000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2156.067731] protocol 88fb is buggy, dev hsr_slave_0 [ 2156.072902] protocol 88fb is buggy, dev hsr_slave_1 00:57:19 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0xf401000000000000) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2156.227718] protocol 88fb is buggy, dev hsr_slave_0 [ 2156.232893] protocol 88fb is buggy, dev hsr_slave_1 [ 2156.238162] protocol 88fb is buggy, dev hsr_slave_0 [ 2156.243279] protocol 88fb is buggy, dev hsr_slave_1 00:57:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x2, 0xf) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000080)="24000000010407051dfffd946fa283000a200a0009000100041d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 00:57:20 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x0) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2156.681948] binder: 5568:5574 ERROR: BC_REGISTER_LOOPER called without request [ 2156.765591] binder: 5568:5579 got reply transaction with no transaction stack [ 2156.831027] binder: 5568:5579 transaction failed 29201/-71, size 0-0 line 2762 [ 2156.888758] binder: release 5568:5574 transaction 2385 out, still active [ 2156.895681] binder: undelivered TRANSACTION_COMPLETE [ 2156.964540] binder: release 5568:5574 transaction 2385 in, still active [ 2156.979062] binder: 5568:5581 transaction failed 29189/-22, size 0-0 line 2855 [ 2156.992421] binder: send failed reply for transaction 2385, target dead [ 2157.019027] binder: undelivered TRANSACTION_ERROR: 29201 [ 2157.093529] binder: 5568:5579 got reply transaction with no transaction stack [ 2157.099587] binder: 5568:5574 ERROR: BC_REGISTER_LOOPER called without request 00:57:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB="14bc42000000000000000000000800000900de56b5000000000800000000080008000100000008000500ac14141b080003000100050f01"], 0x1}}, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00ff04462019d9476a25"], 0x1}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000002c0)="b8010000000f01c166b8e2000f00d8b9800000c00f3235004000000f304a0fc75f20c44379608d00000100f22e0f01ca67440ff6143f66ba4000b846c95182ef0f01cf400f01df", 0x47}], 0xaaaaaaaaaaaace6, 0x0, 0x0, 0xeb) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000010000/0x1000)=nil}) openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x74, 0x0, 0x0, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xffffffffffffffe1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @multicast1}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x40) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2157.147592] binder: 5568:5579 transaction failed 29201/-71, size 0-0 line 2762 [ 2157.193758] binder: undelivered TRANSACTION_ERROR: 29189 00:57:20 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r0, 0x0, 0x1f, 0x0, 0x0) 00:57:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4703, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2157.321927] binder: undelivered TRANSACTION_ERROR: 29201 00:57:20 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x2203, 0x0) 00:57:21 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0xffffffff00000000) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2158.147718] protocol 88fb is buggy, dev hsr_slave_0 [ 2158.152862] protocol 88fb is buggy, dev hsr_slave_1 00:57:21 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x4, 0x0, 0x0) 00:57:21 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001f0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) 00:57:21 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x0) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:21 executing program 4: r0 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x3000)=nil}) [ 2158.329414] binder: 5598:5603 ERROR: BC_REGISTER_LOOPER called without request [ 2158.375257] binder: 5598:5608 got reply transaction with no transaction stack [ 2158.458273] binder: 5598:5608 transaction failed 29201/-71, size 0-0 line 2762 [ 2158.510950] binder: release 5598:5608 transaction 2390 out, still active [ 2158.566590] binder: undelivered TRANSACTION_COMPLETE [ 2158.627122] binder: BINDER_SET_CONTEXT_MGR already set [ 2158.693649] binder: 5598:5610 ERROR: BC_REGISTER_LOOPER called without request [ 2158.729115] binder: 5598:5603 ioctl 40046207 0 returned -16 [ 2158.848133] binder: release 5598:5608 transaction 2393 out, still active [ 2158.855087] binder: undelivered TRANSACTION_COMPLETE [ 2158.897795] binder: release 5598:5603 transaction 2390 in, still active [ 2158.927266] binder: send failed reply for transaction 2390, target dead [ 2158.934233] kauditd_printk_skb: 181 callbacks suppressed 00:57:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2158.934249] audit: type=1400 audit(1555635442.373:37985): avc: denied { map } for pid=5612 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2159.015849] binder: undelivered TRANSACTION_ERROR: 29201 [ 2159.031675] binder: send failed reply for transaction 2393, target dead 00:57:22 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x227e, 0x0) [ 2159.082938] audit: type=1400 audit(1555635442.383:37986): avc: denied { map } for pid=5612 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2159.277673] audit: type=1400 audit(1555635442.393:37987): avc: denied { map } for pid=5612 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x2283, 0x0) 00:57:22 executing program 5: bpf$BPF_TASK_FD_QUERY(0x6, &(0x7f0000000600)={0x0, 0xffffffffffffffff, 0x0, 0x1ee, 0x0}, 0x30) [ 2159.436732] audit: type=1400 audit(1555635442.393:37988): avc: denied { map } for pid=5612 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2159.507847] protocol 88fb is buggy, dev hsr_slave_0 [ 2159.512968] protocol 88fb is buggy, dev hsr_slave_1 [ 2159.582007] audit: type=1400 audit(1555635442.463:37989): avc: denied { map } for pid=5617 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2159.731950] audit: type=1400 audit(1555635442.483:37990): avc: denied { map } for pid=5617 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:23 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x0) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2159.883879] audit: type=1400 audit(1555635442.483:37991): avc: denied { map } for pid=5612 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:23 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x448003, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000080), &(0x7f0000000100)=0x40) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x1a, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0c6300000d630000076304400100000004630440020000000b63"], 0x0, 0x0, 0x0}) [ 2160.018747] binder: 5629:5632 transaction failed 29189/-22, size 0-0 line 2855 [ 2160.029697] audit: type=1400 audit(1555635442.493:37992): avc: denied { map } for pid=5617 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:23 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='projid_map\x00') write$P9_RSETATTR(r0, 0x0, 0x0) [ 2160.127988] binder: undelivered TRANSACTION_ERROR: 29189 [ 2160.150310] binder: 5629:5632 transaction failed 29189/-22, size 0-0 line 2855 [ 2160.194542] audit: type=1400 audit(1555635442.503:37993): avc: denied { map } for pid=5612 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2160.228045] binder: undelivered TRANSACTION_ERROR: 29189 00:57:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2160.417752] audit: type=1400 audit(1555635442.503:37994): avc: denied { map } for pid=5617 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000080)={0x0, 0xfffffffffffffffe}) 00:57:24 executing program 4: creat(0x0, 0x0) epoll_create(0x4) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x800005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x10, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) [ 2161.141073] binder: 5647:5655 ERROR: BC_REGISTER_LOOPER called without request 00:57:24 executing program 5: capset(0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r0, 0x0, 0x1f, 0x0, 0x0) [ 2161.218090] binder: 5647:5660 got reply transaction with no transaction stack [ 2161.258601] binder: 5647:5660 transaction failed 29201/-71, size 0-0 line 2762 [ 2161.290673] binder: release 5647:5655 transaction 2397 out, still active [ 2161.302332] binder: undelivered TRANSACTION_COMPLETE [ 2161.354389] binder: release 5647:5655 transaction 2397 in, still active [ 2161.367137] binder: send failed reply for transaction 2397, target dead [ 2161.406901] binder: undelivered TRANSACTION_ERROR: 29201 [ 2161.416805] binder: 5647:5655 ERROR: BC_REGISTER_LOOPER called without request [ 2161.525977] binder: 5647:5664 got reply transaction with no transaction stack 00:57:25 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x0, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2161.611586] binder: release 5647:5660 transaction 2400 out, still active [ 2161.627740] binder: undelivered TRANSACTION_COMPLETE [ 2161.640428] binder: 5647:5664 transaction failed 29201/-71, size 0-0 line 2762 00:57:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x2201, 0x0) 00:57:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2161.801226] binder: release 5647:5655 transaction 2400 in, still active [ 2161.827671] binder: send failed reply for transaction 2400, target dead 00:57:25 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x20000000000076, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000040)='team_slave_0\x00') write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2161.862744] binder: undelivered TRANSACTION_ERROR: 29201 00:57:25 executing program 4: syz_mount_image$ntfs(&(0x7f0000000380)='ntfs\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 00:57:25 executing program 5: r0 = syz_open_dev$vbi(&(0x7f00000010c0)='/dev/vbi#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000001140)={0x0, 0x0, 0x0, [], 0x0}) [ 2162.307741] protocol 88fb is buggy, dev hsr_slave_0 [ 2162.312867] protocol 88fb is buggy, dev hsr_slave_1 [ 2162.467753] protocol 88fb is buggy, dev hsr_slave_0 [ 2162.472887] protocol 88fb is buggy, dev hsr_slave_1 [ 2162.478090] protocol 88fb is buggy, dev hsr_slave_0 [ 2162.483186] protocol 88fb is buggy, dev hsr_slave_1 00:57:26 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x2289, 0x0) [ 2162.802414] binder: 5680:5684 ERROR: BC_REGISTER_LOOPER called without request [ 2162.860140] binder: 5680:5691 got reply transaction with no transaction stack 00:57:26 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x0, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f00000006c0)) sendfile(r0, r0, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@v2={0x5, 0x0, 0x8, 0x4}, 0xa, 0x3) mount(0x0, 0x0, 0x0, 0x100004, 0x0) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) [ 2162.917915] binder: 5680:5691 transaction failed 29201/-71, size 0-0 line 2762 [ 2162.956289] binder: release 5680:5684 transaction 2403 out, still active 00:57:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x2203, 0x0) [ 2162.974510] binder: undelivered TRANSACTION_COMPLETE [ 2163.128763] binder: BINDER_SET_CONTEXT_MGR already set [ 2163.167228] binder: 5680:5691 got reply transaction with no transaction stack [ 2163.189750] binder: 5680:5684 ERROR: BC_REGISTER_LOOPER called without request [ 2163.216333] binder: release 5680:5695 transaction 2405 out, still active [ 2163.230420] binder: undelivered TRANSACTION_COMPLETE [ 2163.231819] binder: 5680:5691 transaction failed 29201/-71, size 0-0 line 2762 [ 2163.298536] binder: 5680:5694 ioctl 40046207 0 returned -16 [ 2163.352583] binder: undelivered TRANSACTION_ERROR: 29201 00:57:26 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x227f, 0x0) 00:57:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2163.456249] binder: release 5680:5684 transaction 2403 in, still active [ 2163.469456] binder: send failed reply for transaction 2403, target dead [ 2163.507915] binder: undelivered TRANSACTION_ERROR: 29201 [ 2163.513434] binder: send failed reply for transaction 2405, target dead [ 2163.667802] protocol 88fb is buggy, dev hsr_slave_0 [ 2163.672975] protocol 88fb is buggy, dev hsr_slave_1 00:57:27 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) ioctl$sock_ifreq(r1, 0x89b7, &(0x7f0000000080)={'veth0_to_bond\x00', @ifru_hwaddr=@random="5af33749322b"}) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x3f, 0x82) write$UHID_INPUT2(r2, &(0x7f0000000280)={0xc, 0x97, "6aaca7074519dd911de146291490d6f148205678fdc852ac37a315c5ce7fce8397e643476aea495771230b8fd763664747fa7441e9a54df78d5ab1f0fd7d7a696252020025ce8301dde8f110998153e4a93fe24d238d66a4ced9fbaf7d9dc7e6eec87ebf537d5951839e091448094262e8d5500193f7be29a7fc7fafe36982c3fe9cb5a241a135324663ee37f49197149cae7f08a0450e"}, 0x9d) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:27 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 00:57:27 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x401) write$FUSE_WRITE(r0, &(0x7f0000000140)={0x18}, 0x18) [ 2163.974417] kauditd_printk_skb: 174 callbacks suppressed [ 2163.974433] audit: type=1400 audit(1555635447.423:38169): avc: denied { map } for pid=5714 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2164.174698] audit: type=1400 audit(1555635447.423:38170): avc: denied { map } for pid=5714 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2164.364812] audit: type=1400 audit(1555635447.473:38171): avc: denied { map } for pid=5714 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x2287, 0x0) [ 2164.522874] binder: 5715:5719 ERROR: BC_REGISTER_LOOPER called without request [ 2164.543429] audit: type=1400 audit(1555635447.533:38172): avc: denied { map } for pid=5714 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2164.642446] binder: 5715:5724 got reply transaction with no transaction stack [ 2164.697835] binder: 5715:5724 transaction failed 29201/-71, size 0-0 line 2762 [ 2164.727948] audit: type=1400 audit(1555635447.603:38173): avc: denied { map } for pid=5714 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2164.761533] binder: release 5715:5719 transaction 2408 out, still active [ 2164.775752] binder: undelivered TRANSACTION_COMPLETE [ 2164.828348] binder: release 5715:5719 transaction 2408 in, still active [ 2164.841807] audit: type=1400 audit(1555635447.613:38174): avc: denied { map } for pid=5714 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2164.842860] binder: send failed reply for transaction 2408, target dead [ 2164.903403] binder: 5715:5719 got reply transaction with no transaction stack [ 2164.957425] binder: 5715:5728 ERROR: BC_REGISTER_LOOPER called without request [ 2164.984794] audit: type=1400 audit(1555635447.653:38175): avc: denied { map } for pid=5716 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2165.016087] binder: 5715:5719 transaction failed 29201/-71, size 0-0 line 2762 [ 2165.027451] binder: undelivered TRANSACTION_ERROR: 29201 [ 2165.051239] binder: release 5715:5724 transaction 2412 out, still active [ 2165.086881] binder: undelivered TRANSACTION_COMPLETE [ 2165.139156] audit: type=1400 audit(1555635447.653:38176): avc: denied { map } for pid=5716 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:28 executing program 5: openat$null(0xffffffffffffff9c, 0x0, 0x20000000001, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) r0 = syz_open_dev$sndseq(&(0x7f0000000600)='/dev/snd/seq\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\xff\xff\xff\xff\xef\x00\x00\x03\xff\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc3, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x406, 0x0) dup2(r0, r1) 00:57:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2165.183551] binder: undelivered TRANSACTION_ERROR: 29201 [ 2165.189532] binder: release 5715:5728 transaction 2412 in, still active [ 2165.222380] binder: send failed reply for transaction 2412, target dead [ 2165.277757] audit: type=1400 audit(1555635447.693:38177): avc: denied { map } for pid=5716 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2165.384898] audit: type=1400 audit(1555635447.713:38178): avc: denied { map } for pid=5716 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:29 executing program 0: r0 = gettid() pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f00000000c0)=""/168) fstat(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) tkill(r0, 0x1000000000016) 00:57:29 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x0, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:29 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) signalfd(r1, &(0x7f0000000040)={0x6a1}, 0x8) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2166.054558] binder: 5740:5744 ERROR: BC_REGISTER_LOOPER called without request 00:57:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x227d, 0x0) [ 2166.132937] binder: 5740:5750 got reply transaction with no transaction stack [ 2166.179296] binder: 5740:5750 transaction failed 29201/-71, size 0-0 line 2762 [ 2166.240823] binder: release 5740:5744 transaction 2414 out, still active [ 2166.265864] binder: undelivered TRANSACTION_COMPLETE [ 2166.357385] binder: BINDER_SET_CONTEXT_MGR already set [ 2166.419721] binder: 5740:5744 ioctl 40046207 0 returned -16 [ 2166.465936] binder: release 5740:5744 transaction 2414 in, still active [ 2166.468790] binder: 5740:5753 transaction failed 29189/-22, size 0-0 line 2855 [ 2166.473658] binder: 5740:5756 ERROR: BC_REGISTER_LOOPER called without request [ 2166.490086] binder: send failed reply for transaction 2414, target dead [ 2166.496980] binder: undelivered TRANSACTION_ERROR: 29201 00:57:30 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x11}) [ 2166.689013] binder: undelivered TRANSACTION_ERROR: 29189 [ 2166.696719] binder: 5740:5757 got reply transaction with no transaction stack 00:57:30 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_DROP_MASTER(r0, 0x641f) r1 = add_key$user(0x0, 0x0, &(0x7f0000000380), 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'e \x00\b\x00', 0x2}, 0x18) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r1}, 0x0, 0x0, 0x0) r2 = socket(0xa, 0x1, 0x0) ioctl(r2, 0x8916, &(0x7f0000000000)) ioctl(r2, 0x8936, &(0x7f0000000000)) getpgid(0xffffffffffffffff) [ 2166.737875] binder: 5740:5757 transaction failed 29201/-71, size 0-0 line 2762 00:57:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2166.861973] binder: undelivered TRANSACTION_ERROR: 29201 00:57:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=""/71, 0x47}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/netlink\x00') preadv(r0, &(0x7f00000017c0), 0x1be, 0x0) 00:57:31 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x0, 0x0) sendto$inet(r0, &(0x7f0000000280)="a7c9647a924c0f2c80cbe5237073c4b6aa856f1bbe8e3e54ff09c4382a1be856bbd2019755bf84c5c92d38b35e2f900f727161e9642bb0f28daf280d95e1eda1c2b17e04f7149ace2b6f9e53dd50465d44517cd0daa4cdd1086e2757f3932eb305e0a52d3b9dfcc857d0c69de5195f3e1ad122794376424e13ec477adab6167e1fafbb8aa44e", 0x86, 0x40000, &(0x7f00000001c0)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) timerfd_settime(r2, 0x1, &(0x7f0000000200)={{}, {0x0, 0x989680}}, &(0x7f0000000340)) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000140)={@empty, 0xa, r3}) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0xfffffffffffffe23) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:31 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000000400)={0x7b}) [ 2167.789324] binder: 5774:5780 ERROR: BC_REGISTER_LOOPER called without request 00:57:31 executing program 4: openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$P9_RAUTH(0xffffffffffffffff, 0x0, 0x165) r0 = gettid() epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getresgid(0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) alarm(0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) tkill(r0, 0x1000000000016) [ 2167.919497] binder: 5774:5784 got reply transaction with no transaction stack [ 2168.023639] binder: 5774:5784 transaction failed 29201/-71, size 0-0 line 2762 00:57:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x2276, 0x0) 00:57:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2168.392443] binder: release 5774:5780 transaction 2419 out, still active [ 2168.447939] binder: undelivered TRANSACTION_COMPLETE [ 2168.488086] binder: release 5774:5780 transaction 2419 in, still active [ 2168.536432] binder: send failed reply for transaction 2419, target dead [ 2168.591334] binder: undelivered TRANSACTION_ERROR: 29201 00:57:32 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x0, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:32 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm-control\x00', 0x204080, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000200)={0x138a, 0x8, 0x1, 0xffffffffffffff9c}) futex(&(0x7f0000000040)=0x1, 0x0, 0x0, &(0x7f0000000100)={r2, r3+10000000}, &(0x7f0000000140), 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x227f, 0x0) 00:57:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000000400)={0x7b}) [ 2168.978274] kauditd_printk_skb: 132 callbacks suppressed [ 2168.978289] audit: type=1400 audit(1555635452.363:38311): avc: denied { map } for pid=5796 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2169.146876] audit: type=1400 audit(1555635452.433:38312): avc: denied { map } for pid=5796 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2169.339127] audit: type=1400 audit(1555635452.433:38313): avc: denied { map } for pid=5796 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:32 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(r0) r2 = accept$alg(r1, 0x0, 0x0) shutdown(r2, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x200, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x40000000) r4 = socket(0x11, 0x802, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f00000000c0)={0x0, 0x0, 0xfffffffffffffffc, 0x9c, 0x101}, 0x14) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$nl_netfilter(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1220}, 0xc, &(0x7f0000000080)={&(0x7f0000000180)={0xb4, 0xc, 0xf, 0x10, 0x70bd25, 0x25dfdbff, {0xf, 0x0, 0x9}, [@generic="170f34756e41e31b5678a6834dff145101967799e07985a5db4cd2ba481195da86e21da520f7477a7d3114cd1ebde9c77124b41980b2ba3f9100975316fa3bbac6cce34abfcff953e6d9af3bff4498f168a742349ff000f56e6c934fda5f6e384374c9c1173b5e12013c8677db88fa7925811481345434e1a8b1e016daa07b3d6d9ab11caa661c10fadf07b225731bc376b14606c759f7e8f9f28ecbc6"]}, 0xb4}, 0x1, 0x0, 0x0, 0x11}, 0xc080) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x10) [ 2169.471439] binder_alloc: 5803: binder_alloc_buf, no vma [ 2169.527807] binder: 5803:5806 transaction failed 29189/-3, size 0-0 line 2970 [ 2169.529782] binder: 5803:5809 ERROR: BC_REGISTER_LOOPER called without request [ 2169.561097] audit: type=1400 audit(1555635452.493:38314): avc: denied { map } for pid=5796 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2169.690389] binder: 5803:5806 got reply transaction with no transaction stack [ 2169.710844] audit: type=1400 audit(1555635452.493:38315): avc: denied { map } for pid=5796 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:33 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-control\x00', 0x82402, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f00000001c0)={0x7, 0x0, 0x4, 0xffffffff, 0x3ff, 0x4}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2169.854587] binder: 5803:5806 transaction failed 29201/-71, size 0-0 line 2762 [ 2169.898100] audit: type=1400 audit(1555635452.593:38316): avc: denied { map } for pid=5796 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2169.922608] protocol 88fb is buggy, dev hsr_slave_0 [ 2169.922659] protocol 88fb is buggy, dev hsr_slave_1 [ 2170.029992] binder: undelivered TRANSACTION_ERROR: 29189 [ 2170.043445] binder: undelivered TRANSACTION_ERROR: 29201 00:57:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x5382, 0x0) [ 2170.098523] binder: 5803:5806 transaction failed 29189/-22, size 0-0 line 2855 [ 2170.124226] audit: type=1400 audit(1555635452.593:38317): avc: denied { map } for pid=5796 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2170.175183] binder: 5803:5809 got reply transaction with no transaction stack [ 2170.219209] binder: undelivered TRANSACTION_ERROR: 29189 [ 2170.227060] binder: 5803:5806 ERROR: BC_REGISTER_LOOPER called without request 00:57:33 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$9p(r0, 0x0, 0x0) [ 2170.269115] audit: type=1400 audit(1555635452.673:38318): avc: denied { map } for pid=5804 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2170.273020] binder: 5803:5809 transaction failed 29201/-71, size 0-0 line 2762 [ 2170.404909] audit: type=1400 audit(1555635452.673:38319): avc: denied { map } for pid=5804 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2170.440320] binder: undelivered TRANSACTION_ERROR: 29201 00:57:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x8004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2170.528788] audit: type=1400 audit(1555635452.723:38320): avc: denied { map } for pid=5804 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2170.789908] device team0 entered promiscuous mode [ 2170.848850] device team_slave_0 entered promiscuous mode [ 2170.898404] device team_slave_1 entered promiscuous mode [ 2170.991459] device team0 left promiscuous mode [ 2170.996739] device team_slave_0 left promiscuous mode [ 2171.018127] device team_slave_1 left promiscuous mode 00:57:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x227b, 0x0) [ 2171.509492] binder: 5839:5843 ERROR: BC_REGISTER_LOOPER called without request [ 2171.583129] binder: 5839:5845 got reply transaction with no transaction stack 00:57:35 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x0, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2171.652588] binder: 5839:5845 transaction failed 29201/-71, size 0-0 line 2762 00:57:35 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x100000000, 0x0, 0xfffffffffffffdb0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x7, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080), &(0x7f0000000100)=0x14) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000000900)={"daef6a20dcf90bfa356d6e0b6185cdab8a05502eea6181572b471b1843f1dce73d0a4416d8fb669fb0434564523c92bf6f03ad5cac4917401a312123dc5cfe885497f54d52924694ee6b07f86bd69fe9243d209efd0ae9910f0153470f9b35d087cd8a9fde285d994deb569a7ab87932b088d2aafa84acea6fd6c57f132b5e86c0adf4faab4190108c3b8d4710e2ee371b2ce821806491708da59bb9c6fe69f2c8230856439de2a52a225b5964af032b9b41e141790468da2bc8c05a1a03124ae1a72d4cf6974afc61ec6ceed8eee66e7676ebd10b8282e88d41dc5b678d34e32c6ac97c040a55c4b1f569b99014d0ce7d19ae31596fa4b5ce1f47a2f9d3246dec5968a6b23b87557757a1a064685cf925abf7d84834ed9f29e9724fb08fc16aa7525c21f587479bb76a61ed3abc3453298c1d305d53d61cb62e62f41fdde1e02d042b03e383f2f2f1f9b45b6ff2d4051c25735b618e9e0c07791da95c939da79c9d84407e1f03e948390d50925fc5a4661e9ee5c06f8f7727d4a236bce4ffc73fe03a0fa3d3b2496286ae2e05418bbf33dad490cd7aef9b569ad86f2aa0a7995223a0b246b92aa1de710509d0480667dc3e897088d32cfa249c4879d478a4bc0c8ac473767df959a0d5460e60b0b21012660f910c184414561b07bb340ce43064543ee39b1c21a17c63707f765b97210d5cd79aef569b4511234b064083d426434e62b4de49d0e6ce5fd6d022f7a6a0196d6bdb803bd8bc16e0c074c944a07ee5edf2413014d9d8c0b24e682dd438666af61eb4178aa82d93ff998c58de895b73abbd7f3f313454a1a6a83221782f6c1d641813ade8b4ec4f40e04cddc44baef487464f556c89d47a75857f2f293f28acedcb6fa2ff772f30635250416f4602aeaa3477e0270e3fba6d39f5734fa36ecbec3de759bb13cd7b84aa8a8b04c9e05629272723140edd065e924345ca89cbd772c29ebd304a3aa232b914a505188d3566dd6898e56d7ae67b37c2324dab5544df34bef72368683065545a39bf3772be0660bbd39c29d150e463179e2343ff5c4c76be482d8caf47171d377de04e5f4416b31b37d2fcc6676d7cb0b544ae6f682590dcb84723fcaf8ebaf0d33442874746b96272cb373aa882cf9863b0b216f5d0bffdc4b3fd671a9d0eb6f561b765d1337222bf6c4e5a23fdb92aa128ad077522dc16eee4e70274e848a10546e51bc6850aca4f343e2b44f1e145b43abe715aec608e84420bb2bdedc4350ff093e77b090ec0f6e99b2f9992508d0d76c2708eccda92cab643c46e1d6259d35530d073f6f0206a4bae05c630df1a7d5f0ae606c98589b5c22015572307eed7e37126685cb340bec1199373b0834b746aa97eabd34c9ed7285d954f88b2f3a73215ea367feed892aa6dcaefdf935a9bc57e6a4d93972d35c237806b28538db846bd95"}) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2171.855070] binder: release 5839:5843 transaction 2427 out, still active [ 2171.889576] binder: undelivered TRANSACTION_COMPLETE 00:57:35 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='lo\x00\x00\x00\x00\xdf\xff\xff\xff\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080), 0x10) [ 2171.919254] binder: release 5839:5843 transaction 2429 out, still active [ 2171.926143] binder: undelivered TRANSACTION_COMPLETE 00:57:35 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) perf_event_open(&(0x7f000001d000)={0x8000000000001, 0x118, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fe, 0x0, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000000c0), 0x4) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0xc0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r2) 00:57:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xe400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2171.984656] binder: release 5839:5843 transaction 2427 in, still active [ 2172.030080] binder: send failed reply for transaction 2427, target dead [ 2172.036914] binder: undelivered TRANSACTION_ERROR: 29201 [ 2172.107689] binder: send failed reply for transaction 2429, target dead 00:57:35 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, 0x0, 0x0) [ 2172.707723] protocol 88fb is buggy, dev hsr_slave_0 [ 2172.712886] protocol 88fb is buggy, dev hsr_slave_1 [ 2172.756658] binder: 5853:5859 ERROR: BC_REGISTER_LOOPER called without request 00:57:36 executing program 4: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x7fff) [ 2172.848015] binder: 5853:5868 got reply transaction with no transaction stack [ 2172.867710] protocol 88fb is buggy, dev hsr_slave_0 [ 2172.872902] protocol 88fb is buggy, dev hsr_slave_1 [ 2172.878245] protocol 88fb is buggy, dev hsr_slave_0 [ 2172.883341] protocol 88fb is buggy, dev hsr_slave_1 [ 2172.967812] binder: 5853:5868 transaction failed 29201/-71, size 0-0 line 2762 [ 2173.023797] binder: release 5853:5859 transaction 2431 out, still active [ 2173.035524] binder: undelivered TRANSACTION_COMPLETE 00:57:36 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80800) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='veth0\x00', 0x10) syz_open_dev$dri(0x0, 0x3, 0x0) r1 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r1, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) sendmmsg$inet_sctp(r1, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x34) ioctl(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r2 = creat(&(0x7f0000000300)='./file0\x00', 0x50) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000340), &(0x7f0000000380)=0x4) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x200000, 0x0) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f00000002c0)={0x1, &(0x7f0000000280)=[{}]}) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000080)) ioctl$UI_BEGIN_FF_UPLOAD(0xffffffffffffffff, 0xc06855c8, &(0x7f0000000180)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble}}) [ 2173.154919] binder: 5853:5868 got reply transaction with no transaction stack [ 2173.154999] binder: 5853:5859 ERROR: BC_REGISTER_LOOPER called without request 00:57:36 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/igmp6\x00') preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000000c0)=""/52, 0x34}, {&(0x7f0000000240)=""/242, 0xf2}], 0x2, 0x0) [ 2173.292944] binder: release 5853:5875 transaction 2433 out, still active [ 2173.300766] binder: 5853:5868 transaction failed 29201/-71, size 0-0 line 2762 [ 2173.319330] binder: undelivered TRANSACTION_COMPLETE [ 2173.357741] binder: undelivered TRANSACTION_ERROR: 29201 00:57:36 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x40, 0x0) ioctl$VT_RELDISP(r2, 0x5605) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000040)={r1, 0x0, 0xd50, 0x0, 0x80}) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000100)=0x1c, 0x80800) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000140)={0xb59, 0x3ff, 0x4, 0x0, 0x7, 0x5, 0x29cf800000000, 0x7fff, 0x0}, &(0x7f00000001c0)=0x20) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000200)={r4, 0x8, 0x1}, 0x8) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:36 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2173.483424] binder: release 5853:5859 transaction 2431 in, still active [ 2173.521102] binder: send failed reply for transaction 2431, target dead [ 2173.560172] binder: undelivered TRANSACTION_ERROR: 29201 [ 2173.593094] binder: send failed reply for transaction 2433, target dead [ 2174.008699] kauditd_printk_skb: 120 callbacks suppressed [ 2174.008714] audit: type=1400 audit(1555635457.463:38441): avc: denied { map } for pid=5884 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2174.169992] audit: type=1400 audit(1555635457.463:38442): avc: denied { map } for pid=5884 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:37 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, 0x0, &(0x7f00000002c0)) [ 2174.340834] audit: type=1400 audit(1555635457.463:38443): avc: denied { map } for pid=5884 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2174.466312] binder: 5888:5890 ERROR: BC_REGISTER_LOOPER called without request [ 2174.503607] audit: type=1400 audit(1555635457.503:38444): avc: denied { map } for pid=5884 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2174.568852] binder: 5888:5893 got reply transaction with no transaction stack [ 2174.576227] binder: 5888:5893 transaction failed 29201/-71, size 0-0 line 2762 00:57:38 executing program 3: r0 = socket$inet(0x2, 0x800000000000007, 0x4) chroot(&(0x7f0000000000)='./file0\x00') r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) r2 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x3, 0x325203) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x2}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='\xd1y\xffl\xc8\xdcu\xc4\x064v!\x19\xce\xfa\x1f-EB\x93\xd3V=b\x99\xd7\xdc\x9d\xb8>[\xe4a\x00', 0xfe68) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000440)={{{@in6=@mcast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f00000001c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'team0\x00', r3}) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000200)) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x6, &(0x7f0000000540)="0ad401003c123f319bd070") 00:57:38 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x0, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x2289, 0x0) 00:57:38 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = inotify_init1(0x0) fcntl$setflags(r0, 0x2, 0x0) [ 2174.687904] binder: release 5888:5893 transaction 2435 out, still active [ 2174.694822] binder: undelivered TRANSACTION_COMPLETE [ 2174.700240] audit: type=1400 audit(1555635457.513:38445): avc: denied { map } for pid=5885 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2174.804737] binder: BINDER_SET_CONTEXT_MGR already set [ 2174.865572] audit: type=1400 audit(1555635457.523:38446): avc: denied { map } for pid=5885 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2174.908010] binder: 5888:5890 ioctl 40046207 0 returned -16 [ 2174.908024] binder: release 5888:5890 transaction 2435 in, still active [ 2174.908052] binder: send failed reply for transaction 2435, target dead [ 2174.929701] binder: 5888:5896 transaction failed 29189/-22, size 0-0 line 2855 [ 2174.985298] binder: undelivered TRANSACTION_ERROR: 29201 [ 2175.000383] binder: 5888:5893 ERROR: BC_REGISTER_LOOPER called without request [ 2175.033876] audit: type=1400 audit(1555635457.553:38447): avc: denied { map } for pid=5884 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2175.098856] binder: 5888:5896 got reply transaction with no transaction stack [ 2175.107956] binder: undelivered TRANSACTION_ERROR: 29189 [ 2175.139914] binder: 5888:5896 transaction failed 29201/-71, size 0-0 line 2762 [ 2175.158787] audit: type=1400 audit(1555635457.553:38448): avc: denied { map } for pid=5885 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:38 executing program 4: r0 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) r1 = open(&(0x7f0000000080)='./bus\x00', 0x1fe, 0x0) write$binfmt_aout(r1, &(0x7f0000000280)=ANY=[@ANYBLOB='y'], 0x1) sendfile(r1, r1, &(0x7f0000000000), 0x8080fffffffe) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x1000000000016) [ 2175.285288] audit: type=1400 audit(1555635457.563:38449): avc: denied { map } for pid=5885 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2175.323875] binder: undelivered TRANSACTION_ERROR: 29201 00:57:38 executing program 0: r0 = epoll_create1(0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) fcntl$lock(r0, 0x24, 0x0) [ 2175.425586] audit: type=1400 audit(1555635457.593:38450): avc: denied { map } for pid=5884 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:39 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f00000001c0), &(0x7f0000000200)=0x40) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) r2 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xa9d, 0x200200) getsockname$unix(r2, &(0x7f0000000100), &(0x7f0000000080)=0x6e) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0xfffffffffffffffd, &(0x7f0000000240)=""/143, 0x0, 0x8f, 0x1}, 0x20) [ 2176.147733] protocol 88fb is buggy, dev hsr_slave_0 [ 2176.152853] protocol 88fb is buggy, dev hsr_slave_1 00:57:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x1da, 0x0, 0x0}) [ 2176.311677] binder: 5917:5920 ERROR: BC_REGISTER_LOOPER called without request [ 2176.383023] binder: 5917:5927 got reply transaction with no transaction stack 00:57:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x5000aea5, &(0x7f0000000000)={0x0, 0x600000000000000, [], [0xc2]}) [ 2176.515121] binder: 5917:5927 transaction failed 29201/-71, size 0-0 line 2762 00:57:40 executing program 0: r0 = socket$inet6(0xa, 0x80803, 0x9) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@dev, 0x0, 0x2b}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x20000090}}, 0xe8) connect$inet6(r0, &(0x7f00000000c0), 0x1c) [ 2176.650335] binder: release 5917:5920 transaction 2441 out, still active [ 2176.657229] binder: undelivered TRANSACTION_COMPLETE [ 2176.729994] binder: BINDER_SET_CONTEXT_MGR already set [ 2176.805054] binder: release 5917:5920 transaction 2441 in, still active [ 2176.809309] binder: 5917:5934 transaction failed 29189/-22, size 0-0 line 2855 [ 2176.814076] binder: 5917:5920 ioctl 40046207 0 returned -16 [ 2176.837491] binder: send failed reply for transaction 2441, target dead [ 2176.891189] binder: undelivered TRANSACTION_ERROR: 29201 [ 2176.915582] binder: 5917:5927 ERROR: BC_REGISTER_LOOPER called without request [ 2176.981948] binder: undelivered TRANSACTION_ERROR: 29189 00:57:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2177.851610] binder: 5947:5948 ERROR: BC_REGISTER_LOOPER called without request [ 2177.930623] binder_alloc: 5947: binder_alloc_buf, no vma [ 2177.936219] binder: 5947:5948 transaction failed 29189/-3, size 0-0 line 2970 00:57:41 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:41 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x82, 0x0) ioctl$VIDIOC_S_PRIORITY(r2, 0x40045644, 0x3) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:41 executing program 4: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r0, 0x4020565b, &(0x7f0000000040)) 00:57:41 executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, &(0x7f0000000240), 0x4) 00:57:41 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f00000000c0)=""/80) [ 2178.148218] binder: send failed reply for transaction 2445 to 5947:5948 [ 2178.246753] binder: undelivered TRANSACTION_COMPLETE [ 2178.252514] binder: undelivered TRANSACTION_ERROR: 29189 00:57:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dc86055e0bceec7be070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000040)={0x7f, 0x2, [0x11, 0x7fff]}) [ 2178.387963] binder: BINDER_SET_CONTEXT_MGR already set [ 2178.435111] binder: 5947:5964 got reply transaction with no transaction stack [ 2178.436759] binder: 5947:5957 ERROR: BC_REGISTER_LOOPER called without request 00:57:42 executing program 0: syz_emit_ethernet(0x1, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd60b40930000002024300600006000000ffffe0000002ff0200000000000025a5dff9a2510000000000000001210090780007040060b680fa00000000c2000000000000000000ffffffffffff00000000000000000000ffffac14ffbba788cc130b93e3df5afb94050a381359036da9d337f6bf87b8aa8b17c485ab0f2e1a677146f128316099e181e71dd79986c3d52d42b4441eb8a9558ef6bd75b060ffb02ed05aae0e73e3c837de218791797c18b657f0177f74b5eed0e7eb75f1dbd5762c6647d6a9ffb813f01e4973287b4d07e74052bd5d51112083ca92753ee4f87333881dbe5ca2f58895752dd6ea4bc3225aaaa1b79226a1d4b52c77e9fb9b4f336101b0657e3196d4f079256d5b"], 0x0) [ 2178.527336] binder: 5947:5948 ioctl 40046207 0 returned -16 [ 2178.527365] binder: undelivered TRANSACTION_ERROR: 29190 00:57:42 executing program 5: [ 2178.618741] binder: 5947:5963 transaction failed 29189/-22, size 0-0 line 2855 [ 2178.625995] binder: 5947:5964 transaction failed 29201/-71, size 0-0 line 2762 [ 2178.692468] binder: undelivered TRANSACTION_ERROR: 29189 00:57:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2178.911378] binder: undelivered TRANSACTION_ERROR: 29201 [ 2178.947793] protocol 88fb is buggy, dev hsr_slave_0 [ 2178.952942] protocol 88fb is buggy, dev hsr_slave_1 00:57:42 executing program 4: [ 2179.107733] protocol 88fb is buggy, dev hsr_slave_0 [ 2179.112877] protocol 88fb is buggy, dev hsr_slave_1 [ 2179.118328] protocol 88fb is buggy, dev hsr_slave_0 [ 2179.123439] protocol 88fb is buggy, dev hsr_slave_1 00:57:42 executing program 0: 00:57:42 executing program 5: [ 2179.347118] kauditd_printk_skb: 150 callbacks suppressed [ 2179.347133] audit: type=1400 audit(1555635462.793:38601): avc: denied { map } for pid=5976 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2179.453522] audit: type=1400 audit(1555635462.843:38602): avc: denied { map } for pid=5976 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2179.609015] audit: type=1400 audit(1555635462.853:38603): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2179.759786] audit: type=1400 audit(1555635462.863:38604): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2179.881129] binder: 5977:5979 ERROR: BC_REGISTER_LOOPER called without request [ 2179.925195] audit: type=1400 audit(1555635462.893:38605): avc: denied { map } for pid=5976 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2179.988671] binder: 5977:5982 got reply transaction with no transaction stack [ 2179.996088] binder: 5977:5982 transaction failed 29201/-71, size 0-0 line 2762 [ 2180.077764] audit: type=1400 audit(1555635462.943:38606): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2180.180808] binder: release 5977:5979 transaction 2450 out, still active [ 2180.237708] binder: undelivered TRANSACTION_COMPLETE [ 2180.287693] audit: type=1400 audit(1555635462.943:38607): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2180.318152] binder_alloc: 5977: binder_alloc_buf, no vma [ 2180.339487] binder: BINDER_SET_CONTEXT_MGR already set [ 2180.343922] binder: 5977:5979 ERROR: BC_REGISTER_LOOPER called without request [ 2180.344885] binder: 5977:5986 ioctl 40046207 0 returned -16 [ 2180.400954] audit: type=1400 audit(1555635463.013:38608): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2180.453569] binder: release 5977:5979 transaction 2450 in, still active [ 2180.463044] binder: 5977:5988 got reply transaction with no transaction stack [ 2180.472175] binder: send failed reply for transaction 2450, target dead [ 2180.508306] binder: undelivered TRANSACTION_ERROR: 29201 [ 2180.516983] binder: 5977:5987 transaction failed 29189/-3, size 0-0 line 2970 [ 2180.548698] audit: type=1400 audit(1555635463.023:38609): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2180.574688] binder: 5977:5988 transaction failed 29201/-71, size 0-0 line 2762 [ 2180.608221] binder: undelivered TRANSACTION_ERROR: 29189 [ 2180.637912] audit: type=1400 audit(1555635463.083:38610): avc: denied { map } for pid=5976 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:44 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:44 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x19d) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x40, 0x10000) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r2, 0xc0105303, &(0x7f0000000140)={0x8, 0x7fff, 0x80}) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1000000000000176, 0x0, 0xfffffffffffffe3b}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:44 executing program 