2018/03/02 11:09:31 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000a49ff7)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x60}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r2, 0x4008ae48, &(0x7f0000000080)) 2018/03/02 11:09:31 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000004ff4)) recvmmsg(r1, &(0x7f0000003900)=[{{&(0x7f0000000080)=ANY=[@ANYBLOB="0000ffffff0700000000000000000000"], 0x10, &(0x7f0000001440)=[]}}], 0x1, 0x0, &(0x7f00000039c0)={0x77359400}) 2018/03/02 11:09:31 executing program 0: socketpair$inet6(0xa, 0x7, 0x401, &(0x7f0000000040)) socket$inet(0x2, 0x1, 0x0) syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x56cc1b00, 0x8000) 2018/03/02 11:09:31 executing program 3: socketpair(0x4, 0x1, 0x3, &(0x7f0000000000)={0xffffffffffffffff}) r1 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f0000000740)={{0x101, 0x0, 0x7f, 0x5, "b60ef95de714367ae2d7160e3e66a2acd0c2ea99409fe6223c0e13ec6272ebb41af8b54519b79bdf26f045ea", 0x2}, 0x0, 0x0, 0x374, r1, 0x1, 0x2, "ca0ea942f86efbb5e020b82ae59cfc034877af2f44d7d2aa0dd072deda2aded83f2c74d43022fee4e21df60ba5059f262c2c3c8934f40b99fa4095bed82f3171", &(0x7f0000000040)='NFQUEUE\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x20, [], [0x8, 0x0, 0x0, 0x8001]}) r2 = socket$inet(0x2, 0x3, 0x60000000000004) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f00000006c0)=@broute={'broute\x00', 0x20, 0x4, 0x5bc, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000c0], 0x0, &(0x7f0000000080), &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gretap0\x00', 'gre0\x00', 'rose0\x00', 'bcsf0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @random="4bb7efd1b5e6", [], 0xa0, 0x138, 0x160, [@mark_m={'mark_m\x00', 0xc, {{0x0, 0x0, 0x0, 0x2}}}]}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x4}, @common=@nflog={'nflog\x00', 0x4c, {{0x0, 0x0, 0x0, 0x0, 0x0, "f0de785806c7011a0d91eb03f335c00cee226f7b05c1626a8f68e560a774afa7a1c84fef44789f04fba58c394e25c042588048eaaa1b2923fb5116eecae1197f"}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x1, [{{{0x17, 0x0, 0x0, 'ifb0\x00', 'gretap0\x00', 'ip6gretap0\x00', 'vcan0\x00', @random="67a7fba790de", [0x0, 0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x120, 0x190, 0x1cc, [@helper={'helper\x00', 0x24, {{0x0, 'tftp-20000\x00'}}}, @physdev={'physdev\x00', 0x44, {{'rose0\x00', {}, 'syzkaller0\x00'}}}]}, [@common=@nflog={'nflog\x00', 0x4c, {{0x0, 0x0, 0x0, 0x0, 0x0, "072f6d9284bad5349f4e2af3362771a82ab5555711041b6ef9aaecba2d6faa1467f57ebeae745618d2c9493073fcac004de49843d334ea8067c6fe2fc1a181bf"}}}]}, @common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x5, 0x0, 0x0, 'bpq0\x00', 'bcsh0\x00', 'irlan0\x00', 'vcan0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0xe4, 0xe4, 0x120, [@nfacct={'nfacct\x00', 0x24, {{'syz1\x00'}}}, @cgroup0={'cgroup\x00', 0x8}]}, []}, @common=@RATEEST={'RATEEST\x00', 0x18, {{'syz1\x00', 0x0, 0x0, 0x2}}}}, {{{0x17, 0x0, 0x0, 'ip6tnl0\x00', 'vcan0\x00', 'syz_tun\x00', 'ip6gre0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xe0, []}, []}, @common=@nflog={'nflog\x00', 0x4c, {{0x0, 0x0, 0x0, 0x0, 0x0, "433b1a536529e91e870de1c72b1611005ecd2bd8bbbbff4400da8c1c075a4402b948ccfe35291fb70b96a4788856eebbbb86e8c1fa60a7e9b0dfb65c76aa6b40"}}}}]}]}, 0x60c) 2018/03/02 11:09:31 executing program 5: pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) write$selinux_validatetrans(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="737973f4656d5f753a6f626a6563745f723a636f6e736f6c655f6465766963655f743a733020737973742b6d5f753a6f626a656e745f723a7373685f657865635fff3a7330200038202f7573722f7362696e2f6e74706400"], 0x58) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x1c) vmsplice(r1, &(0x7f00004b5fc0)=[{&(0x7f000072f000)}], 0x1, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) dup2(r0, r2) 2018/03/02 11:09:31 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000140), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0xffffff94, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r1, &(0x7f0000000040)="ac230190071905caf36e8aacaa641186552d37e46fd0957e74a2294875085a6dc21820a0994fe5581cbe3fa46ca0e8b9e0428b5d493f3e948580f6e49e70", &(0x7f0000000200)=""/204}, 0x18) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000300)=@req={0xffff, 0x3, 0x80, 0x400}, 0x10) 2018/03/02 11:09:31 executing program 4: r0 = socket$inet(0x2, 0x21, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000080)={0x8a, 0x2, 0x80000001}) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) [ 121.854227] binder: undelivered TRANSACTION_COMPLETE [ 121.859454] binder: undelivered TRANSACTION_ERROR: 29201 [ 121.864923] binder: send failed reply for transaction 691, target dead 2018/03/02 11:09:31 executing program 0: r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xe1d, 0x2000) statx(r0, &(0x7f0000000040)='./file0\x00', 0x1800, 0x10, &(0x7f0000000200)) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) socket$llc(0x1a, 0x1, 0x0) 2018/03/02 11:09:31 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="81081800f01c000000010054409d0954", 0x10) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000300)="790707000000000000608194a10e65ce5540cfdaf000ade1a8ae0fa8729e8ec1411fd4ff4796fc76a7c3f072f9c81100f79fb52e842fe0ba4a4dfbc90875ea5e5d86e1b3a075a4da513897ce8ef80cf6a3f43e7ec72b79000065dabed8f29afced1c81bb3b952de1b13f719753c67d6a216899de730501602b5fe875fd4f767c18", 0x81) [ 121.908295] binder: 17255:17259 transaction failed 29189/-22, size 40-8 line 2848 [ 121.926574] binder: 17260:17266 got new transaction with bad transaction stack, transaction 697 has target 17260:0 [ 121.937294] binder: 17260:17266 transaction failed 29201/-71, size 0-0 line 2875 2018/03/02 11:09:31 executing program 4: r0 = syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0x2000, 0xffffffffffffffff, 0xffffffffffffffff, 0x8001, 0x800) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) getgroups(0x1, &(0x7f00000000c0)=[0xffffffffffffffff]) fgetxattr(r0, &(0x7f00000003c0)=@random={'btrfs.', 'snat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, &(0x7f0000000140)=""/191, 0xbf) fchown(r0, r1, r2) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000980)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000640, 0x0, 0x0, 0x20000670, 0x200006a0], 0x0, &(0x7f000092cff0), &(0x7f0000000640)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', "5e720900000009981eb8000000000012", @link_local={0x1, 0x80, 0xc2}, [0xff, 0x1, 0xff, 0x0, 0x4000000000], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x1], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) 2018/03/02 11:09:31 executing program 6: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'gretap0\x00', @ifru_ivalue=0x9}) r2 = socket(0x15, 0x4, 0x30f4) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000080)=0xe7ac, 0x2b) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e05411, &(0x7f0000a55f5a)=""/166) rt_sigpending(&(0x7f0000000040), 0x8) [ 121.963707] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 121.975421] x_tables: eb_tables: CLASSIFY target: used from hooks BROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 121.989815] binder_alloc: binder_alloc_mmap_handler: 17260 20ffb000-20ffe000 already mapped failed -16 [ 121.994557] binder_alloc: 17260: binder_alloc_buf, no vma [ 122.005067] binder: 17255:17259 transaction failed 29189/-3, size 40-8 line 2963 2018/03/02 11:09:31 executing program 5: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x20000, 0x0) getsockopt$inet_dccp_buf(r0, 0x21, 