5: r0 = socket$inet(0x10, 0x3, 0xc) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000070607031dfffd946fa2830020200a0009000100061d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 00:57:44 executing program 0: 00:57:44 executing program 4: [ 2180.749689] binder: undelivered TRANSACTION_ERROR: 29201 00:57:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:44 executing program 4: [ 2180.885710] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 00:57:44 executing program 0: [ 2180.932218] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 00:57:44 executing program 5: 00:57:44 executing program 4: 00:57:45 executing program 0: [ 2181.690947] binder: 6000:6004 ERROR: BC_REGISTER_LOOPER called without request [ 2181.766829] binder: 6000:6009 got reply transaction with no transaction stack 00:57:45 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") readahead(r0, 0x2, 0x19) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)) socket$inet(0x2, 0x80000, 0x8) [ 2181.841476] binder: 6000:6009 transaction failed 29201/-71, size 0-0 line 2762 [ 2181.895328] binder: release 6000:6004 transaction 2455 out, still active [ 2181.908602] binder: undelivered TRANSACTION_COMPLETE [ 2182.017002] binder: 6000:6009 got reply transaction with no transaction stack [ 2182.062710] binder: release 6000:6010 transaction 2457 out, still active [ 2182.071875] binder: 6000:6009 transaction failed 29201/-71, size 0-0 line 2762 [ 2182.087655] binder: undelivered TRANSACTION_COMPLETE [ 2182.133195] binder: undelivered TRANSACTION_ERROR: 29201 [ 2182.260802] binder: release 6000:6004 transaction 2455 in, still active [ 2182.279359] binder: send failed reply for transaction 2455, target dead [ 2182.317062] binder: undelivered TRANSACTION_ERROR: 29201 [ 2182.353998] binder: send failed reply for transaction 2457, target dead 00:57:46 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:46 executing program 5: 00:57:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:46 executing program 4: 00:57:46 executing program 0: 00:57:46 executing program 5: 00:57:46 executing program 4: 00:57:46 executing program 0: 00:57:46 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x5c) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2183.598195] binder_alloc: 6024: binder_alloc_buf, no vma [ 2183.603801] binder: 6024:6027 transaction failed 29189/-3, size 0-0 line 2970 [ 2183.674586] binder: 6024:6027 ERROR: BC_REGISTER_LOOPER called without request [ 2183.775480] binder: 6024:6028 got reply transaction with no transaction stack [ 2183.857841] binder: 6024:6028 transaction failed 29201/-71, size 0-0 line 2762 00:57:47 executing program 4: 00:57:47 executing program 5: [ 2184.189881] binder: undelivered TRANSACTION_ERROR: 29189 [ 2184.200829] binder: undelivered TRANSACTION_ERROR: 29201 00:57:47 executing program 0: [ 2184.241663] binder: 6024:6028 transaction failed 29189/-22, size 0-0 line 2855 [ 2184.310316] binder: 6024:6027 ERROR: BC_REGISTER_LOOPER called without request [ 2184.353537] binder: 6024:6028 got reply transaction with no transaction stack [ 2184.358575] binder: undelivered TRANSACTION_ERROR: 29189 [ 2184.409004] binder: 6024:6028 transaction failed 29201/-71, size 0-0 line 2762 [ 2184.440723] kauditd_printk_skb: 163 callbacks suppressed [ 2184.440739] audit: type=1400 audit(1555635467.893:38774): avc: denied { map } for pid=6034 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2184.477868] protocol 88fb is buggy, dev hsr_slave_0 [ 2184.483006] protocol 88fb is buggy, dev hsr_slave_1 [ 2184.520239] binder: undelivered TRANSACTION_ERROR: 29201 [ 2184.668498] audit: type=1400 audit(1555635467.893:38775): avc: denied { map } for pid=6034 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2185.091277] audit: type=1400 audit(1555635468.543:38776): avc: denied { map } for pid=6045 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2185.173173] audit: type=1400 audit(1555635468.573:38777): avc: denied { map } for pid=6045 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2185.327901] audit: type=1400 audit(1555635468.573:38778): avc: denied { map } for pid=6045 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2185.432245] audit: type=1400 audit(1555635468.573:38779): avc: denied { map } for pid=6045 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2185.513587] audit: type=1400 audit(1555635468.603:38780): avc: denied { map } for pid=6045 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:49 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2185.607710] audit: type=1400 audit(1555635468.663:38781): avc: denied { map } for pid=6045 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:49 executing program 4: 00:57:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:49 executing program 5: 00:57:49 executing program 0: 00:57:49 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2185.751935] audit: type=1400 audit(1555635468.663:38782): avc: denied { map } for pid=6045 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:49 executing program 4: 00:57:49 executing program 0: [ 2185.904378] audit: type=1400 audit(1555635468.703:38783): avc: denied { map } for pid=6045 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:49 executing program 5: [ 2186.080917] binder: 6051:6054 ERROR: BC_REGISTER_LOOPER called without request [ 2186.117243] binder: 6051:6056 got reply transaction with no transaction stack [ 2186.168599] binder: 6051:6056 transaction failed 29201/-71, size 0-0 line 2762 [ 2186.213936] binder: release 6051:6054 transaction 2466 out, still active [ 2186.227894] binder: undelivered TRANSACTION_COMPLETE [ 2186.311216] binder: BINDER_SET_CONTEXT_MGR already set [ 2186.358576] binder: 6051:6054 ioctl 40046207 0 returned -16 [ 2186.358599] binder: release 6051:6054 transaction 2466 in, still active [ 2186.417235] binder: 6051:6056 ERROR: BC_REGISTER_LOOPER called without request [ 2186.421279] binder: 6051:6062 transaction failed 29189/-22, size 0-0 line 2855 [ 2186.432905] binder: send failed reply for transaction 2466, target dead [ 2186.477676] binder: undelivered TRANSACTION_ERROR: 29201 [ 2186.529360] binder: undelivered TRANSACTION_ERROR: 29189 [ 2186.547772] protocol 88fb is buggy, dev hsr_slave_0 [ 2186.552894] protocol 88fb is buggy, dev hsr_slave_1 00:57:50 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:50 executing program 0: 00:57:50 executing program 4: [ 2187.546576] binder: 6070:6073 ERROR: BC_REGISTER_LOOPER called without request [ 2187.606925] binder: 6070:6076 got reply transaction with no transaction stack [ 2187.708504] binder: 6070:6076 transaction failed 29201/-71, size 0-0 line 2762 [ 2187.777822] binder: release 6070:6073 transaction 2470 out, still active [ 2187.784709] binder: undelivered TRANSACTION_COMPLETE [ 2187.865287] binder: release 6070:6073 transaction 2470 in, still active [ 2187.887707] binder: send failed reply for transaction 2470, target dead [ 2187.894523] binder: undelivered TRANSACTION_ERROR: 29201 [ 2187.961224] binder: 6070:6073 ERROR: BC_REGISTER_LOOPER called without request [ 2187.988792] binder: 6070:6076 got reply transaction with no transaction stack [ 2187.996235] binder: 6070:6076 transaction failed 29201/-71, size 0-0 line 2762 [ 2188.017328] binder: release 6070:6078 transaction 2473 out, still active [ 2188.036764] binder: undelivered TRANSACTION_COMPLETE [ 2188.132309] binder: release 6070:6073 transaction 2473 in, still active [ 2188.139753] binder: send failed reply for transaction 2473, target dead [ 2188.163766] binder: undelivered TRANSACTION_ERROR: 29201 00:57:51 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:51 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000001000000001, 0xffffffffffeffffc) setsockopt$inet_tcp_int(r1, 0x6, 0xc, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7fff, 0xa00) ioctl$VIDIOC_CROPCAP(r2, 0xc02c563a, &(0x7f0000000080)={0xc, {0x63, 0x2, 0x0, 0x8001}, {0x7, 0x6, 0xf2, 0x3}, {0xffffffff80000001, 0x101}}) ioctl$VIDIOC_G_PARM(r2, 0xc0cc5615, &(0x7f0000000280)={0x7, @output={0xc632fd3b4165adaa, 0x1, {0x4, 0x8}, 0x9, 0x4}}) fsetxattr$security_smack_entry(r1, &(0x7f0000000140)='security.SMACK64MMAP\x00', &(0x7f0000000180)='/dev/dsp#\x00', 0xa, 0x2) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) getsockopt$inet_mreqsrc(r2, 0x0, 0x2f, &(0x7f00000001c0)={@local, @empty, @multicast2}, &(0x7f0000000200)=0xc) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180), 0x1000000000000115, 0x0, 0xfffffffffffffe75}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000100)={0x3, 0x2, 0x1, 0xc019, 0x7fff, 0x50, 0x4}, 0xc) 00:57:51 executing program 5: 00:57:51 executing program 0: 00:57:51 executing program 4: 00:57:51 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:51 executing program 4: 00:57:51 executing program 0: 00:57:51 executing program 5: 00:57:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setxattr$security_ima(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000000080)='security.ima\x00', &(0x7f0000000100)=@sha1={0x1, "ef4380026c60eefc65dccef09a0b58035c489dee"}, 0x15, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x2, &(0x7f0000000600)="0af401003c123f319bd070532dbec0f8015a671676dcde123b20d5d13a6504000000df37723bf26ca4e643793743e6f5dc6521197fc55c50bdfb8392cd82ec494cae6be8525349c3f5ca647704b3c25b342ff6e5e6dea94d89b92b85f8d72f1302e38b6348c5ddd7b20900000000000000a2743dc6933288e6c9fbe05e10a3bf4ec78ded321bc0d531f8ebb4eaaf57e784e3dd189e7336db5405b06e411fc905d53c57626652a4080056dcc00ce5d1260cb9357604740bac6e2b323c09430a11fd9494cc") syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x100000000, 0x10800) r2 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x200000, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f00000002c0)=0xfffffffffffffffb) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x800, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x0, 0x0, 0x10, 0xb31e, 0x19, r2, 0x0, [], r3, r4, 0x3ff, 0x2}, 0x3c) 00:57:52 executing program 4: [ 2188.977091] binder: 6088:6090 ERROR: BC_REGISTER_LOOPER called without request [ 2189.043428] binder: 6088:6098 got reply transaction with no transaction stack [ 2189.077498] binder: 6088:6098 transaction failed 29201/-71, size 0-0 line 2762 00:57:52 executing program 5: [ 2189.160928] binder: release 6088:6090 transaction 2476 out, still active [ 2189.179308] binder: undelivered TRANSACTION_COMPLETE [ 2189.342079] binder: 6088:6102 ERROR: BC_REGISTER_LOOPER called without request [ 2189.350704] protocol 88fb is buggy, dev hsr_slave_0 [ 2189.350763] protocol 88fb is buggy, dev hsr_slave_1 [ 2189.491341] kauditd_printk_skb: 141 callbacks suppressed [ 2189.491357] audit: type=1400 audit(1555635472.943:38925): avc: denied { map } for pid=6100 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2189.522039] protocol 88fb is buggy, dev hsr_slave_0 [ 2189.522095] protocol 88fb is buggy, dev hsr_slave_1 [ 2189.522181] protocol 88fb is buggy, dev hsr_slave_0 [ 2189.522225] protocol 88fb is buggy, dev hsr_slave_1 [ 2189.549592] binder: BINDER_SET_CONTEXT_MGR already set [ 2189.554990] binder: 6088:6101 ioctl 40046207 0 returned -16 [ 2189.555696] binder: 6088:6105 got reply transaction with no transaction stack [ 2189.717729] binder: 6088:6105 transaction failed 29201/-71, size 0-0 line 2762 [ 2189.747914] binder: undelivered TRANSACTION_ERROR: 29201 [ 2189.807706] audit: type=1400 audit(1555635472.943:38926): avc: denied { map } for pid=6100 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2189.849678] binder: release 6088:6090 transaction 2476 in, still active [ 2189.856583] binder: send failed reply for transaction 2476, target dead [ 2189.892840] binder: undelivered TRANSACTION_ERROR: 29201 [ 2189.935574] audit: type=1400 audit(1555635473.023:38927): avc: denied { map } for pid=6100 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2190.057756] audit: type=1400 audit(1555635473.023:38928): avc: denied { map } for pid=6100 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2190.187736] audit: type=1400 audit(1555635473.073:38929): avc: denied { map } for pid=6100 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2190.308177] audit: type=1400 audit(1555635473.113:38930): avc: denied { map } for pid=6100 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2190.417742] audit: type=1400 audit(1555635473.733:38931): avc: denied { map } for pid=6109 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:53 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:53 executing program 0: 00:57:53 executing program 4: [ 2190.502137] audit: type=1400 audit(1555635473.733:38932): avc: denied { map } for pid=6109 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:53 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, 0xfffffffffffffffd, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000200)='hbB\x04\x96\xa9\x1e\xb6\a\x14\r\xa1\xd7\xf3q', 0x176) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000280)=@v2={0x3, 0x1, 0x5, 0x6, 0xb8, "5b3689f945b86d4a0e692c6818d5839413bff82b25208f2d89860763b6da1563e9aa7da7c6489608344d98d8d951988b8d74934c1b732229ec154694905456ab02b2a71f011547db0b0677c9dc27f7033f99df6faf1b7d447d6aa935f72a5cd74c3cfd83da4fd187050433036c1558ccae68e4b97fe7907c4b71df143e1f95e1960976e862fcda2aaf52f65b34f9db666f5583d6610f085ed9eb705abfe746fbf6bb49ccc5f244728e24906ec90e2f3d6a04740b76c5aa0d"}, 0xc2, 0x2) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000100)=""/127) 00:57:53 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:53 executing program 5: 00:57:54 executing program 4: [ 2190.646155] audit: type=1400 audit(1555635473.733:38933): avc: denied { map } for pid=6109 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:54 executing program 5: 00:57:54 executing program 0: [ 2190.808204] audit: type=1400 audit(1555635473.733:38934): avc: denied { map } for pid=6109 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2190.939783] binder: 6113:6118 ERROR: BC_REGISTER_LOOPER called without request [ 2191.033663] binder: 6113:6122 got reply transaction with no transaction stack [ 2191.101740] binder: 6113:6122 transaction failed 29201/-71, size 0-0 line 2762 [ 2191.153179] binder: release 6113:6118 transaction 2480 out, still active [ 2191.174105] binder: undelivered TRANSACTION_COMPLETE [ 2191.264980] binder: release 6113:6118 transaction 2480 in, still active [ 2191.275439] binder: send failed reply for transaction 2480, target dead [ 2191.314900] binder: undelivered TRANSACTION_ERROR: 29201 [ 2191.356825] binder: 6113:6118 ERROR: BC_REGISTER_LOOPER called without request [ 2191.411777] binder: release 6113:6127 transaction 2483 out, still active [ 2191.420119] binder: 6113:6122 got reply transaction with no transaction stack [ 2191.427733] protocol 88fb is buggy, dev hsr_slave_0 [ 2191.432871] protocol 88fb is buggy, dev hsr_slave_1 [ 2191.450828] binder: undelivered TRANSACTION_COMPLETE 00:57:54 executing program 4: 00:57:54 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x5) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) r2 = accept$inet6(0xffffffffffffff9c, 0x0, &(0x7f0000000040)=0xfffffffffffffebf) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000080)=0x4, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'lo\x00@\x00', 0x101}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r4 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x200, 0x284000) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000280)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r4, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r5, 0xa00, 0x70bd29, 0x25dfdbff, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x7, 0x3]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xfffffffffffffffa}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x60f2}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x5}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8001}, @SEG6_ATTR_SECRET={0xc, 0x4, [0x685b0893, 0x0]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004080) recvmsg(r1, &(0x7f0000000100)={0x0, 0x214, &(0x7f0000000180), 0x1, 0x0, 0xcfe474a4}, 0x40000060) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e23, @local}, @in6={0xa, 0x4e22, 0x107c, @remote, 0x40}, @in6={0xa, 0x4e22, 0x56, @ipv4={[], [], @multicast2}, 0x2}], 0x48) [ 2191.491022] binder: 6113:6122 transaction failed 29201/-71, size 0-0 line 2762 00:57:55 executing program 0: [ 2191.587733] protocol 88fb is buggy, dev hsr_slave_0 [ 2191.592887] protocol 88fb is buggy, dev hsr_slave_1 [ 2191.598309] protocol 88fb is buggy, dev hsr_slave_0 [ 2191.603413] protocol 88fb is buggy, dev hsr_slave_1 [ 2191.657849] binder: release 6113:6118 transaction 2483 in, still active [ 2191.669239] binder: send failed reply for transaction 2483, target dead [ 2191.712182] binder: undelivered TRANSACTION_ERROR: 29201 [ 2192.259896] device lo entered promiscuous mode [ 2192.423275] device lo left promiscuous mode 00:57:56 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x46030000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:56 executing program 5: 00:57:56 executing program 4: 00:57:56 executing program 0: 00:57:56 executing program 5: 00:57:56 executing program 4: 00:57:56 executing program 0: [ 2193.538483] binder: 6143:6148 ERROR: BC_REGISTER_LOOPER called without request [ 2193.586622] binder_alloc: 6143: binder_alloc_buf, no vma [ 2193.598959] binder: 6143:6148 transaction failed 29189/-3, size 0-0 line 2970 [ 2193.606511] binder: send failed reply for transaction 2486 to 6143:6148 00:57:57 executing program 4: [ 2194.091566] binder: undelivered TRANSACTION_COMPLETE [ 2194.099339] binder: undelivered TRANSACTION_ERROR: 29189 00:57:57 executing program 0: [ 2194.391836] binder: release 6143:6158 transaction 2488 out, still active [ 2194.411742] binder: undelivered TRANSACTION_COMPLETE [ 2194.418928] binder: 6143:6159 got reply transaction with no transaction stack [ 2194.508871] binder: 6143:6159 transaction failed 29201/-71, size 0-0 line 2762 [ 2194.521000] kauditd_printk_skb: 126 callbacks suppressed [ 2194.521016] audit: type=1400 audit(1555635477.973:39061): avc: denied { map } for pid=6152 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2194.634521] binder: undelivered TRANSACTION_ERROR: 29201 [ 2194.647810] audit: type=1400 audit(1555635477.973:39062): avc: denied { map } for pid=6152 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2195.447751] binder: undelivered TRANSACTION_ERROR: 29190 [ 2195.453334] binder: send failed reply for transaction 2488, target dead 00:57:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) socket$inet(0x2, 0xa, 0x1ac0) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x80, 0x100) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffff9c, 0xc010640b, &(0x7f0000000100)={0x0, 0x0, 0xec}) ioctl$DRM_IOCTL_GEM_FLINK(r2, 0xc008640a, &(0x7f0000000140)={r3, r4}) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:57:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x47030000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:57:59 executing program 5: [ 2195.518631] audit: type=1400 audit(1555635478.973:39063): avc: denied { map } for pid=6162 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:59 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:57:59 executing program 4: 00:57:59 executing program 0: [ 2195.626362] audit: type=1400 audit(1555635479.073:39064): avc: denied { map } for pid=6162 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2195.768978] audit: type=1400 audit(1555635479.073:39065): avc: denied { map } for pid=6162 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:57:59 executing program 4: 00:57:59 executing program 5: 00:57:59 executing program 0: [ 2195.893294] audit: type=1400 audit(1555635479.073:39066): avc: denied { map } for pid=6162 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2195.951829] binder: 6165:6169 ERROR: BC_REGISTER_LOOPER called without request [ 2195.985155] audit: type=1400 audit(1555635479.153:39067): avc: denied { map } for pid=6162 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2196.028553] binder_alloc: 6165: binder_alloc_buf, no vma [ 2196.034371] binder: 6165:6169 transaction failed 29189/-3, size 0-0 line 2970 [ 2196.062277] binder: send failed reply for transaction 2491 to 6165:6169 [ 2196.097832] audit: type=1400 audit(1555635479.213:39068): avc: denied { map } for pid=6162 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2196.127434] binder: undelivered TRANSACTION_COMPLETE [ 2196.137641] binder: undelivered TRANSACTION_ERROR: 29189 [ 2196.231431] binder: BINDER_SET_CONTEXT_MGR already set [ 2196.236855] audit: type=1400 audit(1555635479.233:39069): avc: denied { map } for pid=6162 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2196.304781] binder: undelivered TRANSACTION_ERROR: 29190 [ 2196.312177] binder: 6165:6169 ioctl 40046207 0 returned -16 [ 2196.374555] binder: 6165:6172 ERROR: BC_REGISTER_LOOPER called without request [ 2196.418325] audit: type=1400 audit(1555635479.303:39070): avc: denied { map } for pid=6162 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2196.458146] binder: 6165:6175 transaction failed 29189/-22, size 0-0 line 2855 [ 2196.460594] binder: 6165:6176 got reply transaction with no transaction stack 00:58:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r2 = getpid() r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/checkreqprot\x00', 0x101000, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x80000000, 0x8, 0x3, 0x8, 0x0, 0x7, 0x10004, 0xf, 0x20, 0x3, 0x100, 0x8, 0x9, 0x1, 0x10000, 0x7d, 0x6, 0x7, 0x5, 0x7, 0x819e, 0xffffffffffffffff, 0x3, 0x800, 0x6, 0x1, 0xa37f, 0x3, 0xa74, 0x18977f2f, 0x4, 0x7, 0x7, 0x7, 0x395, 0x4, 0x0, 0x9, 0x3, @perf_config_ext={0x81, 0x835}, 0x0, 0xffff, 0x0, 0x1, 0x9, 0x2}, r2, 0x2, r3, 0x0) r4 = accept$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @bcast}, [@netrom, @netrom, @rose, @null, @rose, @rose, @remote, @default]}, &(0x7f0000000100)=0x48) accept$netrom(r4, &(0x7f00000001c0)={{0x3, @rose}, [@default, @null, @remote, @default, @bcast, @rose, @rose, @default]}, &(0x7f0000000140)=0x48) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2196.538063] binder: undelivered TRANSACTION_ERROR: 29189 00:58:00 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:00 executing program 4: [ 2196.683814] binder: 6165:6176 transaction failed 29201/-71, size 0-0 line 2762 00:58:00 executing program 0: 00:58:00 executing program 5: 00:58:00 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2196.819425] binder: undelivered TRANSACTION_ERROR: 29201 00:58:00 executing program 4: [ 2197.406904] binder: 6182:6187 ERROR: BC_REGISTER_LOOPER called without request [ 2197.447501] binder_alloc: 6182: binder_alloc_buf, no vma [ 2197.470862] binder: 6182:6187 transaction failed 29189/-3, size 0-0 line 2970 00:58:01 executing program 0: [ 2197.505425] binder: send failed reply for transaction 2496 to 6182:6187 [ 2197.537358] binder: undelivered TRANSACTION_COMPLETE [ 2197.547425] binder: undelivered TRANSACTION_ERROR: 29189 00:58:01 executing program 5: [ 2197.635084] binder: BINDER_SET_CONTEXT_MGR already set [ 2197.656272] binder: 6182:6195 ioctl 40046207 0 returned -16 [ 2197.667717] protocol 88fb is buggy, dev hsr_slave_0 [ 2197.672969] protocol 88fb is buggy, dev hsr_slave_1 [ 2197.698972] binder: 6182:6187 ERROR: BC_REGISTER_LOOPER called without request [ 2197.735586] binder: 6182:6196 got reply transaction with no transaction stack [ 2197.778509] binder: release 6182:6196 transaction 2498 out, still active [ 2197.791801] binder: undelivered TRANSACTION_COMPLETE [ 2197.807836] binder: 6182:6196 transaction failed 29201/-71, size 0-0 line 2762 [ 2197.827725] protocol 88fb is buggy, dev hsr_slave_0 [ 2197.832972] protocol 88fb is buggy, dev hsr_slave_1 [ 2197.838408] protocol 88fb is buggy, dev hsr_slave_0 [ 2197.843532] protocol 88fb is buggy, dev hsr_slave_1 00:58:01 executing program 4: [ 2197.916690] binder: undelivered TRANSACTION_ERROR: 29201 00:58:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2198.026575] binder: undelivered TRANSACTION_ERROR: 29190 [ 2198.032245] binder: send failed reply for transaction 2498, target dead 00:58:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x7ffffffffffffe, &(0x7f00000005c0)=0x79, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:01 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, 0x0, 0x0) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:01 executing program 0: 00:58:01 executing program 5: 00:58:01 executing program 4: 00:58:02 executing program 5: [ 2199.037813] protocol 88fb is buggy, dev hsr_slave_0 [ 2199.042942] protocol 88fb is buggy, dev hsr_slave_1 [ 2199.057279] binder: 6207:6213 ERROR: BC_REGISTER_LOOPER called without request 00:58:02 executing program 4: 00:58:02 executing program 0: [ 2199.126246] binder: 6207:6217 got reply transaction with no transaction stack [ 2199.183888] binder: 6207:6217 transaction failed 29201/-71, size 0-0 line 2762 [ 2199.268149] binder: release 6207:6213 transaction 2501 out, still active [ 2199.275140] binder: undelivered TRANSACTION_COMPLETE [ 2199.363306] binder: 6207:6213 ERROR: BC_REGISTER_LOOPER called without request [ 2199.370936] binder: 6207:6217 got reply transaction with no transaction stack [ 2199.428802] binder: release 6207:6218 transaction 2503 out, still active [ 2199.443883] binder: undelivered TRANSACTION_COMPLETE [ 2199.449521] binder: 6207:6217 transaction failed 29201/-71, size 0-0 line 2762 00:58:03 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, 0x0, 0x0) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2199.522216] binder: undelivered TRANSACTION_ERROR: 29201 [ 2199.583314] kauditd_printk_skb: 114 callbacks suppressed [ 2199.583329] audit: type=1400 audit(1555635483.033:39185): avc: denied { map } for pid=6220 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:03 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2199.648234] binder: release 6207:6213 transaction 2501 in, still active [ 2199.655073] binder: send failed reply for transaction 2501, target dead [ 2199.710282] binder: undelivered TRANSACTION_ERROR: 29201 [ 2199.715812] binder: send failed reply for transaction 2503, target dead [ 2199.737052] audit: type=1400 audit(1555635483.033:39186): avc: denied { map } for pid=6220 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='s~alable\x00\x13,H\xf5\x02\x97T\x06-\x8bj\xe5y\x0f\x7f\f\x85\x1c\xe8C\x85\xe8\xc2\xdf\xc3\xfcIR\xdb\x10]W\x03\xd3R\x8e\x9f\xc1\xb0\xd8n\xff\xa7\xee\xda\xc6\xa0)}{\xbd\xf8\xad\x1e\x05`\xf4\xb36\xc5\xf4\xd3\x1b7\x10T\xfd\x9bp\xe7x\x83u\xf6\xceT\xe0\xb3A\xd9D\xfc\x99\xd0E\xc3\xe0\x8ap\x8e\x95\xb6n\xe0\xa4\x86\xc6\x18\xde\xe9\x96\'z\x8a\x9a\xd8\xfb\xa7\xe3ST\x8a\xf8\xe4\x17#\xa7}2\x7f\x00\x00\x00\x00\x00\x00\x00\xf9k\x91\x1e\x18n\x9c\x9a\xc1\x10\xd7\x84\xb6\b\x98\xd5\x1e\x8b\xaeaI[\x9f~xB\xad\x01 \xa3\xfe\xe2\xe58\xd2\xe0\xdb\x967@\x9f', 0xfffffffffffffd69) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:03 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) gettid() 00:58:03 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) [ 2199.886333] audit: type=1400 audit(1555635483.043:39187): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2200.027808] audit: type=1400 audit(1555635483.063:39188): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2200.237920] audit: type=1400 audit(1555635483.143:39189): avc: denied { map } for pid=6220 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2200.400180] audit: type=1400 audit(1555635483.143:39190): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:03 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x100000400000003a) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000040)=@fragment, 0x8) dup3(r0, r1, 0x0) [ 2200.566864] audit: type=1400 audit(1555635483.143:39191): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2200.618245] binder: 6226:6231 ERROR: BC_REGISTER_LOOPER called without request [ 2200.717132] binder: 6226:6239 got reply transaction with no transaction stack [ 2200.734978] audit: type=1400 audit(1555635483.233:39192): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2200.768865] binder: 6226:6239 transaction failed 29201/-71, size 0-0 line 2762 [ 2200.833462] binder: release 6226:6231 transaction 2506 out, still active [ 2200.849598] binder: undelivered TRANSACTION_COMPLETE [ 2200.903638] audit: type=1400 audit(1555635483.233:39193): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2200.951304] binder: BINDER_SET_CONTEXT_MGR already set [ 2201.000757] binder: release 6226:6231 transaction 2506 in, still active [ 2201.002364] binder: 6226:6242 transaction failed 29189/-22, size 0-0 line 2855 [ 2201.008202] binder: 6226:6231 ioctl 40046207 0 returned -16 [ 2201.027930] binder: send failed reply for transaction 2506, target dead [ 2201.070332] binder: undelivered TRANSACTION_ERROR: 29201 [ 2201.072625] audit: type=1400 audit(1555635483.283:39194): avc: denied { map } for pid=6220 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2201.107729] protocol 88fb is buggy, dev hsr_slave_0 [ 2201.112854] protocol 88fb is buggy, dev hsr_slave_1 [ 2201.141455] binder: 6226:6239 ERROR: BC_REGISTER_LOOPER called without request 00:58:04 executing program 5: [ 2201.200985] binder: undelivered TRANSACTION_ERROR: 29189 00:58:04 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, 0x0, 0x0) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:04 executing program 0: 00:58:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:04 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) r1 = gettid() timer_create(0x0, &(0x7f0000044000), 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) getpgrp(r1) 00:58:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000280)={0x10000, 0xa233, 0x6, 0x0, 0x0, [{r0, 0x0, 0xfffffffffffff1ae}, {r0, 0x0, 0x7}, {r0, 0x0, 0x1f}, {r0}, {r0, 0x0, 0x1f}, {r0, 0x0, 0x9}]}) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r2 = socket$isdn(0x22, 0x3, 0x27) ioctl$TCXONC(r2, 0x540a, 0x9) sendto$inet(r0, 0x0, 0x1b8, 0x1200007fd, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000100)=0x1e) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:05 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf8, 0x110, 0x9, {"baaf0bc08571b30f91a228f5075e52db637bfa24b1d7132f939ac99dad822fa9e90cec192f8b05ef8cb5c3e00d651943ae42440ab7d34239dcb300a033e4e4fd921662ab89859a99d89a70519acef556ba37c4245ae3f03e25b1d05c5e04717fd1e05a989c103f1f6263b9175f7450f10365ec46e88f17c563ff3e5ffa9b9057f6bf2abd4c06e3b9927517878d6d6ef77b5a6e493147a0081c54df539fd8a0c696ceadce263289a83370dd8b42438228c69877e713d492d1652f2537b59e02d9a42d27addf3354b14d10e917ad4f4dcef40a3e837b8ef3f421bb4b3bb9d07630f9516aaee73c52a615ace3b5c291f60248a03dbdf8"}}, {0x0, "ff985ca0064ee446668e87bf10696c54be63dacb7e9e051d68223f2e90a815bcc7a717c0ded25d7e5ca99f0c70cd19f1c2887878142037648223e16ce635ca9b1a6b46a0082ade8f1b89bd69d042bd23e3622efabc58a7e45497555269129cdd6fd20f2d45571b995c93b6c96b978ee89dae210bdf0c29249990c1e1289ab51fd4ebbf70abd683bfc1c92dcd3063775a6ac2568e60d7a83eb5fe83bc7bd9150c4f5baf65dba750a1bd65974fdaef3392fde1726024c676481ef02a9643e0e85c9b46f35aa774ede419d64529f89521ebc90e8cde1444c42e7fa633374d20163496b2c3fdebaa0ea32ca10116eadf102b"}}, 0x0, 0x202}, 0x20) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) gettid() clock_getres(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./file0/bus\x00', 0x6857b21ff1155d90) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x90) write$P9_RAUTH(r1, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) sendfile(r1, r1, &(0x7f0000000240), 0x7fff) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = fcntl$dupfd(0xffffffffffffffff, 0x3, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x1000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) r4 = memfd_create(&(0x7f00000001c0)='/delo\xff\a\x00\x00\x00\x00', 0x0) pwritev(r4, &(0x7f0000000480)=[{&(0x7f00000004c0)="2bd83b", 0x3}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) sendfile(r2, 0xffffffffffffffff, 0x0, 0x2000006) ioctl$PPPIOCGUNIT(r2, 0x80047456, &(0x7f0000000000)) getdents64(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000200)) 00:58:05 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) setxattr$security_selinux(0x0, 0x0, 0x0, 0x0, 0x1) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r1 = getpgrp(0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x7) 00:58:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x5}) [ 2202.311032] binder: 6258:6261 ERROR: BC_REGISTER_LOOPER called without request [ 2202.398513] binder: 6258:6265 got reply transaction with no transaction stack [ 2202.451711] binder: 6258:6265 transaction failed 29201/-71, size 0-0 line 2762 [ 2202.514158] binder: release 6258:6261 transaction 2510 out, still active [ 2202.536166] binder: undelivered TRANSACTION_COMPLETE [ 2202.613083] binder: release 6258:6261 transaction 2510 in, still active [ 2202.631971] binder: send failed reply for transaction 2510, target dead 00:58:06 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2202.686172] binder: undelivered TRANSACTION_ERROR: 29201 [ 2202.738808] binder: 6258:6261 ERROR: BC_REGISTER_LOOPER called without request [ 2202.818003] binder: release 6258:6274 transaction 2513 out, still active [ 2202.824907] binder: undelivered TRANSACTION_COMPLETE 00:58:06 executing program 3: socket$inet(0x2, 0x3, 0x1c) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x33e, 0x200007ff, &(0x7f00000001c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000400)='bbr\x00', 0xb4) sendmsg$inet_sctp(r1, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$TIOCMBIC(0xffffffffffffffff, 0x5417, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000480)={0x8c, 0x18, 0xfa00, {0x10000000000, &(0x7f0000000440), 0x0, 0x67090000, [0x9c00, 0x8, 0xa8]}}, 0xfef5) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0x7) ioctl$TCSETS(0xffffffffffffffff, 0x8926, &(0x7f0000000040)) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000900)={0xa1, 0x1f, 0xfffffffffffff542}, 0xc) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r0, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='\x00', 0xffffffffffffff9c}, 0x10) syz_read_part_table(0x3, 0x9, &(0x7f00000007c0)=[{&(0x7f0000000100)="0e71c299ffedfac80a17ed08e993d2e7475763ea768855c08c134fc120391cdc082b08f54f5dc131af09fa6506d1ef88054faa6e6f868b30f5cc0f7e515e9631f136f0eeb180d846ab9c89bee34a0007", 0x50, 0x80}, {&(0x7f0000000280)="8ec9ce28c47c42d66fe633ee5a479657e50cb87fceff472a67c75c0f72861782c35e659591cf0be6bbe033293846c1778701ba2c4e74265835857baac80bcdf4c4e19e555934e409fbe06cb3a0d8c4e0f0c4e55a0418af6b2ee884ec66b1f0e31a0f4060710c20c4a9f2249d05b1c86d5c84828af4ed830e19eedb86529a855caaee2b489e56c29edca62aa9a7a394efa6219c0837b2b7268735943725d57ffd44bd08a9c08a31cefc0d2a0e6ce0cbaa631d51bc73465695", 0xb8, 0x40}, {&(0x7f0000000340)="360676862d94f81fdc19f20f5d744b3a75999cc0b8941fb52d28984d40a76a82e9d5fc3e128e833de97a1c478b156e6f181406f08da5716e8b173d244e783abc4de3632c3f039fdad87af8c632617fee4a16098e7ac8c27c6393f5bcb61c3b4711ff1bf1eb34eb7e9774df9f7ec0c79b86ef516e354177dc8310f6ccb54ad0c9f8429484b7f085f02289b457fc80439a23cffe0d3ab6684a8d70a082", 0x9c, 0x4}, {&(0x7f0000000400)="562d3fda1115ff468e75eaf3309de71c2b1a257b49c5be65e929d73153cec715f1e0472126fbd3799a67ffe66ef3631df615a08fde1537836102786f917b3df2d9dfe45658998ce8d0051b3daf056d65f116347c04bf4c3aad5cc0923540f339de8eac0faba46006960aeee4c474ece4b5af126bcee8d07badb906fd18fee96bc975b235fd7f", 0x86, 0x896}, {&(0x7f00000004c0)="a47237a0066801065ef90a1b9b840e2895419b1733078a0538ec599028c536763613875b02c44f024e86be75ceaf6b50266b82f3cb71b3f0b7ee662635ad18d10a79f18395ec06fa6bd0748dd719d74de7a0277768cb3590ce1360e75988dc8c958c3dc2d25d7ed6bf12b40e0d694c947b5011254f7e7bcbe81955cd59d72069859e58a7a26d2472cda6f7ad51953279eb3700e15c7ceff6acaba05f320dfa168a17397da7a2a69b84675bc3c80d49bc52db1f9b6f4bc8d85b25e2683477d5420b894b123fdd85f39ac1e8364def66df7111dbdd6e295d52ec76c91c16b8cbe727619dc5fe", 0xe5, 0x3d5}, {&(0x7f0000000600)="8a3b784eee11f891781f41a9ac1eb507201e819c3a6b91b7972e1282b044913e436fd64133ae30776de62aa46e38ec40826febd6aef8bb50499d2c21f5c62e3bbda4ca0ca6381cb75e60c3d2f9ea674b2b09bb8a3820f30a00315e58e90f0baa57e498fd2e6c10094d86803ee3a5eb20c8da8d119603800959df474e1d343deb09cc982b189b4c5645082091a3592472db0e43138d89e274388104549dde59f21154b98ad63e164dc4f08d6d933341e6a1af2daedd656c73bbabf77c6a", 0xbd, 0x9f7}, {&(0x7f00000001c0)="56fd9804abf6e7970b56f709446929e0ec4bd642730209cefd2c704b645c283f24146884b418d3340c92f9978d25a32c", 0x30, 0x200}, {&(0x7f00000006c0)="bdc86f83c3c1d100c51aa001d58c360eb39fdc072c04497bf37b97b13a285ca8e0ff02d8f4d3f87a879c4a4f31b5b2f62f59a35246f3fa6b25c9a7bcd9af2b261f101bfb825259c2e6548c11e66ab313f16cb636da8f0997641866c0ebf8d3d315a0bbf088b7924d9c859de5e17e92f14ec91b3903976e176747919cd968b314b50976a4459d8e85414639d876e36bb3221d53f42eddeb4fa4cbc7956052c47599469136dfff3cd32b27e82a8a4af72bfd8b453c1fc24411b894651a44ad0b8fce41d6a516a89afd42cf0cded6", 0xcd, 0x7}, {&(0x7f0000000200)="6f871e0716104c13b85f342b86a7092f93e7a4abd4652b0fccd92a3782cbc8f206c94db1f1ba603206ae05aef8c9fa78e9a192233bf21b24da2ae5f458", 0x3d, 0x10000}]) prctl$PR_SET_TIMERSLACK(0x1d, 0x401) ioctl(r3, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2202.973225] binder: release 6258:6261 transaction 2513 in, still active [ 2202.986699] binder: send failed reply for transaction 2513, target dead 00:58:06 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000000)) 00:58:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) setxattr$security_selinux(0x0, 0x0, 0x0, 0x0, 0x1) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) getpgrp(0x0) 00:58:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x800000000008953, 0x0) [ 2203.907740] net_ratelimit: 6 callbacks suppressed [ 2203.907749] protocol 88fb is buggy, dev hsr_slave_0 [ 2203.917853] protocol 88fb is buggy, dev hsr_slave_1 [ 2204.067752] protocol 88fb is buggy, dev hsr_slave_0 [ 2204.073051] protocol 88fb is buggy, dev hsr_slave_1 [ 2204.078493] protocol 88fb is buggy, dev hsr_slave_0 [ 2204.083634] protocol 88fb is buggy, dev hsr_slave_1 [ 2204.128099] binder: 6294:6297 ERROR: BC_REGISTER_LOOPER called without request [ 2204.179381] binder: 6294:6300 got reply transaction with no transaction stack 00:58:07 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy\x17\xf3\xeb\x90\x00', 0x2, 0x0) ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f00000000c0)={0x1, 0x0, 0x2080, {0x4, 0x1000, 