0x80, &(0x7f00000000c0)=""/132, &(0x7f0000000180)=0x84) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000240), &(0x7f0000000280)=0x4) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getdents64(r0, &(0x7f00000001c0)=""/97, 0x61) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000001000)={0x0, @in6={{0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}}}, 0x98) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000d6cf78)={0x1, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000040)) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000000)) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001000)={{{@in=@rand_addr=0x1000000, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, {{@in=@multicast2=0xe0000002}, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, 0xe8) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000925f78)={0x0, {{0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0xffffffffffffff32) getsockopt$inet6_buf(r1, 0x29, 0x30, &(0x7f0000001000)=""/144, &(0x7f0000001ffc)=0x90) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x1, 0x4) 2018/03/02 11:09:31 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) [ 122.016600] binder: BINDER_SET_CONTEXT_MGR already set [ 122.017857] x_tables: eb_tables: CLASSIFY target: used from hooks BROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 122.022769] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 122.046374] binder_alloc: 17260: binder_alloc_buf, no vma [ 122.052155] binder: 17260:17266 transaction failed 29189/-3, size 40-0 line 2963 2018/03/02 11:09:31 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x8400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000fc3f98)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @adapter}]}) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000e65ff8)={0x0, 0x5}) 2018/03/02 11:09:31 executing program 6: futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000003000), &(0x7f000000c000), 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x50200, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, @in={0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e23, @multicast2=0xe0000002}, @in={0x2, 0x4e24, @loopback=0x7f000001}, @in6={0xa, 0x4e22, 0x41, @dev={0xfe, 0x80, [], 0xa}, 0x401}, @in6={0xa, 0x4e23, 0x3, @loopback={0x0, 0x1}, 0x4}], 0x84) 2018/03/02 11:09:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_destroy(0x0) r0 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:31 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000000)={'HL\x00'}, &(0x7f0000000040)=0x1e) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', "ffffffa03000", 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xc8, 0xf8, []}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4}, @snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x208) 2018/03/02 11:09:31 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000100), &(0x7f00000002c0)=0x4) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x3, 0x360, [0x20000300, 0x0, 0x0, 0x20000530, 0x20000560], 0x0, &(0x7f000092cff0), &(0x7f0000000300)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x11, 0x52, 0x0, 'bridge0\x00', 'ip6tnl0\x00', 'erspan0\x00', 'sit0\x00', @empty, [0x0, 0x0, 0xff, 0x0, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0xff, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0xa0, []}, []}, @arpreply={'arpreply\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x17}, 0xffffffffffffffff}}}}, {{{0x1f, 0xc, 0xf758, 'bcsh0\x00', 'lo\x00', 'bcsf0\x00', 'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2}, [0xff, 0x0, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0x2, 0x0, 0x0, 0xff], 0xd8, 0x130, 0x160, [@cpu={'cpu\x00', 0x8, {{0x8, 0x1}}}, @limit={'limit\x00', 0x18, {{0xffffffff, 