0x2}, [], "6ddacef8b17b02572b569f0b5b27f07eb9117296c5e806a71b5e15c73aea2382de00979cee30cf4d63a1a3029fe572a04b8238a6ddc86b264f244d3bba660a381d8c24451f4bc082accde355962a3867f8688262827cf9e3659f25e947a318815fa7f52427e5c18296caa72421a545227de66d455c8942601a66c8905f71de73af3a1d710c969071ae0c41c4b6542ad4688bd1b15515da7337b2c567577f314d0484876a04e9022f482af94125fbafa2ab023a2d2bfd9c34a44951616f8534ee2b78317811e55190c618cb67e728a8528015a6525b2b3568187e630a57cd033115a5eddb1586d25f6686a1f2eb2c1f9c1b8b4676d4b0ac9a95de1f7fb20c6ae17d3f764abdd6cc14e342eef37a57462c4a2afbdf73bf37708b176ed1b85bcaa50e9c182af38fed55dcf57893163b7388c6be0f33ad19fd26b68b0721e22c2d1eba963225f42fcef9360f80db735ecc8296baea37aa789c3c7ac55161acf87395916f9417ad488528cf4299f52c52ffe9e15c894a7ff8038792e9a33f1fef6e33ac2a5c7ad1808438203b4a6330beba43a7b59e9cd371f806a0adec60625fb8ff32e487b906a137286c6102c0b76e84e59bc28d8d8f2655e19005b8daaaac9f2ae9dac970ccc61fae49c4d4601c46f8386b2a5b756e5e2f2832b5b75b3494fffc6f4edbd2736ae1a32d21c67575c61f506325df93ab18cc87610f72b29d20410f2fa76f85709315cdcbf18f07341c84e7b28fcb6b02090b5dee9eacd0c64824593fea76eeeefe0a065d461f8c5bb774f44d91895e0a92c287343a3976e2b1d60e3a921493ae46b5244f5524ab726cccc51c4f6e60bfc49c63ec1a7ae7c5ff2e3a5c64b29cb2adcfc89319d0ad899d762da703065900b4efa086e409d3e04fd4deea78f9787b4e45672835ec4225928fb9b6e4d03a433ca6d45c6d7605c93af6d8cfccfbbde794f4a5d48403838b9bc6b068b5470a35ff849cc7924b4964d0f0e38c90e7b47351a8ebac3829d980efcf1c11562025fa0e273a14115534d1fabaa873889b670cffd0de35737a6eaf5f69678841ff30e84ede1856f3881ef4a61323d4eb90e47cae4815b15b5097ae4dc2ed1169d49b830cc8b9161c52ff8d690aaf60e407dc505399d275ba0593f86e9ba46fe63dd11a24662385c15177595fe88a9a3a6c9ee4ddf2280dd52d24a3014ef29a8008e9435ae14a026ed4d7b7dc4d490493992c368cd87fa5da0df43f0b2c78645844265be91e5adf02eb8908544285c9bf2df9e9ed09cc96ff78200e53d79b9df9aca7927874fbf22f57ce6e53b04950e80ac5691235dde4dd49ea6495bd8c92b903a63684d16e6a26e5af7bff315720fcccf552ba2754de6088779c64bad14016db66ad76d83ad54f7749c9ee237b476dd1f1a57e4747765f7485f28c3d615e11256fd90405718b22d4ddcd675e9b4c0ffa05d21f774a7a59b3408d798caee662781f0ad290d81a6a36fa444d78acc8dadaa161a2bb127dea7c6e4686a175dabb59763b807ccb882d163a28f76b0af34bb8b13bfbc894444b36c63d79b04cb079cd18b6b16453387f88cb44e5117d990a06787c5827ac3b927609f33cc400d9cfff9c3542e9c71e51aad33d63656b63da47332565f07ca1ff8e47417d488f17521e388cab753d07d0755bd2e562122db18c5aed479cc35117dbc93a3b18cd98bf49ca8a057522f75ec40ee992cf19f14556b553054d64883bd36f4df22cd85a2656cda9425bae39e83368c77142a44a398e56b4f2dd0070c1919ddb58a8d96018a8142d4c53a4b5ed653ec0e8640d2d59cf0d04cda9d9f58ea560789318c651931a300557bc3fddc5a318107d5d193fcd16ec70b3be3c104344b6ea136a8903e800d4b088ddd024d31f4e69002e14fe752365750b5fb23f029bc599915ff34cf37ba1ff19141e88cd6a2b6d509c8437405d4ac7fec616ae8817361907d222e76ea5898545123dc88d920372feeb24e4e0ac50efce145f8123e5a242d808d552a0ab61578c88753df276e8a72a08e2ca84f002157ed4821334f5185d20d7fd93359ad0b4cf929f3225ee92a588851c6132eb805662851bfc0452041a150b3471366bb19f72602c6773c5dbc38f77f69888203fbbb20ff2adb20842bc9e0cdf9ef6e020cf29eecf30c79000f08ca2f9c26add112663293781fed7c9d37d75f6c730ff0591d53c14ffda3e2160a9eb39c31d896deb2cab9a9f653d3f7cca4f9d2f1a33c36248ee938b888d0da50e8fb1f7d4daa653f7d0542f995811dba7618c2623e5fd6a7b7cead514df682df82dac0346f84ec176648e773c0ef7a4f9ff83e6b060681d57d7e080e5835b8491b39bfdc20f072c40578f2845fcd8891374c6e03d57e7d16c9a9d8c975e0e9aade3fc200a51e75c1f20cdc174b9b3615776b85c989ca7b479d10c029b003afd6e9e710799ae1729dc7bcd32a82ee2cf6a885eec60ce20c2402aa36da7d890687f816f0eb86990178fef022bf5bb06580b1f8e48b6c0aceb30f017c2220eda281fb039912b50ce686bed3fe70b90cb3b08593ab80b3468179c852095450cc05ca396673c1de5530bde3ac450d24a8b138c8246601aea32b047dbe483d3ce04b0be6f99d7be71e8b63f495e551c2569654de7f0ca9fe907f2a69b854195d719fa3fb48ee5f530e9cb145572797a7558fc46bf7e401d77fda57db541541a541e7502133e50fd9dd11bdb93e724c49b6e6fee1ab684fe96bf900a117b62489465d9b828723b03a3cdf3301fda9f275df79ff9a12fef9bac5101713ea89b2b9f2603fedbaef9b9e264a57a8f809519d21941d09186dfad23345d3b1a445bc4aca0e0ba8e6d3f98b0beefd79fabc7524a1a697154d30fba19c11ca0052df4a1de623060eee91338b9d52ac0b2034bb73b6bfb001c436f2cfb059dfa0b1f65d59e3653c125ba6da38b8bca9db78225e84a26d568d7089da7cf85c66b0ba13815ae0d1b8b821bce805aa5e4bf3988978b168aa3bc9e0d90b7df4011a50f7926e51d15f50747a95aa8b10f6b1cdd1c83185eab9670367bbfe5fac2be0729554db89cd502e77f829cc98a622a501855a6925ad0e9c49f435984c1ff19096f1e6fb2d1407cffa0118b5ea4e9b7615e4114bb596f0c3a444f9620010d49701bf4ef7f908af0cda6a576e7ea6dc86600b6e4a92344200381c25f5a22ffbb7d5b0f65197556aaf56b8f48eeb54f74b4cb438a589d36b454816faa9780812b89742b432560e4c74c6d74dd61a176e03d6ec6a1ae553fb9a6194b81afe06d4ffcccb49e4bf139da9a7124dd1d4424e219c83dc894b86da0dc1f111b3cc44ecbf441242afd79b2a656d7e6c00738e614b56d3797f31b06193a1acbd18f2d45d6d5d6fcaba5663eaa53f53038e18647acffe4f785b7b1591e4e42ffb48f10c9abf03c73628fd9ba4e2dd87299a53806a1f9cc79289744af62852edf9d87fb3ba905359b2974970a8f585e7701cb6d783f6368c43b941b378e63ef6ab07466978f52e6a0d6ecd454aec1c92a44c609cc229ee2956e64d78cd0af4be6c3eee58fea7da755d139c898463342d2c0fc2b3edb4e6480d40187e444c4acef8ddeae465a86302e8b1ebd76efddc7bc724e6473b24a641453a01d00de697c5c108ab3a3e81fe609f140d4593e95551305641486e8df7d62ce706433096c2150d20051a15ffc5d2302753598282f495faacbfab3256ba009777417e223fa2ae7a0dac854871ae262d975564b6708232d048b65570688d822b4e610613fc797655c34e62342b71e4acc23ee041a4309afa3401adb666373625cacb6af2225357619682aff71ad9b048fd6a45f3be5a0fd5ff72de0fae38ecc2740ff3ac62d66ee2fe10b7f1d4fdc8faa58aa103ed50d4a126184d1b36d6f6ab834976bc5e53c88103f89c8d34bf32f4d0b3ada745032e8af4e5010e003d34ee72b09b15de6769b5682fb45474a6dd333a54104e4e5d6384e32c865a7b8c745e9e58dcab0342c5ddd745cade3cd3e5393e42b0dcd840ef344faf77b09e8d5cab31485f45cbf58b46d2763cf0344efe37b44c70f2975fb693f8750c6562a3fe77c9face9eda99ef4f62a4d263d9a96e32ed759df2e916f08494251a991f5e083102fb510f28153a4dde4f8b554d33d776ea51febfbb0eb7583a158c93d0af5e7de85918ee13a5424ec688ee5d0a8879d5fd55f5c06fa0bf67d514e3fb4dfe532f8aaddbe9a56b0728c8c3d03b5d1df39728d7fa98ebc5e9fcfb529b87e024661475bb1c85f81d4c2d9222a30c2efe1d1fa91eee5989d57d52e48452ac29fc41bc691bb9c5fa22fcf6faa89fa16159efdc37e36980abb5d7866c4fa3ba8b00fa9684edccf67d34f86acb4c958b88d589d31be393c8b7a5e7124e7407e4cc562adb86b70fcbd196bd1e12a8ae2f8b03da6037badcb289e9219b198653f1e67c5c3e403290bd3d6658948eecdaa4c8658cb0639159bc7b46611425b9d0070a1aeea844cd83848abed8092fce539c877ffd1c4e588f3a548945808f16ae194d1350ce8d3d929571c01bd75d542b8c59b2ef75c131dbabe2b99fff0e61bb35070b1fe1276b7835730e1acd146a6d6599642bea84ef644c6bd83b5fdf2e4438b8df3931f83eebe702622bbd3b6d96b709c4c13853560cc0b68317802f3fe919336523d7eb041110bce13713e5847b7d75da453f26bf1f682ffa08fc79c8b83dea5e2c63dc3b9fdc670aa8d597243188a8440ba01135e1ba4751d62e831867cc528f811d1c92afe21c8036eb0adb013c940f5b0b8f245e54cef011a1f323b6ae5ccff25d10d2d0ab29f3ae89badddad898b3bf86826070df0aa0eb3bb1154756313cc42b09304c6cff41243859e0980cdaef542ceaf5aa6bd579f327a8977ee219d42b2e649dae4b3fdfc017f6cc06d2583b5b150afe2029e53864145c59c99e30583aa9709fd0b635c1f90293e0c584ee754e0d66b56e614c6382aee22f038cb391a53ed5d5ee9c619626199f5a73917c90561393f6eea6e5c9ba55c2c7f167665842b9817c44206608c1de090d9ce3a1ad4b113dd0d470b17c491c38d97fc97bc909cfecf298b4c33712d1b059f4055bdde5453bc6d47b9240f7942832ac11ad0e68716b3dcbd9c7937f7851361496ba7f9f2a3c0afc29c799e31b7f6d872b38d5bbc41738fa5887cbf71c5a92d528084c9c3a407a637c60f17a1ac96e8855e9935a44645f56fe14030bb6884690d02bbb1fe01e9d08f402e65362bc51d5646305cadae3fac17c02828805c056b709f5f44462e931502834517ad99e5acdfd5ea4799b479bab6d903dccf2f1370e9203cd089e4aca4c5c0ca6d62ecc63e7dfafcd2d82dafa49e920246ca26d45cb8b0ca0bdf38765104315a726b5204d63c0a4cd5ed351368c607701a107a9fe445b2a45de13fb6d1826da0607d04fc442a3eeb19e628ca616477edc495d76963f193d97b38ebf414f049d0e86f1f00482bce4851fed8417ade6ddcdfe32f1cee9b5e67e36cbd767fe826cef239ea83a5f57fbde578a2e4d1ba90afeadc89ffadb0cf57e14e27336a11a4280b870d502c0bf7634a06865d046ca8709c7114f0ae720a9e5336b7a5609ae4fea219ecee002f35facd82c72be8f158439c16e4dbd9e6963ce0159ff325f807c24248b3976f513c9e8416545c9ec7a1be2eb25b7792356b10e2b0c0bc87ab60e7b797e08388d3fdec7f811de87273b9d20df301f6470b2cef3fa188875561f53134c1549dc27e56f37df228135b04022e5bf2d81371fcc0c0fe269c171607198db15f", "c74b354ff4ea3cc135df8c3089bb1154921293ccef527eb1762baf18b2b8c8a22e2bad2d69964adeda0aab328165c7395ff4d3aa8b3d462ce93a08813c0faf336501e2927c8381b98548b3ebd2cac451df0f536ff855b02bddd25540ad6921fc446d60f4df1d51beb7441655278cac9182c9d6b89dc3f4a5be91b8e9dff43eb1c943f12669ea9363fd141cf6282d4e376cd62eed704276ee856bf674540cbc4d8c74f2f821882f99ad74c73308f1e0eaf0d60562291efa9364d7b95fdb4943fdf1cfa0b429f5b62b68ec91a2201b49908b8faeeb806bed78b2a11f0938b81e4c8e3b889dede1349f16891eb291c7bf0d61dd9b3aab863d15de4a19dcf5d784f346e60759b2a057cdef0af55ce073460058031bbe33a18e0282ff4def1d50f98e4f8fe46bf99ef61d437872793e86148052f9368c66dfe74f0f347c1784863c0344accac1df9fa60c33595519fcdbf4f4e50a5ec3d23254042625a930f0ce0eee90cb293997c3b714a2ca96eb1817cc138f1ee898e0d4324208882d867527d5d85fca1bd490df3ed2139b709c19fbe3da0f31275de3e0697b89cb0655e0abd243b72abba68f5514317f3455d3fe54b96c1de456402055f3403ed67f4f40581eebe153200ce88623663cd4742a73cbf8b6078f22d76cce565010678faa8e0e1b78c5865c30b3ac54dfd0f63e36ee149105e2ca1b9d3ce1062ca7d8cc67652936114a0062b18e072405b79d78cc376c6aba5e57c9b81a6e27032dd6c28c3d64fb1afd45839ddc1c1302bc550c40f0139804ba3fce86f380f4571375ad34cddc4992d7467629b5793beb513d8f6eef98f738c304aaf05df7b5ad26c10ab5ef1314bc3f1a5953ae0ff489e3b35632eb0123a1012397188c16742d4052e248a3e0bafb3e3d4b522e2ab30c4cb4baafeb3c6135cc3375a612d60c270d1b1cadabc82f48dbf2c4a3e06499efc43cb7d920a5fdb2530a99b4fc3f80f103d475033c2050fed97dd8365d7214ab85552ca7dbede9a1b5b70bbecfdc2ce1f8f5be531fb27cc1f9f8b68bc1003153652c5db7d7dd46874ff473cd72299bd94ac76b9342ab611e79d4c23d266b7ab3a16f0bd459461326e74f628bcf889b89dc70fc54157a695b89fe0cf2add09a8fefbe79e2a886f586a9ab300308c995c6a4db5f45f80e5f274043dcbc6727200ae132273efb8deaaa70728022aff38f1a366b1a8445748b3e1ecb5e5d90b4c4a5b81b1eeb2836136dc05bd98df43c11768830a27383e48f7330e58e90b78234b7a6b2cc21cfb8610df475cab1321579c241c8cb3f35273fa5e297f45546b8e33f8162351989a0bd145339b696d53569c0156e6da7a72f948d7d7c443177b45423bc99c08e1b0933df1cc216b90a8fb41c33b2dba1ceb1c5496bd08c9b9e0daf3f7c6991d84f028c8cf22056996b2b7cbb1f6c823e63aa20feb10b9b0322875b1a0da09a6ae8fc177f03cf14e39319acb88a21be4b2d7832f57a085c4b11f2efd85e509b701f0d3070eaabd579c00420aaf67f6908f1c3ffbb0c05dbe3b05ca966bde2124d5a8a1341f15ce0199e6d54c8e2ad9a8d68319f34abd2240e2ad4f846b7af3751f1af2ee996e78378ccb8b7f27b7aa85b50235011b243f8b5aa083ecdcb957092871be949b2ff6b8211abda472d53e69afe194b39536b9e7f2b6d01cb00d037bbd82d5f03aa8c88514cfb6509008c17242d9d5cfc2fac8d64a5c9bf4c736ba058a8cbd095b01494d048ebe194759ee2636fd505721d671545e3be9c00d0ed61c6dd2fe6927ce1779e72aa35bc5a99163da07e4b687eb6c337fe051a41f8d645a2e3605c73084bbf9843a3785eef83a4d78a38fbf1fddc057255a7c4310db6c899391719e7ac85c72b283dd4e7cd1da4ba239ccf2a69a037967af25786d6533641e5384b4faf80d34e0d4b35f42d287655f8bba98d16b49907851821f637ee82f3d37b5886840d5df397c55ed5b7b4034ccb5a0bb7e8a2d931486747a7b0f45d50e245aafabce346017f3fcfe2a92adb69a1e642298c8ebcd3aa32b6bb795491e128e9c4bbacd38d4e73ba8738361a557c2f636c7ecf08ea190610a01d251f773f5b400a1c58093a82a0b63f477c15df233d383e017a3fa54b537ca3874742c0b21cd0e3f9e7e719475a5d80ddc99c2c96ee1dd5c82a7136bd5656eab61e8fb39fdd5e939ea2344d996c67c52faf657eecd177eddaef4d7c364c97c635f8af11bfe0be1817b41395100109c3f8e4e957974bff6085b738216539d77d51515ff5f3bdb028c24abf3aa3c1f6ad77f259919aec0536fd5a4b83f5d568654394c8925e51103bac5d2a972c2031d1ab18f53ab06c0570d38fe1596fe6879ebc255324225afccbf563bd1c9a3569113e261afc4f14e200b70098c7f75d28a68cc5bb7735f4b52834856da85a40fffa996914e2fa13c71d6f8dd0e2b7226b013fe76e6c462c5d4d02665381b7d1bd031c98ce7ac763ac52bd5f51bee48adf840bddeda8673f2681f000e6c1b6f72ec3d0db2ddcbecb670a3664866744b55c2981ae005705c34d217f55b2c383b9bb5feb4235b4e03c395bc34b2f99f2632bb3389b50bd27b8a10c9eef841ec4222e2c3cd3db138095e530357ec95879cf9e0a94e645af35c73191dd672ed793106e93d7eb679c95720918a7790ef638a8dc38a54e37fb75fa48793f4819e4c6994ec754c6389f1d974c023988639cedd4e563df62e18f73c786ec1d58560c81adba6f6cd9c90e48be292635969a54968c8defe8925d5be1876031b037d3e6d442921cd4b53b1070f19d433ee91f742d7361f53187ec07b5756c4ea27debc4797d8041b9f3eaba38a1381536a54085c91e1965b311f51e5c0d0ea60ea0a6523d245ac22d35b9564a4d82500e7fbdb96ce9adea3d256d0f04a78f23b60af2d4dafe3d94609c037d87682fccf18740cbc9945ad9850aba7510214755b3cc85b239a9a373304e7b74fb5ff6a387dd94d07241c5b6747f948d2f5178df181d9811b3d74f7bd33112dc9d529cfabb4e9eec2de9fb24b1679e0779f306a7badcc6a763a06e0ce80acc24cdece723688cc550305e6083c003d8f880dbaf64b64c1d749ef698de47c8ba78da72280ba4567abc46582a0bc0cbcebdcbf8e6ec71f5d13d168d3905e24124f747e7bd5d8bfbbac9bc3da8d6b19c479a62802d4aa069814c955f440d0e27c19c74bbe63fdd84d65baa001b3d660c180c15346c2e78f3c1dabb332f578bcd0e44333f0dc6a6a6689db066cbe687e9adef4a0076b6d57c2817fa6be3465351076722cbc5ffb087eda9f746007c7cce084aaae4b632324409f79c87977671538582d9bc7304b4058a6a3d192dae511df7e2b421e0e7a46e9f4bc8a0049691a25b5359975caf449e84dcc71000d129d389189feb741b506e1121a5e949e667e71c7e44b24ec9f3ea75b80a8e54a7a839c8f3dc6ff98612edab8a725f8a9c579b17598d660ce5e380a596433c002cc48d78ef3f0c040573d32d0dccb4ec02f727676430d4118e657feb0ae6f2c6df53193d99f19060fda6a5df81620b05fd9ce93b6531af8266d204056e207bc2246fefb63564faa8039734915808656f8716301a60cb3e5ba2c413485767492318eae829f0cc9370bdfd7a8d3ce043839f9bc3f91de0e843b5a0f5f0558b5c6115ce4059bddc8e1a687c9c4c66267787b96f668940ece2faecd772c9d215b6ec4b886772e28fe76381a55a57c88f97db5ae40a7441303672ef6761280b34758a42bcfeb160fbe9ba13ba37735edb04a5606d2d511080cfb765a39039dbb5ffc3cef1225d2c9f8b080295789cae61ae0284f523adc352d2128063a6be1dcb3815ff1cec2946aa064624027b92596e93b8d35ed7691542dc07c05411bf5bf7c7d99e6a952ee158377ccc6a2b274faa54feaeea203e0a86d9b3c9896bf510dfc28ec60174e1bc40e01339b3f078a464b8590aec296791a88c064d5a12f0d7b033713052e5eee659b22bcc9796505ee5a14e05590edf70d789f0fbb9b843497a8819343be35e5b9e0d32e41e214186b5d0696f3c8fddcd79c3cef7ec53f7f66742b4eec588729e75591072e0994d8506450d771996aca5219dae09280df8082f5a7e634391f9bf41a7ed486b8f79227618bcde93c365d42bc0e86b9aa7e06aa4db81212f7578fbf53702eaa9ac88d6624d76342177a536e91390bc0720e3d9c88f5c53a2ed0661e533bab6ee02f286bdd0cea7a1773f83dd07b68ac28757596a6e64e2a7e7ef0901b6f7572e6532644541ae418686147293a6006fb6dfe432defefca6e7b2141a797f5fc6b635f667706a5fe66218cd6f224cc6f6b95887bce165e51d976419a79ead9179208720bc8b9d356857ba491fbb6a40904c83a03750ab80a21f96a8d001378796a09939a5558085b51d77488f0b207405e8238f610177f4d95ef3c541c822c6662b7dabff5cd7cacb1ee0e83eddd0fbd58528f1b4ce295df86042867838915bab83b54ad84bb2f919273dafdaa7855c8d3d5ce4047ed82d8a1fed81426346296507e70e07e12c95f087b8b664ddef23d95d737f9e8c4e98fe9c9359351e4c9436175fe97270a3ea405e162e379857232117160e26fc48128ba552d73a6c981a70c135e5335d0fcfd20ff8f76fd8b91b9be86840e8640810a063e3b3b3fe9ba996e8528d46e0e083f2ca957667ed8bffc26c7452c19f85697bd28c5e78756871c9714bb2f54f993943f4007a5b83a56de58adfe31784653b9ffd869ba1563836aabc73d24b8c4f5a6ac35da12ea9b501110296aa1868e346872aff3389701e5927f661c8f4195a82e003c6846dcece6f21781c555c33cd071cb00dc742f0089d926bd686d6551c2fb7063fb35e02298d1564c7ffc56164e634fd85994de8da697aae7ee299d4e747691afcbbfa05313d16b8fedd764a961a5b78fa562bbeee620473aaf885e49ac6b19548397ad2cc56bd44106718ccee062ed258d570de85a08fb09038853eb926a64f0b2703fb5503b518a2a08a0ede31fe4887f4eda7dba3c548703ea336da3d3117081a9cc78f58b1b7cb2c55d63c3425dfd1f65c9ba742eec55ffb10926e2c0af3120f3c7f2cf33450c9a51c64b47be12ae3097b127bfc9c4bbd44285933a6c12611f92f4857a8ed89a1a6b04a88f5411dd7781bad097bb746f8fd1a82c7caa89ff86e56d6371413807e1ea959fe7819451c6d221a5f488fa898d8e0f968355fd7fa2c82ad3099e9150c0dd781d6bf4e4eae10b49689c02eaf9e6d5445e71a04ac4615a46e5ce0529e3de0e311c8c1a55ce03e831dcc97699463fe394e1462393b613934fcb9c3e72c645fc7af429226f41bc0720c2e78da728fe9b2cbc5082e6b82337cf53b12ddec9595b75d6b444593d04d8a4925ba0a9c26aa82b6a3cfb9b7feecd2dccbb50039c70fcbf1ced9d9c5703e39e95cc57010a13d9cf9c07d933b0e088fb4bec85905d385f758a4fad25dcb4c7cd59a9cb56a35fc032c33878bd92253e2342d16e5048ca6a83069d409a5dac5f8cbf2ed903f17e88691cd7abfd7933f66a6adcbe82c98ba9da0ec439c34fe71e4be4700865f32736e4392426d1ac077f1c88845d36f8cb05d45350833e6739c83bae3da555de8579a26db4082acefdcba69979ac3c459b7d5378c6e4503dfd085c3c884d6b46631f93e93a9c46be14e0c528ced0f85e9c031075631134602a3293c994c2fbeb33ab5e4def99965a779c29c9a43dda171544a17b2f906b305cf1b575fb5c15cce2e699fa4d55e424ecb52bb873c7309"}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x2, 0x0) ioctl$int_in(r3, 0x800000c0045005, &(0x7f00000004c0)=0x100040000) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000080)={{0x16, @remote, 0x4e23, 0x1, 'lc\x00', 0x10, 0xf962}, {@multicast2, 0x4e21, 0x0, 0x6154, 0x7}}, 0x44) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000340)={0x0, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e21, @local}, {0x2, 0x4e22, @multicast2}, 0x14, 0x0, 0x0, 0x0, 0x7b, &(0x7f0000000300)='batadv0\x00', 0x7, 0x100, 0x5d10}) r4 = fcntl$dupfd(0xffffffffffffffff, 0x404, 0xffffffffffffffff) socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$VIDIOC_TRY_ENCODER_CMD(0xffffffffffffffff, 0xc028564e, &(0x7f0000000040)={0x0, 0x0, [0x3, 0x0, 0x100000000, 0x0, 0x5, 0x0, 0xb7]}) clone(0x200000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000003c0)=@assoc_value, &(0x7f0000000400)=0x8) write$P9_RUNLINKAT(r4, &(0x7f0000002140)={0x7, 0x4d, 0x2}, 0x7) r5 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) request_key(0x0, 0x0, 0x0, r5) r6 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xe78f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup(r6) fcntl$lock(r6, 0x24, &(0x7f0000000080)) [ 2204.255768] binder: 6294:6300 transaction failed 29201/-71, size 0-0 line 2762 00:58:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) shutdown(r0, 0x1) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:07 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2204.383629] binder: release 6294:6297 transaction 2515 out, still active [ 2204.419262] binder: undelivered TRANSACTION_COMPLETE 00:58:08 executing program 5: keyctl$read(0x12, 0xfffffffffffffffd, 0x0, 0x0) [ 2204.562442] binder: BINDER_SET_CONTEXT_MGR already set [ 2204.621966] kauditd_printk_skb: 141 callbacks suppressed [ 2204.621983] audit: type=1400 audit(1555635488.073:39336): avc: denied { map } for pid=6302 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2204.685197] binder: 6294:6309 ERROR: BC_REGISTER_LOOPER called without request [ 2204.786540] audit: type=1400 audit(1555635488.103:39337): avc: denied { map } for pid=6302 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2204.868435] binder: 6294:6297 ioctl 40046207 0 returned -16 [ 2204.874727] binder: release 6294:6297 transaction 2515 in, still active [ 2204.894740] binder: send failed reply for transaction 2515, target dead [ 2204.909658] binder_alloc: 6294: binder_alloc_buf, no vma [ 2204.924549] audit: type=1400 audit(1555635488.153:39338): avc: denied { map } for pid=6302 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2204.947125] binder: undelivered TRANSACTION_ERROR: 29201 [ 2205.032517] audit: type=1400 audit(1555635488.153:39339): avc: denied { map } for pid=6302 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2205.070526] binder: 6294:6308 transaction failed 29189/-3, size 0-0 line 2970 [ 2205.170696] audit: type=1400 audit(1555635488.273:39340): avc: denied { map } for pid=6311 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:08 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2205.257937] binder: undelivered TRANSACTION_ERROR: 29189 [ 2205.267786] protocol 88fb is buggy, dev hsr_slave_0 [ 2205.272952] protocol 88fb is buggy, dev hsr_slave_1 00:58:08 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2205.331030] audit: type=1400 audit(1555635488.273:39341): avc: denied { map } for pid=6311 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:08 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) gettid() fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) [ 2205.480842] audit: type=1400 audit(1555635488.273:39342): avc: denied { map } for pid=6311 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2205.572377] audit: type=1400 audit(1555635488.273:39343): avc: denied { map } for pid=6311 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2205.659769] audit: type=1400 audit(1555635488.343:39345): avc: denied { map } for pid=6311 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2205.706232] audit: type=1400 audit(1555635488.323:39344): avc: denied { call } for pid=6294 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 00:58:09 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) timer_create(0x0, &(0x7f0000044000), 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) getpgrp(0x0) 00:58:09 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) accept(r1, &(0x7f00000001c0)=@vsock={0x28, 0x0, 0x0, @reserved}, &(0x7f0000000100)=0xfffffffffffffed1) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:09 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2206.236667] binder: 6332:6338 ERROR: BC_REGISTER_LOOPER called without request [ 2206.272936] binder_alloc: 6332: binder_alloc_buf, no vma [ 2206.292957] binder: 6332:6338 transaction failed 29189/-3, size 0-0 line 2970 [ 2206.324290] binder: send failed reply for transaction 2518 to 6332:6338 [ 2206.381393] binder: undelivered TRANSACTION_COMPLETE [ 2206.386813] binder: undelivered TRANSACTION_ERROR: 29189 [ 2206.580329] binder: 6332:6338 ERROR: BC_REGISTER_LOOPER called without request [ 2206.694406] binder: release 6332:6348 transaction 2521 out, still active [ 2206.726489] binder: undelivered TRANSACTION_COMPLETE 00:58:10 executing program 5: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x3c, 0x0, 0x0) 00:58:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:10 executing program 4: r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) preadv(r0, &(0x7f0000000700)=[{0x0}, {&(0x7f0000000200)=""/246, 0xf6}], 0x2, 0x0) [ 2206.874714] binder: undelivered TRANSACTION_ERROR: 29190 [ 2206.880840] binder: send failed reply for transaction 2521, target dead [ 2207.347738] protocol 88fb is buggy, dev hsr_slave_0 [ 2207.352877] protocol 88fb is buggy, dev hsr_slave_1 00:58:10 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 00:58:11 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:11 executing program 4: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000080)=0x7) [ 2207.723340] binder: 6368:6370 ERROR: BC_REGISTER_LOOPER called without request [ 2207.763279] binder_alloc: 6368: binder_alloc_buf, no vma [ 2207.803053] binder: 6368:6370 transaction failed 29189/-3, size 0-0 line 2970 [ 2207.817804] binder: send failed reply for transaction 2523 to 6368:6370 [ 2207.834762] binder: undelivered TRANSACTION_COMPLETE [ 2207.840239] binder: undelivered TRANSACTION_ERROR: 29189 00:58:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000000200)={0xffffffffffffffff}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000380)={0x0}) ioctl$DRM_IOCTL_DMA(r3, 0xc0406429, &(0x7f00000004c0)={r4, 0x6, &(0x7f00000003c0)=[0x1, 0x100000000, 0x200, 0x9, 0x10000, 0x3ff], &(0x7f0000000400)=[0x8], 0x0, 0x4, 0xb41, &(0x7f0000000440)=[0x4, 0xffffffffffffff54, 0x5, 0x3], &(0x7f0000000480)=[0xe055, 0x5, 0x74a3, 0x2, 0x8, 0x6]}) setsockopt$inet6_buf(r2, 0x29, 0x0, &(0x7f0000000280)="2cd9b9c9ee26cc3c8c3b559e301d1612a27f27f3654795a75d2578d7dd56144ecf336e867c4fcc63c2d3722b8c5abc650589d86d4c60ed2cea6ad328a1566419f7198b5f09b4af2a0ffecea73d56f56c5399fd9e54d12dae8a00ce5a23edff97c81c44b0aeb05f38dbbd0371a1cb084326040390b31ae5dbdd2b70e7a9914f14fd4e57fc3b3c48e0f3f36f31c85494f6c7c6fe3804db6aec2f04765143e2a034a6a54dc6af00ecc7469e9c6277f6c3d52cb07f4e9852b90f940e23038936e1f962162889b9539bb4903a445982e920a6c2a36f614fcd8743182bcf8c0c", 0xdd) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000540)=ANY=[@ANYBLOB="ffffffff0000000900648537c000000003000200ac1414db000004a4b80ddda92ed709388d705c00141cbb890d466a9ca3e65f77b2262d213fa93f"], 0x1c) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r5 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) write$UHID_GET_REPORT_REPLY(r5, &(0x7f0000000140)={0xa, 0x4, 0x9, 0x8}, 0xa) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000000500)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000900)=""/4096, 0x1000}], 0x1}, 0x0) syz_open_dev$ndb(&(0x7f00000001c0)='/dev/nbd#\x00', 0x0, 0x80000) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) setsockopt$inet_tcp_int(r0, 0x6, 0x6, &(0x7f0000000040)=0x80000001, 0x4) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2207.984866] binder: 6368:6372 got reply transaction with no transaction stack [ 2208.023786] binder: 6368:6370 ERROR: BC_REGISTER_LOOPER called without request [ 2208.055598] binder: release 6368:6375 transaction 2525 out, still active [ 2208.064727] binder: 6368:6372 transaction failed 29201/-71, size 0-0 line 2762 [ 2208.073774] binder: undelivered TRANSACTION_COMPLETE 00:58:11 executing program 5: openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x4000, 0x0) 00:58:11 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x37, 0x0, &(0x7f0000000080)) [ 2208.119168] binder: undelivered TRANSACTION_ERROR: 29201 00:58:11 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2208.217557] binder: undelivered TRANSACTION_ERROR: 29190 [ 2208.223860] binder: send failed reply for transaction 2525, target dead 00:58:12 executing program 5: mprotect(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000) [ 2209.019352] binder: 6389:6391 ERROR: BC_REGISTER_LOOPER called without request [ 2209.077103] binder_alloc: 6389: binder_alloc_buf, no vma [ 2209.113049] binder: 6389:6391 transaction failed 29189/-3, size 0-0 line 2970 [ 2209.143623] binder: send failed reply for transaction 2528 to 6389:6391 [ 2209.180097] binder: undelivered TRANSACTION_COMPLETE [ 2209.185320] binder: undelivered TRANSACTION_ERROR: 29189 [ 2209.266385] binder: 6389:6392 got reply transaction with no transaction stack [ 2209.274375] binder: 6389:6392 transaction failed 29201/-71, size 0-0 line 2762 [ 2209.274842] binder: 6389:6391 ERROR: BC_REGISTER_LOOPER called without request [ 2209.290272] binder: release 6389:6394 transaction 2530 out, still active [ 2209.309126] binder: undelivered TRANSACTION_COMPLETE [ 2209.323962] binder: undelivered TRANSACTION_ERROR: 29201 [ 2209.363265] binder: undelivered TRANSACTION_ERROR: 29190 [ 2209.369155] binder: send failed reply for transaction 2530, target dead [ 2209.633777] kauditd_printk_skb: 122 callbacks suppressed [ 2209.633794] audit: type=1400 audit(1555635493.083:39468): avc: denied { map } for pid=6396 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.708322] audit: type=1400 audit(1555635493.083:39469): avc: denied { map } for pid=6396 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.761791] audit: type=1400 audit(1555635493.083:39470): avc: denied { map } for pid=6396 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.807734] audit: type=1400 audit(1555635493.093:39471): avc: denied { map } for pid=6396 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.834211] audit: type=1400 audit(1555635493.093:39472): avc: denied { map } for pid=6396 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.860244] audit: type=1400 audit(1555635493.133:39473): avc: denied { map } for pid=6397 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.883018] audit: type=1400 audit(1555635493.133:39474): avc: denied { map } for pid=6397 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.905501] audit: type=1400 audit(1555635493.133:39475): avc: denied { map } for pid=6397 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2209.931218] audit: type=1400 audit(1555635493.143:39476): avc: denied { map } for pid=6397 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:13 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:13 executing program 4: mq_getsetattr(0xffffffffffffffff, &(0x7f0000000000)={0x53}, 0x0) 00:58:13 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000040)={'bond0\x00', 0x7fffffff}) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:13 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xe4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2209.955176] audit: type=1400 audit(1555635493.153:39477): avc: denied { map } for pid=6397 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:13 executing program 5: r0 = syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0401273, 0x0) 00:58:13 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)) [ 2210.157780] net_ratelimit: 6 callbacks suppressed [ 2210.157788] protocol 88fb is buggy, dev hsr_slave_0 [ 2210.167848] protocol 88fb is buggy, dev hsr_slave_1 00:58:13 executing program 5: r0 = socket$unix(0x1, 0x2, 0x0) sendmmsg$unix(r0, &(0x7f0000000980)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=[@rights={0x10, 0x1, 0x1, [0xffffffffffffffff]}], 0x10}], 0x1, 0x0) [ 2210.307758] protocol 88fb is buggy, dev hsr_slave_0 [ 2210.312933] protocol 88fb is buggy, dev hsr_slave_1 [ 2210.318177] protocol 88fb is buggy, dev hsr_slave_0 [ 2210.323287] protocol 88fb is buggy, dev hsr_slave_1 [ 2210.345775] binder_alloc: 6400: binder_alloc_buf, no vma [ 2210.369697] binder: 6400:6406 transaction failed 29189/-3, size 0-0 line 2970 [ 2210.393404] binder: 6400:6408 ERROR: BC_REGISTER_LOOPER called without request [ 2210.417353] binder: 6400:6406 got reply transaction with no transaction stack [ 2210.440052] binder: 6400:6406 transaction failed 29201/-71, size 0-0 line 2762 [ 2210.465299] binder: undelivered TRANSACTION_ERROR: 29189 [ 2210.478261] binder: undelivered TRANSACTION_ERROR: 29201 [ 2210.573544] binder: 6400:6417 transaction failed 29189/-22, size 0-0 line 2855 [ 2210.624817] binder: 6400:6406 ERROR: BC_REGISTER_LOOPER called without request 00:58:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) poll(&(0x7f0000000200)=[{r1, 0x10}, {r1}, {r0}, {r0}], 0x4, 0xffffffff) 00:58:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:14 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:14 executing program 5: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGSW(r0, 0x8040451b, 0x0) [ 2211.495117] binder: 6425:6427 ERROR: BC_REGISTER_LOOPER called without request [ 2211.517761] protocol 88fb is buggy, dev hsr_slave_0 [ 2211.522993] protocol 88fb is buggy, dev hsr_slave_1 [ 2211.561730] binder: 6425:6432 got reply transaction with no transaction stack [ 2211.652261] binder: 6425:6432 transaction failed 29201/-71, size 0-0 line 2762 [ 2211.672496] binder: release 6425:6427 transaction 2537 out, still active [ 2211.688427] binder: undelivered TRANSACTION_COMPLETE [ 2211.749713] binder: 6425:6432 got reply transaction with no transaction stack [ 2211.774316] binder: 6425:6427 ERROR: BC_REGISTER_LOOPER called without request [ 2211.782206] binder: 6425:6432 transaction failed 29201/-71, size 0-0 line 2762 [ 2211.796744] binder: release 6425:6434 transaction 2539 out, still active [ 2211.807942] binder: undelivered TRANSACTION_COMPLETE [ 2211.823832] binder_release_work: 1 callbacks suppressed [ 2211.823840] binder: undelivered TRANSACTION_ERROR: 29201 [ 2211.857496] binder: release 6425:6427 transaction 2537 in, still active [ 2211.873621] binder: send failed reply for transaction 2537, target dead [ 2211.884085] binder: undelivered TRANSACTION_ERROR: 29201 [ 2211.897086] binder: send failed reply for transaction 2539, target dead [ 2212.237741] protocol 88fb is buggy, dev hsr_slave_0 [ 2212.242940] protocol 88fb is buggy, dev hsr_slave_1 00:58:16 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:16 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:16 executing program 3: socket$inet(0x2, 0x3, 0x1c) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x0, @local, 'hwsim0\x00'}}, 0x1e) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000140)=0x4) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000000c0)={'tunl0\x00', 0x600}) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r1, 0x1000008912, &(0x7f0000000200)="0ad401974b078c70") openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x8000, 0x0) 00:58:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:16 executing program 5: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) 00:58:16 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) accept4(r0, 0x0, 0x0, 0x0) 00:58:17 executing program 4: r0 = syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0401273, &(0x7f0000000140)={[], 0x0, 0x5, 0x3f}) 00:58:17 executing program 5: dup(0xffffffffffffffff) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'e \x00\b\x00', 0x2}, 0x18) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x8916, &(0x7f0000000000)) ioctl(r1, 0x8936, &(0x7f0000000000)) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x81, 0x8, 0x0, 0x3f, 0x7fff, 0x0, 0x4, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, 0x0, 0x0, 0x1, 0x0, 0x3f, 0xf26, 0x0, 0x0, 0x71ed, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x7, 0x0, 0x1, 0x7fff}, 0x0, 0x0, r0, 0xa) [ 2213.674098] binder: 6439:6447 ERROR: BC_REGISTER_LOOPER called without request [ 2213.739400] binder: 6439:6451 got reply transaction with no transaction stack [ 2213.746922] binder: 6439:6451 transaction failed 29201/-71, size 0-0 line 2762 [ 2213.947708] binder: release 6439:6447 transaction 2542 out, still active [ 2213.954655] binder: undelivered TRANSACTION_COMPLETE [ 2214.019631] binder: release 6439:6447 transaction 2542 in, still active [ 2214.026586] binder: send failed reply for transaction 2542, target dead [ 2214.065890] binder: undelivered TRANSACTION_ERROR: 29201 [ 2214.088603] binder: 6439:6451 ERROR: BC_REGISTER_LOOPER called without request 00:58:17 executing program 4: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='bcsh0\x00', 0x10) [ 2214.159031] binder: release 6439:6457 transaction 2544 out, still active [ 2214.170862] binder: undelivered TRANSACTION_COMPLETE 00:58:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2214.284631] binder: release 6439:6451 transaction 2544 in, still active [ 2214.296235] binder: send failed reply for transaction 2544, target dead 00:58:17 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:17 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0) 00:58:18 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000040)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x14) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={r2, 0x1}, 0x8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2214.787349] kauditd_printk_skb: 106 callbacks suppressed [ 2214.787364] audit: type=1400 audit(1555635498.233:39584): avc: denied { map } for pid=6471 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2214.919359] audit: type=1400 audit(1555635498.313:39585): avc: denied { map } for pid=6471 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.037678] audit: type=1400 audit(1555635498.313:39586): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.153722] binder: 6472:6480 transaction failed 29189/-22, size 0-0 line 2855 [ 2215.197407] audit: type=1400 audit(1555635498.313:39587): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.279987] binder: undelivered TRANSACTION_ERROR: 29189 [ 2215.339249] audit: type=1400 audit(1555635498.353:39588): avc: denied { map } for pid=6471 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.500137] audit: type=1400 audit(1555635498.403:39589): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.647688] audit: type=1400 audit(1555635498.403:39590): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.781875] audit: type=1400 audit(1555635498.443:39591): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2215.917906] audit: type=1400 audit(1555635498.473:39592): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:19 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:19 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000000400)={0x7b}) 00:58:19 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x5, 0x10000) mq_timedreceive(r2, &(0x7f0000000080)=""/50, 0x32, 0xf7a, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:19 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:19 executing program 5: socket$inet_smc(0x2b, 0x1, 0x0) [ 2216.120693] audit: type=1400 audit(1555635498.543:39593): avc: denied { map } for pid=6471 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:19 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:19 executing program 4: ioctl$DRM_IOCTL_MAP_BUFS(0xffffffffffffffff, 0xc0186419, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) 00:58:19 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x89b1, &(0x7f0000000040)={'l\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00H\xe0'}) [ 2216.425786] binder: 6491:6497 ERROR: BC_REGISTER_LOOPER called without request [ 2216.473210] binder_alloc: 6491: binder_alloc_buf, no vma [ 2216.514654] binder: 6491:6497 transaction failed 29189/-3, size 0-0 line 2970 [ 2216.544099] binder: send failed reply for transaction 2548 to 6491:6497 [ 2216.573541] binder: undelivered TRANSACTION_COMPLETE [ 2216.578878] binder: undelivered TRANSACTION_ERROR: 29189 [ 2216.691056] binder: BINDER_SET_CONTEXT_MGR already set [ 2216.756844] binder: 6491:6506 ERROR: BC_REGISTER_LOOPER called without request [ 2216.801236] binder: undelivered TRANSACTION_ERROR: 29190 [ 2216.827156] binder_alloc: 6491: binder_alloc_buf, no vma [ 2216.864085] binder: 6491:6497 ioctl 40046207 0 returned -16 [ 2216.921161] binder: 6491:6508 got reply transaction with no transaction stack [ 2216.960481] binder: 6491:6505 transaction failed 29189/-3, size 0-0 line 2970 [ 2217.002851] binder: 6491:6508 transaction failed 29201/-71, size 0-0 line 2762 [ 2217.043875] binder: undelivered TRANSACTION_ERROR: 29189 00:58:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:20 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x0) [ 2217.122726] binder: undelivered TRANSACTION_ERROR: 29201 00:58:20 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x311000) r3 = openat$cgroup_ro(r2, &(0x7f0000000140)='memory.events\x00', 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) poll(&(0x7f0000000040)=[{r1, 0x4060}, {r0, 0x200}, {r1, 0x8203}, {r1, 0x400}], 0x4, 0x4) readv(r1, &(0x7f0000000340)=[{&(0x7f0000000280)=""/84, 0x54}, {&(0x7f0000000300)=""/59, 0x3b}], 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYRESHEX=r3], 0x12) ioctl(r0, 0x8000, &(0x7f00000000c0)="0ad401003c123f319bd070") ioctl$IOC_PR_RELEASE(r3, 0x401070ca, &(0x7f0000000200)={0x5, 0x8}) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000080)) [ 2217.773580] binder: 6523:6526 transaction failed 29189/-22, size 0-0 line 2855 [ 2217.817388] binder: undelivered TRANSACTION_ERROR: 29189 [ 2217.924666] binder: 6523:6532 transaction failed 29189/-22, size 0-0 line 2855 [ 2217.982205] binder: 6523:6529 got reply transaction with no transaction stack [ 2218.029206] binder: 6523:6526 ERROR: BC_REGISTER_LOOPER called without request [ 2218.069399] binder: undelivered TRANSACTION_ERROR: 29189 [ 2218.075479] binder: 6523:6529 transaction failed 29201/-71, size 0-0 line 2762 [ 2218.113330] binder: undelivered TRANSACTION_ERROR: 29201 00:58:22 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:22 executing program 4: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffe, 0xfffffffffffffffe, 0x0, 0x7fffffd, 0x0, 0xd1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xcd84}, 0x800000200000000, 0x2}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, 0x0) 00:58:22 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x8002) write(r0, &(0x7f0000a2afe3)="b63db85e1e8d020000000000003ef0011dcc606aed5ed2bc7018cebc9b97ae21b14d872c678ce22c9b160096aa1fae1a", 0x30) ioctl$SG_GET_PACK_ID(r0, 0x227c, 0x0) 00:58:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:22 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x80000, 0x8fe0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:22 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2219.104095] binder: 6541:6546 ERROR: BC_REGISTER_LOOPER called without request [ 2219.148846] binder_alloc: 6541: binder_alloc_buf, no vma [ 2219.171049] binder: 6541:6546 transaction failed 29189/-3, size 0-0 line 2970 [ 2219.201084] binder: send failed reply for transaction 2556 to 6541:6546 [ 2219.237191] binder: undelivered TRANSACTION_COMPLETE [ 2219.249162] binder: undelivered TRANSACTION_ERROR: 29189 [ 2219.504439] binder: undelivered TRANSACTION_ERROR: 29190 [ 2219.789404] kauditd_printk_skb: 147 callbacks suppressed [ 2219.789419] audit: type=1400 audit(1555635503.243:39741): avc: denied { map } for pid=6558 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2219.827768] net_ratelimit: 4 callbacks suppressed [ 2219.827776] protocol 88fb is buggy, dev hsr_slave_0 [ 2219.837826] protocol 88fb is buggy, dev hsr_slave_1 00:58:23 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x20002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_group_source_req(r1, 0x29, 0x30, &(0x7f00000002c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @initdev}}}, 0x488) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000040)) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2e) fcntl$setstatus(r1, 0x4, 0x42803) 00:58:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f00000001c0)) 00:58:23 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000200)='westwood\x00', 0x9) write$binfmt_elf64(r1, &(0x7f0000000900)={{0x7f, 0x45, 0x4c, 0x46, 0x9, 0x8793, 0x7, 0x9, 0x3, 0x3, 0x3f, 0x10000, 0x27, 0x40, 0x2b0, 0xfffffffffffffffa, 0x7, 0x38, 0x1, 0x2, 0xdbaf, 0x7f}, [{0x3, 0x7, 0x4, 0xffffffffffffffff, 0x6, 0x8000, 0x3, 0x6}], "6782d53be2042937a80984c5f95b37e834e1d98c2dd748b491ab1f18151d35aa5f2aa5481658fa0883ab13504496e7aa36d6b125c3b97f61ca359fdf6710a6ff35b04249bf37e4ae5fdfd910b7b771243486d2e8", [[], [], [], [], [], []]}, 0x6cc) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f00000002c0)={0x7, &(0x7f0000000280)=[{0x6, 0x39, 0x55, 0x200}, {0x3, 0x1, 0x2, 0x10001}, {0x7, 0x7ff, 0x6, 0x8001}, {0x2, 0x52db, 0x1fffe000}, {0x7, 0x1a82, 0xfc00000000000000, 0x4}, {0x5, 0x4c1, 0x400, 0x5}, {0x4, 0x3, 0xba4, 0x3}]}, 0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x1b5}, &(0x7f0000000100)=0xfffffd57) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000140)={r3, 0x2}, &(0x7f00000001c0)=0x8) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={0xffffffffffffffff, r4, 0x0, 0x8, &(0x7f0000000300)='vmnet1:\x00'}, 0x30) fcntl$lock(r2, 0x0, &(0x7f0000000380)={0x1, 0x7, 0x6, 0x800, r5}) ioctl$RTC_AIE_ON(r4, 0x7001) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2220.021411] audit: type=1400 audit(1555635503.423:39742): avc: denied { map } for pid=6565 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2220.114124] audit: type=1400 audit(1555635503.473:39743): avc: denied { map } for pid=6565 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2220.284402] audit: type=1400 audit(1555635503.473:39744): avc: denied { map } for pid=6565 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:23 executing program 5: socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, 0x0, 0x256) r0 = open(&(0x7f0000000280)='./file0\x00', 0x143042, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) r1 = gettid() ptrace$peekuser(0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) semctl$GETNCNT(0x0, 0x0, 0xe, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f0000ffa000/0x3000)=nil) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, 0x0) write$P9_RXATTRWALK(r0, 0x0, 0xae) tkill(r1, 0x1000000000016) [ 2220.425735] audit: type=1400 audit(1555635503.503:39745): avc: denied { map } for pid=6565 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2220.441554] binder: 6567:6571 transaction failed 29189/-22, size 0-0 line 2855 [ 2220.567914] audit: type=1400 audit(1555635503.553:39746): avc: denied { map } for pid=6565 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2220.600327] binder: undelivered TRANSACTION_ERROR: 29189 [ 2220.738654] audit: type=1400 audit(1555635503.553:39747): avc: denied { map } for pid=6565 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2220.813516] binder: 6567:6580 got reply transaction with no transaction stack [ 2220.900481] audit: type=1400 audit(1555635503.593:39748): avc: denied { map } for pid=6565 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2220.936943] binder: 6567:6571 ERROR: BC_REGISTER_LOOPER called without request [ 2220.947904] binder: 6567:6580 transaction failed 29201/-71, size 0-0 line 2762 [ 2220.973408] binder_alloc: 6567: binder_alloc_buf, no vma [ 2221.030170] binder: 6567:6581 transaction failed 29189/-3, size 0-0 line 2970 [ 2221.069213] binder: undelivered TRANSACTION_ERROR: 29201 [ 2221.076491] binder: undelivered TRANSACTION_ERROR: 29189 [ 2221.090307] audit: type=1400 audit(1555635503.663:39749): avc: denied { map } for pid=6565 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2221.253216] audit: type=1400 audit(1555635503.663:39750): avc: denied { map } for pid=6565 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:25 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:25 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x0, 0x181000) openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x80000, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x4200, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=ANY=[@ANYRESDEC, @ANYRES64], 0x2) dup3(r0, r0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) perf_event_open(&(0x7f000001d000)={0x8000000000001, 0x118, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fe, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) r3 = dup2(r2, r2) r4 = getpgrp(0x0) setpgid(0x0, r4) sendmsg$alg(r3, &(0x7f0000001100)={0x0, 0x0, 0x0}, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) sendto$inet(r2, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x204104, 0x0) 00:58:25 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:25 executing program 3: r0 = socket$inet(0x2, 0xffffffffffffffff, 0x401) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000140), &(0x7f00000001c0)=0xb) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) write$P9_RMKNOD(r2, &(0x7f0000000200)={0x14, 0x13, 0x2, {0x0, 0x4, 0x5}}, 0x14) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000040)={'icmp\x00'}, &(0x7f0000000080)=0x1e) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:25 executing program 5: socket(0x0, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) 00:58:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0xda9, 0x4) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") [ 2222.129244] binder: 6600:6605 ERROR: BC_REGISTER_LOOPER called without request [ 2222.176404] binder_alloc: 6600: binder_alloc_buf, no vma [ 2222.200514] binder: 6600:6605 transaction failed 29189/-3, size 0-0 line 2970 [ 2222.248581] binder: send failed reply for transaction 2563 to 6600:6605 [ 2222.296423] binder: undelivered TRANSACTION_COMPLETE [ 2222.301808] binder: undelivered TRANSACTION_ERROR: 29189 [ 2222.413277] binder: BINDER_SET_CONTEXT_MGR already set [ 2222.450414] binder: 6600:6605 ERROR: BC_REGISTER_LOOPER called without request [ 2222.503900] binder: release 6600:6615 transaction 2565 out, still active [ 2222.512479] binder: 6600:6612 ioctl 40046207 0 returned -16 [ 2222.520578] binder: undelivered TRANSACTION_COMPLETE 00:58:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2222.627426] binder: undelivered TRANSACTION_ERROR: 29190 [ 2222.633095] protocol 88fb is buggy, dev hsr_slave_0 [ 2222.633158] protocol 88fb is buggy, dev hsr_slave_1 00:58:26 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, 0x0, 0x8e}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2222.685066] binder: send failed reply for transaction 2565, target dead 00:58:26 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x80045440, &(0x7f0000000040)) [ 2222.787699] protocol 88fb is buggy, dev hsr_slave_0 [ 2222.792909] protocol 88fb is buggy, dev hsr_slave_1 [ 2222.798915] protocol 88fb is buggy, dev hsr_slave_0 [ 2222.804027] protocol 88fb is buggy, dev hsr_slave_1 [ 2223.473579] binder: 6626:6630 ERROR: BC_REGISTER_LOOPER called without request [ 2223.536654] binder: 6626:6635 got reply transaction with no transaction stack 00:58:27 executing program 4: prctl$PR_SET_THP_DISABLE(0x29, 0x1) mmap(&(0x7f00006ea000/0x200000)=nil, 0x200000, 0x3000007, 0x8d471, 0xffffffffffffffff, 0x0) [ 2223.622111] binder: 6626:6635 transaction failed 29201/-71, size 0-0 line 2762 [ 2223.654804] binder: release 6626:6630 transaction 2567 out, still active 00:58:27 executing program 5: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) [ 2223.677208] binder: undelivered TRANSACTION_COMPLETE [ 2223.752246] binder: 6626:6635 got reply transaction with no transaction stack [ 2223.792830] binder: 6626:6630 ERROR: BC_REGISTER_LOOPER called without request [ 2223.828265] binder: release 6626:6638 transaction 2569 out, still active [ 2223.837480] binder: 6626:6635 transaction failed 29201/-71, size 0-0 line 2762 [ 2223.839956] binder: undelivered TRANSACTION_COMPLETE [ 2223.913330] binder: undelivered TRANSACTION_ERROR: 29201 [ 2223.943624] binder: release 6626:6630 transaction 2567 in, still active [ 2223.977713] binder: send failed reply for transaction 2567, target dead [ 2224.000728] binder: undelivered TRANSACTION_ERROR: 29201 [ 2224.018337] binder: send failed reply for transaction 2569, target dead 00:58:28 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:28 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14, 0x800) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000280)={@ipv4={[], [], @empty}, @ipv4={[], [], @loopback}, @rand_addr="5cda8ef5292f48e191399fd18bcbfe15", 0xca42, 0x9, 0x7, 0x0, 0x6, 0x40e00105, r3}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000080)={r2}) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='\xd9X\xf6\x98k', 0x5) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") ioctl$KVM_RUN(r2, 0xae80, 0x0) 00:58:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:28 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000000400)={0x7b}) 00:58:28 executing program 4: sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x0, 0x0, 0x0, r2}) 00:58:28 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2224.839001] kauditd_printk_skb: 138 callbacks suppressed [ 2224.839026] audit: type=1400 audit(1555635508.293:39889): avc: denied { map } for pid=6648 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2224.990329] audit: type=1400 audit(1555635508.333:39890): avc: denied { map } for pid=6648 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2225.147706] audit: type=1400 audit(1555635508.333:39891): avc: denied { map } for pid=6648 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:28 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=ANY=[@ANYBLOB="14bc42000000000000000000000800000900de56b5000000000800000000080008000100000008000500ac14141b080003000100050f01"], 0x1}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000002c0)="b8010000000f01c166b8e2000f00d8b9800000c00f3235004000000f304a0fc75f20c44379608d00000100f22e0f01ca67440ff6143f66ba4000b846c95182ef0f01cf400f01df", 