0x534a, 0x7, 0x100000000, 0x58, 0xdc}}}]}, [@arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 0xffffffffffffffff}}}, @common=@redirect={'redirect\x00', 0x4, {{0xffffffffffffffff}}}]}, @snat={'snat\x00', 0xc, {{@empty, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x20000000000, 0x0, 0x0, 0x0, 0xff], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x3b0) 2018/03/02 11:09:31 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x80000000000008, &(0x7f00008c3000)=0x6, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x348, @empty, 0x20000000000000}, 0x4734f30230c36c8c) r3 = socket$inet_tcp(0x2, 0x1, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_buf(r3, 0x0, 0x481, &(0x7f0000000040)=""/24, &(0x7f0000000080)=0x2d0) listen(r1, 0x0) sendto$inet6(r0, &(0x7f00004e8000), 0x0, 0x20000001, &(0x7f000007f000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000164000)={0x3ff, 0x3}, 0x8) ioctl$sock_bt_hidp_HIDPCONNDEL(r2, 0x400448c9, &(0x7f00000000c0)={{0x773, 0x4, 0x1, 0x7, 0x3, 0x4}, 0x4}) close(r0) [ 122.065582] binder: 17260:17282 ioctl 40046207 0 returned -16 [ 122.079516] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.085725] binder_alloc: 17260: binder_alloc_buf, no vma [ 122.091475] binder: 17260:17294 transaction failed 29189/-3, size 0-0 line 2963 [ 122.109599] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.147800] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.153389] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.156010] binder_alloc: 17260: binder_alloc_buf, no vma [ 122.164603] binder: 17309:17312 transaction failed 29189/-3, size 40-8 line 2963 [ 122.175828] binder: release 17260:17266 transaction 697 out, still active [ 122.183159] binder: undelivered TRANSACTION_COMPLETE [ 122.188323] binder: undelivered TRANSACTION_ERROR: 29201 2018/03/02 11:09:31 executing program 3: timer_create(0x0, &(0x7f0000000040)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f00000000c0)) perf_event_open(&(0x7f0000012000)={0x2, 0x78, 0xfffffffffffffff5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgrp(0x0) timer_create(0x0, &(0x7f0000b3d000)={0x0, 0x0, 0x0, @tid=r0}, &(0x7f0000a7e000)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000140)=[@in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x4e21, 0xa15, @local={0xfe, 0x80, [], 0xaa}, 0x3f}, @in={0x2, 0x4e22, @rand_addr=0x8}], 0x3c) timer_settime(0x0, 0x0, &(0x7f00002f2000)={{0x0, 0x3}, {0x7ff, 0x4}}, &(0x7f000061b000)) timer_settime(0x0, 0x0, &(0x7f0000d9efe0)={{0x0, 0x989680}}, &(0x7f0000ef9fe0)) 2018/03/02 11:09:31 executing program 7: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x33eed547) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:31 executing program 5: r0 = socket$inet(0x10, 0x3, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f00006f7000)={0xfffffffffffffffc, 0x100000000000000}, &(0x7f0000000080), 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000040)=0xe07, 0x4) sendmsg(r0, &(0x7f000000ffc8)={0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000012000)="260000001a00030207fffd73ffffff18810000000300000003fb8468647ba3a2d188637e57e4", 0x26}], 0x1}, 0x0) 2018/03/02 11:09:31 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x1, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xffffffffffffffff], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) [ 122.193832] binder: send failed reply for transaction 697, target dead [ 122.232139] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.261325] binder: 17322:17327 got new transaction with bad transaction stack, transaction 704 has target 17322:0 [ 122.272078] binder: 17322:17327 transaction failed 29201/-71, size 0-0 line 2875 [ 122.293016] binder_alloc: binder_alloc_mmap_handler: 17322 20ffb000-20ffe000 already