0x47}], 0xaaaaaaaaaaaace6, 0x0, 0x0, 0xeb) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000010000/0x1000)=nil}) openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x74, 0x0, 0x0, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @multicast1}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2225.280451] binder: 6649:6651 ERROR: BC_REGISTER_LOOPER called without request [ 2225.291669] audit: type=1400 audit(1555635508.333:39892): avc: denied { map } for pid=6648 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2225.325851] binder: 6649:6661 got reply transaction with no transaction stack 00:58:28 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2c, 0x0, 0xffffffffffffff50) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2225.418356] binder: 6649:6661 transaction failed 29201/-71, size 0-0 line 2762 00:58:28 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2225.455501] audit: type=1400 audit(1555635508.403:39893): avc: denied { map } for pid=6648 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2225.568173] binder: release 6649:6661 transaction 2572 out, still active [ 2225.575147] binder: undelivered TRANSACTION_COMPLETE [ 2225.622928] audit: type=1400 audit(1555635508.413:39894): avc: denied { map } for pid=6648 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2225.731230] binder: release 6649:6672 transaction 2574 out, still active [ 2225.742414] binder: undelivered TRANSACTION_COMPLETE 00:58:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x6, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\fc\x00\x00\rc'], 0x0, 0x0, 0x0}) [ 2225.790520] audit: type=1400 audit(1555635508.413:39895): avc: denied { map } for pid=6648 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:29 executing program 4: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @empty=[0x0, 0x0, 0x2800000000000000], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 00:58:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2225.922721] binder: release 6649:6651 transaction 2572 in, still active [ 2225.933065] binder: send failed reply for transaction 2572, target dead [ 2225.978853] audit: type=1400 audit(1555635508.443:39896): avc: denied { map } for pid=6648 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2225.994691] binder: undelivered TRANSACTION_ERROR: 29201 [ 2226.067744] protocol 88fb is buggy, dev hsr_slave_0 [ 2226.072862] protocol 88fb is buggy, dev hsr_slave_1 [ 2226.091124] binder: send failed reply for transaction 2574, target dead [ 2226.199307] audit: type=1400 audit(1555635508.473:39897): avc: denied { map } for pid=6654 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2226.344074] audit: type=1400 audit(1555635508.473:39898): avc: denied { map } for pid=6654 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2226.992404] binder: 6689:6690 ERROR: BC_REGISTER_LOOPER called without request [ 2227.065306] binder: 6689:6691 got reply transaction with no transaction stack [ 2227.192682] binder: 6689:6691 transaction failed 29201/-71, size 0-0 line 2762 [ 2227.229658] binder: release 6689:6690 transaction 2576 out, still active [ 2227.236586] binder: undelivered TRANSACTION_COMPLETE [ 2227.308478] binder: release 6689:6690 transaction 2576 in, still active [ 2227.315354] binder: send failed reply for transaction 2576, target dead [ 2227.330942] binder: 6689:6690 ERROR: BC_REGISTER_LOOPER called without request [ 2227.350539] binder: 6689:6691 got reply transaction with no transaction stack [ 2227.358153] binder: undelivered TRANSACTION_ERROR: 29201 [ 2227.388496] binder: release 6689:6691 transaction 2579 out, still active [ 2227.396448] binder: undelivered TRANSACTION_COMPLETE [ 2227.396970] binder: 6689:6691 transaction failed 29201/-71, size 0-0 line 2762 [ 2227.478165] binder: send failed reply for transaction 2579, target dead [ 2227.517698] binder: undelivered TRANSACTION_ERROR: 29201 00:58:31 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:31 executing program 5: r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, 0x0, &(0x7f0000000100)) 00:58:31 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) dup3(r0, r2, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff55) 00:58:31 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) inotify_init() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:31 executing program 5: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/186, 0x4a9e280) accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000100)) syz_genetlink_get_family_id$tipc(0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) 00:58:31 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000000)={0x7c, 0x600000000000000, [0xc0000103], [0xc2]}) [ 2228.175159] binder: 6700:6706 ERROR: BC_REGISTER_LOOPER called without request [ 2228.208924] binder_alloc: 6700: binder_alloc_buf, no vma [ 2228.230711] binder: 6700:6706 transaction failed 29189/-3, size 0-0 line 2970 [ 2228.251008] binder: send failed reply for transaction 2582 to 6700:6706 [ 2228.271273] binder: undelivered TRANSACTION_COMPLETE [ 2228.276756] binder: undelivered TRANSACTION_ERROR: 29189 [ 2228.344624] binder: undelivered TRANSACTION_ERROR: 29190 [ 2228.380733] binder: 6700:6710 got reply transaction with no transaction stack [ 2228.385911] binder: 6700:6706 ERROR: BC_REGISTER_LOOPER called without request [ 2228.426362] binder_thread_release: 1 callbacks suppressed [ 2228.426374] binder: release 6700:6710 transaction 2585 out, still active [ 2228.444568] binder: 6700:6710 transaction failed 29201/-71, size 0-0 line 2762 [ 2228.466344] binder: undelivered TRANSACTION_COMPLETE 00:58:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2228.613055] binder: release 6700:6706 transaction 2585 in, still active [ 2228.629336] binder: send failed reply for transaction 2585, target dead [ 2228.676919] binder: undelivered TRANSACTION_ERROR: 29201 00:58:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000000)="17b97fc829020122e81c46a6e4aeec4608379f09d36c24a7b1ecba157da0", 0x1e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec7) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2228.867739] protocol 88fb is buggy, dev hsr_slave_0 [ 2228.873560] protocol 88fb is buggy, dev hsr_slave_1 00:58:32 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1e) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2229.028118] protocol 88fb is buggy, dev hsr_slave_0 [ 2229.035309] protocol 88fb is buggy, dev hsr_slave_1 [ 2229.040743] protocol 88fb is buggy, dev hsr_slave_0 [ 2229.046783] protocol 88fb is buggy, dev hsr_slave_1 00:58:32 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x100000400000003a) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000180)=@fragment, 0x8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000480)="8fafc3c980d065f106d500015e05e561011a00d80fe80f5ff9a68057980b90ccc863d9f5dda28d30efb662cd", 0x2c}], 0x1) [ 2229.598108] binder: 6727:6729 ERROR: BC_REGISTER_LOOPER called without request [ 2229.681319] binder: 6727:6732 got reply transaction with no transaction stack [ 2229.708621] binder: 6727:6732 transaction failed 29201/-71, size 0-0 line 2762 [ 2229.750312] binder: release 6727:6729 transaction 2588 out, still active [ 2229.781082] binder: undelivered TRANSACTION_COMPLETE [ 2229.849933] kauditd_printk_skb: 159 callbacks suppressed [ 2229.849949] audit: type=1400 audit(1555635513.303:40058): avc: denied { map } for pid=6730 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2229.854939] binder: BINDER_SET_CONTEXT_MGR already set [ 2229.866941] audit: type=1400 audit(1555635513.303:40059): avc: denied { map } for pid=6731 comm="modprobe" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2230.012611] binder: release 6727:6729 transaction 2588 in, still active [ 2230.029185] binder: 6727:6736 transaction failed 29189/-22, size 0-0 line 2855 [ 2230.052058] binder: send failed reply for transaction 2588, target dead [ 2230.087775] binder: undelivered TRANSACTION_ERROR: 29201 [ 2230.095862] binder: 6727:6732 ERROR: BC_REGISTER_LOOPER called without request [ 2230.145249] audit: type=1400 audit(1555635513.373:40060): avc: denied { map } for pid=6731 comm="modprobe" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2230.172902] binder: 6727:6729 ioctl 40046207 0 returned -16 [ 2230.212063] binder: 6727:6740 got reply transaction with no transaction stack [ 2230.219841] binder: undelivered TRANSACTION_ERROR: 29189 [ 2230.287778] audit: type=1400 audit(1555635513.373:40061): avc: denied { map } for pid=6730 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2230.328799] binder: 6727:6740 transaction failed 29201/-71, size 0-0 line 2762 [ 2230.408886] audit: type=1400 audit(1555635513.823:40062): avc: denied { map } for pid=6742 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2230.446239] binder: undelivered TRANSACTION_ERROR: 29201 [ 2230.500322] audit: type=1400 audit(1555635513.833:40063): avc: denied { map } for pid=6742 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:34 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4603000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2230.631596] audit: type=1400 audit(1555635513.843:40064): avc: denied { map } for pid=6742 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2230.746559] audit: type=1400 audit(1555635513.843:40065): avc: denied { map } for pid=6742 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2230.878261] audit: type=1400 audit(1555635513.893:40066): avc: denied { map } for pid=6742 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:34 executing program 5: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000340)='/dev/urandom\x00', 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, 0x0) 00:58:34 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:34 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0xfffffdc2) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x70000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f00000001c0)={0x8, 0x0, {0x1, 0x3, 0x0, 0x1, 0x4}}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x8) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:34 executing program 4: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000240)={'security\x00', 0x4, "61008153"}, 0x0) [ 2231.032589] audit: type=1400 audit(1555635513.923:40067): avc: denied { map } for pid=6742 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:34 executing program 4: sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) setxattr$security_evm(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000140)=@v2, 0xa, 0x0) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:58:34 executing program 5: openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, 0x0, 0x7fffffd, 0x0, 0xd1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xcd84}, 0x800000200000000, 0x2}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000340)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0], 0x0, 0x0, 0x6, 0x2}) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, 0x0) [ 2231.383116] binder: 6745:6757 ERROR: BC_REGISTER_LOOPER called without request [ 2231.428423] binder: 6745:6751 got reply transaction with no transaction stack [ 2231.517664] binder: 6745:6751 transaction failed 29201/-71, size 0-0 line 2762 [ 2231.579321] binder: release 6745:6751 transaction 2593 out, still active [ 2231.599205] binder: undelivered TRANSACTION_COMPLETE [ 2231.698076] binder: 6745:6757 got reply transaction with no transaction stack [ 2231.748917] binder: 6745:6751 ERROR: BC_REGISTER_LOOPER called without request [ 2231.763946] binder: 6745:6757 transaction failed 29201/-71, size 0-0 line 2762 [ 2231.841752] binder: release 6745:6761 transaction 2595 out, still active [ 2231.857220] binder: undelivered TRANSACTION_COMPLETE [ 2231.897146] binder: undelivered TRANSACTION_ERROR: 29201 00:58:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4703000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:35 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2231.973810] binder: undelivered TRANSACTION_ERROR: 29201 [ 2231.981218] binder: release 6745:6757 transaction 2593 in, still active 00:58:35 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) close(r0) accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000180), 0x8000000000003bf, 0x0, 0x0) [ 2232.048370] binder: send failed reply for transaction 2593, target dead [ 2232.099196] binder: send failed reply for transaction 2595, target dead 00:58:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="24000000200007041dfffd946f610500020000001f00000000000800080017000400ff7e", 0x24}], 0x1}, 0x0) [ 2232.830225] binder: 6778:6781 ERROR: BC_REGISTER_LOOPER called without request [ 2232.887152] binder: 6778:6786 got reply transaction with no transaction stack [ 2232.948170] binder: 6778:6786 transaction failed 29201/-71, size 0-0 line 2762 [ 2233.005651] binder: release 6778:6786 transaction 2598 out, still active [ 2233.036325] binder: undelivered TRANSACTION_COMPLETE [ 2233.081496] binder: release 6778:6781 transaction 2598 in, still active [ 2233.097118] binder: send failed reply for transaction 2598, target dead [ 2233.136499] binder: undelivered TRANSACTION_ERROR: 29201 [ 2233.172364] binder: 6778:6781 ERROR: BC_REGISTER_LOOPER called without request [ 2233.220665] binder: 6778:6786 got reply transaction with no transaction stack [ 2233.227941] binder: release 6778:6793 transaction 2601 out, still active [ 2233.246756] binder: undelivered TRANSACTION_COMPLETE [ 2233.257153] binder: 6778:6786 transaction failed 29201/-71, size 0-0 line 2762 [ 2233.333416] binder: send failed reply for transaction 2601, target dead [ 2233.357387] binder: undelivered TRANSACTION_ERROR: 29201 00:58:37 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:37 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0xfffffffffffffffe}]}) 00:58:37 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200400, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x70, r3, 0x8, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000001}, 0x90) 00:58:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:37 executing program 4: [ 2234.061625] binder: 6798:6803 ERROR: BC_REGISTER_LOOPER called without request [ 2234.101431] binder_alloc: 6798: binder_alloc_buf, no vma [ 2234.107046] binder: 6798:6803 transaction failed 29189/-3, size 0-0 line 2970 00:58:37 executing program 4: [ 2234.168417] binder: send failed reply for transaction 2604 to 6798:6803 [ 2234.201503] binder: undelivered TRANSACTION_COMPLETE [ 2234.206694] binder: undelivered TRANSACTION_ERROR: 29189 [ 2234.273879] binder_thread_release: 1 callbacks suppressed [ 2234.273890] binder: release 6798:6809 transaction 2606 out, still active [ 2234.293727] binder: undelivered TRANSACTION_COMPLETE 00:58:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2234.353140] binder: undelivered TRANSACTION_ERROR: 29190 [ 2234.368737] binder: send failed reply for transaction 2606, target dead [ 2234.387734] protocol 88fb is buggy, dev hsr_slave_0 [ 2234.392952] protocol 88fb is buggy, dev hsr_slave_1 00:58:38 executing program 4: 00:58:38 executing program 5: [ 2234.863029] kauditd_printk_skb: 118 callbacks suppressed [ 2234.863044] audit: type=1400 audit(1555635518.303:40186): avc: denied { map } for pid=6813 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2234.941252] binder: 6816:6817 ERROR: BC_REGISTER_LOOPER called without request [ 2234.964592] audit: type=1400 audit(1555635518.333:40187): avc: denied { map } for pid=6816 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2235.023279] binder: 6816:6818 got reply transaction with no transaction stack [ 2235.122726] audit: type=1400 audit(1555635518.363:40188): avc: denied { map } for pid=6813 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2235.167890] binder: 6816:6818 transaction failed 29201/-71, size 0-0 line 2762 [ 2235.188068] binder: release 6816:6817 transaction 2608 out, still active [ 2235.201612] binder: undelivered TRANSACTION_COMPLETE [ 2235.265029] audit: type=1400 audit(1555635518.363:40189): avc: denied { set_context_mgr } for pid=6816 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2235.304673] binder: BINDER_SET_CONTEXT_MGR already set [ 2235.355587] binder: 6816:6817 ioctl 40046207 0 returned -16 [ 2235.381898] audit: type=1400 audit(1555635518.373:40190): avc: denied { map } for pid=6813 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2235.395067] binder: release 6816:6817 transaction 2608 in, still active [ 2235.441201] binder: 6816:6824 got reply transaction with no transaction stack [ 2235.446220] binder: 6816:6818 ERROR: BC_REGISTER_LOOPER called without request [ 2235.493593] binder: send failed reply for transaction 2608, target dead [ 2235.502343] audit: type=1400 audit(1555635518.383:40191): avc: denied { call } for pid=6816 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2235.527830] binder: undelivered TRANSACTION_ERROR: 29201 00:58:39 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2235.619076] binder: 6816:6824 transaction failed 29201/-71, size 0-0 line 2762 [ 2235.632466] audit: type=1400 audit(1555635518.433:40192): avc: denied { map } for pid=6813 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2235.660272] binder_alloc: 6816: binder_alloc_buf, no vma 00:58:39 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, 0x0, 0xfffffffffffffdaa) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x804, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000100)='yam0\x00') ioctl$VIDIOC_DBG_S_REGISTER(r2, 0x4038564f, &(0x7f0000000080)={{0x0, @addr=0x5}, 0x8, 0x2}) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capi20\x00', 0x12000, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:39 executing program 4: [ 2235.700893] binder: 6816:6822 transaction failed 29189/-3, size 0-0 line 2970 [ 2235.754105] binder: undelivered TRANSACTION_ERROR: 29189 [ 2235.789085] audit: type=1400 audit(1555635518.443:40193): avc: denied { map } for pid=6813 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2235.895701] audit: type=1400 audit(1555635518.733:40194): avc: denied { map } for pid=6816 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2235.897903] binder: undelivered TRANSACTION_ERROR: 29201 [ 2236.063495] audit: type=1400 audit(1555635518.783:40195): avc: denied { map } for pid=6820 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:39 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:39 executing program 5: 00:58:39 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:39 executing program 4: 00:58:39 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:40 executing program 5: 00:58:40 executing program 4: [ 2236.726036] binder: 6836:6838 ERROR: BC_REGISTER_LOOPER called without request [ 2236.792748] binder: 6836:6842 got reply transaction with no transaction stack 00:58:40 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x200000, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x6, &(0x7f0000000080)=0x6, 0x4) [ 2236.859217] binder: 6836:6842 transaction failed 29201/-71, size 0-0 line 2762 [ 2236.936985] binder: release 6836:6838 transaction 2613 out, still active [ 2236.954961] binder: undelivered TRANSACTION_COMPLETE 00:58:40 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:40 executing program 4: [ 2237.085527] binder: BINDER_SET_CONTEXT_MGR already set 00:58:40 executing program 5: [ 2237.158278] binder: 6836:6851 ERROR: BC_REGISTER_LOOPER called without request [ 2237.165826] binder: 6836:6853 got reply transaction with no transaction stack [ 2237.187732] protocol 88fb is buggy, dev hsr_slave_0 [ 2237.192894] protocol 88fb is buggy, dev hsr_slave_1 [ 2237.269900] binder: 6836:6838 ioctl 40046207 0 returned -16 [ 2237.269915] binder: release 6836:6838 transaction 2613 in, still active [ 2237.269929] binder: send failed reply for transaction 2613, target dead [ 2237.297970] binder: 6836:6853 transaction failed 29201/-71, size 0-0 line 2762 [ 2237.346920] binder: undelivered TRANSACTION_ERROR: 29201 [ 2237.347788] protocol 88fb is buggy, dev hsr_slave_0 [ 2237.357513] protocol 88fb is buggy, dev hsr_slave_1 [ 2237.362825] protocol 88fb is buggy, dev hsr_slave_0 [ 2237.367974] protocol 88fb is buggy, dev hsr_slave_1 [ 2237.375495] binder: send failed reply for transaction 2615 to 6836:6851 [ 2237.415114] binder: undelivered TRANSACTION_COMPLETE 00:58:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2237.492349] binder: undelivered TRANSACTION_ERROR: 29189 [ 2237.544899] binder: undelivered TRANSACTION_ERROR: 29201 [ 2238.465943] binder: 6868:6869 ERROR: BC_REGISTER_LOOPER called without request [ 2238.568136] binder: 6868:6871 got reply transaction with no transaction stack [ 2238.618935] binder: 6868:6871 transaction failed 29201/-71, size 0-0 line 2762 [ 2238.650192] binder: release 6868:6869 transaction 2618 out, still active [ 2238.664137] binder: undelivered TRANSACTION_COMPLETE [ 2238.741252] binder: BINDER_SET_CONTEXT_MGR already set [ 2238.836470] binder: 6868:6874 got reply transaction with no transaction stack [ 2238.843833] binder: 6868:6869 ERROR: BC_REGISTER_LOOPER called without request [ 2238.920960] binder: 6868:6874 transaction failed 29201/-71, size 0-0 line 2762 [ 2238.998086] binder: release 6868:6873 transaction 2620 out, still active [ 2239.005046] binder: undelivered TRANSACTION_COMPLETE [ 2239.010732] binder: 6868:6871 ioctl 40046207 0 returned -16 [ 2239.050947] binder: undelivered TRANSACTION_ERROR: 29201 [ 2239.160010] binder: release 6868:6869 transaction 2618 in, still active [ 2239.166877] binder: send failed reply for transaction 2618, target dead [ 2239.207936] binder: undelivered TRANSACTION_ERROR: 29201 [ 2239.213503] binder: send failed reply for transaction 2620, target dead 00:58:42 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:42 executing program 4: 00:58:42 executing program 5: 00:58:42 executing program 3: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x109000, 0x0) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f00000001c0)) r1 = socket$inet(0x2, 0x3, 0x2) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r3 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x5, 0x4000) getsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f0000000080)=0x80000000, &(0x7f0000000100)=0x2) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) getrandom(&(0x7f0000000280)=""/133, 0x85, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r2, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:42 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:43 executing program 4: 00:58:43 executing program 5: [ 2239.874550] kauditd_printk_skb: 139 callbacks suppressed [ 2239.874598] audit: type=1400 audit(1555635523.323:40335): avc: denied { map } for pid=6880 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2239.999783] audit: type=1400 audit(1555635523.363:40336): avc: denied { map } for pid=6880 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2240.070301] binder: 6884:6888 ERROR: BC_REGISTER_LOOPER called without request [ 2240.134915] audit: type=1400 audit(1555635523.423:40337): avc: denied { map } for pid=6884 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2240.162522] binder: 6884:6892 got reply transaction with no transaction stack [ 2240.202828] binder: 6884:6892 transaction failed 29201/-71, size 0-0 line 2762 [ 2240.245217] binder: release 6884:6888 transaction 2623 out, still active [ 2240.260170] binder: undelivered TRANSACTION_COMPLETE [ 2240.261676] audit: type=1400 audit(1555635523.483:40338): avc: denied { set_context_mgr } for pid=6884 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2240.335279] binder: release 6884:6888 transaction 2623 in, still active [ 2240.349470] binder: send failed reply for transaction 2623, target dead [ 2240.362261] binder: 6884:6892 transaction failed 29189/-22, size 0-0 line 2855 00:58:43 executing program 4: [ 2240.390310] audit: type=1400 audit(1555635523.513:40339): avc: denied { call } for pid=6884 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2240.393517] binder: undelivered TRANSACTION_ERROR: 29201 00:58:43 executing program 5: [ 2240.440190] binder: 6884:6898 ERROR: BC_REGISTER_LOOPER called without request 00:58:43 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2240.504618] binder: 6884:6899 got reply transaction with no transaction stack [ 2240.528890] audit: type=1400 audit(1555635523.713:40340): avc: denied { map } for pid=6893 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2240.558681] binder: undelivered TRANSACTION_ERROR: 29189 [ 2240.597678] binder: 6884:6899 transaction failed 29201/-71, size 0-0 line 2762 00:58:44 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet(0x2, 0x20005, 0x4000000000000002) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x0, 0x0, 0xfffffe93) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r2, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2240.626729] audit: type=1400 audit(1555635523.713:40341): avc: denied { map } for pid=6893 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2240.657740] protocol 88fb is buggy, dev hsr_slave_0 [ 2240.662896] protocol 88fb is buggy, dev hsr_slave_1 [ 2240.758213] binder: undelivered TRANSACTION_ERROR: 29201 [ 2240.835974] audit: type=1400 audit(1555635523.753:40342): avc: denied { map } for pid=6893 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2240.967689] audit: type=1400 audit(1555635523.773:40344): avc: denied { map } for pid=6893 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2241.086201] audit: type=1400 audit(1555635523.773:40343): avc: denied { map } for pid=6884 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 00:58:45 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:45 executing program 5: 00:58:45 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:45 executing program 4: add_key(0x0, 0x0, &(0x7f0000000080), 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x3, 0x9) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x3ff, @dev, 0x6}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000)=@routing, 0x8) sendmmsg(r0, &(0x7f00000002c0), 0x400000000000174, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) 00:58:45 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:45 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000040)={@multicast1, @loopback}, 0x8) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:45 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x9) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x400000000000174, 0x0) 00:58:46 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2242.517420] binder: 6918:6922 ERROR: BC_REGISTER_LOOPER called without request [ 2242.576351] binder: 6918:6929 got reply transaction with no transaction stack [ 2242.587187] binder: 6918:6929 transaction failed 29201/-71, size 0-0 line 2762 [ 2242.603975] binder: release 6918:6922 transaction 2629 out, still active [ 2242.614681] binder: undelivered TRANSACTION_COMPLETE [ 2242.715922] binder: BINDER_SET_CONTEXT_MGR already set [ 2242.750131] binder: release 6918:6922 transaction 2629 in, still active [ 2242.759275] binder: 6918:6922 ioctl 40046207 0 returned -16 [ 2242.767449] binder: send failed reply for transaction 2629, target dead [ 2242.810218] binder: undelivered TRANSACTION_ERROR: 29201 [ 2242.818712] binder: 6918:6929 ERROR: BC_REGISTER_LOOPER called without request [ 2242.839350] binder: 6918:6935 got reply transaction with no transaction stack [ 2242.872306] binder: 6918:6932 transaction failed 29189/-22, size 0-0 line 2855 [ 2242.886551] binder: 6918:6935 transaction failed 29201/-71, size 0-0 line 2762 [ 2242.966078] binder: undelivered TRANSACTION_ERROR: 29189 00:58:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2243.049428] binder: undelivered TRANSACTION_ERROR: 29201 00:58:46 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:46 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x10000, 0x0) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2243.427719] protocol 88fb is buggy, dev hsr_slave_0 [ 2243.432942] protocol 88fb is buggy, dev hsr_slave_1 00:58:47 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2244.036254] binder: 6945:6949 ERROR: BC_REGISTER_LOOPER called without request [ 2244.122201] binder: 6945:6954 got reply transaction with no transaction stack [ 2244.235965] binder: 6945:6954 transaction failed 29201/-71, size 0-0 line 2762 [ 2244.370358] binder: release 6945:6949 transaction 2634 out, still active [ 2244.377419] binder: undelivered TRANSACTION_COMPLETE [ 2244.481051] binder: BINDER_SET_CONTEXT_MGR already set [ 2244.520223] binder: release 6945:6949 transaction 2634 in, still active [ 2244.532209] binder: 6945:6949 ioctl 40046207 0 returned -16 [ 2244.538338] binder: send failed reply for transaction 2634, target dead [ 2244.565148] binder: undelivered TRANSACTION_ERROR: 29201 [ 2244.587827] binder: 6945:6959 transaction failed 29189/-22, size 0-0 line 2855 [ 2244.591745] binder: 6945:6954 ERROR: BC_REGISTER_LOOPER called without request [ 2244.622891] binder: 6945:6960 got reply transaction with no transaction stack 00:58:48 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2244.687038] binder: undelivered TRANSACTION_ERROR: 29189 [ 2244.689359] binder: 6945:6960 transaction failed 29201/-71, size 0-0 line 2762 00:58:48 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x8004000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2244.804647] binder: undelivered TRANSACTION_ERROR: 29201 [ 2245.263021] kauditd_printk_skb: 126 callbacks suppressed [ 2245.263036] audit: type=1400 audit(1555635528.713:40471): avc: denied { map } for pid=6967 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2245.428433] audit: type=1400 audit(1555635528.773:40472): avc: denied { map } for pid=6967 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2245.507774] protocol 88fb is buggy, dev hsr_slave_0 [ 2245.512941] protocol 88fb is buggy, dev hsr_slave_1 [ 2245.573108] audit: type=1400 audit(1555635528.793:40473): avc: denied { map } for pid=6967 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2245.663515] audit: type=1400 audit(1555635528.793:40474): avc: denied { map } for pid=6967 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2245.687891] protocol 88fb is buggy, dev hsr_slave_0 [ 2245.687948] protocol 88fb is buggy, dev hsr_slave_1 [ 2245.688032] protocol 88fb is buggy, dev hsr_slave_0 [ 2245.688079] protocol 88fb is buggy, dev hsr_slave_1 [ 2245.777287] binder: 6970:6974 ERROR: BC_REGISTER_LOOPER called without request 00:58:49 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0x3) 00:58:49 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 00:58:49 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x10280, 0x0) ioctl$KDMKTONE(r2, 0x4b30, 0x52) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x0, 0x8e, 0x9e, &(0x7f0000000140)="69926251f939f8151e320109c6f210d746867677866606cc56693e4cc4fc9f1fff020ee4b09da1d49c2eaee2ae3bf670309099d54dd1a41b2a6e53aa3af7aeb0a10be12f189d7f2269ce449bf1a58148a52905b50b0fc146104fb2108acca07342d26f6139f917a5e410ac24e3f4a4f7055d76a330db8fdcb8ddfcbee421142c72b51a3703320ec57e6685e55af7", &(0x7f0000000280)=""/158, 0xfffffffffffffc6c}, 0x28) mincore(&(0x7f0000ffe000/0x1000)=nil, 0x1000, &(0x7f0000000340)=""/13) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000200)=0xffff) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000003ac0)=""/4096, 0xfffffffffffffdf0}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r2, 0x1000008912, &(0x7f0000000440)="4b46f310b1d56066830f3eff724ba74e2632d399cbb75d11c73f6bf32743b6e779a4ff9976639145e68d100e1f52cfc19743cf7fa7998aac5baafa83ec5fb2a5d6") [ 2245.826116] binder: 6970:6975 got reply transaction with no transaction stack [ 2245.898146] binder: 6970:6975 transaction failed 29201/-71, size 0-0 line 2762 [ 2245.935266] audit: type=1400 audit(1555635528.853:40475): avc: denied { map } for pid=6967 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2245.969429] binder: release 6970:6975 transaction 2639 out, still active [ 2245.976484] binder: undelivered TRANSACTION_COMPLETE 00:58:49 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) timer_create(0x0, &(0x7f0000044000), 0x0) [ 2246.089828] binder: release 6970:6974 transaction 2639 in, still active [ 2246.106696] binder: send failed reply for transaction 2639, target dead [ 2246.137922] audit: type=1400 audit(1555635528.853:40476): avc: denied { map } for pid=6967 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2246.179366] binder: undelivered TRANSACTION_ERROR: 29201 [ 2246.187534] binder: 6970:6974 ERROR: BC_REGISTER_LOOPER called without request [ 2246.225126] binder: 6970:6975 got reply transaction with no transaction stack [ 2246.262463] audit: type=1400 audit(1555635528.883:40477): avc: denied { map } for pid=6967 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2246.301011] binder: release 6970:6979 transaction 2643 out, still active [ 2246.311500] binder: undelivered TRANSACTION_COMPLETE [ 2246.332921] binder: 6970:6975 transaction failed 29201/-71, size 0-0 line 2762 00:58:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xe400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2246.456204] audit: type=1400 audit(1555635528.933:40478): avc: denied { map } for pid=6967 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2246.460330] binder: release 6970:6974 transaction 2643 in, still active [ 2246.564339] binder: send failed reply for transaction 2643, target dead [ 2246.595096] binder: undelivered TRANSACTION_ERROR: 29201 00:58:50 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x1}], 0x100000c7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/route\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000269, 0x10400003) [ 2246.606214] audit: type=1400 audit(1555635528.953:40479): avc: denied { map } for pid=6967 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2246.770181] audit: type=1400 audit(1555635529.013:40480): avc: denied { map } for pid=6971 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:50 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x204000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x64, r2, 0x404, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xddd6}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x1b}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @loopback}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x48000}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0xfffffffffffffd01, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r0, &(0x7f00000002c0)=ANY=[], 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x100, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4800e3f3", @ANYRES16=r4, @ANYBLOB="000026bd7000fddbdf250500000034000200080004001f00000008000600ff03000008000900050000000800050002000000080005002b0000000800080004000000"], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:50 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 2247.233515] binder: 6991:6996 transaction failed 29189/-22, size 0-0 line 2855 [ 2247.349592] binder: 6991:6995 ERROR: BC_REGISTER_LOOPER called without request 00:58:50 executing program 5: syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) flock(0xffffffffffffffff, 0x0) epoll_create1(0x80000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000003c0)=0x80) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000200)={'IDLETIMER\x00'}, &(0x7f0000000240)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000080)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@empty, 0x8, 0x0, 0x3, 0x0, 0x0, 0x1}, 0x20) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0) memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x3, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) ioctl$sock_inet_SIOCSARP(r2, 0x8955, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x3ff800) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) [ 2247.447811] binder: 6991:6996 got reply transaction with no transaction stack [ 2247.455208] binder: 6991:6996 transaction failed 29201/-71, size 0-0 line 2762 [ 2247.630126] binder: undelivered TRANSACTION_ERROR: 29189 [ 2247.637383] binder: undelivered TRANSACTION_ERROR: 29201 [ 2247.818707] binder: 6991:7003 transaction failed 29189/-22, size 0-0 line 2855 00:58:51 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:51 executing program 4: futex(&(0x7f0000000100)=0x1, 0x800000000006, 0x0, &(0x7f0000000040)={0x77359400}, 0x0, 0x0) [ 2247.885398] binder: 6991:6995 ERROR: BC_REGISTER_LOOPER called without request [ 2247.930610] binder: undelivered TRANSACTION_ERROR: 29189 [ 2247.975051] binder: 6991:6996 got reply transaction with no transaction stack [ 2248.041902] binder: 6991:6996 transaction failed 29201/-71, size 0-0 line 2762 [ 2248.103105] binder: undelivered TRANSACTION_ERROR: 29201 00:58:51 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 00:58:51 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2248.840000] binder: 7021:7024 transaction failed 29189/-22, size 0-0 line 2855 00:58:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='reno\x00', 0x277) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000440)=0xd) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000140)={r2, 0x6}, &(0x7f00000001c0)=0x8) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x80, 0x0) ioctl$ION_IOC_HEAP_QUERY(r3, 0xc0184908, &(0x7f0000000400)={0x34, 0x0, &(0x7f0000000280)}) ioctl$SIOCX25SSUBSCRIP(r3, 0x89e1, &(0x7f0000000300)={'vxcan1\x00', 0x3ff, 0x22}) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000040)={'ip_vti0\x00', 0x9}) [ 2248.895913] binder: undelivered TRANSACTION_ERROR: 29189 [ 2248.947723] protocol 88fb is buggy, dev hsr_slave_0 [ 2248.953002] protocol 88fb is buggy, dev hsr_slave_1 [ 2249.017557] binder: 7021:7024 ERROR: BC_REGISTER_LOOPER called without request [ 2249.048228] binder: 7021:7026 got reply transaction with no transaction stack 00:58:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) sendfile(r1, r1, &(0x7f0000000040), 0xa198) 00:58:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:52 executing program 5: syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) flock(0xffffffffffffffff, 0x0) epoll_create1(0x80000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000003c0)=0x80) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000200)={'IDLETIMER\x00'}, &(0x7f0000000240)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000080)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@empty, 0x8, 0x0, 0x3, 0x0, 0x0, 0x1}, 0x20) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0) memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x3, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) ioctl$sock_inet_SIOCSARP(r2, 0x8955, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x3ff800) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) 00:58:53 executing program 0: r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:53 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vcs\x00', 0x2401, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000003c0)=[@in6={0xa, 0x4e24, 0x9, @loopback}], 0x1c) socket$rxrpc(0x21, 0x2, 0xa) socket$pptp(0x18, 0x1, 0x2) r1 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000280)={{0x3, @null}, [@null, @netrom, @bcast, @default, @default, @remote, @null, @rose]}, &(0x7f0000000200)=0x48, 0x80000) r2 = accept(r1, 0x0, &(0x7f00000001c0)=0x2aa) getsockname$inet(r2, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f0000000100)=0x10) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000480)={0xa, 0xa, 0x8, 0x101}, 0xa) r3 = socket$inet(0x2, 0x3, 0x1c) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000400), &(0x7f0000000440)=0x14) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0xfffffffffffffda7) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)=0x0) sched_setattr(r5, &(0x7f0000000140)={0x30, 0x1, 0x0, 0x3ff, 0x186, 0xfffffffffffffffc, 0xf21a, 0x5}, 0x0) bind$inet(r4, &(0x7f0000deb000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f00000004c0)={0x6, 0x0, 0x5, 0x82b, 0x4}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$NBD_CLEAR_QUE(r6, 0xab05) setsockopt$inet_udp_int(r4, 0x11, 0x6f, &(0x7f0000000300)=0x1, 0x4) recvmsg(r4, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r4, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r3, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2250.200540] binder: 7043:7046 ERROR: BC_REGISTER_LOOPER called without request [ 2250.288407] kauditd_printk_skb: 141 callbacks suppressed [ 2250.288423] audit: type=1400 audit(1555635533.743:40622): avc: denied { map } for pid=7048 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2250.330312] binder: 7043:7050 got reply transaction with no transaction stack 00:58:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_emit_ethernet(0x66, &(0x7f00000000c0)={@broadcast, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}, @broadcast}, @gre={{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x8}, {}, {}, {0x0, 0x21}}}}}}, 0x0) [ 2250.402960] binder_transaction: 2 callbacks suppressed [ 2250.402981] binder: 7043:7050 transaction failed 29201/-71, size 0-0 line 2762 [ 2250.466090] binder: release 7043:7046 transaction 2652 out, still active [ 2250.481399] binder: undelivered TRANSACTION_COMPLETE [ 2250.525826] audit: type=1400 audit(1555635533.743:40623): avc: denied { map } for pid=7048 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2250.629570] binder: BINDER_SET_CONTEXT_MGR already set 00:58:54 executing program 0: r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2250.657947] binder: 7043:7056 ioctl 40046207 0 returned -16 [ 2250.690032] binder: 7043:7050 got reply transaction with no transaction stack [ 2250.732972] audit: type=1400 audit(1555635533.833:40624): avc: denied { map } for pid=7048 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2250.794625] binder: release 7043:7050 transaction 2654 out, still active [ 2250.810057] binder: undelivered TRANSACTION_COMPLETE [ 2250.816420] binder: 7043:7050 transaction failed 29201/-71, size 0-0 line 2762 [ 2250.870762] binder_release_work: 2 callbacks suppressed [ 2250.870770] binder: undelivered TRANSACTION_ERROR: 29201 [ 2250.884619] audit: type=1400 audit(1555635533.873:40625): avc: denied { map } for pid=7048 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2250.985819] binder: release 7043:7046 transaction 2652 in, still active [ 2250.995124] binder: send failed reply for transaction 2652, target dead [ 2251.029131] audit: type=1400 audit(1555635533.903:40626): avc: denied { map } for pid=7048 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2251.062850] binder: undelivered TRANSACTION_ERROR: 29201 [ 2251.086786] binder: send failed reply for transaction 2654, target dead 00:58:54 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:54 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x440, 0x0) ioctl$EVIOCSABS2F(r2, 0x401845ef, &(0x7f0000000080)={0x3, 0xf1a5, 0x200, 0x5, 0x8, 0x6}) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000100)) 00:58:54 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2251.146446] audit: type=1400 audit(1555635533.953:40627): avc: denied { map } for pid=7048 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:54 executing program 5: syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) flock(0xffffffffffffffff, 0x0) epoll_create1(0x80000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000003c0)=0x80) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000200)={'IDLETIMER\x00'}, &(0x7f0000000240)=0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000080)) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@empty, 0x8, 0x0, 0x3, 0x0, 0x0, 0x1}, 0x20) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0) memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x3, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) ioctl$sock_inet_SIOCSARP(r2, 0x8955, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x3ff800) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) [ 2251.317453] audit: type=1400 audit(1555635533.963:40628): avc: denied { map } for pid=7048 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:54 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) flock(r0, 0xa3a66d72334654fc) [ 2251.465297] audit: type=1400 audit(1555635534.033:40629): avc: denied { map } for pid=7052 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:55 executing program 0: r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2251.589082] audit: type=1400 audit(1555635534.033:40630): avc: denied { map } for pid=7052 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2251.729761] audit: type=1400 audit(1555635534.073:40631): avc: denied { map } for pid=7052 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2251.778587] binder: 7063:7067 ERROR: BC_REGISTER_LOOPER called without request [ 2251.826358] binder_alloc: 7063: binder_alloc_buf, no vma [ 2251.875958] binder: 7063:7067 transaction failed 29189/-3, size 0-0 line 2970 [ 2251.907706] protocol 88fb is buggy, dev hsr_slave_0 [ 2251.912915] protocol 88fb is buggy, dev hsr_slave_1 [ 2251.918157] protocol 88fb is buggy, dev hsr_slave_0 [ 2251.923260] protocol 88fb is buggy, dev hsr_slave_1 [ 2251.943403] binder: send failed reply for transaction 2657 to 7063:7067 [ 2252.024788] binder: undelivered TRANSACTION_COMPLETE [ 2252.030229] binder: undelivered TRANSACTION_ERROR: 29189 [ 2252.151686] binder: BINDER_SET_CONTEXT_MGR already set [ 2252.204906] binder: 7063:7083 ERROR: BC_REGISTER_LOOPER called without request 00:58:55 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="acfdd50e3a588e39b848ad5a6f2121202e2f66696c65300a47ae191f16d8e04bbb5e68478628583385"], 0x29) [ 2252.308056] binder: release 7063:7080 transaction 2659 out, still active [ 2252.315132] binder: undelivered TRANSACTION_COMPLETE [ 2252.322877] binder: 7063:7067 ioctl 40046207 0 returned -16 00:58:55 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2252.441059] binder: undelivered TRANSACTION_ERROR: 29190 [ 2252.446740] binder: send failed reply for transaction 2659, target dead 00:58:56 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$key(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="020003090200002e9a000000fddbdf25"], 0x10}}, 0x0) 00:58:56 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0xa, 0x3) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:56 executing program 4: syz_execute_func(&(0x7f0000000000)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000480)='./file0\x00', 0x1043, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000300)=""/11, 0xb) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000200)) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) ioctl$TIOCGRS485(r1, 0x542e, 0x0) msgctl$IPC_RMID(r0, 0x0) [ 2253.326058] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pig=7102 comm=syz-executor.5 [ 2253.367971] binder: 7092:7098 ERROR: BC_REGISTER_LOOPER called without request [ 2253.456771] binder: 7092:7105 got reply transaction with no transaction stack [ 2253.557504] binder: 7092:7105 transaction failed 29201/-71, size 0-0 line 2762 [ 2253.618952] binder: release 7092:7098 transaction 2661 out, still active [ 2253.625931] binder: undelivered TRANSACTION_COMPLETE [ 2253.746606] binder: BINDER_SET_CONTEXT_MGR already set [ 2253.819813] binder: 7092:7098 ioctl 40046207 0 returned -16 [ 2253.825645] binder: release 7092:7098 transaction 2661 in, still active [ 2253.829947] binder_alloc: 7092: binder_alloc_buf, no vma [ 2253.841795] binder: send failed reply for transaction 2661, target dead [ 2253.893266] binder: undelivered TRANSACTION_ERROR: 29201 [ 2253.901589] binder: 7092:7112 transaction failed 29189/-3, size 0-0 line 2970 [ 2253.904324] binder: 7092:7105 ERROR: BC_REGISTER_LOOPER called without request [ 2253.998300] binder: 7092:7117 got reply transaction with no transaction stack [ 2254.028182] binder: undelivered TRANSACTION_ERROR: 29189 [ 2254.069346] binder: 7092:7117 transaction failed 29201/-71, size 0-0 line 2762 [ 2254.198898] binder: undelivered TRANSACTION_ERROR: 29201 00:58:57 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:57 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:58:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:58:57 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000000), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f0000000040)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, 0x0, &(0x7f0000000240)) 00:58:57 executing program 5: syz_execute_func(&(0x7f00000000c0)="410f01f9c4e1f573d50664ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110d4b842419dcccc") clone(0x84007ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() mknod(&(0x7f00000000c0)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) creat(&(0x7f0000000180)='./file0\x00', 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_DISABLE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, 0x0}, 0x0) ptrace(0x11, r0) 00:58:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x76, 0xffffff72) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) rt_sigprocmask(0x2, &(0x7f0000000080)={0x7}, &(0x7f0000000100), 0x8) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x5}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000200)={0x0, 0xfffffffffffffffe, 0x1, 0x8, 0x1, 0x6, 0x0, 0x7, r2}, &(0x7f0000000280)=0x20) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:58:58 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2254.797231] binder: 7131:7136 ERROR: BC_REGISTER_LOOPER called without request [ 2254.858403] binder_alloc: 7131: binder_alloc_buf, no vma [ 2254.898203] binder: 7131:7136 transaction failed 29189/-3, size 0-0 line 2970 [ 2254.936881] binder: send failed reply for transaction 2666 to 7131:7136 [ 2254.998458] binder: undelivered TRANSACTION_COMPLETE [ 2255.003812] binder: undelivered TRANSACTION_ERROR: 29189 [ 2255.158872] binder: BINDER_SET_CONTEXT_MGR already set [ 2255.197718] protocol 88fb is buggy, dev hsr_slave_0 [ 2255.202843] protocol 88fb is buggy, dev hsr_slave_1 [ 2255.238846] binder: 7131:7146 got reply transaction with no transaction stack [ 2255.246548] binder: undelivered TRANSACTION_ERROR: 29190 [ 2255.253626] binder: send failed reply for transaction 2668 to 7131:7146 [ 2255.262224] binder: 7131:7136 ioctl 40046207 0 returned -16 [ 2255.297857] binder: undelivered TRANSACTION_COMPLETE [ 2255.305959] kauditd_printk_skb: 128 callbacks suppressed [ 2255.305973] audit: type=1400 audit(1555635538.753:40760): avc: denied { map } for pid=7144 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2255.342756] binder: 7131:7145 ERROR: BC_REGISTER_LOOPER called without request [ 2255.360055] binder: 7131:7146 transaction failed 29201/-71, size 0-0 line 2762 [ 2255.364921] binder: undelivered TRANSACTION_ERROR: 29189 00:58:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x101001, 0x0) socketpair(0x1, 0x6, 0x9, &(0x7f0000000080)={0xffffffffffffffff}) connect$nfc_llcp(r3, &(0x7f0000000100)={0x27, 0x0, 0x1, 0x7, 0xffff, 0x100, "97d22ec88dcf364541fb957fac889d92eef1134d9ccf84be6f964aae0ef19015a7802e59cff632311e963dae447ca3b2e68bfc3e86172dc03a4fe3e55e5859", 0x10}, 0x60) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000040)=0x81, 0x4) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) ioctl$RTC_AIE_OFF(r2, 0x7002) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2255.431913] audit: type=1400 audit(1555635538.763:40761): avc: denied { map } for pid=7144 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2255.544822] audit: type=1400 audit(1555635538.793:40762): avc: denied { map } for pid=7144 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:59 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(0x0, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2255.687742] audit: type=1400 audit(1555635538.843:40763): avc: denied { map } for pid=7144 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2255.807972] audit: type=1400 audit(1555635538.883:40764): avc: denied { map } for pid=7144 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2255.979351] audit: type=1400 audit(1555635538.883:40765): avc: denied { map } for pid=7152 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2256.088143] audit: type=1400 audit(1555635538.883:40766): avc: denied { map } for pid=7152 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2256.202688] audit: type=1400 audit(1555635538.913:40767): avc: denied { map } for pid=7144 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:58:59 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(0x0, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:58:59 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) tkill(r2, 0x14) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0xffffffffffffff98, 0x8051, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2256.306898] binder: 7162:7166 ERROR: BC_REGISTER_LOOPER called without request [ 2256.332219] audit: type=1400 audit(1555635538.943:40768): avc: denied { map } for pid=7152 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2256.378508] binder: 7162:7169 got reply transaction with no transaction stack [ 2256.385884] binder: 7162:7169 transaction failed 29201/-71, size 0-0 line 2762 [ 2256.452987] binder: release 7162:7166 transaction 2671 out, still active [ 2256.465960] binder: undelivered TRANSACTION_COMPLETE [ 2256.497982] audit: type=1400 audit(1555635538.953:40769): avc: denied { map } for pid=7152 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2256.547954] binder: release 7162:7166 transaction 2671 in, still active [ 2256.554824] binder: send failed reply for transaction 2671, target dead [ 2256.602887] binder: 7162:7166 ERROR: BC_REGISTER_LOOPER called without request [ 2256.607743] binder_release_work: 1 callbacks suppressed [ 2256.607750] binder: undelivered TRANSACTION_ERROR: 29201 [ 2256.648925] binder: 7162:7169 got reply transaction with no transaction stack [ 2256.656316] binder: 7162:7169 transaction failed 29201/-71, size 0-0 line 2762 [ 2256.707885] binder: release 7162:7170 transaction 2674 out, still active [ 2256.714821] binder: undelivered TRANSACTION_COMPLETE 00:59:00 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2256.846543] binder: release 7162:7166 transaction 2674 in, still active [ 2256.863772] binder: send failed reply for transaction 2674, target dead [ 2256.902762] binder: undelivered TRANSACTION_ERROR: 29201 00:59:00 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) 00:59:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000040)) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) socket$inet6_udp(0xa, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:00 executing program 4: gettid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) utimes(0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, 0x0) prctl$PR_SET_TIMERSLACK(0xf, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x9e156f2c28587a4a) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, 0x0) write$P9_RGETLOCK(r1, &(0x7f0000000000)={0x22, 0x37, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4, 'eth1'}}, 0x22) 00:59:00 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./\x00group.net/syz0\x00', 0x200002, 0x0) 00:59:00 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(0x0, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2257.502384] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pig=7182 comm=syz-executor.4 [ 2257.629623] binder: 7179:7181 ERROR: BC_REGISTER_LOOPER called without request 00:59:01 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140), 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2257.675166] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pig=7185 comm=syz-executor.4 [ 2257.729179] binder: 7179:7188 got reply transaction with no transaction stack [ 2257.736557] binder: 7179:7188 transaction failed 29201/-71, size 0-0 line 2762 00:59:01 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000180)='/dev/snd/timer\x00', 0x0, 0x200000) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/176, 0xb0}, {&(0x7f0000000280)}, {&(0x7f00000002c0)=""/59, 0x3b}], 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_UIE_OFF(r2, 0x7004) [ 2257.897287] binder: release 7179:7181 transaction 2677 out, still active [ 2257.917410] binder: undelivered TRANSACTION_COMPLETE [ 2257.958633] binder: release 7179:7181 transaction 2677 in, still active [ 2257.970314] binder: send failed reply for transaction 2677, target dead [ 2257.987741] protocol 88fb is buggy, dev hsr_slave_0 [ 2257.992845] protocol 88fb is buggy, dev hsr_slave_1 [ 2258.010769] binder: 7179:7181 ERROR: BC_REGISTER_LOOPER called without request [ 2258.035393] binder: undelivered TRANSACTION_ERROR: 29201 [ 2258.079202] binder: release 7179:7188 transaction 2679 out, still active [ 2258.091819] binder: undelivered TRANSACTION_COMPLETE [ 2258.147765] protocol 88fb is buggy, dev hsr_slave_0 [ 2258.152899] protocol 88fb is buggy, dev hsr_slave_1 [ 2258.158232] protocol 88fb is buggy, dev hsr_slave_0 [ 2258.163324] protocol 88fb is buggy, dev hsr_slave_1 00:59:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:01 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000006b80)={&(0x7f0000006a80)={0x10, 0x0, 0x0, 0x42}, 0xc, 0x0}, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2258.191994] binder: release 7179:7181 transaction 2679 in, still active [ 2258.202371] binder: send failed reply for transaction 2679, target dead 00:59:02 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140), 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:02 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000600)=ANY=[], 0xfec8) recvmmsg(r2, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000002640)=[{&(0x7f00000002c0)=""/4096, 0xfec8}], 0x1}}], 0x1, 0x0, 0x0) 00:59:02 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x7, 0x80) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, 0x0, 0xffffffffffffff64) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[], 0xff92) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000280)={0x0, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e23, @loopback}, {0x2, 0x4e22, @rand_addr=0x8}, 0x221, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffd, 0x200, 0x81}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x120018, &(0x7f0000000440)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c1302e6716e6363657473adf6de666a03f8d3e33d7565722c756964e2f41abeb8c2cf812b1c61f8dbaf87ab8330296af1e70d414e4312b9fbb781b152075d84c21f06e76bb977aadf999e362860ad26c42f86b0f51e1741e12836bc23664330af3dba4f4ed5030e799dcf9ecb09ee77af61c024ccfe596bb06a68b7a068ff59da6fe2ca3c19", @ANYRESDEC=r3, @ANYBLOB="65024ecdcd30a9"]) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") write$FUSE_CREATE_OPEN(r2, &(0x7f0000000300)={0xa0, 0x0, 0x4, {{0x6, 0x3, 0x7, 0x80000000, 0x6, 0x7e1, {0x6, 0x4, 0x6, 0x1, 0x1, 0x9, 0x9, 0xfff, 0x1f, 0x2, 0x7, r3, r4, 0x7868, 0x3}}, {0x0, 0x1}}}, 0xa0) pwrite64(r2, &(0x7f00000003c0)="20c2882b9cdd07c56d619eee671cc0c9b7fb9c26043f064744490b9fbbbebff6b15a915f10c68d03032628750b1011c8598b028debf35a62716f723563c6208691f74576e8b29dc993eaca1dbd39", 0x4e, 0x0) [ 2259.053459] binder: 7211:7213 ERROR: BC_REGISTER_LOOPER called without request [ 2259.113264] binder_alloc: 7211: binder_alloc_buf, no vma [ 2259.148761] binder: 7211:7213 transaction failed 29189/-3, size 0-0 line 2970 [ 2259.203939] binder: send failed reply for transaction 2682 to 7211:7213 [ 2259.238946] binder: undelivered TRANSACTION_COMPLETE [ 2259.244277] binder: undelivered TRANSACTION_ERROR: 29189 [ 2259.342549] binder: BINDER_SET_CONTEXT_MGR already set [ 2259.398207] binder: undelivered TRANSACTION_ERROR: 29190 [ 2259.399798] binder: 7211:7224 transaction failed 29189/-22, size 0-0 line 2855 [ 2259.412943] binder: 7211:7213 ioctl 40046207 0 returned -16 [ 2259.443145] binder: 7211:7217 got reply transaction with no transaction stack [ 2259.490604] binder: undelivered TRANSACTION_ERROR: 29189 [ 2259.504923] binder: 7211:7217 transaction failed 29201/-71, size 0-0 line 2762 [ 2259.771215] binder: undelivered TRANSACTION_ERROR: 29201 00:59:03 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) 00:59:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x7, 0x4000) getsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000100)=0x200, &(0x7f0000000140)=0x4) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000001c0), &(0x7f0000000200)=0x4) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x17, &(0x7f0000000280)="4ea06373b8ec96b3cea6658f604c007ab6c7b23f33354dda2b75520c880a3077dc52ba743f5cfe445821ee5bf4ebfd843b6daff9606bce8fbd6c176932a4481ad5118f4245020dafad10eeae95385644495bdf256cf0a94ed5528a527da0a3c52666d4bbfae33af98498f9cc4831d56969f3b16269ce6f9d2c2f1024aa6d32cb34463f083f6e79c065dcdc2f289242ee44b00133d3954eb62120e82a06e78328eb239d325e065dda5bc6432b67303f4127109beebf38226a47dfff3b", 0xbc) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) getitimer(0x2, &(0x7f0000000040)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r2, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:03 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140), 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:03 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x82) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 00:59:03 executing program 4: r0 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r0, &(0x7f0000001480)={&(0x7f0000000040)=@file={0x170, './file0\x00'}, 0x3, 0x0}, 0x0) [ 2260.325945] kauditd_printk_skb: 163 callbacks suppressed [ 2260.325960] audit: type=1400 audit(1555635543.773:40933): avc: denied { map } for pid=7241 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:04 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2260.518390] audit: type=1400 audit(1555635543.873:40934): avc: denied { map } for pid=7235 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2260.678351] audit: type=1400 audit(1555635543.873:40935): avc: denied { map } for pid=7241 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2260.802089] audit: type=1400 audit(1555635543.873:40936): avc: denied { map } for pid=7241 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2260.870180] binder: 7247:7252 transaction failed 29189/-22, size 0-0 line 2855 [ 2260.920118] binder: undelivered TRANSACTION_ERROR: 29189 [ 2260.968106] audit: type=1400 audit(1555635543.873:40937): avc: denied { map } for pid=7241 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2261.111432] binder: 7247:7259 transaction failed 29189/-22, size 0-0 line 2855 [ 2261.123310] audit: type=1400 audit(1555635543.883:40938): avc: denied { map } for pid=7235 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2261.188873] binder: 7247:7252 ERROR: BC_REGISTER_LOOPER called without request [ 2261.205772] binder: 7247:7254 got reply transaction with no transaction stack [ 2261.236362] binder: undelivered TRANSACTION_ERROR: 29189 [ 2261.258719] binder: 7247:7254 transaction failed 29201/-71, size 0-0 line 2762 [ 2261.296455] binder: undelivered TRANSACTION_ERROR: 29201 [ 2261.300721] audit: type=1400 audit(1555635543.883:40939): avc: denied { map } for pid=7243 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:04 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(r0, 0x0, 0x0) 00:59:04 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2261.427725] protocol 88fb is buggy, dev hsr_slave_0 [ 2261.432865] protocol 88fb is buggy, dev hsr_slave_1 [ 2261.439729] audit: type=1400 audit(1555635543.883:40940): avc: denied { map } for pid=7243 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2261.547801] audit: type=1400 audit(1555635543.933:40941): avc: denied { map } for pid=7241 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:05 executing program 5: pipe(0x0) capget(0x0, 0x0) r0 = gettid() rt_sigqueueinfo(0x0, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000380)='/dev/full\x00', 0x0, 0x0) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x382) socket$unix(0x1, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) tkill(r0, 0x1000000000016) shmdt(0x0) [ 2261.727760] audit: type=1400 audit(1555635543.943:40942): avc: denied { map } for pid=7243 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:05 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='setgroups\x00') openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x802, 0x0) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000080)={0x1, 0x8, 0xe8, &(0x7f0000000280)="eac6162384301fa733129ac410eac8c52fbdccbc253873972c9caa6f197f724d96aad0bd5e2189be335cc320a45ce1b1b6caa5916b4f58b797bed0c39abdae1df8abe02c73c9ac7b6c355a07480216eafbef521d5b9a021692b10e64c86b1cecb3afbaa392cbe5b439d07052084dc0f10369cf0c0919c058174cd8bf43a2354f08362cc38b7beb4ba2bb2a5f19a1c471e069f5103f55595ff6772fa62843d453196414acc5d5b579777e4cc252845ea749b44616f3f03616cf530ebf9c0d6ae3831e14ec6682b858557b289e5e29a8c29d996542734719a3693b4f230d51b91b3e9add26de8f82a7"}) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2262.272998] binder: 7276:7279 transaction failed 29189/-22, size 0-0 line 2855 [ 2262.370371] binder: undelivered TRANSACTION_ERROR: 29189 [ 2262.442838] binder: 7276:7285 transaction failed 29189/-22, size 0-0 line 2855 [ 2262.508861] binder: 7276:7282 got reply transaction with no transaction stack [ 2262.516233] binder: 7276:7282 transaction failed 29201/-71, size 0-0 line 2762 [ 2262.624866] binder: undelivered TRANSACTION_ERROR: 29189 [ 2262.633220] binder: undelivered TRANSACTION_ERROR: 29201 00:59:06 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) 00:59:06 executing program 4: 00:59:06 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:06 executing program 5: 00:59:06 executing program 5: 00:59:06 executing program 4: 00:59:06 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2263.612469] binder: 7300:7304 ERROR: BC_REGISTER_LOOPER called without request [ 2263.674189] binder: 7300:7307 got reply transaction with no transaction stack 00:59:07 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) ioctl$sock_bt_cmtp_CMTPCONNDEL(r2, 0x400443c9, &(0x7f0000000100)={{0x80, 0x80000001, 0xcb, 0x1, 0x0, 0x3}, 0x2}) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) socket$isdn_base(0x22, 0x3, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000040)={0x80fb, 0x1}) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2263.727079] binder: 7300:7307 transaction failed 29201/-71, size 0-0 line 2762 [ 2263.788609] binder: release 7300:7304 transaction 2693 out, still active [ 2263.795599] binder: undelivered TRANSACTION_COMPLETE 00:59:07 executing program 4: [ 2263.924784] binder: BINDER_SET_CONTEXT_MGR already set [ 2263.994384] binder: release 7300:7304 transaction 2693 in, still active [ 2264.014394] binder: 7300:7313 ERROR: BC_REGISTER_LOOPER called without request [ 2264.025891] binder: send failed reply for transaction 2693, target dead [ 2264.083552] binder: undelivered TRANSACTION_ERROR: 29201 [ 2264.119731] binder_alloc: 7300: binder_alloc_buf, no vma [ 2264.159993] binder: 7300:7304 ioctl 40046207 0 returned -16 00:59:07 executing program 5: [ 2264.206191] binder: 7300:7307 transaction failed 29189/-3, size 0-0 line 2970 [ 2264.227728] protocol 88fb is buggy, dev hsr_slave_0 [ 2264.232953] protocol 88fb is buggy, dev hsr_slave_1 00:59:07 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2264.289784] binder: undelivered TRANSACTION_ERROR: 29189 [ 2264.387715] protocol 88fb is buggy, dev hsr_slave_0 [ 2264.392861] protocol 88fb is buggy, dev hsr_slave_1 [ 2264.398088] protocol 88fb is buggy, dev hsr_slave_0 [ 2264.403281] protocol 88fb is buggy, dev hsr_slave_1 [ 2265.525707] kauditd_printk_skb: 161 callbacks suppressed [ 2265.525722] audit: type=1400 audit(1555635548.973:41104): avc: denied { map } for pid=7334 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2265.570568] audit: type=1400 audit(1555635549.023:41105): avc: denied { map } for pid=7334 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:09 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140), 0x0, 0x0) 00:59:09 executing program 4: 00:59:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2265.653578] audit: type=1400 audit(1555635549.053:41106): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:09 executing program 5: 00:59:09 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:09 executing program 3: r0 = socket$inet(0x2, 0x20a, 0x200008000000001b) r1 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000040), &(0x7f0000000080)=0x40) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2265.821620] audit: type=1400 audit(1555635549.073:41107): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:09 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:09 executing program 4: 00:59:09 executing program 5: [ 2265.951790] audit: type=1400 audit(1555635549.093:41108): avc: denied { map } for pid=7334 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2266.024876] binder: 7338:7340 ERROR: BC_REGISTER_LOOPER called without request [ 2266.037015] audit: type=1400 audit(1555635549.093:41109): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2266.095028] binder: 7338:7347 got reply transaction with no transaction stack [ 2266.120493] binder: 7338:7347 transaction failed 29201/-71, size 0-0 line 2762 [ 2266.149532] binder: release 7338:7340 transaction 2697 out, still active [ 2266.162201] binder: undelivered TRANSACTION_COMPLETE [ 2266.165815] audit: type=1400 audit(1555635549.203:41110): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2266.236194] binder: BINDER_SET_CONTEXT_MGR already set [ 2266.305875] binder: 7338:7347 ioctl 40046207 0 returned -16 [ 2266.371425] audit: type=1400 audit(1555635549.243:41111): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2266.419726] binder: 7338:7340 ERROR: BC_REGISTER_LOOPER called without request [ 2266.467767] protocol 88fb is buggy, dev hsr_slave_0 [ 2266.467975] binder: release 7338:7348 transaction 2699 out, still active [ 2266.473050] protocol 88fb is buggy, dev hsr_slave_1 [ 2266.485023] protocol 88fb is buggy, dev hsr_slave_0 [ 2266.490183] protocol 88fb is buggy, dev hsr_slave_1 [ 2266.498175] binder: undelivered TRANSACTION_COMPLETE 00:59:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2266.570305] audit: type=1400 audit(1555635549.253:41112): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2266.586888] binder: release 7338:7340 transaction 2697 in, still active [ 2266.643238] binder: send failed reply for transaction 2697, target dead 00:59:10 executing program 4: [ 2266.688276] binder: undelivered TRANSACTION_ERROR: 29201 [ 2266.710095] audit: type=1400 audit(1555635549.333:41113): avc: denied { map } for pid=7334 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2266.749775] binder: send failed reply for transaction 2699, target dead 00:59:10 executing program 5: [ 2267.505892] binder: 7365:7367 transaction failed 29189/-22, size 0-0 line 2855 [ 2267.560567] binder: undelivered TRANSACTION_ERROR: 29189 [ 2267.655276] binder_alloc: 7365: binder_alloc_buf, no vma [ 2267.696324] binder: 7365:7371 got reply transaction with no transaction stack [ 2267.702402] binder: 7365:7368 transaction failed 29189/-3, size 0-0 line 2970 [ 2267.768330] binder: undelivered TRANSACTION_ERROR: 29189 [ 2267.774805] binder: 7365:7371 transaction failed 29201/-71, size 0-0 line 2762 [ 2267.841116] binder: undelivered TRANSACTION_ERROR: 29201 00:59:11 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140), 0x0, 0x0) 00:59:11 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x10800, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000080)) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f00000004c0)=0x1c) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') openat(r2, &(0x7f0000000500)='./file0\x00', 0x3a5240, 0x12c) sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20202}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x100, r3, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x68, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x40}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x16}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}]}, 0x100}, 0x1, 0x0, 0x0, 0x4000801}, 0x10) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) sendto(r1, &(0x7f00000003c0)="2e7edbc406fb98bf5eaa1149d4b51ba7fe21acb8203fc8387d0e9554bc750a8b0274d189311bd31d7643822a89ed0c2640de75db614c3514d91564818421e459f4a9b0db7b0ac8bd11f320fb09", 0x4d, 0x8000, &(0x7f0000000440)=@rc={0x1f, {0x7f, 0x1, 0x40, 0x100, 0x81, 0x401}, 0x6bf}, 0x80) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) accept4$vsock_stream(r2, &(0x7f0000000100)={0x28, 0x0, 0x2711, @my=0x1}, 0x10, 0x800) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:11 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:11 executing program 4: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000680)='/dev/video0\x00', 0x2, 0x0) writev(r0, 0x0, 0xfffffffffffffca1) 00:59:11 executing program 5: dup(0xffffffffffffffff) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'e \x00\b\x00', 0x2}, 0x18) r0 = socket(0x0, 0x1, 0x0) ioctl(r0, 0x8916, &(0x7f0000000000)) ioctl(r0, 0x8936, &(0x7f0000000000)) getpgid(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000040)={0x2, 'bridge_slave_1\x00'}, 0x18) 00:59:11 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:12 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:12 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, 0x0) [ 2268.714815] binder: 7380:7384 ERROR: BC_REGISTER_LOOPER called without request [ 2268.782189] binder: 7380:7391 got reply transaction with no transaction stack [ 2268.830643] binder: 7380:7391 transaction failed 29201/-71, size 0-0 line 2762 [ 2268.877188] binder: release 7380:7384 transaction 2705 out, still active [ 2268.892768] binder: undelivered TRANSACTION_COMPLETE [ 2268.994329] binder: BINDER_SET_CONTEXT_MGR already set [ 2269.021683] binder: release 7380:7384 transaction 2705 in, still active [ 2269.028834] binder: 7380:7384 ioctl 40046207 0 returned -16 [ 2269.050623] binder: send failed reply for transaction 2705, target dead [ 2269.080680] binder: undelivered TRANSACTION_ERROR: 29201 [ 2269.091607] binder: 7380:7391 ERROR: BC_REGISTER_LOOPER called without request 00:59:12 executing program 5: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x43, 0x0, 0x0) [ 2269.126834] binder: 7380:7395 transaction failed 29189/-22, size 0-0 line 2855 [ 2269.182827] binder: undelivered TRANSACTION_ERROR: 29189 00:59:12 executing program 4: r0 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$inet6_int(r0, 0x29, 0x38, 0x0, &(0x7f00000001c0)) 00:59:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:12 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2269.747820] protocol 88fb is buggy, dev hsr_slave_0 [ 2269.752965] protocol 88fb is buggy, dev hsr_slave_1 [ 2270.118986] binder: 7417:7421 ERROR: BC_REGISTER_LOOPER called without request [ 2270.213368] binder: 7417:7425 got reply transaction with no transaction stack [ 2270.258773] binder: 7417:7425 transaction failed 29201/-71, size 0-0 line 2762 [ 2270.291780] binder: release 7417:7421 transaction 2709 out, still active [ 2270.321808] binder: undelivered TRANSACTION_COMPLETE [ 2270.371634] binder: release 7417:7421 transaction 2709 in, still active [ 2270.407963] binder: send failed reply for transaction 2709, target dead [ 2270.427414] binder: undelivered TRANSACTION_ERROR: 29201 [ 2270.436670] binder: 7417:7421 ERROR: BC_REGISTER_LOOPER called without request [ 2270.473455] binder: release 7417:7425 transaction 2712 out, still active [ 2270.503935] binder: undelivered TRANSACTION_COMPLETE [ 2270.567466] binder: release 7417:7421 transaction 2712 in, still active [ 2270.576160] binder: send failed reply for transaction 2712, target dead 00:59:14 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140), 0x0, 0x0) 00:59:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) 00:59:14 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000040)={0x1, 0x0, [{0x200, 0x4, 0x0, 0x0, @irqchip={0x0, 0x1d}}]}) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0xfffffffffffffcdf) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3f, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:14 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x42, 0x402) pwritev(r0, &(0x7f0000001140)=[{&(0x7f0000000040)="2b6696848a92773eee19198c02df7bfdf656335980b168fcfa3e74f821cd7908b971bf4846844b08cb33a95127acf4e8a51b7c8cede4256db7788c8b5e5dd5060144eb8de11a169fe27124ab7715e43360e0df838dbb5c2090fe23520e3fadf86fe095cf0c5c270c99fd4c662c81975afc6670358d4deb0f42366a1b0df78dddfc8d10c8726d2e35575551012e46781bea3a98956a5442b40d444073bc54ea7434629275483d0a530d6ddaf5c75eb610fc48753c97b2d905336c000d5b0aaa03bbccef42a1be5f8c1994053a2cddb4a4d4f002b939518a8b345ac52b7867d756d0f18b115e019f106bd02925f7cf146f5a1070ac597672d457d06ecc06cc0e1389e96f0d539a32f90a704033327df95c596f6b3a294a1b41ea8bcd47638cfc39dfd8fa5b16d5c43b38882a35c7e46049e70cda73881eb0c4fb19c6ac13db8c98326e8b2aa0f0bdcf5a47170bd978ff44811594ba99bb9020266863c2b2e2822eeca5fbc77172fb96ba6b4e1e2330f527b7a6923c0c415491662ec044459179191fa4aef9060748725a36e2562ed6029bd0f81c59775e35ec1516209bcefdfcd1118708b3e4c87f96da8cc545491a115426c96613812e3ee3928efb50aafdf7bd09bf2b0eefdabc750759613efa1521f67f1d4311577ae703978306ce44af35e0a90fe5f3eb1c06be3f489a6ea1571ce31bca74eb1a3a2a19d7162ce41e250d09f3a54c0d3e60d29dd4c5d7ef3b39cb3c44fd0c8b1bdc81e095e8ec77ce1d09cf1472a241fde2f7c2845b3b75cf6ff79b90dae9d6da969f3d02c6e4321a1da4ccf004587e04c2a4220e9cb98d555fd75623160ff7e0e2b807d0a230157665a12aab17991f4d11f97f3a3ff565a22ee078851ffe7c79d96ef6d52f646feb9c38af9976efd9c158491fc50f7fe7f0397a1f349c309bde2b7400eae7c240b303dc03e0bb85fe738efe175e3ac198b0b2315cb1f10a956e40e90f94fddfd384f6128134bb99736fa83bd7e0dff528d24258f32479f5b85cdbeaffab71756f3587f21d838fe5b67e86b03f59e8853514bcca201b41a44f472ed1130380bc57c38ccb5045ae3fbc29258e3787b20cf343d435095169e1e4c01866050ad5d232fae53c8609343fae4a7a689a759b23185482c2dec0162bdb92876d2b1c4a86b3dca6c5c88c1ceb47d77aa60b0d2cecdc022f8cffdc60b1b2f57797fbf27d68bf5a647361409223629112dbc37810d662936fc2fa9a1751c2696852e30a088759f29e67bf517f7a15523d15a67e00642c544ce61fbb74ea77f7721d45398cbc93c37cd2ac8dc0c6d18c9cface4801f29bb9b2485d1874751fb903af2480c1fc747a33e11d01adb87c0769d7a47be31b03037a1ec927c6f8a6b4c43aa105a0233ab94c5b7898d273fcc0a54d44358ec8a3453723c316a0e85d14b372c65579835333108edca823f48818c6c4aba0c8c50671d4e0f21aacc2c0ea680820c68203b6f13a923fc97d77d1bf7c8d6d5f6b14cd481bdcbba34d459729327e001e7b6967c88a636beda50917f89946ad74b7b8270af989e1920108068201947e2139100a010f3880a4296ef012c7156bc1ca6ca3f926a1b85e4d1e3e3e13f371ac6588a4809c3fd66d3c584fa5602ad73e467d56c8e939f8993a5655acf17b176d62327f49f918d62314f2ef399c942be1f31a11f29bd3f5c29cb7a7b345a4cb71791768015bddf375b294c231b283e96475279ea25aac663c00293155765facd3df5206a03c29b740169fbafefee300b185881374346b9014c96d522834a5372cf7ce7ba7223b047e9c9f5cec12cbd10117113405646d40cdb2b963c901d658a8809c4afc845515aeb41f3168253fe8ffbcabd5f84a2eb6b8be35d4ada97b39dfd4db49553b39604b8903c31dd972d7e8a4b07d2493ab7ead92f45146c9ad492d300e7bb3d64acf90d1bd322b10391c302d2d53df37188ae9860d2e0879cd1f4194fd668935adaaec9efb69b9a7ae680ccf7edd27437affed9917ebd6138c4621c5fa5afd8eb1c51584822dcf53fc88435a3f34aed6f8f537d5c6e866d09887a84ab2757666fc1488e6ff49b98f081cdc47dcaad8c355770ac775fd2b84968ef1ecce1a3c0a19fde6b7167b6f6b1ddeac380ba753865be52c2b8e972c1b431d8d6d184c9046e0f850db9afaee2303ed391e92882eef805479f4bc59609b374b93fd8c8c67e7826fee852fc0cda1a6513cc383a0c51b4d7ddba65ad4f5a3c7448923f7642253c2c6882cbbf579faeeb0c7a778208179fe4f0134e6177790a0c8516cf7e38eb36f53a2a21b0d180a744e11f337805094c8657c5291a89a3331009e34e31f8e7177e1076158ccaa96e62c8b5561458265f151f83235249b37a7cde4753746688aaf68a4f7b110851cc000fedaed0454876f44c71d8a042f64d11ec254654143e7569d1fa5c5d9b07b3c595115edab9b171e5b61a6243e5dad00b48264ec5c47179ac3b363161a5e555cd5d46f4296037603b3383d0cc36dea828a41dfb755a16b5d7ffa1f1ac733c1472510a77f0ae8643ca39508824e3f92ee7466518794e30be3f5060db7ee0ce3859cc0bb9c2ee7144ebf7017b784372d4d79318fca23dcefd38e947b6158d3d9a378c911376b988de3d68ff67ee32a1e321aa895231f43bd7d7deca090d32a4261a1df63a1fd48fcf33c065b06e50fee631cceae3e3304a5a977199c84faced91b31bd490adc69bc282fa03d35067626cfc500669fb780bbc53cdafbf652fe0e0f907195f35cda13095cfb9948f7d93365ee310d56a0db9e5700158550b6156980024bf0a844795c723f242cd3cd527d9b7eed4f7c77e148c20bf95c0fdee50c150c840042149fc216875ccb4fed2eeb9c7d9bcfca4024b53c1837bb6adc166973c6e58013662b99619454c0078098cb48f06fc31df571e478c48a95523cdd47afcabc43fc5f583982edbc7c0ae272a37277888ed5d93900123476869327ef540cfab23d361da938d5ffb922138d7417f730e6e25dc7b2798634b12af06d062d0c6c383b1e510fc311f671a9f9f16f628ef49f6bef09e5ca6be1c2351cd486b5409fdf514f034f5223851d73707a9e951ea454b4ae2c2f2b82b05c5b33ae0164d7966d798721307e0ac671c1136de39ed660fd6979810f4967abfe17a760014d8177e2688da635a404d353a72deae946691e362f0f36b6f03e7aa07df97e6439a926d34f94feddd299ba3d2f80ab158cd9fa82bb47aa9e4e2bbb7e0ddbd409efeb9a5888d31ec794fa0336c2c09a40e787351b4bc1574e813781391a9ab7fcd4259a055d6fb80c8f40d96aaed3afe9ddfc312fa99f4377f2fc3651d3976937ce7847e6cb25d94f3cb44a71834a001272df4dd96992d78907b8cf1ed3ea464fbb3c08d865ed452cee1d1b3c34783000f4a273bec0cf015cf2b91803289705d4f4fe4eaf3b9ad61d338adbf97aba5301d42f712eaa742cf322e1b7017ecc4454410ee8b68b2047b9130212a7da3e5ecd337e7f2c9098cadeadfbf76702943db04440b5c39e67c27d02866e0605fdb64e64695026209c924cde1b1d6fd8a2fcc405772668400b78f3de20dfb7d6836fa533ffaa8d730615b9a20f74b533817fb9251d4b8f751821bda8ab2755c605b4086fdd1da7ae28afbd1e9410888678d503c0ead325c4903bb4c0c15cad0de8ed35975312e982d45001ce9a39367a8db8bbffea813271bd3f068e795901a0c0c554d34c1316b00b4a8f8b54ec06dc5f606a8539c4cdedd0bd71ea9b0d902554821297acaccbf55a5e2aa4b3a7b08f705578afbf5eb6ba1f283bdfdf76950e0a0aa8476b87dd8515d3d72f6800628da1aaa70dcfe1ae65c71e64c8219bda140c405b4c72f5ca1453d2c13f47b43c9848458bdaa0b7ba4ae2a78ef0a36da061f303a03e39df21b2a74c8ce9e448a423d9846c8f0449a27524ebe56f643990e0524091e2aaccdb176c3ba4768f7c3aeb8484d47cca6c2315943793c4698035c8a1641e90851ab509f7276b2553aa3efc2606028ae7c08635555e53c1f1e8b7b670621c6ddf210235fa462bf23b61d9a78c4c26debe26627e80b1239b89d869b726a34595fa6d3c791b5c8e3149f767dd75c9b4406ea59beaced3de898e8aaec6779f48f2ba540f8f451f3fa96cd5272add50573732b1093aae67ed6b7e1d56843e5a3374e1ee0756fd971a381530492c7842d9218e5252035e64108b7ada84ac8eb31d865ba94b413d50251d98406fc45a5cfc98544b5ab7597fc1df5b84e8b5c848392d4d5e778a4c3f994808a7953867c7f89f8de91bbc89c57f17c4dec25e76da589b0032f316a1180ec62665b85c24a782a0cb6057fb5f264ea7883657794952b852fbf6fdbce073e48fbbd182ca0651a95e4649b81ccb742af1935aaf3cb2756b6bda0de122c7a13c6ede61c05ab23467939348610eaeee254bd2f2375c17317f25894c9a69933954320f3e0bea36e0c862e089e2559bd90439589fbe6c927d39925e1553c4998cf173991710279c7a6032c6e0189fcbf9e000051ae30f1712e8aa4a1c33de8bb03688a4b498e33cfa5a1ef5145fc5960325949117d109f2cd162635a4025e4dedf0657781b7e30df838564b29971bffaf3bc12a2866c3476cf4a8441f41b515842374860c13590b40f8f98c041997b2881e79be9db5a042100e64266a6e309060f4e717276b64091ee8287caf98bb3506e030610179c49d80f3f5959575aacd2166965bc5cf9fbfd42c590ab641df636e6388fc5c3275cea690e23e67fb6068585d0f3a377d88c01e0470b57c83060eac10a1a76f41139a441712606f60ce495264b5c80dddbce1ebae4991ad612fa026febeb34507ad4f54704d7c9693da7c06fe58e4979be57394072052e44ba823ec4de35b51cd818ab8e73f54c91513e6f6ec1b62dfc1705c3ef1a6d1ac9ab48fae4bbf600e6bbe868190548b328d7b2124356f8cf9f446d3a60d84cbd18ed1312b767ef026482e8355ebf3ab5bb8dc3a3f58a796515343149fa4265a4d5aef1d03efa292dd9052b43eb4dae7945b162eccc034aa07ca2de31b319db6796ecc95a0ec6fc29bd4f91726a443d1c8f1d50b5b237970d1c5d42099184740f04dce2a8e00c21b447a97e7f8027ab882408e1ffdb76c2f9294993dc7451dcb5a248525e86f22edfd96f46319ba05a2a993241e1c7337065fcb66ba1de4e272b86abff598faedec1f86260e9a3ea9408f6941a284b6b98f36100dfff9b3b69635b25e4fa6f892b393d44e5bdfffe12e34071349605b2c441bab7fb6f14c7b87b5d7c4020b42be0d9a3cd9a1dc637bf26c152deee4e15bfe6cf8a29e4fe371de6e872854255e8e0e4a6687c30c396c9a1f96275d239f1095014ee4a9e388b1d4c3fa83d61a3f5ec17a616b56fd4aee428e2be59f538b94562ac0cd4d0e5daaee4759f11a5461524c7b11bcfaf9426741b8d7bbba850664f0797fe1f2507df06c68e3f084471c4da1d6950d4014425d6781a662534e0387cf2f9e86d7e0f28f7fd119f2163e777509e533d6a94c2b6b883a8bb4e61ad0874a59619f124c4137b53a64c92bff4dd5387f2469e6ae127a77e76338e05c2e55b2bbbe45fb3bf3485f826fcdb0060db316c2acdeb48fdcf21e92961bb6acb532c9311b946d5f", 0xfa4}], 0x1, 0x0) 00:59:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2270.896718] kauditd_printk_skb: 198 callbacks suppressed [ 2270.896733] audit: type=1400 audit(1555635554.343:41312): avc: denied { map } for pid=7429 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.022377] audit: type=1400 audit(1555635554.343:41313): avc: denied { map } for pid=7429 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:14 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffff7f7ffffffa}]}) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fsetxattr(r0, &(0x7f00000001c0)=@known='user.syz\x00', 0x0, 0x0, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='user.syz\x00') 00:59:14 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:14 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, r0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'nat\x00', 0x19, 0x2, 0x210, [0x20000980, 0x0, 0x0, 0x200009b0, 0x20000ab8], 0x0, &(0x7f0000000100), &(0x7f0000000980)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x15, 0x43, 0xc39f, 'sit0\x00', 'veth0_to_hsr\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], @broadcast, [0xff, 0x0, 0xff, 0xff], 0xa0, 0xa0, 0xd8, [@connlabel={'connlabel\x00', 0x8, {{0x0, 0x2}}}]}}, @snat={'snat\x00', 0x10, {{@random="dceba8b90f6f", 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x19, 0x50, 0x6006, 'syzkaller0\x00', 'netdevsim0\x00', 'ip6gre0\x00', 'bridge_slave_1\x00', @dev={[], 0x2b}, [0xff, 0xff, 0x0, 0xff, 0xff], @dev={[], 0x1b}, [0xff, 0xff], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@dev={[], 0x18}, 0xfffffffffffffffe}}}}]}]}, 0x288) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)=0x6, 0x4) sched_getaffinity(0x0, 0x0, 0x0) unshare(0x40000000) fcntl$getown(0xffffffffffffffff, 0x9) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x80000000) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) sendmsg(r1, &(0x7f0000000900)={&(0x7f0000000500)=@nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x40000}, 0x80, &(0x7f0000000880)=[{&(0x7f00000007c0)="0959bde07efe01fa1036ced362a242c04c790b0a809e091dbef3ae7006e732979d1aa8eb268f3bc045ef89def54d337ac1defe435152e73cdfa1823689b12a61e248f998e24c706bf4e51178d95e753f48abdefb51012762bd18213c2319138ffa2fafa5767a23f03860be48e6305e6967e959053c62c742a915ac82f0b9d4602a424e68aac17575f1b538f7bf6587b60a77e01b2a4dd75df4ad4ea25843081fe43ede72e1", 0xa5}], 0x1}, 0x81) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) open(&(0x7f0000000300)='./file0\x00', 0x400, 0x10) syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0xfff, 0x101000) ioctl$BLKFLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000940)) mkdirat$cgroup(r4, &(0x7f0000000080)='3yj \x00', 0x1ff) fcntl$setflags(r3, 0x2, 0x1) fchdir(r2) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)}], 0x0, 0x0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) [ 2271.140745] audit: type=1400 audit(1555635554.353:41314): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.210525] audit: type=1400 audit(1555635554.373:41315): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.271282] audit: type=1400 audit(1555635554.433:41316): avc: denied { map } for pid=7429 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.298619] binder: 7434:7437 ERROR: BC_REGISTER_LOOPER called without request [ 2271.316137] binder_alloc: 7434: binder_alloc_buf, no vma [ 2271.379612] binder: 7434:7437 transaction failed 29189/-3, size 0-0 line 2970 [ 2271.397315] binder: send failed reply for transaction 2714 to 7434:7437 [ 2271.416196] audit: type=1400 audit(1555635554.463:41317): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.470385] binder: undelivered TRANSACTION_COMPLETE [ 2271.478230] binder: undelivered TRANSACTION_ERROR: 29189 [ 2271.552335] audit: type=1400 audit(1555635554.473:41318): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.596723] binder: undelivered TRANSACTION_ERROR: 29190 [ 2271.660523] binder: 7434:7437 ERROR: BC_REGISTER_LOOPER called without request [ 2271.689874] audit: type=1400 audit(1555635554.503:41319): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2271.724857] binder: release 7434:7442 transaction 2716 out, still active [ 2271.744699] binder: undelivered TRANSACTION_COMPLETE [ 2271.827707] protocol 88fb is buggy, dev hsr_slave_0 [ 2271.832911] protocol 88fb is buggy, dev hsr_slave_1 [ 2271.839874] audit: type=1400 audit(1555635554.523:41320): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2271.877431] binder: release 7434:7437 transaction 2716 in, still active [ 2271.899387] binder: send failed reply for transaction 2716, target dead 00:59:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0xfffffffffffffffc, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x8dd67418787192a, 0x0, 0xfffffffffffffdcb}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) 00:59:15 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2272.004765] audit: type=1400 audit(1555635554.573:41321): avc: denied { map } for