mapped failed -16 [ 122.304109] binder: BINDER_SET_CONTEXT_MGR already set [ 122.309446] binder: 17322:17333 ioctl 40046207 0 returned -16 [ 122.316608] binder_alloc: 17322: binder_alloc_buf, no vma [ 122.322444] binder: 17322:17327 transaction failed 29189/-3, size 40-0 line 2963 [ 122.333167] binder_alloc: 17322: binder_alloc_buf, no vma [ 122.338823] binder: 17322:17333 transaction failed 29189/-3, size 0-0 line 2963 2018/03/02 11:09:31 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f000000eff4)={0x10, 0x34000}, 0xc, &(0x7f0000000040)={&(0x7f0000016fe0)={0x20, 0x2a, 0x829, 0x0, 0x0, {0x3}, [@nested={0xc, 0x0, [@typed={0x8, 0x9, @binary}]}]}, 0x20}, 0x1}, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x40000, 0x0) 2018/03/02 11:09:31 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000400)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff010000000500000000000001000100723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000100736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000000000000000000000000000000c000000c9c37ee3085f0000fdffffff8892efa336f7b76b7d"]}, 0x20b) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x2) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000080)=""/144) setsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000040)={0x19, 0x2, 0x1e, 0x100000000}, 0x6) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f0000000140)={0x9, 0x20000000000, 0xfffffffffffffffe, 0x7, 0x7, 0x3}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000180)={0x4, 0xd51, 0x1, 0x7, 0x0, 0x6, 0x6}, 0xc) ioctl$TCSBRKP(r1, 0x5425, 0x0) 2018/03/02 11:09:31 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000200)={{0x2, 0x4e20, @rand_addr}, {0x0, @link_local={0x1, 0x80, 0xc2}}, 0x38, {0x2, 0x4e20, @loopback=0x7f000001}, 'ip6tnl0\x00'}) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000000)={{0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, {0x6, @empty}, 0x20, {0x2, 0x4e23, @multicast2=0xe0000002}, 'vlan0\x00'}) 2018/03/02 11:09:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000040)="2d6c6f70726f638400", 0x3) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000080)={'ip_vti0\x00', @ifru_addrs={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:31 executing program 6: mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0405405, &(0x7f0000000040)={{0x1, 0x1, 0x0, 0x2, 0x5}, 0x6, 0xfffffffffffffb78, 0x100000001}) lsetxattr(&(0x7f0000592000)='./control\x00', &(0x7f0000aff000)=@known='system.posix_acl_default\x00', &(0x7f0000241fee)="02000000000000006f556e657430242d2a00", 0x12, 0x0) 2018/03/02 11:09:31 executing program 7: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000180)="bf0d261d7abc340f619fe25e6c55692ffbf8781b03daa877354b9590ce56b9717054bfb243714e4bf143ca3eb6a871390de98a0994b8e0aa49ca95869ad06739954e8e49c9034fdb280c26c9cba68f27ea7ea283e962055defe3999171d0b2bd264f628d0fd3b9ed9b515614d53827b4e856ddda3a") ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000600), &(0x7f0000000640)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000580)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00@'], 0x0, 0x0, &(0x7f0000000500)}) 2018/03/02 11:09:31 executing program 0: r0 = socket$inet(0x2, 0x7, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x2, 0x160, [0x20000080, 0x0, 0x0, 0x200000b0, 0x200000e0], 0x0, &(0x7f000092cff0), &(0x7f0000000080)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffeffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, []}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x0, 0x0, 'nr0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @link_local={0x1, 0x80, 0xc2}, [], @random="2a97e74a12af", [], 0x70, 0x70, 0xa0, []}, []}, @snat={'snat\x00', 0xc, {{@random="c9c37ee3085f", 0xfffffffffffffffd}}}}]}]}, 