pid=7429 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:15 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000840)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x4c1078b5631b409f}}) [ 2272.503250] IPVS: ftp: loaded support on port[0] = 21 [ 2272.682360] binder: 7462:7467 transaction failed 29189/-22, size 0-0 line 2855 [ 2272.756056] binder: 7462:7463 ERROR: BC_REGISTER_LOOPER called without request [ 2272.879427] binder: 7462:7463 got reply transaction with no transaction stack [ 2272.886840] binder: 7462:7463 transaction failed 29201/-71, size 0-0 line 2762 [ 2272.921214] IPVS: ftp: loaded support on port[0] = 21 [ 2272.941989] binder: undelivered TRANSACTION_ERROR: 29189 [ 2272.959531] binder: undelivered TRANSACTION_ERROR: 29201 [ 2273.084048] binder: 7462:7480 transaction failed 29189/-22, size 0-0 line 2855 [ 2273.115940] binder: 7462:7479 got reply transaction with no transaction stack [ 2273.116579] binder: 7462:7467 ERROR: BC_REGISTER_LOOPER called without request [ 2273.181179] binder: undelivered TRANSACTION_ERROR: 29189 [ 2273.195485] binder: 7462:7479 transaction failed 29201/-71, size 0-0 line 2762 [ 2273.208151] binder: undelivered TRANSACTION_ERROR: 29201 00:59:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:16 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0x50000}]}) clone(0x9e5741d77f301faf, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000380)="29a80adaee95c4c9e045a5368aabf969e0981483ab463fc9b76a02c8564e1a7cf2d9b506ddc92f9079fc187f2d3247fae3f59f04c52c9ba8b5b19183cbfd008d9560fbe3557d9acacac3da6820") 00:59:16 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000008, &(0x7f00000001c0)) r0 = gettid() timer_create(0x0, &(0x7f0000ee4000)={0x0, 0x14}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000e04000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x1000000000012) 00:59:17 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:17 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x5, 0x200000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0xd}}, 0x20) r4 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x9, 0x2000) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f0000000200)={0x12, 0x10, 0xfa00, {&(0x7f0000000080), r3, r4}}, 0x18) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r2, &(0x7f0000000280)="ba4f901e5929d7ee9e924b23290a2e06cd72a5bae81b00f08117fed56ffaa53920d1b47bd073da1ef387eb4683ca1b1a17408dfc48d93c2e891cd30f22150b6fcfc08fcb6b312c70efe7a1c2f70f93e1309e15914566f3d590378f8325ef13f6619e121b9af7da49c4901e0120d695905e5361aaec1d1319145326a838f65e2ea2d8351cdc56526cf0beb1007363dd9a0516c3796bad8083e529767a38d65965cec6900e705af16c0080160eab340c03947e1b8265a54da97d97d1dd87667907ab06e6bb60d2bed85b5e8b56adec8a93ba108d42523c9c784ccf76"}, 0x10) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:17 executing program 4: [ 2273.999176] binder: 7485:7486 transaction failed 29189/-22, size 0-0 line 2855 [ 2274.043770] binder: undelivered TRANSACTION_ERROR: 29189 [ 2274.163215] binder: 7485:7494 transaction failed 29189/-22, size 0-0 line 2855 [ 2274.220844] binder: undelivered TRANSACTION_ERROR: 29189 00:59:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2274.987456] binder: 7502:7503 ERROR: BC_REGISTER_LOOPER called without request [ 2275.022853] binder_alloc: 7502: binder_alloc_buf, no vma [ 2275.032151] binder: 7502:7503 transaction failed 29189/-3, size 0-0 line 2970 [ 2275.045133] binder: send failed reply for transaction 2725 to 7502:7503 [ 2275.061804] binder: undelivered TRANSACTION_COMPLETE [ 2275.067183] binder: undelivered TRANSACTION_ERROR: 29189 [ 2275.113116] binder: undelivered TRANSACTION_ERROR: 29190 [ 2275.137374] binder: 7502:7503 ERROR: BC_REGISTER_LOOPER called without request [ 2275.154782] binder: 7502:7504 got reply transaction with no transaction stack [ 2275.166338] binder: 7502:7504 transaction failed 29201/-71, size 0-0 line 2762 [ 2275.183178] binder: release 7502:7504 transaction 2728 out, still active [ 2275.195433] binder: undelivered TRANSACTION_COMPLETE [ 2275.234211] binder: release 7502:7503 transaction 2728 in, still active [ 2275.245945] binder: send failed reply for transaction 2728, target dead [ 2275.270424] binder: undelivered TRANSACTION_ERROR: 29201 00:59:20 executing program 5: 00:59:20 executing program 4: 00:59:20 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") lsetxattr$security_smack_entry(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64EXEC\x00', &(0x7f0000000100)=']\x00', 0x2, 0x1) 00:59:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x346, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:20 executing program 1: 00:59:20 executing program 4: [ 2277.050899] kauditd_printk_skb: 112 callbacks suppressed [ 2277.050914] audit: type=1400 audit(1555635560.503:41434): avc: denied { map } for pid=7507 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 00:59:20 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2277.145374] binder: 7507:7509 ERROR: BC_REGISTER_LOOPER called without request [ 2277.179727] audit: type=1400 audit(1555635560.553:41435): avc: denied { set_context_mgr } for pid=7507 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2277.198689] binder: 7507:7512 got reply transaction with no transaction stack [ 2277.282696] binder: 7507:7512 transaction failed 29201/-71, size 0-0 line 2762 [ 2277.290247] audit: type=1400 audit(1555635560.583:41436): avc: denied { call } for pid=7507 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2277.290274] audit: type=1400 audit(1555635560.603:41437): avc: denied { map } for pid=7511 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2277.290302] audit: type=1400 audit(1555635560.623:41438): avc: denied { map } for pid=7511 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2277.290328] audit: type=1400 audit(1555635560.653:41439): avc: denied { map } for pid=7511 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2277.290354] audit: type=1400 audit(1555635560.673:41440): avc: denied { map } for pid=7511 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2277.391898] binder: release 7507:7509 transaction 2731 out, still active [ 2277.456988] binder: undelivered TRANSACTION_COMPLETE [ 2277.525916] binder: release 7507:7509 transaction 2731 in, still active [ 2277.547557] binder: 7507:7512 transaction failed 29189/-22, size 0-0 line 2855 [ 2277.549595] binder: send failed reply for transaction 2731, target dead 00:59:21 executing program 5: [ 2277.586256] binder: 7507:7509 ERROR: BC_REGISTER_LOOPER called without request [ 2277.610228] binder: 7507:7512 got reply transaction with no transaction stack [ 2277.618427] binder: undelivered TRANSACTION_ERROR: 29201 00:59:21 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x100000003, @local}, 0x10) sendto$inet(r0, 0x0, 0x2f5, 0x200007fc, &(0x7f0000000000)={0x2, 0x3, @local}, 0x10) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) getpid() r1 = epoll_create1(0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000007c0)) stat(0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) epoll_create1(0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) lstat(0x0, 0x0) ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000100)="913735aeb140355336749c709ff7e362aeecec52906f8a75639c2e0350d855832c14cff609075bb287e9d4f36d681bfdc70b35bfa9781789f487f374aba9357c2708f0c35bd70fe15e3049db21f510a43bf2599eabb28cd2b48c6de06ecd886430a45b4ce02eac59673cd8f9bab05d1334899af99d57fc24ea51d951b8bc668becd1e5", 0x83, 0x8000, 0x0, 0x0) shutdown(r0, 0x2) 00:59:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x0) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) [ 2277.748199] audit: type=1400 audit(1555635560.703:41441): avc: denied { map } for pid=7511 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x347, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2277.895729] audit: type=1400 audit(1555635560.733:41442): avc: denied { map } for pid=7511 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:21 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0xda, 0x1) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f0000000100)={r3, r4/1000+10000}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2278.093672] audit: type=1400 audit(1555635560.813:41443): avc: denied { map } for pid=7511 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5427, 0x0) 00:59:21 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2278.579848] binder: 7529:7532 ERROR: BC_REGISTER_LOOPER called without request 00:59:22 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dc86055e0bceec7be070") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') readlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000002040)=""/4096, 0x1000) 00:59:22 executing program 4: add_key$user(&(0x7f0000000000)='user\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x0, 0x0) semget$private(0x0, 0x0, 0x10) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/ptype\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x0, 0x0, 0x0, 0x3, 0xfc}]}) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000080)=0x8) [ 2278.681573] binder: 7529:7541 got reply transaction with no transaction stack [ 2278.735068] binder_transaction: 1 callbacks suppressed [ 2278.735086] binder: 7529:7541 transaction failed 29201/-71, size 0-0 line 2762 [ 2278.869190] binder: release 7529:7532 transaction 2737 out, still active [ 2278.876195] binder: undelivered TRANSACTION_COMPLETE 00:59:22 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000900)=""/4096, 0x1000}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x80000, 0x0) getsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f0000000080)=0xfffffffffffffffe, &(0x7f0000000100)=0x4) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2278.965488] binder: BINDER_SET_CONTEXT_MGR already set [ 2279.043929] binder: 7529:7532 ioctl 40046207 0 returned -16 [ 2279.128376] binder: 7529:7546 got reply transaction with no transaction stack [ 2279.146190] binder: release 7529:7541 transaction 2739 out, still active [ 2279.153702] binder: 7529:7546 transaction failed 29201/-71, size 0-0 line 2762 [ 2279.168875] binder: undelivered TRANSACTION_COMPLETE [ 2279.197986] binder_release_work: 2 callbacks suppressed [ 2279.197995] binder: undelivered TRANSACTION_ERROR: 29201 00:59:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x480, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2279.249982] binder: release 7529:7532 transaction 2737 in, still active [ 2279.256842] binder: send failed reply for transaction 2737, target dead [ 2279.321877] binder: undelivered TRANSACTION_ERROR: 29201 [ 2279.327448] binder: send failed reply for transaction 2739, target dead 00:59:22 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0x2}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)) 00:59:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000000)={0x7c, 0x600000000000000, [0x277], [0xc2]}) 00:59:23 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x541e, 0x0) [ 2279.935055] binder: 7564:7565 ERROR: BC_REGISTER_LOOPER called without request [ 2279.964705] binder_alloc: 7564: binder_alloc_buf, no vma [ 2279.988270] binder: 7564:7565 transaction failed 29189/-3, size 0-0 line 2970 [ 2280.011767] binder: send failed reply for transaction 2742 to 7564:7565 00:59:23 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2280.052398] binder: undelivered TRANSACTION_COMPLETE [ 2280.058299] binder: undelivered TRANSACTION_ERROR: 29189 00:59:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dc86055e0bceec7be070") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff0000, 0x17}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x80000018000}) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 00:59:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000000)={0x7c, 0x600000000000000, [0x480], [0xc2]}) [ 2280.200835] binder: 7564:7573 got reply transaction with no transaction stack [ 2280.249211] binder: release 7564:7574 transaction 2744 out, still active [ 2280.259908] binder: 7564:7573 transaction failed 29201/-71, size 0-0 line 2762 [ 2280.260773] binder: undelivered TRANSACTION_COMPLETE [ 2280.273317] binder: 7564:7565 ERROR: BC_REGISTER_LOOPER called without request [ 2280.338544] binder: undelivered TRANSACTION_ERROR: 29201 00:59:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:23 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000000)={0x2}) [ 2280.415948] binder: undelivered TRANSACTION_ERROR: 29190 [ 2280.421648] binder: send failed reply for transaction 2744, target dead 00:59:24 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x1, 0x0) write$FUSE_WRITE(r0, &(0x7f00000001c0)={0x18, 0xfffffffffffffffe, 0x2, {0x1}}, 0x18) r1 = socket$inet(0x2, 0x1, 0x50) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet(0x2, 0x7, 0x2) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000100)) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) getgid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) ioctl$PPPIOCGIDLE(r3, 0x8010743f, &(0x7f0000000080)) recvmsg(r2, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r4 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x3, 0x8100) ioctl$LOOP_SET_BLOCK_SIZE(r4, 0x4c09, 0x6) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") socket$inet(0x2, 0x802, 0x10000) 00:59:24 executing program 4: r0 = syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r0, 0xc0905664, &(0x7f0000000100)={0x0, 0x0, [], @raw_data}) 00:59:24 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:24 executing program 1: [ 2281.329499] binder: 7595:7597 ERROR: BC_REGISTER_LOOPER called without request [ 2281.413829] binder: 7595:7601 got reply transaction with no transaction stack [ 2281.468991] binder: 7595:7601 transaction failed 29201/-71, size 0-0 line 2762 [ 2281.544073] binder: release 7595:7597 transaction 2747 out, still active [ 2281.574088] binder: undelivered TRANSACTION_COMPLETE 00:59:25 executing program 4: [ 2281.650337] binder: BINDER_SET_CONTEXT_MGR already set [ 2281.722824] binder: release 7595:7597 transaction 2747 in, still active [ 2281.731213] binder: 7595:7597 ioctl 40046207 0 returned -16 [ 2281.742837] binder: send failed reply for transaction 2747, target dead [ 2281.748644] binder: 7595:7612 transaction failed 29189/-22, size 0-0 line 2855 00:59:25 executing program 1: [ 2281.796546] binder: undelivered TRANSACTION_ERROR: 29201 [ 2281.827931] binder: 7595:7601 ERROR: BC_REGISTER_LOOPER called without request [ 2281.883212] binder: 7595:7618 got reply transaction with no transaction stack 00:59:25 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2281.972574] binder: undelivered TRANSACTION_ERROR: 29189 [ 2281.980296] binder: 7595:7618 transaction failed 29201/-71, size 0-0 line 2762 [ 2282.060202] kauditd_printk_skb: 137 callbacks suppressed [ 2282.060217] audit: type=1400 audit(1555635565.513:41581): avc: denied { map } for pid=7620 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2282.169069] binder: undelivered TRANSACTION_ERROR: 29201 [ 2282.251666] audit: type=1400 audit(1555635565.513:41582): avc: denied { map } for pid=7620 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2282.436477] audit: type=1400 audit(1555635565.563:41583): avc: denied { map } for pid=7621 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2282.639482] audit: type=1400 audit(1555635565.573:41584): avc: denied { map } for pid=7620 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2282.801340] audit: type=1400 audit(1555635565.573:41585): avc: denied { map } for pid=7621 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2282.972811] audit: type=1400 audit(1555635565.593:41586): avc: denied { map } for pid=7621 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2283.137264] audit: type=1400 audit(1555635565.603:41587): avc: denied { map } for pid=7621 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2283.264825] audit: type=1400 audit(1555635565.623:41588): avc: denied { map } for pid=7620 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2283.341707] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2283.373342] audit: audit_backlog=65 > audit_backlog_limit=64 [ 2283.394124] binder: 7634:7643 ERROR: BC_REGISTER_LOOPER called without request [ 2283.434430] binder: 7634:7638 got reply transaction with no transaction stack [ 2283.489790] binder: 7634:7638 transaction failed 29201/-71, size 0-0 line 2762 [ 2283.555320] binder: release 7634:7638 transaction 2752 out, still active [ 2283.568103] binder: undelivered TRANSACTION_COMPLETE 00:59:27 executing program 5: 00:59:27 executing program 4: 00:59:27 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x800, 0x0) recvmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000100)=""/101, 0x65}], 0x3, &(0x7f0000000600)=""/221, 0xdd}, 0x12121) r2 = socket$inet(0x2, 0xb, 0x100000000) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) fstatfs(r2, &(0x7f0000000280)=""/199) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r2, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:27 executing program 1: 00:59:27 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2283.709410] binder: 7634:7638 ERROR: BC_REGISTER_LOOPER called without request [ 2283.822637] binder: 7634:7643 got reply transaction with no transaction stack [ 2283.849423] binder: release 7634:7647 transaction 2754 out, still active [ 2283.856377] binder: undelivered TRANSACTION_COMPLETE [ 2283.866527] binder: 7634:7643 transaction failed 29201/-71, size 0-0 line 2762 00:59:27 executing program 1: r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) r1 = socket$unix(0x1, 0x2, 0x0) connect(r1, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) sendmmsg(r1, &(0x7f0000000140), 0x1236aa6efce153, 0x0) [ 2283.915574] binder: undelivered TRANSACTION_ERROR: 29201 00:59:27 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x0, @local}]}, &(0x7f00000001c0)=0xc) 00:59:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2284.039886] binder: undelivered TRANSACTION_ERROR: 29201 [ 2284.045510] binder: release 7634:7643 transaction 2752 in, still active [ 2284.081561] binder: send failed reply for transaction 2752, target dead 00:59:27 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2284.127864] binder: send failed reply for transaction 2754, target dead 00:59:27 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000080)={0x4, 0x0, 0x100000001}) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:28 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, 0x0, &(0x7f0000000080)=0x44) 00:59:28 executing program 4: syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/pid_for_children\x00') [ 2284.951167] binder: 7667:7671 ERROR: BC_REGISTER_LOOPER called without request [ 2285.039398] binder: 7667:7678 got reply transaction with no transaction stack [ 2285.046781] binder: 7667:7678 transaction failed 29201/-71, size 0-0 line 2762 00:59:28 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2285.159739] binder: release 7667:7671 transaction 2757 out, still active [ 2285.179421] binder: undelivered TRANSACTION_COMPLETE [ 2285.219030] binder: BINDER_SET_CONTEXT_MGR already set [ 2285.256979] binder: 7667:7671 ioctl 40046207 0 returned -16 [ 2285.256993] binder: release 7667:7671 transaction 2757 in, still active [ 2285.257020] binder: send failed reply for transaction 2757, target dead [ 2285.298319] binder: undelivered TRANSACTION_ERROR: 29201 [ 2285.330395] binder: 7667:7683 ERROR: BC_REGISTER_LOOPER called without request [ 2285.347205] binder: 7667:7678 transaction failed 29189/-22, size 0-0 line 2855 00:59:28 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, 0x0, &(0x7f0000000080)) [ 2285.442026] binder: undelivered TRANSACTION_ERROR: 29189 00:59:29 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) write$binfmt_aout(r0, &(0x7f0000000040)={{}, "a709625afc361474f12a2279c602784270f2ca86e158a788cec65cb5aa80df5061007996d0588a664b572ecd234fac236e9b26518d51be29943ebcc5a5a7ab228709b447a5bd310da911647bf6bb37f3d7d09fab10d11a6a4cfe1a5dc04dd4bf1fb89374bf6806ff9b70c9c1c6e99edac91bac650ebf536a965671876fb9c25dc4fbbd4f4cbd82d0b016b1584882e341713bda73d4ef648497c0", [[], [], [], [], [], [], [], [], []]}, 0x9ba) 00:59:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:29 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x227d, 0x0) 00:59:29 executing program 3: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/checkreqprot\x00', 0x181000, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000400), 0x4) r1 = socket$inet(0x2, 0x80002, 0x7) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x3) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000280)="91cae6adbace59736ddb4192c1cf996cd2857164d1b1fb4e9dd44a101cdba739b5f668570bfade7385b78ce55f32bbe375085e8a26fadaf646c90e9717851022ec660897245c97b3968edb4cefb9f594292e46e62c42928ec2144905e9039bdb86039e40e77f05aee279303e63138b455a613747167ae267ced924c8bfcfd505d32b4808adad5cc4fec2a2adf0db4d9d97b6cca2423e5ba367d83605673dedbdf26aaba89c4833d8f19a6085ff42b668db535f2fa1e25ea0674044728626435c47aeb98e084053865d9b1b8e9ccda08f97b4edd0e033b04f46a42df75fadebfa3b50b3e1d755d99adf18093360494ae76a2c18c526ee8c5866f874a5054d3f86") sendmsg$alg(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="5a2339e76df0def983a8d5816743090d73046a959eb25ea0d6dd8d8311aed0b037335a4877e1e347fb67ef5f43855a326ebaeac31d81e87d360ff11949b457600c90a1ce5f32c8de6a3114987b2a432db8d56225b9cb6f319a7b74376823d23821f45a5436465901bfb4de69a79146609889aee1bad7f54ba1577511428a3b754355bc42c996e9492a57aee804e467b599344ad743", 0x95}], 0x1, 0x0, 0x0, 0x8000}, 0x8080) recvmsg(r2, &(0x7f0000000080)={0x0, 0xfffffffffffffff8, &(0x7f0000000100)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x0) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:29 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x12, 0x0, &(0x7f0000000080)) 00:59:29 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) [ 2286.216222] binder: 7694:7704 ERROR: BC_REGISTER_LOOPER called without request [ 2286.231632] binder_alloc: 7694: binder_alloc_buf, no vma [ 2286.237214] binder: 7694:7704 transaction failed 29189/-3, size 0-0 line 2970 00:59:29 executing program 5: r0 = socket$rxrpc(0x21, 0x2, 0x2) ppoll(&(0x7f0000000140)=[{r0}], 0x1, &(0x7f0000000180)={0x0, 0x989680}, 0x0, 0x0) [ 2286.322773] binder: send failed reply for transaction 2761 to 7694:7704 [ 2286.430191] binder: undelivered TRANSACTION_COMPLETE [ 2286.435411] binder: undelivered TRANSACTION_ERROR: 29189 [ 2286.532385] binder: 7694:7712 got reply transaction with no transaction stack [ 2286.629506] binder: 7694:7712 transaction failed 29201/-71, size 0-0 line 2762 [ 2286.697723] binder: undelivered TRANSACTION_ERROR: 29201 00:59:30 executing program 1: r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/current\x00', 0x2, 0x0) write$binfmt_elf32(r0, 0x0, 0x0) 00:59:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2286.745032] binder: undelivered TRANSACTION_ERROR: 29190 00:59:30 executing program 4: add_key(&(0x7f0000000040)='ceph\x00', 0x0, &(0x7f00000000c0)="2c1f1b68c6db57dd3ea8c5e9", 0xc, 0xfffffffffffffffd) [ 2287.079723] kauditd_printk_skb: 192 callbacks suppressed [ 2287.079738] audit: type=1400 audit(1555635570.533:41777): avc: denied { map } for pid=7723 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2287.200614] audit: type=1400 audit(1555635570.603:41778): avc: denied { map } for pid=7723 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:30 executing program 5: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) set_mempolicy(0x0, 0x0, 0x1000) [ 2287.353917] audit: type=1400 audit(1555635570.623:41779): avc: denied { map } for pid=7723 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2287.487235] audit: type=1400 audit(1555635570.643:41780): avc: denied { map } for pid=7723 comm="modprobe" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2287.583069] binder_alloc: 7729: binder_alloc_buf, no vma [ 2287.631125] audit: type=1400 audit(1555635570.643:41781): avc: denied { map } for pid=7723 comm="modprobe" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2287.631799] binder: 7729:7734 ERROR: BC_REGISTER_LOOPER called without request 00:59:31 executing program 1: r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) keyctl$chown(0x4, r0, 0x0, 0x0) [ 2287.727947] binder: 7729:7731 transaction failed 29189/-3, size 0-0 line 2970 [ 2287.827171] audit: type=1400 audit(1555635570.743:41782): avc: denied { map } for pid=7728 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2287.857199] binder: 7729:7731 got reply transaction with no transaction stack 00:59:31 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) 00:59:31 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000004, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000380)={0x0, 0x8000}, &(0x7f00000003c0)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000400)={r2, 0x80, 0xffffffffffffff01}, &(0x7f0000000440)=0x8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r4, r4, r3) syz_open_dev$usbmon(&(0x7f0000000340)='/dev/usbmon#\x00', 0x9, 0x40) setregid(r3, r4) ioctl(r0, 0x1000008912, &(0x7f0000000500)="e38af96f03000000b08ffdbf9f4f3938e603ac1d16348000f7faf1276087cf8dd039b2143015c16e0b0500d3f3eff1e3f0c01343622e927f3a31c4c6847ecbacf268e0073b5486db826c") [ 2287.922860] binder: 7729:7731 transaction failed 29201/-71, size 0-0 line 2762 [ 2287.977981] audit: type=1400 audit(1555635570.753:41783): avc: denied { map } for pid=7728 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2287.979623] binder: undelivered TRANSACTION_ERROR: 29189 [ 2288.098390] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.115459] binder_alloc: 7729: binder_alloc_buf, no vma [ 2288.118961] binder: 7729:7734 got reply transaction with no transaction stack [ 2288.134310] audit: type=1400 audit(1555635570.783:41784): avc: denied { map } for pid=7728 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2288.156293] binder: 7729:7731 ERROR: BC_REGISTER_LOOPER called without request [ 2288.212186] binder: 7729:7746 transaction failed 29189/-3, size 0-0 line 2970 00:59:31 executing program 5: add_key(&(0x7f0000000040)='ceph\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffd) [ 2288.288282] audit: type=1400 audit(1555635570.793:41785): avc: denied { map } for pid=7728 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2288.317745] binder: undelivered TRANSACTION_ERROR: 29189 [ 2288.324121] binder: 7729:7734 transaction failed 29201/-71, size 0-0 line 2762 [ 2288.394536] binder: undelivered TRANSACTION_ERROR: 29201 [ 2288.424427] audit: type=1400 audit(1555635570.833:41786): avc: denied { map } for pid=7728 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:33 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:33 executing program 1: mbind(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x1, 0x0) 00:59:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:33 executing program 4: set_mempolicy(0x1, &(0x7f0000000000)=0x200, 0x1000) 00:59:33 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x800, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r2, &(0x7f0000000080)='./file0\x00', r3, r4, 0xc00) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:33 executing program 5: openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x0) r0 = gettid() getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) eventfd(0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) tkill(r0, 0x2001000000000016) 00:59:33 executing program 1: ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$UHID_GET_REPORT_REPLY(r1, &(0x7f00000002c0)={0xa, 0x0, 0x8}, 0xa) 00:59:33 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) timerfd_gettime(r0, &(0x7f00000000c0)) 00:59:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f0000001300)='ramfs\x00', 0x0, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0, 0x20, 0x0) [ 2289.988818] binder: 7765:7777 ERROR: BC_REGISTER_LOOPER called without request 00:59:33 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) r2 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) ioctl$TIOCEXCL(r2, 0x540c) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x7, 0x1, 0x1f, 0x80000000, 0x0, 0x7, 0x0, {0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x1, 0x6, 0x1, 0x169d, 0x134}}, &(0x7f0000000040)=0xb0) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000080)={r3, 0x1000}, &(0x7f0000000100)=0x8) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2290.058595] binder: 7765:7770 got reply transaction with no transaction stack [ 2290.066033] binder: 7765:7770 transaction failed 29201/-71, size 0-0 line 2762 [ 2290.268454] binder: release 7765:7770 transaction 2770 out, still active [ 2290.275389] binder: undelivered TRANSACTION_COMPLETE 00:59:33 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2290.368834] binder: release 7765:7786 transaction 2772 out, still active [ 2290.412885] binder: undelivered TRANSACTION_COMPLETE 00:59:33 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind(r0, &(0x7f0000000100)=@in={0x2, 0x4e20}, 0x80) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000200)=0x80000000, 0x4) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2, 0x8004e20}, 0x10) recvmmsg(r0, &(0x7f0000000040)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000000480)}}], 0x400000000000057, 0x22, 0x0) 00:59:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4603, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2290.509168] binder: undelivered TRANSACTION_ERROR: 29201 [ 2290.514836] binder: release 7765:7777 transaction 2770 in, still active [ 2290.557129] binder: send failed reply for transaction 2770, target dead 00:59:34 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000080), 0x8) [ 2290.617216] binder: send failed reply for transaction 2772, target dead 00:59:34 executing program 5: clone(0x41fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x10000000016, &(0x7f0000000200)) prctl$PR_SET_DUMPABLE(0x4, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) 00:59:34 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000040)) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:34 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x7, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) 00:59:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000600)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) [ 2291.467381] binder: 7808:7809 ERROR: BC_REGISTER_LOOPER called without request [ 2291.492182] binder_alloc: 7808: binder_alloc_buf, no vma [ 2291.518074] binder: 7808:7809 transaction failed 29189/-3, size 0-0 line 2970 [ 2291.545597] binder: send failed reply for transaction 2774 to 7808:7809 [ 2291.583580] binder: undelivered TRANSACTION_COMPLETE [ 2291.588992] binder: undelivered TRANSACTION_ERROR: 29189 [ 2291.666912] binder: undelivered TRANSACTION_ERROR: 29190 [ 2291.700538] binder: 7808:7809 ERROR: BC_REGISTER_LOOPER called without request [ 2291.739202] binder: 7808:7814 got reply transaction with no transaction stack [ 2291.768331] binder: release 7808:7814 transaction 2777 out, still active [ 2291.781283] binder: undelivered TRANSACTION_COMPLETE 00:59:35 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) sync_file_range(r1, 0x0, 0x0, 0x4) [ 2291.792054] binder: 7808:7814 transaction failed 29201/-71, size 0-0 line 2762 00:59:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket(0x10, 0x80002, 0x0) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900080008000c00010000000000156f757284366a660006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000", 0x55}], 0x1}, 0x0) 00:59:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4703, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2291.901425] binder: release 7808:7809 transaction 2777 in, still active [ 2291.919271] binder: send failed reply for transaction 2777, target dead [ 2291.940937] binder: undelivered TRANSACTION_ERROR: 29201 [ 2292.193128] IPv6: Can't replace route, no match found [ 2292.249310] kauditd_printk_skb: 173 callbacks suppressed [ 2292.249326] audit: type=1400 audit(1555635575.703:41960): avc: denied { map } for pid=7834 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2292.279291] binder: 7834:7837 ERROR: BC_REGISTER_LOOPER called without request 00:59:35 executing program 1: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x400002100001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20010001, &(0x7f0000000280)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r2 = dup2(r0, r0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) sendmsg$TIPC_NL_NET_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) close(r0) tkill(r1, 0x1000000000016) openat$urandom(0xffffffffffffff9c, &(0x7f0000000300)='/dev/urandom\x00', 0x0, 0x0) exit_group(0x0) [ 2292.318981] binder_alloc: 7834: binder_alloc_buf, no vma [ 2292.322246] audit: type=1400 audit(1555635575.703:41961): avc: denied { set_context_mgr } for pid=7834 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2292.330812] binder: 7834:7837 transaction failed 29189/-3, size 0-0 line 2970 [ 2292.375171] binder: send failed reply for transaction 2780 to 7834:7837 [ 2292.391477] audit: type=1400 audit(1555635575.703:41962): avc: denied { call } for pid=7834 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2292.423554] binder: undelivered TRANSACTION_COMPLETE [ 2292.433052] binder: undelivered TRANSACTION_ERROR: 29189 [ 2292.441295] audit: type=1400 audit(1555635575.763:41963): avc: denied { map } for pid=7840 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2292.496313] binder: undelivered TRANSACTION_ERROR: 29190 [ 2292.511317] binder: 7834:7842 transaction failed 29189/-22, size 0-0 line 2855 [ 2292.512779] audit: type=1400 audit(1555635575.773:41964): avc: denied { map } for pid=7840 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2292.556680] binder: 7834:7843 ERROR: BC_REGISTER_LOOPER called without request [ 2292.588019] binder: 7834:7853 got reply transaction with no transaction stack [ 2292.613777] binder: 7834:7853 transaction failed 29201/-71, size 0-0 line 2762 [ 2292.649532] binder: undelivered TRANSACTION_ERROR: 29189 [ 2292.666668] audit: type=1400 audit(1555635575.823:41965): avc: denied { map } for pid=7840 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2292.779836] audit: type=1400 audit(1555635575.823:41966): avc: denied { map } for pid=7840 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2292.793695] binder: undelivered TRANSACTION_ERROR: 29201 [ 2292.848873] audit: type=1400 audit(1555635575.863:41967): avc: denied { map } for pid=7840 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2292.997690] audit: type=1400 audit(1555635575.883:41968): avc: denied { map } for pid=7840 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2293.118043] audit: type=1400 audit(1555635575.893:41969): avc: denied { map } for pid=7840 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:37 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e1"], 0x1d) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:37 executing program 5: capget(0x0, 0x0) r0 = gettid() rt_sigqueueinfo(r0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x382) r1 = socket$unix(0x1, 0x5, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r2 = dup2(r1, r1) write$cgroup_pid(0xffffffffffffffff, 0x0, 0xfffffffffffffe85) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) mmap$perf(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x400004, 0x11, r2, 0x7) 00:59:37 executing program 4: capget(0x0, 0x0) r0 = gettid() rt_sigqueueinfo(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x382) r1 = socket$unix(0x1, 0x5, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) r2 = dup2(r1, r1) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) mmap$perf(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$TCSETXF(r2, 0x5434, 0x0) ioctl$TIOCMBIC(r2, 0x5417, 0x0) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f0000000040)) accept$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) tkill(r0, 0x1000000000016) 00:59:37 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r0}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000080)=[@in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e21, @local}], 0x30) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) shmget$private(0x0, 0x2000, 0x1810, &(0x7f0000ffe000/0x2000)=nil) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:37 executing program 1: seccomp(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffff7f7ffffffa}]}) ustat(0x6, &(0x7f0000000100)) 00:59:37 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt(r0, 0x0, 0x8, 0x0, 0x0) 00:59:37 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x227b, 0x0) 00:59:37 executing program 1: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) pause() tkill(r0, 0x1000000000016) 00:59:37 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x5}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000280)={r2, 0xdc, "bd0b99092364671d206238eeaa94962ec8bfd5b7afb045ba791aab2d927d69e3a8366fda958450c6655db25dbb185a353444d15c86cf229c14c7155b87185ef94c80f2ce1b2d1777766a5b08c3d6625ae0d5b0e75ec8228651de18cd3ea78a65e1178cfcea1e3407bfea9c8dbd075a3abd2ddc86cf01c615de63a358e10f68b05ef5deb8e42027c89d926eef52817f7a8a4006ee43a76a3cb7a5d90250c9566b82d571d0417f3b1f49247a97e9f840f92ffe5bdd6319faabb8e651c6e4425387634f211fd2a7c884b195c7fee03d75544df4841d834a16d4a147209f"}, &(0x7f0000000140)=0xe4) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2294.223861] binder: 7893:7899 ERROR: BC_REGISTER_LOOPER called without request [ 2294.293788] binder_alloc: 7893: binder_alloc_buf, no vma [ 2294.358189] binder: 7893:7899 transaction failed 29189/-3, size 0-0 line 2970 [ 2294.373741] binder: send failed reply for transaction 2786 to 7893:7899 [ 2294.411420] binder: undelivered TRANSACTION_COMPLETE [ 2294.417209] binder: undelivered TRANSACTION_ERROR: 29189 [ 2294.549322] binder: undelivered TRANSACTION_ERROR: 29190 [ 2294.562850] binder: 7893:7907 transaction failed 29189/-22, size 0-0 line 2855 [ 2294.618364] binder: 7893:7912 got reply transaction with no transaction stack [ 2294.657843] binder: 7893:7912 transaction failed 29201/-71, size 0-0 line 2762 00:59:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:38 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.controllers\x00', 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0xc) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2295.387576] binder: 7924:7926 ERROR: BC_REGISTER_LOOPER called without request [ 2295.422295] binder_alloc: 7924: binder_alloc_buf, no vma [ 2295.430128] binder: 7924:7926 transaction failed 29189/-3, size 0-0 line 2970 [ 2295.459133] binder: send failed reply for transaction 2792 to 7924:7926 [ 2295.476703] binder: undelivered TRANSACTION_COMPLETE [ 2295.535474] binder: 7924:7930 got reply transaction with no transaction stack [ 2295.551660] binder: 7924:7926 ERROR: BC_REGISTER_LOOPER called without request [ 2295.571617] binder: 7924:7930 transaction failed 29201/-71, size 0-0 line 2762 [ 2295.592992] binder: release 7924:7931 transaction 2794 out, still active [ 2295.603228] binder: undelivered TRANSACTION_COMPLETE [ 2295.616098] binder_release_work: 3 callbacks suppressed [ 2295.616105] binder: undelivered TRANSACTION_ERROR: 29201 [ 2295.634431] binder: undelivered TRANSACTION_ERROR: 29190 [ 2295.649093] binder: send failed reply for transaction 2794, target dead 00:59:40 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e1"], 0x1d) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:40 executing program 5: 00:59:40 executing program 4: 00:59:40 executing program 1: 00:59:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:40 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") r2 = dup2(r0, r0) setsockopt$CAIFSO_REQ_PARAM(r2, 0x116, 0x80, &(0x7f0000000280)="c2c8115f8c404c16fd467de4df1d72e8d7dbc78016008f6a87d095da8f17aca141d06e0f714066b53bc492020e2604dc2a14eb109ba9f71a794aaccc191f5cdadd76bc4603d581fd70774d83169cc077104f68404ca1dae651e1081314515df1d579b479dc9a970e73e6bfbdf42d84a6155887bbadcf8b3f1168f8ead8ab76acac06942dc0473f8b3e8f63a7fc0ad252d2ed35b818bb5600", 0x98) 00:59:40 executing program 4: 00:59:40 executing program 1: 00:59:40 executing program 5: [ 2297.562182] kauditd_printk_skb: 114 callbacks suppressed [ 2297.562198] audit: type=1400 audit(1555635581.013:42084): avc: denied { map } for pid=7941 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2297.644163] binder: 7941:7944 ERROR: BC_REGISTER_LOOPER called without request [ 2297.675650] audit: type=1400 audit(1555635581.043:42085): avc: denied { set_context_mgr } for pid=7941 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2297.701196] binder: 7941:7948 got reply transaction with no transaction stack [ 2297.790272] binder: 7941:7948 transaction failed 29201/-71, size 0-0 line 2762 [ 2297.799527] audit: type=1400 audit(1555635581.053:42086): avc: denied { call } for pid=7941 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2297.897411] audit: type=1400 audit(1555635581.123:42087): avc: denied { map } for pid=7945 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2297.900714] binder: release 7941:7944 transaction 2797 out, still active 00:59:41 executing program 4: [ 2297.982660] binder: undelivered TRANSACTION_COMPLETE 00:59:41 executing program 5: [ 2298.027739] audit: type=1400 audit(1555635581.133:42088): avc: denied { map } for pid=7945 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2298.034728] binder: 7941:7944 ERROR: BC_REGISTER_LOOPER called without request 00:59:41 executing program 1: [ 2298.124606] binder: release 7941:7957 transaction 2799 out, still active [ 2298.135455] binder: undelivered TRANSACTION_COMPLETE [ 2298.150589] audit: type=1400 audit(1555635581.153:42089): avc: denied { map } for pid=7945 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2298.226540] binder: release 7941:7944 transaction 2797 in, still active [ 2298.247678] binder: send failed reply for transaction 2797, target dead [ 2298.254531] binder: undelivered TRANSACTION_ERROR: 29201 [ 2298.299816] audit: type=1400 audit(1555635581.163:42090): avc: denied { map } for pid=7945 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2298.313363] binder: send failed reply for transaction 2799, target dead [ 2298.426133] audit: type=1400 audit(1555635581.243:42091): avc: denied { map } for pid=7945 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2298.557822] audit: type=1400 audit(1555635581.273:42092): avc: denied { map } for pid=7945 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2298.678649] audit: type=1400 audit(1555635581.303:42093): avc: denied { map } for pid=7945 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:44 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e1"], 0x1d) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:44 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x34b) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:44 executing program 1: 00:59:44 executing program 4: 00:59:44 executing program 5: 00:59:44 executing program 1: 00:59:44 executing program 4: 00:59:44 executing program 5: [ 2301.060608] binder: 7970:7971 ERROR: BC_REGISTER_LOOPER called without request [ 2301.115862] binder_alloc: 7970: binder_alloc_buf, no vma [ 2301.135449] binder: 7970:7971 transaction failed 29189/-3, size 0-0 line 2970 [ 2301.170249] binder: send failed reply for transaction 2801 to 7970:7971 [ 2301.218298] binder: undelivered TRANSACTION_COMPLETE [ 2301.223765] binder: undelivered TRANSACTION_ERROR: 29189 00:59:44 executing program 1: [ 2301.367091] binder: BINDER_SET_CONTEXT_MGR already set [ 2301.410360] binder: undelivered TRANSACTION_ERROR: 29190 [ 2301.416120] binder: send failed reply for transaction 2803 to 7970:7981 [ 2301.421660] binder: 7970:7978 ERROR: BC_REGISTER_LOOPER called without request [ 2301.426050] binder: 7970:7971 ioctl 40046207 0 returned -16 00:59:44 executing program 4: [ 2301.501041] binder: undelivered TRANSACTION_COMPLETE [ 2301.506364] binder: undelivered TRANSACTION_ERROR: 29189 00:59:45 executing program 5: [ 2302.572726] kauditd_printk_skb: 107 callbacks suppressed [ 2302.572743] audit: type=1400 audit(1555635586.023:42201): avc: denied { map } for pid=7991 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2302.624791] audit: type=1400 audit(1555635586.023:42202): avc: denied { map } for pid=7991 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:47 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871c"], 0x2b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:47 executing program 1: 00:59:47 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:47 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r2 = socket(0x10, 0x2, 