0x1b0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2800, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc00c64b5, &(0x7f0000000200)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00000002c0)={r2, @in6={{0xa, 0xfffffffffffffffe, 0xb3, @mcast1={0xff, 0x1, [], 0x1}, 0x951b}}}, 0x8c) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r1, 0x50, &(0x7f0000000380)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000440)=r3, 0x4) 2018/03/02 11:09:31 executing program 3: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x101001, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc004240a, &(0x7f00000000c0)={0x3, 0x0, [0x0, 0x0, 0x0]}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000000)=0x10000, 0x4) [ 122.364467] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.369997] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.375500] binder: release 17322:17327 transaction 704 out, still active [ 122.382468] binder: undelivered TRANSACTION_COMPLETE [ 122.387660] binder: undelivered TRANSACTION_ERROR: 29201 [ 122.393135] binder: send failed reply for transaction 704, target dead 2018/03/02 11:09:31 executing program 5: mkdir(&(0x7f0000b2dff8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000a9eff8)='./file0\x00', &(0x7f00000db000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000e6eff8)='./file0\x00') mknod(&(0x7f00000ac000)='./file0\x00', 0x0, 0x0) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000000b40)=[{{&(0x7f0000000040)=@in={0x0, 0x0, @multicast2}, 0x10, &(0x7f0000000500)=[{&(0x7f0000000080)=""/29, 0x1d}, {&(0x7f00000000c0)=""/117, 0x75}, {&(0x7f0000000140)=""/156, 0x9c}, {&(0x7f0000000200)=""/115, 0x73}, {&(0x7f0000000280)=""/243, 0xf3}, {&(0x7f0000000380)=""/176, 0xb0}, {&(0x7f0000000440)=""/184, 0xb8}], 0x7, 0x0, 0x0, 0x9}, 0x2}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000540)=""/139, 0x8b}, {&(0x7f0000000600)}], 0x2, &(0x7f0000000680)=""/121, 0x79, 0x8}, 0x400}, {{&(0x7f0000000700)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @loopback}}}, 0x32, &(0x7f0000000a80)=[{&(0x7f0000000740)=""/61, 0x3d}, {&(0x7f0000000780)=""/203, 0xcb}, {&(0x7f0000000880)=""/82, 0x52}, {&(0x7f0000000900)=""/218, 0xda}, {&(0x7f0000000a00)=""/81, 0x51}], 0x5, &(0x7f0000000ac0)=""/98, 0x62, 0x4}, 0x4}], 0x3, 0x10000, &(0x7f0000000bc0)={0x0, 0x989680}) link(&(0x7f000062eff8)='./file0\x00', &(0x7f0000882ff6)='./control\x00') [ 122.413734] kernel msg: ebtables bug: please report to author: Wrong len argument [ 122.425237] kernel msg: ebtables bug: please report to author: Wrong len argument [ 122.437809] binder: 17338:17347 transaction failed 29189/-22, size 40-8 line 2848 [ 122.442560] binder: 17346:17352 unknown command 16384 [ 122.453106] binder: 17346:17352 ioctl c0306201 20000580 returned -22 2018/03/02 11:09:31 executing program 2: r0 = socket$inet(0x2, 0x3, 0x20000000084) r1 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x534, 0x10000) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000003c0)={@broadcast, @rand_addr, 0x0}, &(0x7f0000000400)=0xc) sendmsg$nl_route(r1, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)=@mpls_getnetconf={0x24, 0x52, 0x8, 0x70bd2c, 0x25dfdbfe, {0x1c}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x20e8}, @NETCONFA_IFINDEX={0x8, 0x1, r2}]}, 0x24}, 0x1}, 0x4004000) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f0000000280)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'teql0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', r3}) sched_setaffinity(0x0, 0x8, &(0x7f0000588000)=0x75) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) io_setup(0x9, &(0x7f0000000040)=0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) io_getevents(r5, 0x6, 