0xc) write(r2, &(0x7f0000a6b000)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) write(r2, &(0x7f0000000000)="1f0000000104fffffd3b000007110000f30501000b000200020423ca0000cf", 0x1f) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000280)={{{@in=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f00000001c0)={@broadcast, @multicast1, r3}, 0xc) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet6_dccp_int(r2, 0x21, 0x0, &(0x7f0000000080), &(0x7f0000000100)=0x4) ioctl$UI_SET_MSCBIT(r4, 0x40045568, 0x18) 00:59:47 executing program 4: 00:59:47 executing program 5: 00:59:47 executing program 4: 00:59:47 executing program 1: 00:59:47 executing program 5: [ 2304.410315] audit: type=1400 audit(1555635587.863:42203): avc: denied { map } for pid=7993 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2304.528632] binder: 7993:7998 ERROR: BC_REGISTER_LOOPER called without request [ 2304.541217] audit: type=1400 audit(1555635587.933:42204): avc: denied { set_context_mgr } for pid=7993 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2304.598689] binder: 7993:7999 got reply transaction with no transaction stack [ 2304.601230] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2304.606029] binder: 7993:7999 transaction failed 29201/-71, size 0-0 line 2762 [ 2304.624989] binder: release 7993:7998 transaction 2805 out, still active [ 2304.648955] binder: undelivered TRANSACTION_COMPLETE [ 2304.699784] audit: type=1400 audit(1555635587.953:42205): avc: denied { call } for pid=7993 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2304.746728] binder: 7993:7999 got reply transaction with no transaction stack [ 2304.758723] binder: 7993:7998 ERROR: BC_REGISTER_LOOPER called without request [ 2304.817710] audit: type=1400 audit(1555635587.993:42206): avc: denied { create } for pid=7992 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 2304.819216] binder: release 7993:8005 transaction 2807 out, still active [ 2304.867265] binder: 7993:7999 transaction failed 29201/-71, size 0-0 line 2762 [ 2304.913748] audit: type=1400 audit(1555635588.023:42207): avc: denied { write } for pid=7992 comm="syz-executor.3" path="socket:[197679]" dev="sockfs" ino=197679 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 00:59:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x8400ae8e, 0x0) [ 2304.961589] binder: undelivered TRANSACTION_COMPLETE 00:59:48 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000040)={0x77359400}, 0x10) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x40000, 0x0) recvmsg(r2, &(0x7f0000000200)={&(0x7f0000000100)=@in={0x2, 0x0, @broadcast}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000001c0)=""/38, 0x26}, {&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f0000002340)=""/4096, 0x1000}, {&(0x7f0000000280)=""/104, 0x68}, {&(0x7f0000000300)=""/236, 0xec}, {&(0x7f0000000400)=""/225, 0xe1}, {&(0x7f0000000500)=""/148, 0x94}, {&(0x7f0000000600)=""/160, 0xa0}], 0x8, &(0x7f0000000740)=""/102, 0x66}, 0x40010162) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2304.986926] binder: undelivered TRANSACTION_ERROR: 29201 00:59:48 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871c"], 0x2b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2305.089142] binder: release 7993:7998 transaction 2805 in, still active [ 2305.096005] binder: send failed reply for transaction 2805, target dead 00:59:48 executing program 5: syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) flock(0xffffffffffffffff, 0x0) epoll_create1(0x80000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000003c0)=0x80) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, 0x0, &(0x7f0000000240)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r1, 0x80386433, &(0x7f0000000100)=""/27) memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x3ff800) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) 00:59:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x227e, 0x0) [ 2305.139097] binder: undelivered TRANSACTION_ERROR: 29201 [ 2305.144658] binder: send failed reply for transaction 2807, target dead [ 2305.155145] audit: type=1400 audit(1555635588.053:42208): avc: denied { write } for pid=7992 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 2305.327687] audit: type=1400 audit(1555635588.113:42209): avc: denied { map } for pid=8003 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2305.456165] audit: type=1400 audit(1555635588.123:42210): avc: denied { map } for pid=8003 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:49 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = epoll_create(0x2) r2 = epoll_create(0x7ffffffc) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)) dup2(r0, r1) [ 2305.958092] binder: 8014:8024 ERROR: BC_REGISTER_LOOPER called without request [ 2306.040842] binder: 8014:8037 got reply transaction with no transaction stack [ 2306.061014] binder: 8014:8037 transaction failed 29201/-71, size 0-0 line 2762 00:59:49 executing program 1: r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180), 0x0) [ 2306.093448] binder: release 8014:8024 transaction 2810 out, still active [ 2306.105620] binder: undelivered TRANSACTION_COMPLETE [ 2306.219917] binder: BINDER_SET_CONTEXT_MGR already set [ 2306.271856] binder: 8014:8037 ERROR: BC_REGISTER_LOOPER called without request [ 2306.305427] binder_alloc: 8014: binder_alloc_buf, no vma [ 2306.351941] binder: 8014:8024 ioctl 40046207 0 returned -16 [ 2306.351952] binder: release 8014:8024 transaction 2810 in, still active [ 2306.351966] binder: send failed reply for transaction 2810, target dead [ 2306.393246] binder: 8014:8039 transaction failed 29189/-3, size 0-0 line 2970 [ 2306.426809] binder: undelivered TRANSACTION_ERROR: 29201 [ 2306.449204] binder: undelivered TRANSACTION_ERROR: 29189 00:59:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:50 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:50 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:59:50 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:59:50 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2307.197713] protocol 88fb is buggy, dev hsr_slave_0 [ 2307.203074] protocol 88fb is buggy, dev hsr_slave_1 [ 2307.279722] binder: 8053:8061 ERROR: BC_REGISTER_LOOPER called without request [ 2307.338057] binder_alloc: 8053: binder_alloc_buf, no vma [ 2307.357882] binder: 8053:8061 transaction failed 29189/-3, size 0-0 line 2970 [ 2307.391176] binder: send failed reply for transaction 2814 to 8053:8061 [ 2307.443167] binder: undelivered TRANSACTION_COMPLETE [ 2307.449097] binder: undelivered TRANSACTION_ERROR: 29189 00:59:50 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2307.565246] binder: 8053:8061 ERROR: BC_REGISTER_LOOPER called without request [ 2307.607528] binder: release 8053:8072 transaction 2816 out, still active [ 2307.620219] binder: 8053:8071 got reply transaction with no transaction stack [ 2307.629306] binder: undelivered TRANSACTION_COMPLETE [ 2307.663590] binder: 8053:8071 transaction failed 29201/-71, size 0-0 line 2762 [ 2307.693291] binder: undelivered TRANSACTION_ERROR: 29201 [ 2307.790831] binder: undelivered TRANSACTION_ERROR: 29190 [ 2307.796725] binder: send failed reply for transaction 2816, target dead [ 2307.907765] protocol 88fb is buggy, dev hsr_slave_0 [ 2307.912888] protocol 88fb is buggy, dev hsr_slave_1 [ 2308.067730] protocol 88fb is buggy, dev hsr_slave_0 [ 2308.072918] protocol 88fb is buggy, dev hsr_slave_1 [ 2308.078163] protocol 88fb is buggy, dev hsr_slave_0 [ 2308.083384] protocol 88fb is buggy, dev hsr_slave_1 [ 2308.341909] kauditd_printk_skb: 98 callbacks suppressed [ 2308.341924] audit: type=1400 audit(1555635591.793:42309): avc: denied { map } for pid=8079 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2308.417223] audit: type=1400 audit(1555635591.793:42310): avc: denied { map } for pid=8079 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2308.501782] audit: type=1400 audit(1555635591.793:42311): avc: denied { map } for pid=8079 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2308.628119] audit: type=1400 audit(1555635591.793:42312): avc: denied { map } for pid=8079 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:52 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871c"], 0x2b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000400)={0x0, {0x2, 0x4e22, @local}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f00000003c0)='gre0\x00', 0x1, 0x9, 0x3}) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/mls\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000700)={r2, 0x28, &(0x7f0000000580)}, 0x10) r3 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x4bc7, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000280)={{{@in=@local, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000100)=0xe8) sendmsg$nl_route_sched(r3, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=@deltfilter={0x70, 0x2d, 0x100, 0x70bd28, 0x25dfdbff, {0x0, r4, {0x0, 0x1}, {0x0, 0xffef}, {0x10, 0xfff7}}, [@TCA_RATE={0x8, 0x5, {0x0, 0xff}}, @TCA_RATE={0x8, 0x5, {0x7fffffff, 0xffffffffffffffff}}, @TCA_RATE={0x8, 0x5, {0x40, 0xffffffffffffff3b}}, @TCA_RATE={0x8, 0x5, {0xed, 0x6}}, @filter_kind_options=@f_matchall={{0x10, 0x1, 'matchall\x00'}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x5}]}}, @TCA_RATE={0x8, 0x5, {0xfffffffffffffffa, 0x7}}]}, 0x70}, 0x1, 0x0, 0x0, 0x8000}, 0xc800) socket$inet(0x2, 0x7, 0x8000) mount$9p_virtio(&(0x7f0000000480)='z\x00', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x1, &(0x7f0000000600)={'trans=virtio,', {[{@aname={'aname', 0x3d, '/dev/vcs#\x00'}}, {@version_L='version=9p2000.L'}, {@dfltuid={'dfltuid', 0x3d, r5}}], [{@fsuuid={'fsuuid', 0x3d, {[0x3f, 0x7d, 0x67, 0x32, 0x32, 0x65, 0x65, 0x66], 0x2d, [0x73, 0x37, 0x0, 0x77], 0x2d, [0x63, 0x77], 0x2d, [0x77, 0x76, 0x32, 0x31], 0x2d, [0x37, 0x38, 0x64, 0x39, 0x77, 0x33, 0x38, 0x77]}}}, {@smackfsroot={'smackfsroot', 0x3d, 'lo'}}, {@uid_eq={'uid', 0x3d, r5}}, {@euid_gt={'euid>', r5}}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}, {@uid_eq={'uid', 0x3d, r5}}]}}) 00:59:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x8004, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 00:59:52 executing program 5: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 00:59:52 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2308.889500] audit: type=1400 audit(1555635591.823:42313): avc: denied { map } for pid=8080 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2309.115894] audit: type=1400 audit(1555635591.823:42314): avc: denied { map } for pid=8080 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000040)=0x140000, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) faccessat(r2, &(0x7f0000000100)='./file0\x00', 0x40, 0x200) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2309.275960] audit: type=1400 audit(1555635591.833:42315): avc: denied { map } for pid=8080 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xe400, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2309.387369] audit: type=1400 audit(1555635591.843:42316): avc: denied { map } for pid=8080 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:52 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2309.529879] audit: type=1400 audit(1555635591.853:42317): avc: denied { map } for pid=8080 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:53 executing program 5: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x2, 0x0, "a77760f5a7645bc43c241d69912dda0c63c2a66726f8cfafd6c8fe2c98de7ba44947a79015f0fe57917cb62a93987a938fdedfce7bbba4fec2d8a09c41fb233245f2604b9e07b8ab79ec15ef2818a179"}, 0xd8) r2 = shmget$private(0x0, 0x8000, 0x880, &(0x7f0000ff7000/0x8000)=nil) shmctl$IPC_INFO(r2, 0x3, &(0x7f0000000040)=""/56) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000100), 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x100) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2309.708006] audit: type=1400 audit(1555635591.893:42318): avc: denied { map } for pid=8079 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:53 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a"], 0x32) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 00:59:53 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2310.338895] binder: 8106:8111 ERROR: BC_REGISTER_LOOPER called without request [ 2310.415176] binder: 8106:8119 got reply transaction with no transaction stack [ 2310.452693] binder: 8106:8119 transaction failed 29201/-71, size 0-0 line 2762 [ 2310.484636] binder: release 8106:8111 transaction 2819 out, still active [ 2310.501375] binder: undelivered TRANSACTION_COMPLETE [ 2310.564098] binder: release 8106:8111 transaction 2819 in, still active [ 2310.575307] binder: send failed reply for transaction 2819, target dead [ 2310.601610] binder: undelivered TRANSACTION_ERROR: 29201 [ 2310.609826] binder: 8106:8111 ERROR: BC_REGISTER_LOOPER called without request [ 2310.630924] binder: 8106:8119 got reply transaction with no transaction stack [ 2310.661242] binder: release 8106:8119 transaction 2822 out, still active [ 2310.672523] binder: undelivered TRANSACTION_COMPLETE [ 2310.685286] binder: 8106:8119 transaction failed 29201/-71, size 0-0 line 2762 00:59:54 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2310.755265] binder: release 8106:8111 transaction 2822 in, still active [ 2310.766283] binder: send failed reply for transaction 2822, target dead [ 2310.795369] binder: undelivered TRANSACTION_ERROR: 29201 00:59:54 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) 00:59:54 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000100)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r0, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000040)=[{&(0x7f0000000900)=""/4096, 0x9427}], 0x1}, 0x42) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @broadcast}, 0x10) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 00:59:54 executing program 5: r0 = memfd_create(&(0x7f0000000180)='\xd7\xd6s\x14i\xday V\xfe(aK\x0f\xf4\x15U\xd0t\xc3Ax\x9b\xa7\x9e{\x1b;i\xb4e\x11\x13\x04z\x88\x14?\xca\xff\xe0\xc77\xc6/\xf4\x82\xbf\xf0\x8a3\x00Vz6V\xc4\xd8\xc7u\xfc\xda\xe0\x94\x81\xc6\xa4\xeb\x03\xdc\x81\x15pC\xd3yM\r\xf3\xa7\xf8P\xb4)\x01\xcd`\xda\xba%\xd3\xb7', 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003003e01"], 0x14) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="7e0741ab6b7980eab86fa9881634228384d3bc8c2d0c25b6bba1850826b20546d793b64ab4e72010822fb53c4e19065361ffb7d44bc70772a34f") syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 2311.480499] binder: 8132:8133 ERROR: BC_REGISTER_LOOPER called without request [ 2311.552746] binder: 8132:8138 got reply transaction with no transaction stack [ 2311.682245] binder: 8132:8138 transaction failed 29201/-71, size 0-0 line 2762 [ 2311.717753] binder: release 8132:8133 transaction 2825 out, still active [ 2311.731833] binder: undelivered TRANSACTION_COMPLETE [ 2311.805487] binder: BINDER_SET_CONTEXT_MGR already set [ 2311.881585] binder: 8132:8145 ERROR: BC_REGISTER_LOOPER called without request [ 2311.925043] binder: 8132:8133 ioctl 40046207 0 returned -16 [ 2311.976233] binder: release 8132:8133 transaction 2825 in, still active [ 2311.989913] binder: 8132:8146 got reply transaction with no transaction stack [ 2311.994180] binder: send failed reply for transaction 2825, target dead [ 2311.997241] binder: 8132:8146 transaction failed 29201/-71, size 0-0 line 2762 00:59:55 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2312.080947] binder: undelivered TRANSACTION_ERROR: 29201 [ 2312.110496] binder: send failed reply for transaction 2827 to 8132:8143 [ 2312.163895] binder: undelivered TRANSACTION_ERROR: 29201 [ 2312.192063] binder: undelivered TRANSACTION_COMPLETE [ 2312.213866] binder: undelivered TRANSACTION_ERROR: 29189 00:59:55 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) 00:59:55 executing program 1: r0 = memfd_create(&(0x7f0000000100)='\xd7\xd6s\x14i\xday V\xfe(aK\x0f\xf4\x15U\xd0t\xc3Ax\x9b\xa7\x9e{\x1b;i\xb4e\x11\x13\x04z\x88\x14?\xca\xff\xe0\xc77\xc6/\xf4\x82\xbf\xf0\x8a3\x00Vz6V\xc4\xd8\xc7u\xfc\xda\xe0\x94\x81\xc6\xa4\xeb\x03\xdc\x81\x15pC\xd3yM\r\xf3\xa7\xf8P\xb4)\x01\xcd`\xda\xba%\xd3\xb7', 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003003e01"], 0x14) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 00:59:56 executing program 5: r0 = memfd_create(&(0x7f0000000180)='\xd7\xd6s\x14i\xday V\xfe(aK\x0f\xf4\x15U\xd0t\xc3Ax\x9b\xa7\x9e{\x1b;i\xb4e\x11\x13\x04z\x88\x14?\xca\xff\xe0\xc77\xc6/\xf4\x82\xbf\xf0\x8a3\x00Vz6V\xc4\xd8\xc7u\xfc\xda\xe0\x94\x81\xc6\xa4\xeb\x03\xdc\x81\x15pC\xd3yM\r\xf3\xa7\xf8P\xb4)\x01\xcd`\xda\xba%\xd3\xb7', 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003003e01"], 0x14) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="7e0741ab6b7980eab86fa9881634228384d3bc8c2d0c25b6bba1850826b20546d793b64ab4e72010822fb53c4e19065361ffb7d44bc70772a34f") syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") 00:59:56 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x80, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000004ac0)={0x1, 0x0, 0x2080, {0x7000, 0x1000, 0x2}, [], "ca26752d0b7e9b6ba46be04dae44a72cd2802d7d0e8d78d44079082b1f364169b537460089d1a5c04db0346ad9e30a54a9e4a35657425649702465058df80380acd3521b3082f852da655986c310ee54b72f283ac71aa1df3ca0127043769d293872533d4a87eb9abb1a98cdc8f1c2b5d6c1f9e76ad6bee6742a2ade47edd723a3960bfd3725180d38a43f5954d76c07a00bbbb9bc501fabc7e4f9e7c311e26a963df69cb43faa505fdd0dbd8a239646402c9129ecad7e7c5cc244a5811cafbf9aa1beb3a2dae17e9405c8b8e6519e78a69eb52021e850ec19c1f4df236ea6874d242dd21f161a57e26c4b54c9066c38c4cf3f6b729a26874cb4b31216a448686114395fba0ac9601af8204640d54cca68ab8bd367a8d2b76d26d6a3d873136b4b2e0a7b26af3cf4110aa4732c537383772c254e1c02b559fbef65a5fb6535b23cf7fd0fe15fc10f2d575ac13bce10493db69b0457467384b0afb6c855a9335adf38a39b631fd82e08a41b70169bbfbabcef7077e7e9ee3d5e98814043263831f39184a207193bfd8d46f2897301ca8b0425fdf40ff176ad46fac517d9e2a61e7e1fe93007f4f1088148c06abb724a7457d2897e19726bca8e0695ae49b0334f2eeebbb62367b03511d395e8cbecb22ee383bedc0d6716aa41787abe456f49659e7f88ad86d1ce9d5a22aa038b5533cdf7f9ba5a024100cbf5c7170e66968bc8b6cee518bcb3fce9cd724f508efa1d85ace50a39b3c136706597d2a668af02b5f85216273472b508c351bc9d01fa70fcb557fe1fd2026fdf975c9b013887442be4f81941b0ce3e301f2e2222fdeed1bff46711d2509a81afb03a316cb55da9db6fb3e4a782f3b118ef91fd640dfcd606da0db5b228dbf319a811cf3ba6580575f103f0f9498caa3bed92035b244e7be21696e8dce45e63ac21f34b80817681775e56402d7607435112a0818928c7365e4da759b14aa8d32da894b904e1599c82e7aa10d406040d27e526d35ea00b65091028d6258de24e255f3cb1dcd6a30f55c5ee80f50125744e4e80d2ce96b276ea71593844fda57d9581540a6e146dbfc90aee956f99ad9260a90384a231fcdcccf548f8d2c53a2f59ac1218d16d3ebab8276a98ac139440cb752e4fb8f70728a853ae723710845fcecab831df0ca782be20e3291e35ec5a514be3b06408a5c009fb24638cdbd7568be5d34038c6465733d42dc7cbdc1afb9ba8d080724202281286fa864c5055aa1f3fc634d5d820672234e488db6264d005234d84fc8f1adb7ca216510dfcfee5a52a5337ffc05900b8da13a6ca3ba56e90037bb4874e91c0bf2efa5b9774ea8bf400c969d6335b211696f142bdd023d7dcd2c404d0a0a11359725722f8bdf4416cbf67661784d93d589b95cade3fc8dfdb6b52c525dea12e137ac2e38fe778d2bb481498abb03dd0f5095a8a4038eeaefede42bfc6e05ee2169c946dafe2057720673fb1cd52654b0bbbb0ff1b3a7670412c42fbe4bd1f6d9e3be547a6132a3f8144f0ed9427406cc627db5bf809de22baf174bcbc343f757ab7db3d2c5f36b84f1962f116fb946d77d8e13c2040d7c124fe3424cf33e3cc0319de677a8d138a60337a76e92244b720649c22babe055d6e70fb6335d0491d1d7933035bded1436861be4ebd83d445c075bc5702db3a2f05d44d7535ee9219f41febe5f764bc551fcb35e86ae4f86c307312a2dd8a26037b85fe2e76d30a61fb234ca46b99c33c7feda200aa28a517055c62516c8468302ffec2c38b6600bb54ef8371af3da37500cfb7d2469c60188d6abbf05a962bcae55bca9ec072e79b1e9d630bd4e80c1c57929846a01f7de1cac1ad6873b4f02c5d463b9d52d9b76f5b3492d68cfe889bd07dde1ed187cd75328dbcdb49cb88788e0216be83469e2bde20601f599e8674a40efbe2d12af4087f684c4ad7d9f19761529e042313d86062c0d0b3025b6f316d361605910eee9cf36db28a7a0fcdde008e82326ef14aed0bced7d4323f1ed32827a1db6fdd52073d00a351394738238e4b1223576244de40e4d94833d932c614d915863b7b45c6ed22e7b6c2116058fdef4ba82a6c0d0af22af95ef23335454241b9d307973a2c96e0ac2806d069c960cd719e90c40422b91bae704d6b6a0d5b8336c184e466b89567964dac54ab34787c833e21d85c204688c6526444221fcaaec5a0d11b93fd3210e020dcf7c0e8ee1b9668e74133d65322e4a52668f55cecc4ad52222b170f0af0ff711555dd6306224303fd72b6e1f0f5704bc3c19d44c1a39ac16fc117933539aaa058474c8452e6cdc1c3300d0ba513d5fb2ddd5111fea0046c56885ee31c12bfeced78cbb15daf31fbc3b17b8cd8d9b5589ea54e4e23f07b1759af5e1115e629cfdd1162d9c49ce35d10af52ccbf193ecfb07000883cf13c291febcfbbb62121f9880b9a56c549fde4ba1f4748dfcb896244d59cc08b776635ca6f242d6f8f4db41df791a3b53ea5eea450b558a5c9e30706d714d22a1f1b2f21640ac4977673b04c889a70e1a8f86baf16fe5bd8804d8db268a9caffae64ee2319458c93592aa4dd8a489da5c9dd3c73db7d8f217eb54bb99f3440d6901c41918c583833b67350298e98255aae8738b822e66bff8e62aeaeb8cade33bdf48a9f5d8b444cabe5cae2ee8b82a08c415a34575d363198447f896464a317ea2d6de14111d7cc527b48b01d09ae58393e56450df7ba18aee84cea76139b2f3bce03839026ad1994b4fe23271edc5139afff5ef7da3c317506826e648506e7bf7fb48805b8d1350c6416a9a10761dbdaf55f3cf74c327b87d52354f83c088ddb4f8ef3a8bb3bb69156047111b39c4f0eaad526145c2ffb466380f33ccbb9ca571a14ccf758f258491a1d4f3ffaa31d3d43739166424ba971bea78a7e4faf49f62f34e7f4ddeb7dbf370f9e12c1a7ba4b568f5b302438b78cb81cd713d08adf5e9de4d3ae08146fcda6bb1b2369940d482eac0696af1254e126c1bb949cf4a890700b1d1fda7bd395db0e025aec435ab6fc1662fc7dd2cc12fe490f040e5631652c1276c7558f4611b92177494d52bfad5314af151865f9b1f7a2b1a579f572058c60815c1d01ab171ffea2c8d91abd723fcc76397217a28adf77c0c16be07febfb1fc1758b0f75dc165ecabae8d7edb58143e495105de40a0891f3fab30502df464ce89bdb68443a73c39c20a99ab8bfd7123f6e3593146be9f4a9c060d68dca260484842671162515419156158f56aeb52ac41ec4170b9718cb8d4fc837945a66625e6121f96dca6a46b225d514f846dbe9532f3dbcb706217be53ad34d1f218021fe7f5d93c70540d51468b686c9844d41348906aedd53d5ad9330f594b328775010105a4788c891734a55047e9da1fc20221c7ab2fc20228e77ac25ecf2bfa51f2fa889102bf7b6dcd457a2b3200ea1a0eef457760efc5c73c1ab8923e3dbefe4a1084e4b1c6d0121314acbd4a4fa3e458268c71c8f0dc5ceb66ca60dd8b2fcde2a017ebec28855c2664b440c6cc1462f761eacbca8ba5c9fc32e5e00c21a236285f66cddaf6053b8aefda90b3f41368c5adf55f3162d875e39b0bbd8d687c35aa3661c4e28c9690d1bc79db1103dca84fb5fc058e71ca884a5165cfd4fd5633d2f7ceff9236fadc26c95b1a3128abaa25aaa939c8042eebf3fee2d62f047d5ce910f6af34e0d0a938d98d7225cc9f6a7365baf59d92b853412df2181dde39919388c7b5ff7f87024ed8ed313d1f69c08b6535c04b8466f1cf199044d74ccd5e415ff08f8723430c1a13854e037484f005054e0419de4148eefa5e28212bdf2754ff608c644b4b778962a3f966b1287f57a501aa22c432fbdb5cd3e736414065c645de39ab26b1bc829a3b001c3d4c85fdba7d34bd1c1d265c675a2757298d3bdf7cbaef3cd61dbd3e810811ead152fd2789d5c668ea703055e28f21b11cba1b8e878e1000b362b292613ca794b15533994167dbfd9074129ce87a71d9d0b5c8bfa876f3634fd7b733f8eee4ab2d01947d23fd9d4042b01a0bd209bb48359d6a23d3612d8d7f3058adfe988e622c75a143dc6a37f5e3702b353ed6f65ed82cd7a2b5cccc57fef6d168a276f782f930d5d38fca487f710c3fe74b5c5676d3759fa6ad84cc9cf238d2141c7adfd9450b5291352bcbffe93b015fc74867301b8694e7fade8a846deb929f6a62bac0660fe27fe56a4e51a19624ba88cbef3bfe2639806d597a36bbeb67913ba4bdb1561352878df0fe0bbd4fa92754e8fa2c169f4f80764b8ff42889ea6bd6929c2841339c2b14e41bcef2ad59c7e713464f99cf9d0dac6e878d490c8344f29fc97164f102420b094710dd005e296cd20a22c47f47d3a12d440472ec9a875129413dee33bd3aaa64417f0919c3fa29d8eb065d5339e3e3f1d893558e3b09e662bdaf5b9e53082932a29065f523e3a9bc25e6de521fd7b5915cb48c8451e7bf19f80a2b806c9daecb4b3e22873132de724be4e92d03dda28f6c8f7a4d230932558d8f127dab3a4fe75cc0bbde3cd106e2a9d45691f46387e450acd09273daed397e23df85fa0a92f07c1d4cc13cc081827098fa07937b47ab69bde8a3e4fd97c9f8fe95beb19ec62da4fe9dbdaa8121807c0a7ea454a2880d78114ec959bcbc92fc7eb1169444de8a656e357168d4ba0ec3b7f778988b8b9158671a6a36cc6be089f7681927421f56915bb034d7e018e9d61ac1cab7581044b47dc29992e8646cfe477f4a7cf250e5da6021994901d188806acb2a0329e58991179cb64855023bb3cc694a8ab3b9aa6ab31385d42d890823ca69671cea8639335603288795205140d74c11eb513f918efd38af213a6220e3c8cff4301504922e9b15e9bb3a21c31d78f67daa37db4fcfbf3f9458f502fd9dc31c8ca18eab7d74cc01148c2b699554c649f7e5d0ddbfea442cfbd7b2b1e3984640a738afc76f487b142e39ef47790569c9dfeb2345802adaba189b2049fe30dc7435555f2382ba97377fc1b6fc0159c115d13589ce43fd615c4029110513d317f555fe9f23590ec349d800d33774cf29b7e9e88df5d9f2fa0d4f24cf885b1c782da1a9849b898d4d3727d60384d6ab2c2e145245491e4071bd7bc0f7d16e8914d6bedae34de0da02fa0c051fa46db0c1ae5745281e015883c4e68e3f78488b5d9bf65837224127a3cfa6cad6bd428988cb7bb927f3dd5a10665141e4772a84055683f59c8e839601d9c3268253a36ed1fc7d2eea89561127a4e9d3e5031cd96acc30618e29a3e3253d7a9e3f57c09ce9517f84cab14e1ddac1350835e78f7c232869cfab623a7466c87ed386cca9fdb3c6bd44d77b02ad6af255510851936dee96ddbd8da2a20fa527ed11dd85d78d535a2f7fa546705376756450d8a995d5a0630a44cd7e2ef0de03d02b165a7337a29def50918f9f665b8476989265b80dc9315b5530395f97dbade23cbc898159b226df306fb230882afae1a9078400d119d072b6da42c13f9f4b17287d8acddd4a2b7af3a96da34f0f8452d0bf1e6815b83a36e2d0b9766872fe0ba2fa1ff24ff366c348678db39ce7e89786e3b0935d4b5382c3d96cb84b2ca9f939b6516561f35fc386567268f3c79b22d4f80ae40e29fc0fa704742a6dadeded3ee610c6e932b546e42b388466f6bb119817477b9b06507e5a1b03f4a410f348ca28973856c84513cb0f3cf127ad15f9a935b7b062bdb806c25969999db354bd8f82db7f0c546c410588cd72514f3980d224cb239a99effbae1b22bb4c548", "a6e0e6c2f9858eb128d58631dc9db82dd09e2c98859c69f17f0c81a8a79be65d00b6b21d7a91c7e9ac0542a51f4391286baca5dcde78c3e63e26cd7cfaacc98a508edd1e6fb060c752e40229bef64382d916dd5d2902a0a16f27c7698e785361833dd91dd9222c4d8babc6075b212cb3b453c6a6d951047d3f11af0d41fbeab1bba6bbf8b5fa5c81ce7ad2a08987ae11b14ea7a48a23ab6c4375c6bedc3a0328955bba5ac814127c515ccae32947c1ca72eac1475390d8e066c6038269d85e85569c104567209965df85e150a72453d31431b4dbd4c4aa05982d30301703c7c0cd916826f3ad6e15baf7ac1329d289292afa4e9d884cddf3f3ca0979ec9c7b039e5681cfc0974c66f5930960d9983377749ea21849967f44d5cf1cf3b9cad624f86f7a690359eae1a2a9e331cefdac6b7637959b8a5569a114cdff9423f0606a86e382da7ed573174d445d34d23fb95423ade8e34f13fd38a942f1e266c0a8a82a0c91063c1e0bb89b668d7fb0f80179bc031a6c338e762fe3842981e57fedf54bc9eee914cd5700a148935fbb5b8b62f2c9b858ffe06801ade273c651fc0e87bd8f224a5b395e41467766be040a45f40e17b73efe37421e13b8e4fac3e47663ca96e9f8b4871750bc9f94810ce1469a8e8c70c57e935d30306337acf03abfb8ea6b50e9d70c29122b2769aae24452486e0e7407e6ed1eb65761d28bf2fdc1eb35988e79f2f78e907c3a39742a061ef07a5706e6d7a638fda63fd41995653abdeafa0a276985467314e849ed52545d319fff9b55e9707f817b3b84197da6f6da2367fcdb5f9baef67839e1f32c3012ad1cbf8d20d939b72543020aa6e4eb3b5f340a70e269ddc5250d3073ce801fee784756a416a3a50f8ac51c0f341b975502306e2194fefa782235252948c577a859a1f0a5cd62d7b396276ec48d0c85e5dbf1cfe8270960a8bbe5b00c31bd947fe79e9aec4b4cfbdacd690de0f437576cc932e83590602a84cdc9dabf401cf0972ab6903cc34ab80557616cadd57df69302404a8526c0da152caa0204c1339f4b71069210db0d82786c87f2e646e4e66ce8a429683d1cf96a6f122245fcd2b3c833d6f7e0e20acad8f4567fbda34c898c758d8a9d6d07710b178287907b3ee8394fee9ed5deeb148adea0441960f01a152bc308258e0358853978274faeec06d020d4710485283d8ea1c082b2ce8fa833b1039d8f4eb7269facb84c62e33e1863affdd722b978e8229af52a232d985644e6e7c1bfa8708d86b233a94ddd32c803cc39c50aabea679c8cef34ba4c3926e12e3d23cb24a3d5ef01da85a396cdc5da0989d9b3383a079852fdd79373f2653da9f42fa1286957b47534f68d91ec39d028cd4c55681fd6596751f35ba5bf0ae5e3f4a57a5090a1b9a79ff5cb6831085985cbf9a3840628dcc20f1ec955bd4127090028dc6b146bc4bfe4edb1ea502ada7b005b6767745e177d28f71c08e0481692c9bff0946a211a9494eb00c98593241b02fe501b0165a13c7bba3380b6fda023bb3f88adea1426b6060aeefba54362843a380f0c7c210edc9b4bb341acadf205b863eaf67cb6cd0adcfaf7ddd4ae99ae09098466f4ef2345ec8d66f74979d54da907ff8c3fbe5b37823f187681f688e4e58317a918ef0e02eeb8c2ca8428a2263336a16a46985e15c6d127e77d4cd3feeeca43a55d5afa3203e42b878208250e13f9bb1c16ff2ca68271a61392e1de8400994644ce79e17a92432ba928423c0097eee1536397f98f8d7a3c211c676387d49a72dc284438e0156483d8ed17e44a55b320ade5afe4c2721b5087ea3c29c5a4ec732867ef392ecdc5e1e841bcf30d6435ebc891f82be157e73739f97873cc2306833a4d6f797c0042c17dc018956566872410f616924b3e7f7c6720026fa7b5cb1a95306381ada8ec50d3e1122c06ada3752b05e69121fee04786f575e0c8fd9945f4c054ab2489999d436760232639a6778cd70007a6cd7d08a4e082c8c4ec7ee6eaa1ca9dfc7c9ba0099096224cec0b111b029d29872a3d67aed15448779738bbc9a7d53a1e97799fb790b0fdd69c7d18fbcbfd07b27f66c869a0e5b723e636b33404389a22d0a69e3e6ad6c7c546c042b6d2552b1524df205d712b0e75c6a199cbbbff24e8c448c77547fd95a0aa9fbe16b117461265b8fb519dc7206e2408eb5ab47d01e199058f42ec27e61ef54515dd801c656d255b57ce2212e5c05aba9e0b9feb607cd4b38cf743df5c67729e5714db06161872ccaaf3861a9d615e090c2b39d2d9a26908d539a9470c6fcf92372e01f523659b59d7a1fdbc8e2c61150ae98a1c64b9181be928cf0c07aa88ed2daf16dbe940108a6222d78b7c252489c279f2783c836101fdbfa280a58403742bd0ffc780a4066b97454df31b5c85fb178e3c107ac4d3dd7f145bc45a01da822e387f74df17198e577465295f07e021e30deaef43f43fe55e11e37633602ae5c2f2f360701c61e91d2035f3baad495e695aa6e15719cde6aaa486135242ac670be0641914ebb9eb2f44c21afc836bee441b70ac4a49f790407d59c3d63468e024015ae124845240192123caabe6b83b8ae4576296f7b0500480105e137cae3b0d01a3987aeef711d4a95ea7663002e47a7f5914e72c7df5a4980a6b65f2157eb7f1da1d944cbeba8fbf76d20db05c43bb9f1e3a23f12b7c42185df0c9f3624dde9be2b5febba05054e2a042d92bb10b287b1f8f57e982d108233b6df1e2ad489ab99085c47b02dd681dc211285b501d0a5b3481752891573e795879f9c8fffa271c75cd3279a41a6474893c8c579a1f76ee8c2b9969b0b7d2bed5895098ae57adbb0ef295107148893e93ab3a1fdf10d063bc905decb801f2aeb7573fa6b95a796cf8cf69815735957cf8ce8aea7a6730b3b69f38ab6459a3bff5c0f1980183e91018785fcab0c0fae16310e6bd6a1b14293af403f42bf17e83f7eb90f2a6faf15c398377bad7d1ae76ac1fd3d91e4807c900c7813e36be861ca6f44811cfc0fa2c979f274ce57847425f2bd989fb01d96c6fdcff2e524dfd7ce65cf102f572213bbb83a8494c824b642b43b023ad00587d874331d36f2d4798c1fcaa4bc90820038136a8cab52cc58f3dd8ce4febb974d38c69272e84d7161165ce80f7ed874b0b5057e6108168f83b36e7a65bde0ae4b139d9874b948e43338190e61445c8cf8dc9766ba9f413daa94951af742271d0a0344a75f6116e082cbf39303d940ae1d02b3c35635750463fa1d2b4c5a2d0e9b57d73943c5fd749f14052d0656ca99fb02896b6523abbcd09e954c7d1b9e491d4ff5c6c9eb00ed1dd57977111a22d0e088aaa1164de4911b477b299d9501054983e919d45a18175348afe6280412a296be214b23b2a65024937a378b3ff14dc6bd9e2e91edd26f6a005365f416a1f03334d9361516e6b6e21479242a93d7f56789d527a599951025bc23ebf5f5fba01fb16023128e444d6a63f282dac2f44887918686325c05ac4d0faa2cbe3cea3aa4ef121b5e5e813978de4727edd3ba82669467448118dc381562b00da08a8bca5c7673894289be970e4765abc98206d43ee1c215fee7bfd3615163b335cbdbc2a6125f8c678d47a8cca3de794805a9e661651a165c6ba96c99fb99a9bb4c0caed5e83afec3957c34cd22eccaa6a84e3972cdbc10066090c79a29239ed752867a09fc7946cdde73a4c658991b650227390ca98e797c965d1f7c80bb6585234c97c4d68a712f47a37fe6e0314e8dde772dddf0b1bc01794ce25f709283b7937e924f5e338ac99dfd70759b1ebf3c95c7f493d2751888d43edef660dd784e9a32fdc8ffb150d512a48c7ae7b9618dea7668402c3984067e76b607d9a8739fd6d2a711f183fb5489d079c24fbd32cc6e4a80f192bf0500732e5907de9d574744f5ce4e2edefbd9594d927ac99dc248709013a2d0a980b0455e38132e121a585a04071c424c4ec151a408c73eee58a1f15318fb7ca4c274a50ea8bf199bdde8208a6aab76e38b2e62fb2d100865ff679bea47b27370bfb81c79bf6cd6315e1ef33547061a2476af479e3b6c3f442ae0fe6f907d4ea3d8b7e4cef660b9eb9ce4b5b0343bc07ce4aef1aac10989ac07cfa231e7ff9c0fce472cbc4293ec1d379548687220575c26dfbd362d70f4cd0f9f45ec9be245150d75ca7b0b55ef123fd96f66b87d3e838b566d654a16618a6b1d5f9f8c71b21985aafd3a07d51addd165908d0d2661776d36bcde9b49820133b391149964a02015d926f93a7a15a5b1496e6e8db5dac8c42be73a106d7102c7fb1f3a5d48134674857e69634eaea593b83420bfd512f3bc1f0492c89c15b0eced5ca29ba892d87eaac6fdf108616bac959c2c08081d880320f5ee7787063179b1a2b2f10f12cb74940aab008fd0060689e36646be35fcc33976a387f6d271fad025c76428d830235e6f2b0f9cdff279e6bcb115a2ccdb0b55ff9d9baa3f3333929e9c21a955e6c950585e44bc93335743cc5117c03a9ad363c351796570a6b3efe381eb3fec7752877084d056a483946225bfe6885b8be2dbe97f4153ef0a7731f09873620ba80021b37cd1cad1d70f9e69e76462fc3348dd5e6d10f806695bbfecbe6b0dd82d88e6839f2e1bdc05b8c7323363f7a82af9b3d6a77ed598d4e247115302503ae341985ac630713af941523e0d035d09642b973a0ae45b0800237e3e9c60dc0e970a2a95ba9a92449940b3b003b49d3c8e2d087b30b040c5a4281ae01d2daab71288864f5ee656146d88bea760f11fde0ea4cde19d25da2da24e771a07091757c6bd0897aec6b608ecda54d43cd3b67526f1750267e24e7b38947b49d5bc82579f4fa064a85cb5361d2b641cf947a88cd1053c4b857e4d22929af32e04138b30ea42efed72ce5fa6cec5a7153a87f5646316aa25abe11f9acf6482d1c63d352c2443c7aaefd00b4f8bff3cf234d443dee056f1cc84866b76d996b1d041e70062ca7a659990f10d054e0ea4185eeeb25a0efd361ca11012d8eba50eb3ce15a90ca5a0c42ed1fd6de7c8ae41bdc9c030e3c649befda4ec920ba616a0f1ba8ec5669f1f18d141d00f28e975b40b4bc2d2537bddb6f921042ca3784ce1d8596864bd42675401b5bad5f676fd96796dd308738b4e7fc06fcc5768dc5897f8f4b904665294233744ebc47fb15a72a7c9dc2c0b03e5b19b504adc66f5ca27076fd5669ef3c1b863037053aa17ce30a751edca0a6ab0459eec2f52e6bfcece170df85a63f1751fe75c154e43291c8e5964c249880413b983656990c1a19eeb7e8953603587c175c53538c10214a62143e7790a00378a3355369a0f3e732e8dc913de2a3aa830bf500141199ede2d6302e81211ab362e4db7030661a3b93df225f39edb29bc866dbaecf7b4a67d4ddaceaa467134ef818a337035ec686f0aaeda312bcbe8f3e80d2bdf7fbe791b447098661d7af8af6c6d75e239d668749952726649aaffdc525156274cd0325c4f7f153c41108fa7063dfb709b43aad8ce0ee97bce0debc523a935f0d0f750ba2e86a50c51b27881e9ce2e1b9ff3d4a32f891f08a5eac3053e7b7c35e28f75b7a97a3abbfd01e4cbfc4cf9235445f7d222ae4dc4fca4ec92f10f94754233b07f7e662f082dd66908cf56bd0d2632e091a02695628c2a00451cab685a2b727d9c067318424fd88726fcc3edb773b3f9968ffff6f079c0994fe7feeba1ebc02c59d74b8710bc6b0b4fe48c34ce5e63bc39c15b67167352fbee160bb07562bd307960532"}) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2313.014574] binder: 8152:8153 ERROR: BC_REGISTER_LOOPER called without request [ 2313.080119] binder: 8152:8161 got reply transaction with no transaction stack [ 2313.124355] binder: 8152:8161 transaction failed 29201/-71, size 0-0 line 2762 [ 2313.180345] binder: release 8152:8153 transaction 2830 out, still active [ 2313.205869] binder: undelivered TRANSACTION_COMPLETE [ 2313.299250] binder: 8152:8161 got reply transaction with no transaction stack [ 2313.345106] binder: release 8152:8167 transaction 2832 out, still active [ 2313.353917] kauditd_printk_skb: 161 callbacks suppressed [ 2313.353931] audit: type=1400 audit(1555635596.793:42481): avc: denied { map } for pid=8158 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:56 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a"], 0x32) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2313.378929] binder: 8152:8161 transaction failed 29201/-71, size 0-0 line 2762 [ 2313.418322] binder: undelivered TRANSACTION_COMPLETE 00:59:57 executing program 1: r0 = memfd_create(&(0x7f0000000100)='\xd7\xd6s\x14i\xday V\xfe(aK\x0f\xf4\x15U\xd0t\xc3Ax\x9b\xa7\x9e{\x1b;i\xb4e\x11\x13\x04z\x88\x14?\xca\xff\xe0\xc77\xc6/\xf4\x82\xbf\xf0\x8a3\x00Vz6V\xc4\xd8\xc7u\xfc\xda\xe0\x94\x81\xc6\xa4\xeb\x03\xdc\x81\x15pC\xd3yM\r\xf3\xa7\xf8P\xb4)\x01\xcd`\xda\xba%\xd3\xb7', 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003003e01"], 0x14) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_execute_func(&(0x7f00000000c0)="2e2ef34a0f2c91001000024b99c441896c5b038fa94094418e660f3a0c6fcbef2e03b200000000660fe9f5660f3829efc4617a6fa2fd000000c4e1c1e16ea1") [ 2313.559330] audit: type=1400 audit(1555635596.793:42480): avc: denied { map } for pid=8160 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2313.602125] binder: undelivered TRANSACTION_ERROR: 29201 00:59:57 executing program 5 (fault-call:9 fault-nth:0): socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2313.725461] binder: release 8152:8153 transaction 2830 in, still active 00:59:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2313.750655] audit: type=1400 audit(1555635596.803:42482): avc: denied { map } for pid=8160 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2313.805436] binder: send failed reply for transaction 2830, target dead 00:59:57 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) [ 2313.850660] binder: undelivered TRANSACTION_ERROR: 29201 [ 2313.893433] binder: send failed reply for transaction 2832, target dead [ 2313.987759] audit: type=1400 audit(1555635596.953:42483): avc: denied { map } for pid=8171 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2314.151862] audit: type=1400 audit(1555635596.963:42484): avc: denied { map } for pid=8171 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2314.295719] audit: type=1400 audit(1555635597.003:42485): avc: denied { map } for pid=8171 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 00:59:57 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@mcast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000140)=0xe8) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x801, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=./file0,upperdir=./file0,upperdir=./file0,workdir=./file0,index=on,xino=on,xino=off,default_permissions,smackfsdef=fou\x00,fowner<', @ANYRESDEC=r2, @ANYBLOB="2c686173202c636f4e746578743d7693a57f059326db73757265726f6c653d2c00"]) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000280)="abc4fe5b481a23ae6981fcd14c27f6680457304f60e76ef3f246728a1a15128a3a9fd127f02664a25bbe76af33d2ad54db6306b350ff8de730c591a8bd8b9bca1c43574114e1292dcad675b204133c1b841879abb0ffe1ab8dd4a672ac4e1eb096690cc37ac70629607b29971d3a310ba545c100df2a3f94abce568ac0c10dd60203b02b16f50dcab100907676ad81c8428fd2c06ab98d1a5f44b1457f0618e873de606a80ba326926847c30dd2fdb8decc48ef6fd76e0b2dcbc7d73741e4ba743b598576eb0b04d28feb17fe497f7b206c705fcbe85a1c919cc8c81ac039600b571fa7a9712a16245ecf64dedc801e3e7affc62be1526cfea72a3c43f719f5d") [ 2314.516245] audit: type=1400 audit(1555635597.013:42486): avc: denied { map } for pid=8171 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2314.699336] audit: type=1400 audit(1555635597.093:42487): avc: denied { map } for pid=8171 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2314.850453] audit: type=1400 audit(1555635597.143:42488): avc: denied { map } for pid=8171 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2314.974888] binder: 8191:8195 ERROR: BC_REGISTER_LOOPER called without request [ 2314.995430] audit: type=1400 audit(1555635597.153:42489): avc: denied { map } for pid=8171 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2315.059231] binder: 8191:8198 got reply transaction with no transaction stack [ 2315.138181] binder: 8191:8198 transaction failed 29201/-71, size 0-0 line 2762 [ 2315.167485] FAULT_INJECTION: forcing a failure. [ 2315.167485] name failslab, interval 1, probability 0, space 0, times 0 [ 2315.205424] binder: release 8191:8195 transaction 2835 out, still active [ 2315.239742] CPU: 1 PID: 8189 Comm: syz-executor.5 Not tainted 4.19.35 #3 00:59:58 executing program 1 (fault-call:9 fault-nth:0): timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2315.248148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2315.259871] Call Trace: [ 2315.263317] dump_stack+0x172/0x1f0 [ 2315.267619] should_fail.cold+0xa/0x1b [ 2315.272616] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2315.278398] __should_failslab+0x121/0x190 [ 2315.284314] should_failslab+0x9/0x14 [ 2315.288179] kmem_cache_alloc_node+0x56/0x710 [ 2315.293088] __alloc_skb+0xd5/0x5f0 [ 2315.297905] ? skb_scrub_packet+0x490/0x490 [ 2315.302701] tipc_buf_acquire+0x2f/0x100 [ 2315.306909] tipc_msg_create+0x38/0x270 [ 2315.311762] __tipc_shutdown+0x807/0xae0 [ 2315.315927] ? mark_held_locks+0x77/0x100 [ 2315.320471] ? tipc_sk_respond+0x5b0/0x5b0 [ 2315.326984] ? __local_bh_enable_ip+0x15a/0x270 [ 2315.332665] ? lock_sock_nested+0x9a/0x120 [ 2315.337928] ? do_wait_intr_irq+0x2b0/0x2b0 [ 2315.343161] ? __local_bh_enable_ip+0x15a/0x270 [ 2315.361110] tipc_release+0x70/0x1010 [ 2315.365641] ? __sock_release+0x89/0x2b0 [ 2315.370664] __sock_release+0xd3/0x2b0 [ 2315.375896] ? __sock_release+0x2b0/0x2b0 [ 2315.381280] sock_close+0x1b/0x30 [ 2315.385217] __fput+0x2df/0x8b0 [ 2315.388547] ____fput+0x16/0x20 [ 2315.392454] task_work_run+0x14a/0x1c0 [ 2315.397071] get_signal+0x1961/0x1d50 [ 2315.401713] ? find_held_lock+0x35/0x130 00:59:58 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r2 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000100)="82d554e9fb", 0x5, 0xffffffffffffffff) r3 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$search(0xa, r2, &(0x7f0000000140)='cifs.idmap\x00', &(0x7f00000001c0)={'syz', 0x3}, r3) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) r4 = dup2(r1, r0) ioctl$SIOCX25SDTEFACILITIES(r4, 0x89eb, &(0x7f00000002c0)={0x7f, 0x8, 0xfff, 0x32, 0x1ff, 0x17, 0x22, "ff3ac9c83c065327d111c58a55577c3b3e365066", "a333470da8f2f822ea7be4ed43ef3dfc26c75dd1"}) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2315.406659] ? __f_unlock_pos+0x19/0x20 [ 2315.411912] do_signal+0x95/0x1950 [ 2315.415877] ? poll_freewait+0x260/0x260 [ 2315.421087] ? setup_sigcontext+0x7d0/0x7d0 [ 2315.426327] ? do_pselect+0x300/0x3f0 [ 2315.431233] ? kern_select+0x1e0/0x1e0 [ 2315.435739] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2315.442948] ? fput+0x128/0x1a0 [ 2315.446608] ? ksys_write+0x166/0x1f0 [ 2315.450854] ? exit_to_usermode_loop+0x43/0x2c0 [ 2315.456296] ? do_syscall_64+0x52d/0x610 [ 2315.460788] ? exit_to_usermode_loop+0x43/0x2c0 [ 2315.466080] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2315.471217] ? trace_hardirqs_on+0x67/0x230 [ 2315.476124] exit_to_usermode_loop+0x244/0x2c0 [ 2315.481667] do_syscall_64+0x52d/0x610 [ 2315.488468] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2315.495674] RIP: 0033:0x458c29 [ 2315.501178] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2315.524483] RSP: 002b:00007f154117cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 2315.533040] RAX: fffffffffffffdfe RBX: 00007f154117cc90 RCX: 0000000000458c29 [ 2315.541064] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000040 [ 2315.549030] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2315.557499] R10: 0000000020000140 R11: 0000000000000246 R12: 00007f154117d6d4 [ 2315.565242] R13: 00000000004c599d R14: 00000000004d9d28 R15: 0000000000000009 [ 2315.577808] protocol 88fb is buggy, dev hsr_slave_0 [ 2315.583544] protocol 88fb is buggy, dev hsr_slave_1 [ 2315.584357] binder: undelivered TRANSACTION_COMPLETE 00:59:59 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) gettid() r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2315.651851] binder: 8191:8195 ERROR: BC_REGISTER_LOOPER called without request [ 2315.695406] binder: 8191:8198 got reply transaction with no transaction stack 00:59:59 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 00:59:59 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2315.745238] binder: 8191:8198 transaction failed 29201/-71, size 0-0 line 2762 [ 2315.764915] binder: release 8191:8203 transaction 2837 out, still active [ 2315.779354] binder: undelivered TRANSACTION_COMPLETE [ 2315.814960] binder: undelivered TRANSACTION_ERROR: 29201 00:59:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2315.860928] binder: release 8191:8195 transaction 2835 in, still active [ 2315.876939] binder: send failed reply for transaction 2835, target dead [ 2315.914488] binder: undelivered TRANSACTION_ERROR: 29201 [ 2315.947358] binder: send failed reply for transaction 2837, target dead [ 2316.227736] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.233795] protocol 88fb is buggy, dev hsr_slave_1 [ 2316.387714] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.393245] protocol 88fb is buggy, dev hsr_slave_1 [ 2316.399151] protocol 88fb is buggy, dev hsr_slave_0 [ 2316.404876] protocol 88fb is buggy, dev hsr_slave_1 [ 2316.621465] binder: 8217:8219 ERROR: BC_REGISTER_LOOPER called without request [ 2316.691128] binder: 8217:8221 got reply transaction with no transaction stack [ 2316.751686] binder: 8217:8221 transaction failed 29201/-71, size 0-0 line 2762 [ 2316.793210] binder: release 8217:8219 transaction 2840 out, still active [ 2316.823105] binder: undelivered TRANSACTION_COMPLETE [ 2316.867454] binder: 8217:8219 ERROR: BC_REGISTER_LOOPER called without request [ 2316.911251] binder: release 8217:8224 transaction 2842 out, still active [ 2316.928471] binder: 8217:8221 got reply transaction with no transaction stack [ 2316.946743] binder: undelivered TRANSACTION_COMPLETE [ 2316.965291] binder: 8217:8221 transaction failed 29201/-71, size 0-0 line 2762 [ 2316.978862] binder: undelivered TRANSACTION_ERROR: 29201 [ 2317.020049] binder: release 8217:8219 transaction 2840 in, still active [ 2317.027574] binder: send failed reply for transaction 2840, target dead [ 2317.053709] binder: undelivered TRANSACTION_ERROR: 29201 [ 2317.064372] binder: send failed reply for transaction 2842, target dead 01:00:00 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0x27, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:00 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a"], 