0x6, &(0x7f0000f57f20)=[{}, {}, {}, {}, {}, {}], &(0x7f000014b000)={0x0, r6+10000000}) io_submit(r5, 0x1, &(0x7f0000b52fd8)=[&(0x7f0000594fc0)={0x0, 0x0, 0x0, 0x1, 0x0, r4, &(0x7f0000000040)}]) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_get$uid(0x3, r7) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000002c0)={0x0, 0x10001, 0x2, 0x5}, &(0x7f0000000300)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000340)={r8, 0x0, 0x1, 0x4}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in6=@dev={0xfe, 0x80}, 0x4e20, 0x0, 0x4e20, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x3}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, @in6=@ipv4={[], [0xff, 0xff], @empty}}}, 0xe8) 2018/03/02 11:09:31 executing program 6: r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000d10ffc)=0x3, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0x6, @mcast1={0xff, 0x1, [], 0x1}, 0x6a}, @in6={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}], 0xffffffffffffff91) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000947000)=[@in6={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}], 0x1c) 2018/03/02 11:09:31 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f000018c000)=@nat={'nat\x00', 0x19, 0x1, 0x1b8, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000260], 0x0, &(0x7f000092cff0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff01000000050000000000000000006e723000000000000000000000000000ffffffa0300000000000000000000000697036746e6c300000000000000000006e7230000000000000000000000000000180c2000000000000000000ffffffffffff000000000000000070000000c8000000f8000000434c4153534946590000000000000000000000000000000000000000000000000400000000000000736e6174000000000000000000000000000000000000000000000000000000000c000000ffffffffffff0000ffffffff736e6174000000000000000000000000000000001a679a6004c069e500d9220000000000000000000000000c000000c9"]}, 0x208) r1 = geteuid() ioprio_set$uid(0x3, r1, 0x6) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x759, 0x8, 0x0, 0xfff, 0x0, 0x80000000, 0x1, 0x2, 0x81, 0x40, 0x0, 0x80000000}) [ 122.462400] binder_alloc: binder_alloc_mmap_handler: 17346 20ffb000-20ffe000 already mapped failed -16 2018/03/02 11:09:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001180)={0x3, 0x1, &(0x7f0000000080)=""/13, &(0x7f00000000c0)=""/4096, &(0x7f00000010c0)=""/172}) io_destroy(0x0) r1 = syz_open_dev$binder(&(0x7f0000f5b000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/03/02 11:09:31 executing program 3: r0 = socket$inet6_sctp(0xa, 0x2, 0x84) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000001c0)=@add_del={0x2, &(0x7f0000000200)='bpq0\x00', 0xa85}) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="18000000a92733d361611734fdaa7135db1e1ab4dd9f60d30d66aa56"], &(0x7f0000000040)=0x20) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)={r1}, &(0x7f00001c3ffc)=0x8) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f00000000c0)=0x4) [ 122.505100] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.510397] binder: BINDER_SET_CONTEXT_MGR already set [ 122.522386] binder_alloc: 17346: binder_alloc_buf, no vma [ 122.522619] binder: 17346:17372 ioctl 40046207 0 returned -16 [ 122.528121] binder: 17346:17352 transaction failed 29189/-3, size 40-0 line 2963 [ 122.550192] WARNING: CPU: 1 PID: 17369 at net/bridge/netfilter/ebtables.c:2056 compat_copy_entries+0xcfa/0x1050 [ 122.560679] Kernel panic - not syncing: panic_on_warn set ... [ 122.560679] [ 122.568051] CPU: 1 PID: 17369 Comm: syz-executor4 Not tainted 4.16.0-rc3+ #245 [ 122.573598] binder: undelivered TRANSACTION_ERROR: 29189 [ 122.575402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 122.581421] binder: release 17346:17352 transaction 710 out, still active [ 122.590228] Call Trace: [ 122.590245] dump_stack+0x194/0x24d [ 122.590262] ? arch_local_irq_restore+0x53/0x53 [ 122.590283] ? vsnprintf+0x1ed/0x1900 [ 122.590305] panic+0x1e4/0x41c [ 122.590318] ? refcount_error_report+0x214/0x214 [ 122.597245] binder: undelivered TRANSACTION_COMPLETE [ 122.599786] ? show_regs_print_info+0x18/0x18 [ 122.599812] ? __warn+0x1c1/0x200 [ 122.603444] binder: send failed reply for transaction 710, target dead [ 122.608071] ? compat_copy_entries+0xcfa/0x1050 [ 122.608080] __warn+0x1dc/0x200 [ 122.647246] ? compat_copy_entries+0xcfa/0x1050 [ 122.651897] report_bug+0x211/0x2d0 [ 122.655513] fixup_bug.part.11+0x37/0x80 [ 122.659551] do_error_trap+0x2d7/0x3e0 [ 122.663420] ? wait_for_completion+0x770/0x770 [ 122.667987] ? math_error+0x400/0x400 [ 122.671781] ? module_unload_free+0x5b0/0x5b0 [ 122.676255] ? perf_trace_lock+0x900/0x900 [ 122.680471] ? __alloc_pages_nodemask+0xabe/0xdd0 [ 122.685298] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 122.690125] do_invalid_op+0x1b/0x20 [ 122.693818] invalid_op+0x1b/0x40 [ 122.697248] RIP: 0010:compat_copy_entries+0xcfa/0x1050 [ 122.702497] RSP: 0018:ffff8801d2de77e8 EFLAGS: 00010216 [ 122.707837] RAX: 0000000000010000 RBX: 0000000000000000 RCX: ffffffff851aa9ba [ 122.715083] RDX: 0000000000000548 RSI: ffffc90003b55000 RDI: 0000000000000000 [ 122.722331] RBP: ffff8801d2de7968 R08: 0000000000000000 R09: 0000000000000000 [ 122.729589] R10: ffffffff88613300 R11: 000000000000000c R12: 0000000000000004 [ 122.736837] R13: dffffc0000000000 R14: ffff8801d2de79c8 R15: ffffc900089f01ac [ 122.744102] ? compat_copy_entries+0xcfa/0x1050 [ 122.748758] ? compat_copy_entries+0xcfa/0x1050 [ 122.753434] ? compat_table_info+0x590/0x590 [ 122.757828] ? __might_sleep+0x95/0x190 [ 122.761804] compat_do_replace+0x398/0x7c0 [ 122.766029] ? do_ebt_set_ctl+0x110/0x110 [ 122.770184] ? ns_capable_common+0xcf/0x160 [ 122.774491] compat_do_ebt_set_ctl+0x22a/0x2d0 [ 122.779054] ? compat_do_replace+0x7c0/0x7c0 [ 122.783453] ? mutex_unlock+0xd/0x10 [ 122.787148] ? nf_sockopt_find.constprop.0+0x1a7/0x220 [ 122.792414] compat_nf_setsockopt+0x88/0x130 [ 122.796820] ? compat_do_replace+0x7c0/0x7c0 [ 122.801210] compat_ip_setsockopt+0x8b/0xd0 [ 122.805514] inet_csk_compat_setsockopt+0x95/0x120 [ 122.810417] ? ip_setsockopt+0xa0/0xa0 [ 122.814291] compat_tcp_setsockopt+0x3d/0x70 [ 122.818687] compat_sock_common_setsockopt+0xb2/0x140 [ 122.823853] ? tcp_setsockopt+0xd0/0xd0 [ 122.827810] compat_SyS_setsockopt+0x17c/0x410 [ 122.832367] ? sock_common_setsockopt+0xd0/0xd0 [ 122.837025] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 122.841767] ? do_fast_syscall_32+0x156/0xf9f [ 122.846247] ? scm_detach_fds_compat+0x3c0/0x3c0 [ 122.850983] do_fast_syscall_32+0x3ec/0xf9f [ 122.855284] ? _raw_spin_unlock_irq+0x27/0x70 [ 122.859766] ? do_int80_syscall_32+0x9c0/0x9c0 [ 122.864327] ? _raw_spin_unlock_irq+0x27/0x70 [ 122.868802] ? finish_task_switch+0x1c1/0x7e0 [ 122.873283] ? syscall_return_slowpath+0x2ac/0x550 [ 122.878191] ? prepare_exit_to_usermode+0x350/0x350 [ 122.883189] ? sysret32_from_system_call+0x5/0x3c [ 122.888025] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 122.892857] entry_SYSENTER_compat+0x70/0x7f [ 122.897242] RIP: 0023:0xf7f84c99 [ 122.900582] RSP: 002b:00000000f778009c EFLAGS: 00000286 ORIG_RAX: 000000000000016e [ 122.908269] RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000000000000 [ 122.915518] RDX: 0000000000000080 RSI: 000000002018c000 RDI: 0000000000000208 [ 122.922763] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 122.930014] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 122.937261] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 122.945337] Dumping ftrace buffer: [ 122.949083] (ftrace buffer empty) [ 122.952771] Kernel Offset: disabled [ 122.956377] Rebooting in 86400 seconds..