0x32) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:00 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x3}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:00 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000140), &(0x7f00000001c0)=0x14) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0xfedb, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000040)=""/96, 0x60}], 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") 01:00:00 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:00 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) gettid() r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:01 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) gettid() r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:01 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0x27000000, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2317.860819] binder: 8233:8239 ERROR: BC_REGISTER_LOOPER called without request [ 2317.952680] binder: 8233:8248 got reply transaction with no transaction stack [ 2318.093192] binder: 8233:8248 transaction failed 29201/-71, size 0-0 line 2762 [ 2318.130089] binder: release 8233:8239 transaction 2845 out, still active 01:00:01 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:01 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea9020"], 0x36) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2318.162507] binder: undelivered TRANSACTION_COMPLETE [ 2318.292456] binder: 8233:8248 got reply transaction with no transaction stack [ 2318.414455] kauditd_printk_skb: 144 callbacks suppressed [ 2318.414469] audit: type=1400 audit(1555635601.863:42634): avc: denied { call } for pid=8233 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2318.414478] binder: release 8233:8252 transaction 2848 out, still active [ 2318.414489] binder: undelivered TRANSACTION_COMPLETE 01:00:01 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x5, 0x400541) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) write$P9_RWRITE(r2, &(0x7f0000000140)={0xb, 0x77, 0x1, 0x5}, 0xb) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x100, 0x0) ioctl$CAPI_GET_SERIAL(r3, 0xc0044308, &(0x7f0000000080)=0x6) [ 2318.493692] binder: 8233:8248 transaction failed 29201/-71, size 0-0 line 2762 01:00:02 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2318.697925] binder: release 8233:8239 transaction 2845 in, still active [ 2318.705539] binder: send failed reply for transaction 2845, target dead 01:00:02 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2318.796466] binder: undelivered TRANSACTION_ERROR: 29201 [ 2318.828694] binder: send failed reply for transaction 2848, target dead [ 2318.853663] binder: undelivered TRANSACTION_ERROR: 29201 01:00:02 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea9020"], 0x36) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:02 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0xe) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2319.078279] audit: type=1400 audit(1555635602.523:42635): avc: denied { map } for pid=8268 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2319.229169] audit: type=1400 audit(1555635602.573:42636): avc: denied { map } for pid=8268 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2319.341960] audit: type=1400 audit(1555635602.603:42637): avc: denied { map } for pid=8268 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2319.438926] binder: 8272:8275 transaction failed 29189/-22, size 0-0 line 2855 [ 2319.484034] binder: undelivered TRANSACTION_ERROR: 29189 [ 2319.535299] audit: type=1400 audit(1555635602.603:42638): avc: denied { map } for pid=8268 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2319.576851] binder: 8272:8282 transaction failed 29189/-22, size 0-0 line 2855 [ 2319.608398] binder: undelivered TRANSACTION_ERROR: 29189 [ 2319.708972] audit: type=1400 audit(1555635602.663:42639): avc: denied { map } for pid=8268 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2319.757713] protocol 88fb is buggy, dev hsr_slave_0 [ 2319.763147] protocol 88fb is buggy, dev hsr_slave_1 01:00:03 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea9020"], 0x36) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2319.849834] audit: type=1400 audit(1555635602.663:42640): avc: denied { map } for pid=8270 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2319.963950] audit: type=1400 audit(1555635602.723:42641): avc: denied { map } for pid=8268 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:03 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2320.091215] audit: type=1400 audit(1555635602.723:42642): avc: denied { map } for pid=8270 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:03 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x9}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2320.193224] audit: type=1400 audit(1555635602.723:42643): avc: denied { map } for pid=8270 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2320.486296] binder: 8297:8298 ERROR: BC_REGISTER_LOOPER called without request [ 2320.537968] binder_alloc: 8297: binder_alloc_buf, no vma [ 2320.578094] binder: 8297:8298 transaction failed 29189/-3, size 0-0 line 2970 01:00:04 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x10) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2320.617394] binder: send failed reply for transaction 2852 to 8297:8298 [ 2320.655183] binder: undelivered TRANSACTION_COMPLETE [ 2320.661105] binder: undelivered TRANSACTION_ERROR: 29189 01:00:04 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067af"], 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2320.774362] binder: 8297:8298 ERROR: BC_REGISTER_LOOPER called without request [ 2320.833505] binder: release 8297:8311 transaction 2854 out, still active [ 2320.849428] binder: undelivered TRANSACTION_COMPLETE 01:00:04 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:04 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x300}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2320.937134] binder: undelivered TRANSACTION_ERROR: 29190 [ 2320.952856] binder: send failed reply for transaction 2854, target dead 01:00:04 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000280)="a7235d9aeb9d219edc87ab8d86ece5965cc1f030b7ed1552272a5aab481484794efbf1bd38146571bc6b32a4f04cb9363156ac9eb24fe34e7ab21fe82d22e6c6e5c17eee515d8b4f909a2b321542a0bce1bebe0fd79644f63619e10b5d330cb90c113567b8eaca785f09b579020d8712772061adcbe6a68e2edd6e64743b927d7106d1b5c90614ee0c", 0x89) ioctl$CAPI_GET_PROFILE(0xffffffffffffffff, 0xc0404309, &(0x7f0000000080)) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2321.749622] binder: 8323:8327 transaction failed 29189/-22, size 0-0 line 2855 [ 2321.776302] binder: undelivered TRANSACTION_ERROR: 29189 [ 2321.827762] protocol 88fb is buggy, dev hsr_slave_0 [ 2321.833833] protocol 88fb is buggy, dev hsr_slave_1 [ 2321.879547] binder: 8323:8331 transaction failed 29189/-22, size 0-0 line 2855 [ 2321.926921] binder: undelivered TRANSACTION_ERROR: 29189 01:00:05 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:05 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0xe00) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:05 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067af"], 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:05 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x900}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:05 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2322.627717] protocol 88fb is buggy, dev hsr_slave_0 [ 2322.633494] protocol 88fb is buggy, dev hsr_slave_1 [ 2322.639243] protocol 88fb is buggy, dev hsr_slave_0 [ 2322.644588] protocol 88fb is buggy, dev hsr_slave_1 01:00:06 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x3f00) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2322.794592] binder: 8343:8347 ERROR: BC_REGISTER_LOOPER called without request [ 2322.903037] binder: 8343:8353 got reply transaction with no transaction stack 01:00:06 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x3000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:06 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_init_net_socket$ax25(0x3, 0x0, 0xcf) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") [ 2322.974026] binder: 8343:8353 transaction failed 29201/-71, size 0-0 line 2762 [ 2323.007996] binder: release 8343:8347 transaction 2858 out, still active [ 2323.021727] binder: undelivered TRANSACTION_COMPLETE [ 2323.102034] binder: release 8343:8347 transaction 2858 in, still active [ 2323.112844] binder: send failed reply for transaction 2858, target dead [ 2323.151296] binder: undelivered TRANSACTION_ERROR: 29201 [ 2323.175800] binder: 8343:8347 ERROR: BC_REGISTER_LOOPER called without request [ 2323.207931] binder: 8343:8353 got reply transaction with no transaction stack [ 2323.232417] binder: release 8343:8357 transaction 2861 out, still active [ 2323.246226] binder: 8343:8353 transaction failed 29201/-71, size 0-0 line 2762 [ 2323.264801] binder: undelivered TRANSACTION_COMPLETE 01:00:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2323.390001] binder: release 8343:8347 transaction 2861 in, still active [ 2323.400526] binder: send failed reply for transaction 2861, target dead [ 2323.432820] kauditd_printk_skb: 108 callbacks suppressed [ 2323.432833] audit: type=1400 audit(1555635606.883:42752): avc: denied { map } for pid=8362 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2323.469475] binder: undelivered TRANSACTION_ERROR: 29201 [ 2323.514179] audit: type=1400 audit(1555635606.943:42753): avc: denied { map } for pid=8362 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:07 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x4000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2323.629727] audit: type=1400 audit(1555635606.943:42754): avc: denied { map } for pid=8362 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:07 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2323.753292] audit: type=1400 audit(1555635606.943:42755): avc: denied { map } for pid=8362 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2323.886507] audit: type=1400 audit(1555635606.993:42756): avc: denied { map } for pid=8362 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2323.992877] audit: type=1400 audit(1555635607.013:42757): avc: denied { map } for pid=8362 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2324.119761] audit: type=1400 audit(1555635607.013:42758): avc: denied { map } for pid=8365 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2324.226534] audit: type=1400 audit(1555635607.023:42759): avc: denied { map } for pid=8365 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2324.276394] binder: 8374:8376 ERROR: BC_REGISTER_LOOPER called without request [ 2324.296905] binder_alloc: 8374: binder_alloc_buf, no vma [ 2324.304238] audit: type=1400 audit(1555635607.033:42760): avc: denied { map } for pid=8365 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2324.307854] binder: 8374:8376 transaction failed 29189/-3, size 0-0 line 2970 [ 2324.339364] audit: type=1400 audit(1555635607.033:42761): avc: denied { map } for pid=8365 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2324.370560] binder: send failed reply for transaction 2864 to 8374:8376 [ 2324.383415] binder: undelivered TRANSACTION_COMPLETE [ 2324.399926] binder: undelivered TRANSACTION_ERROR: 29189 01:00:07 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x1000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2324.479087] binder: 8374:8376 ERROR: BC_REGISTER_LOOPER called without request [ 2324.494972] binder: 8374:8382 got reply transaction with no transaction stack [ 2324.509990] binder: 8374:8382 transaction failed 29201/-71, size 0-0 line 2762 [ 2324.526096] binder: release 8374:8385 transaction 2866 out, still active [ 2324.544381] binder: undelivered TRANSACTION_COMPLETE [ 2324.564373] binder: undelivered TRANSACTION_ERROR: 29201 [ 2324.613970] binder: undelivered TRANSACTION_ERROR: 29190 [ 2324.634502] binder: send failed reply for transaction 2866, target dead 01:00:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x46030000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:09 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:09 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067af"], 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:09 executing program 3: r0 = socket$inet(0x2, 0x3, 0x1c) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x76, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6) recvmsg(r1, &(0x7f0000000240)={0x0, 0x214, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x9400}], 0x1}, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x10000054d) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0ad401003c123f319bd070") 01:00:09 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0xe000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:09 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x9000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2326.105809] binder: 8397:8400 ERROR: BC_REGISTER_LOOPER called without request [ 2326.160132] binder_alloc: 8397: binder_alloc_buf, no vma [ 2326.191013] binder: 8397:8400 transaction failed 29189/-3, size 0-0 line 2970 01:00:09 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2326.206580] binder: send failed reply for transaction 2869 to 8397:8400 [ 2326.255200] binder: undelivered TRANSACTION_COMPLETE [ 2326.260573] binder: undelivered TRANSACTION_ERROR: 29189 01:00:09 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x10000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:09 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0xfeffffff}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2326.359162] binder: 8397:8400 ERROR: BC_REGISTER_LOOPER called without request [ 2326.370564] binder: 8397:8412 got reply transaction with no transaction stack [ 2326.409300] binder: release 8397:8414 transaction 2871 out, still active [ 2326.422356] binder: 8397:8412 transaction failed 29201/-71, size 0-0 line 2762 [ 2326.426203] binder: undelivered TRANSACTION_COMPLETE [ 2326.494178] binder: undelivered TRANSACTION_ERROR: 29201 01:00:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x47030000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2326.581283] binder: undelivered TRANSACTION_ERROR: 29190 [ 2326.588259] binder: send failed reply for transaction 2871, target dead 01:00:10 executing program 3 (fault-call:5 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2}) 01:00:10 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:10 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x3f000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2327.439359] binder: 8434:8435 ERROR: BC_REGISTER_LOOPER called without request [ 2327.493568] binder_alloc: 8434: binder_alloc_buf, no vma [ 2327.559011] binder: 8434:8435 transaction failed 29189/-3, size 0-0 line 2970 [ 2327.598099] binder: send failed reply for transaction 2874 to 8434:8435 [ 2327.650928] binder: undelivered TRANSACTION_COMPLETE [ 2327.656146] binder: undelivered TRANSACTION_ERROR: 29189 [ 2327.756390] binder: 8434:8435 ERROR: BC_REGISTER_LOOPER called without request [ 2327.816076] binder: 8434:8442 got reply transaction with no transaction stack [ 2327.838686] binder: 8434:8442 transaction failed 29201/-71, size 0-0 line 2762 [ 2327.854659] FAULT_INJECTION: forcing a failure. [ 2327.854659] name failslab, interval 1, probability 0, space 0, times 0 [ 2327.880067] binder: release 8434:8443 transaction 2876 out, still active [ 2327.887341] binder: undelivered TRANSACTION_COMPLETE [ 2327.917261] binder: undelivered TRANSACTION_ERROR: 29201 [ 2327.936813] CPU: 0 PID: 8446 Comm: syz-executor.3 Not tainted 4.19.35 #3 [ 2327.943697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2327.953067] Call Trace: [ 2327.955681] dump_stack+0x172/0x1f0 [ 2327.959340] should_fail.cold+0xa/0x1b [ 2327.963255] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2327.968395] ? security_compute_av+0x27b/0xb70 [ 2327.973016] __should_failslab+0x121/0x190 [ 2327.977274] should_failslab+0x9/0x14 [ 2327.981372] kmem_cache_alloc+0x47/0x700 [ 2327.985471] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2327.990602] ? avc_compute_av+0x225/0x690 [ 2327.994871] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2328.000014] avc_alloc_node+0x2a/0x630 [ 2328.003927] ? kasan_check_read+0x11/0x20 [ 2328.008134] avc_compute_av+0x22d/0x690 [ 2328.012144] avc_has_extended_perms+0x815/0x10f0 [ 2328.016928] ? find_held_lock+0x35/0x130 [ 2328.021044] ? avc_ss_reset+0x190/0x190 [ 2328.025078] ? kasan_check_read+0x11/0x20 [ 2328.029273] ? mark_held_locks+0x100/0x100 [ 2328.033557] ? proc_fail_nth_write+0x9d/0x1e0 [ 2328.033574] ? proc_cwd_link+0x1d0/0x1d0 [ 2328.033598] ? __fget+0x340/0x540 [ 2328.033619] ? __might_sleep+0x95/0x190 [ 2328.033644] selinux_file_ioctl+0x46f/0x5e0 [ 2328.054014] ? kasan_check_read+0x11/0x20 [ 2328.058195] ? selinux_file_mprotect+0x620/0x620 [ 2328.063014] ? iterate_fd+0x360/0x360 [ 2328.063037] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2328.063051] ? fput+0x128/0x1a0 [ 2328.063105] security_file_ioctl+0x7d/0xc0 [ 2328.080024] ? security_file_ioctl+0x7d/0xc0 [ 2328.084466] ksys_ioctl+0x57/0xd0 [ 2328.087956] __x64_sys_ioctl+0x73/0xb0 [ 2328.091880] do_syscall_64+0x103/0x610 [ 2328.095804] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2328.101014] RIP: 0033:0x458c29 [ 2328.104218] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2328.123139] RSP: 002b:00007f46f546fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2328.130873] RAX: ffffffffffffffda RBX: 00007f46f546fc90 RCX: 0000000000458c29 [ 2328.138169] RDX: 0000000020000040 RSI: 0000000000005412 RDI: 0000000000000004 [ 2328.145471] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2328.152853] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f46f54706d4 [ 2328.160145] R13: 00000000004c2ddb R14: 00000000004d5ff0 R15: 0000000000000005 [ 2328.194600] binder: undelivered TRANSACTION_ERROR: 29190 [ 2328.200222] binder: send failed reply for transaction 2876, target dead [ 2328.440562] kauditd_printk_skb: 132 callbacks suppressed [ 2328.440586] audit: type=1400 audit(1555635611.893:42894): avc: denied { map } for pid=8451 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.558346] audit: type=1400 audit(1555635611.933:42895): avc: denied { map } for pid=8451 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.619878] audit: type=1400 audit(1555635611.953:42896): avc: denied { map } for pid=8452 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.644091] audit: type=1400 audit(1555635611.973:42897): avc: denied { map } for pid=8452 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.668354] audit: type=1400 audit(1555635611.973:42898): avc: denied { map } for pid=8452 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.695295] audit: type=1400 audit(1555635611.973:42899): avc: denied { map } for pid=8452 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.721508] audit: type=1400 audit(1555635612.013:42900): avc: denied { map } for pid=8452 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.746151] audit: type=1400 audit(1555635612.043:42901): avc: denied { map } for pid=8452 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.806834] audit: type=1400 audit(1555635612.043:42902): avc: denied { map } for pid=8452 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2328.835109] audit: type=1400 audit(1555635612.093:42903): avc: denied { map } for pid=8452 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:12 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:12 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0xfffffffe}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:12 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x40000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:12 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:12 executing program 3 (fault-call:5 fault-nth:1): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2}) [ 2329.585077] binder: 8456:8464 ERROR: BC_REGISTER_LOOPER called without request [ 2329.589504] FAULT_INJECTION: forcing a failure. [ 2329.589504] name failslab, interval 1, probability 0, space 0, times 0 [ 2329.615112] CPU: 1 PID: 8462 Comm: syz-executor.3 Not tainted 4.19.35 #3 [ 2329.621507] binder_alloc: 8456: binder_alloc_buf, no vma [ 2329.622002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2329.630404] binder: 8456:8464 transaction failed 29189/-3, size 0-0 line 2970 [ 2329.636851] Call Trace: [ 2329.636881] dump_stack+0x172/0x1f0 [ 2329.636904] should_fail.cold+0xa/0x1b [ 2329.636921] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2329.636936] ? security_compute_av+0x27b/0xb70 [ 2329.636962] __should_failslab+0x121/0x190 [ 2329.646694] binder: send failed reply for transaction 2879 to 8456:8464 [ 2329.646859] should_failslab+0x9/0x14 [ 2329.653643] binder: undelivered TRANSACTION_COMPLETE [ 2329.654385] kmem_cache_alloc+0x47/0x700 [ 2329.654409] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2329.654424] ? avc_compute_av+0x225/0x690 [ 2329.654444] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2329.659839] binder: undelivered TRANSACTION_ERROR: 29189 [ 2329.664158] avc_alloc_node+0x2a/0x630 [ 2329.664176] ? kasan_check_read+0x11/0x20 [ 2329.664204] avc_compute_av+0x22d/0x690 [ 2329.692078] binder: undelivered TRANSACTION_ERROR: 29190 [ 2329.693700] avc_has_perm_noaudit+0x324/0x570 [ 2329.693723] ? avc_has_extended_perms+0x10f0/0x10f0 [ 2329.693745] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 2329.740530] ? rcu_read_unlock_special+0x679/0xea0 [ 2329.745488] ? avc_has_extended_perms+0x8e7/0x10f0 [ 2329.750540] cred_has_capability+0x179/0x320 [ 2329.755028] ? selinux_ipv4_output+0x50/0x50 [ 2329.759483] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2329.765071] ? avc_has_extended_perms+0xa78/0x10f0 [ 2329.770026] selinux_capable+0x36/0x40 [ 2329.773939] security_capable+0x82/0xc0 [ 2329.777962] ns_capable_common+0x86/0x170 [ 2329.782148] capable+0x22/0x30 [ 2329.785433] tty_ioctl+0xdca/0x1530 [ 2329.789092] ? tty_vhangup+0x30/0x30 [ 2329.792843] ? mark_held_locks+0x100/0x100 [ 2329.797111] ? proc_fail_nth_write+0x9d/0x1e0 [ 2329.801649] ? proc_cwd_link+0x1d0/0x1d0 [ 2329.805768] ? __fget+0x340/0x540 [ 2329.809274] ? __might_sleep+0x95/0x190 [ 2329.813273] ? tty_vhangup+0x30/0x30 [ 2329.817011] do_vfs_ioctl+0xd6e/0x1390 [ 2329.820914] ? selinux_file_ioctl+0x46f/0x5e0 [ 2329.825424] ? selinux_file_ioctl+0x125/0x5e0 [ 2329.829937] ? ioctl_preallocate+0x210/0x210 [ 2329.834366] ? selinux_file_mprotect+0x620/0x620 [ 2329.839145] ? iterate_fd+0x360/0x360 [ 2329.842967] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2329.848527] ? fput+0x128/0x1a0 [ 2329.851835] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2329.857755] ? security_file_ioctl+0x93/0xc0 [ 2329.862189] ksys_ioctl+0xab/0xd0 [ 2329.865920] __x64_sys_ioctl+0x73/0xb0 [ 2329.869826] do_syscall_64+0x103/0x610 [ 2329.873746] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2329.879225] RIP: 0033:0x458c29 [ 2329.882427] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2329.901540] RSP: 002b:00007f46f546fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2329.909280] RAX: ffffffffffffffda RBX: 00007f46f546fc90 RCX: 0000000000458c29 [ 2329.916828] RDX: 0000000020000040 RSI: 0000000000005412 RDI: 0000000000000004 [ 2329.924124] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 2329.931607] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f46f54706d4 [ 2329.938899] R13: 00000000004c2ddb R14: 00000000004d5ff0 R15: 0000000000000005 [ 2329.962238] binder: 8456:8464 ERROR: BC_REGISTER_LOOPER called without request [ 2329.971238] binder: 8456:8471 got reply transaction with no transaction stack [ 2329.982263] binder: 8456:8471 transaction failed 29201/-71, size 0-0 line 2762 01:00:13 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x100000000000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2330.023482] binder: release 8456:8472 transaction 2882 out, still active [ 2330.053768] binder: undelivered TRANSACTION_COMPLETE 01:00:13 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2330.075388] binder: release 8456:8464 transaction 2882 in, still active [ 2330.092861] binder: send failed reply for transaction 2882, target dead 01:00:13 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x1000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:13 executing program 3 (fault-call:5 fault-nth:2): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2}) [ 2330.121800] binder: undelivered TRANSACTION_ERROR: 29201 [ 2330.701217] binder: 8475:8480 ERROR: BC_REGISTER_LOOPER called without request [ 2330.783269] binder: 8475:8491 got reply transaction with no transaction stack [ 2330.787771] protocol 88fb is buggy, dev hsr_slave_0 [ 2330.795769] protocol 88fb is buggy, dev hsr_slave_1 01:00:14 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2}) [ 2330.858885] binder: 8475:8491 transaction failed 29201/-71, size 0-0 line 2762 01:00:14 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x300000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:14 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0xe00000000000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2330.935720] binder: release 8475:8480 transaction 2885 out, still active [ 2330.997754] binder: undelivered TRANSACTION_COMPLETE [ 2331.079374] binder: 8475:8480 ERROR: BC_REGISTER_LOOPER called without request [ 2331.087181] binder: 8475:8491 got reply transaction with no transaction stack [ 2331.134527] binder: 8475:8491 transaction failed 29201/-71, size 0-0 line 2762 [ 2331.157928] binder: release 8475:8493 transaction 2887 out, still active [ 2331.164852] binder: undelivered TRANSACTION_COMPLETE [ 2331.208202] binder: undelivered TRANSACTION_ERROR: 29201 [ 2331.335038] binder: release 8475:8480 transaction 2885 in, still active [ 2331.348131] binder: send failed reply for transaction 2885, target dead [ 2331.388183] binder: undelivered TRANSACTION_ERROR: 29201 [ 2331.422663] binder: send failed reply for transaction 2887, target dead 01:00:15 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:15 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:15 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x2, &(0x7f0000000040)={0x2}) 01:00:15 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x1000000000000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:15 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x800000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:16 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2332.646452] binder: 8510:8519 ERROR: BC_REGISTER_LOOPER called without request [ 2332.683316] binder_alloc: 8510: binder_alloc_buf, no vma 01:00:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x4b47, &(0x7f0000000040)={0x2}) [ 2332.713965] binder: 8510:8519 transaction failed 29189/-3, size 0-0 line 2970 01:00:16 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x900000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2332.758149] binder: send failed reply for transaction 2890 to 8510:8519 [ 2332.785066] binder: undelivered TRANSACTION_COMPLETE [ 2332.790663] binder: undelivered TRANSACTION_ERROR: 29189 01:00:16 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x3f00000000000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2332.878637] binder: undelivered TRANSACTION_ERROR: 29190 [ 2332.958031] binder: 8510:8519 ERROR: BC_REGISTER_LOOPER called without request [ 2332.991227] binder: 8510:8529 got reply transaction with no transaction stack [ 2333.068210] binder: release 8510:8527 transaction 2893 out, still active [ 2333.075283] binder: undelivered TRANSACTION_COMPLETE [ 2333.084135] binder: 8510:8529 transaction failed 29201/-71, size 0-0 line 2762 01:00:16 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2333.284555] binder: release 8510:8519 transaction 2893 in, still active [ 2333.291854] binder: send failed reply for transaction 2893, target dead [ 2333.337727] binder: undelivered TRANSACTION_ERROR: 29201 [ 2333.468083] kauditd_printk_skb: 121 callbacks suppressed [ 2333.468102] audit: type=1400 audit(1555635616.923:43025): avc: denied { map } for pid=8533 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:17 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2333.654685] audit: type=1400 audit(1555635616.923:43026): avc: denied { map } for pid=8533 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x4b49, &(0x7f0000000040)={0x2}) [ 2333.828260] audit: type=1400 audit(1555635616.983:43027): avc: denied { map } for pid=8532 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:17 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x4000000000000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2333.913881] audit: type=1400 audit(1555635616.983:43028): avc: denied { map } for pid=8533 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:17 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0xfeffffff00000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2334.089244] audit: type=1400 audit(1555635616.993:43029): avc: denied { map } for pid=8533 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2334.247714] audit: type=1400 audit(1555635617.003:43030): avc: denied { map } for pid=8532 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2334.286075] binder: 8553:8556 ERROR: BC_REGISTER_LOOPER called without request [ 2334.365295] binder: 8553:8559 got reply transaction with no transaction stack [ 2334.402366] binder: 8553:8559 transaction failed 29201/-71, size 0-0 line 2762 [ 2334.417246] audit: type=1400 audit(1555635617.053:43031): avc: denied { map } for pid=8532 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2334.466259] binder: release 8553:8556 transaction 2896 out, still active [ 2334.486734] binder: undelivered TRANSACTION_COMPLETE [ 2334.582790] audit: type=1400 audit(1555635617.063:43032): avc: denied { map } for pid=8532 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2334.628302] binder: BINDER_SET_CONTEXT_MGR already set 01:00:18 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2334.672632] binder: release 8553:8556 transaction 2896 in, still active [ 2334.691459] binder: 8553:8556 ioctl 40046207 0 returned -16 [ 2334.697550] binder: send failed reply for transaction 2896, target dead [ 2334.731250] binder: undelivered TRANSACTION_ERROR: 29201 [ 2334.754189] binder: 8553:8559 ERROR: BC_REGISTER_LOOPER called without request [ 2334.757816] binder: 8553:8567 transaction failed 29189/-22, size 0-0 line 2855 [ 2334.769805] audit: type=1400 audit(1555635617.383:43033): avc: denied { map } for pid=8551 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5409, &(0x7f0000000040)={0x2}) [ 2334.888198] audit: type=1400 audit(1555635617.423:43034): avc: denied { map } for pid=8551 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2334.912007] binder: undelivered TRANSACTION_ERROR: 29189 01:00:18 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0xffffffff00000000) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2334.947738] protocol 88fb is buggy, dev hsr_slave_0 [ 2334.952872] protocol 88fb is buggy, dev hsr_slave_1 01:00:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2335.107728] protocol 88fb is buggy, dev hsr_slave_0 [ 2335.112960] protocol 88fb is buggy, dev hsr_slave_1 01:00:18 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x540b, &(0x7f0000000040)={0x2}) [ 2335.713104] binder: 8583:8585 transaction failed 29189/-22, size 0-0 line 2855 [ 2335.771332] binder: undelivered TRANSACTION_ERROR: 29189 [ 2335.852589] binder: 8583:8592 transaction failed 29189/-22, size 0-0 line 2855 [ 2335.880719] binder: 8583:8586 got reply transaction with no transaction stack [ 2335.966489] binder: undelivered TRANSACTION_ERROR: 29189 [ 2335.975721] binder: 8583:8586 transaction failed 29201/-71, size 0-0 line 2762 [ 2336.011615] binder: undelivered TRANSACTION_ERROR: 29201 [ 2336.467740] protocol 88fb is buggy, dev hsr_slave_0 [ 2336.472921] protocol 88fb is buggy, dev hsr_slave_1 01:00:20 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:20 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) utimensat(r2, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000280)={{r4, r5/1000+30000}}, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r6 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r7 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f00000000c0)={0x7, 0x3, 0x2, {0x8, 0x10000, 0x0, 0x5}}) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x1, 0x1) write$P9_RWALK(r3, &(0x7f0000000380)={0x7e, 0x6f, 0x2, {0x9, [{0x4, 0x1, 0x3}, {0x9, 0x4, 0x6}, {0x80, 0x2, 0x3}, {0x10, 0x2, 0x2}, {0x80, 0x2, 0x7}, {0x0, 0x0, 0x7}, {0x40, 0x2, 0x3}, {0x84, 0x1, 0x3}, {0x0, 0x4, 0x4}]}}, 0x7e) r8 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r7, 0x0, r8, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r6, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) sched_setparam(r0, &(0x7f00000002c0)) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000340)={0x2, 0x34, 0x4, 0x1b, 0x0, 0x7, 0x6, 0x113, 0x1}) 01:00:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x540c, &(0x7f0000000040)={0x2}) 01:00:20 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:20 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2337.187723] protocol 88fb is buggy, dev hsr_slave_0 [ 2337.192931] protocol 88fb is buggy, dev hsr_slave_1 [ 2337.198178] protocol 88fb is buggy, dev hsr_slave_0 [ 2337.203359] protocol 88fb is buggy, dev hsr_slave_1 01:00:20 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x7fff) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="24de00000300000000000000000009000000000000060000000000000076000065743100000000"], 0x27) [ 2337.245098] binder: 8602:8607 ERROR: BC_REGISTER_LOOPER called without request 01:00:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x540d, &(0x7f0000000040)={0x2}) [ 2337.351534] binder: 8602:8612 got reply transaction with no transaction stack [ 2337.423512] binder: 8602:8612 transaction failed 29201/-71, size 0-0 line 2762 [ 2337.509269] binder: release 8602:8607 transaction 2902 out, still active [ 2337.516170] binder: undelivered TRANSACTION_COMPLETE [ 2337.607124] binder: 8602:8607 ERROR: BC_REGISTER_LOOPER called without request 01:00:21 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2337.648576] binder: 8602:8612 got reply transaction with no transaction stack [ 2337.676114] binder: 8602:8612 transaction failed 29201/-71, size 0-0 line 2762 [ 2337.680317] binder: release 8602:8620 transaction 2905 out, still active [ 2337.714597] binder: undelivered TRANSACTION_COMPLETE [ 2337.742217] binder: undelivered TRANSACTION_ERROR: 29201 01:00:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2337.825671] binder: release 8602:8607 transaction 2902 in, still active [ 2337.839355] binder: send failed reply for transaction 2902, target dead 01:00:21 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2337.900234] binder: undelivered TRANSACTION_ERROR: 29201 [ 2337.941032] binder: send failed reply for transaction 2905, target dead 01:00:21 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="27000000030000000000000026ec2a4dcc73bf59000000000600000000000000766d6e65743100"], 0x27) 01:00:21 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5413, &(0x7f0000000040)={0x2}) [ 2338.481449] kauditd_printk_skb: 121 callbacks suppressed [ 2338.481466] audit: type=1400 audit(1555635621.933:43156): avc: denied { map } for pid=8638 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2338.611126] binder: 8638:8642 ERROR: BC_REGISTER_LOOPER called without request [ 2338.621806] audit: type=1400 audit(1555635621.943:43157): avc: denied { map } for pid=8639 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2338.658919] binder: 8638:8645 got reply transaction with no transaction stack [ 2338.676292] binder: 8638:8645 transaction failed 29201/-71, size 0-0 line 2762 [ 2338.722121] binder: release 8638:8645 transaction 2908 out, still active [ 2338.732785] binder: undelivered TRANSACTION_COMPLETE [ 2338.755047] audit: type=1400 audit(1555635621.943:43158): avc: denied { map } for pid=8639 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2338.852339] binder: 8638:8642 ERROR: BC_REGISTER_LOOPER called without request [ 2338.869178] audit: type=1400 audit(1555635621.993:43159): avc: denied { map } for pid=8639 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2338.912498] binder: release 8638:8654 transaction 2910 out, still active [ 2338.923092] binder: undelivered TRANSACTION_COMPLETE [ 2338.931287] binder: 8638:8645 got reply transaction with no transaction stack [ 2338.972689] audit: type=1400 audit(1555635621.993:43160): avc: denied { set_context_mgr } for pid=8638 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2339.003961] binder: 8638:8645 transaction failed 29201/-71, size 0-0 line 2762 [ 2339.045621] audit: type=1400 audit(1555635622.023:43161): avc: denied { map } for pid=8639 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2339.052900] binder: undelivered TRANSACTION_ERROR: 29201 01:00:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5414, &(0x7f0000000040)={0x2}) [ 2339.098313] audit: type=1400 audit(1555635622.033:43162): avc: denied { call } for pid=8638 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2339.121173] protocol 88fb is buggy, dev hsr_slave_0 [ 2339.121233] protocol 88fb is buggy, dev hsr_slave_1 [ 2339.191208] audit: type=1400 audit(1555635622.063:43163): avc: denied { map } for pid=8639 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2339.197943] binder: release 8638:8642 transaction 2908 in, still active 01:00:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:22 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x1c9, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x16b) [ 2339.222086] audit: type=1400 audit(1555635622.063:43164): avc: denied { map } for pid=8639 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2339.267711] protocol 88fb is buggy, dev hsr_slave_0 [ 2339.272916] protocol 88fb is buggy, dev hsr_slave_1 [ 2339.293114] binder: send failed reply for transaction 2908, target dead [ 2339.321404] binder: undelivered TRANSACTION_ERROR: 29201 [ 2339.345466] binder: send failed reply for transaction 2910, target dead [ 2339.367692] audit: type=1400 audit(1555635622.163:43165): avc: denied { map } for pid=8648 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:22 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:23 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x300}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:23 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5415, &(0x7f0000000040)={0x2}) [ 2339.996656] binder: 8670:8674 ERROR: BC_REGISTER_LOOPER called without request [ 2340.072614] binder: 8670:8679 got reply transaction with no transaction stack [ 2340.117434] binder: 8670:8679 transaction failed 29201/-71, size 0-0 line 2762 [ 2340.171532] binder: release 8670:8674 transaction 2913 out, still active [ 2340.184631] binder: undelivered TRANSACTION_COMPLETE [ 2340.299834] binder: BINDER_SET_CONTEXT_MGR already set [ 2340.341148] binder: release 8670:8674 transaction 2913 in, still active [ 2340.354274] binder: send failed reply for transaction 2913, target dead [ 2340.390687] binder: 8670:8679 ERROR: BC_REGISTER_LOOPER called without request [ 2340.425154] binder: 8670:8685 got reply transaction with no transaction stack [ 2340.426934] binder: undelivered TRANSACTION_ERROR: 29201 [ 2340.594820] binder: 8670:8682 transaction failed 29189/-22, size 0-0 line 2855 [ 2340.630523] binder: 8670:8685 transaction failed 29201/-71, size 0-0 line 2762 [ 2340.640763] binder: 8670:8674 ioctl 40046207 0 returned -16 [ 2340.647918] binder: undelivered TRANSACTION_ERROR: 29189 [ 2340.675635] binder: undelivered TRANSACTION_ERROR: 29201 01:00:24 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:24 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) ioctl$sock_netrom_SIOCDELRT(r4, 0x890c, &(0x7f0000000080)={0x0, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bpq0='bpq0\x00', 0x7, 'syz0\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x9, 0x7, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast]}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:24 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5416, &(0x7f0000000040)={0x2}) 01:00:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xe4000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:24 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:24 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x900}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5418, &(0x7f0000000040)={0x2}) [ 2341.528459] binder: 8693:8700 ERROR: BC_REGISTER_LOOPER called without request [ 2341.563622] binder_alloc: 8693: binder_alloc_buf, no vma [ 2341.589235] binder: 8693:8700 transaction failed 29189/-3, size 0-0 line 2970 [ 2341.607134] binder: send failed reply for transaction 2918 to 8693:8700 [ 2341.642147] binder: undelivered TRANSACTION_COMPLETE [ 2341.647379] binder: undelivered TRANSACTION_ERROR: 29189 01:00:25 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) getsockname$tipc(r4, &(0x7f00000000c0)=@name, &(0x7f0000000140)=0x10) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="270000000300000000000000000000000600b9bb7ca3000000000000766d6e65743100"], 0x27) [ 2341.769774] binder: undelivered TRANSACTION_ERROR: 29190 01:00:25 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 2341.843645] binder: 8693:8700 ERROR: BC_REGISTER_LOOPER called without request [ 2341.925155] binder: release 8693:8712 transaction 2920 out, still active [ 2341.967709] binder: undelivered TRANSACTION_COMPLETE 01:00:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2342.047294] binder: release 8693:8700 transaction 2920 in, still active [ 2342.068058] binder: send failed reply for transaction 2920, target dead 01:00:25 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:26 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x541b, &(0x7f0000000040)={0x2}) [ 2342.707751] net_ratelimit: 6 callbacks suppressed [ 2342.707760] protocol 88fb is buggy, dev hsr_slave_0 [ 2342.717832] protocol 88fb is buggy, dev hsr_slave_1 01:00:26 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2342.879462] binder: 8731:8736 ERROR: BC_REGISTER_LOOPER called without request [ 2342.965032] binder_alloc: 8731: binder_alloc_buf, no vma 01:00:26 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x3000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2343.033073] binder: 8731:8736 transaction failed 29189/-3, size 0-0 line 2970 [ 2343.152438] binder: send failed reply for transaction 2923 to 8731:8736 01:00:26 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x1, 0x400) getsockopt$packet_int(r1, 0x107, 0x3, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001424, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2343.239683] binder: undelivered TRANSACTION_COMPLETE [ 2343.244848] binder: undelivered TRANSACTION_ERROR: 29189 [ 2343.413173] binder: 8731:8748 got reply transaction with no transaction stack [ 2343.445584] binder: undelivered TRANSACTION_ERROR: 29190 [ 2343.453707] binder: send failed reply for transaction 2925 to 8731:8749 [ 2343.466538] binder: 8731:8748 transaction failed 29201/-71, size 0-0 line 2762 [ 2343.477788] binder: undelivered TRANSACTION_COMPLETE [ 2343.487627] kauditd_printk_skb: 133 callbacks suppressed [ 2343.487642] audit: type=1400 audit(1555635626.933:43299): avc: denied { map } for pid=8741 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2343.498413] binder: undelivered TRANSACTION_ERROR: 29189 01:00:27 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x541d, &(0x7f0000000040)={0x2}) 01:00:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2343.626244] audit: type=1400 audit(1555635627.023:43300): avc: denied { map } for pid=8741 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2343.656724] binder: undelivered TRANSACTION_ERROR: 29201 01:00:27 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2343.777929] audit: type=1400 audit(1555635627.023:43301): avc: denied { map } for pid=8741 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2343.899659] audit: type=1400 audit(1555635627.073:43302): avc: denied { map } for pid=8756 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2344.051278] audit: type=1400 audit(1555635627.073:43303): avc: denied { map } for pid=8756 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2344.171937] audit: type=1400 audit(1555635627.073:43304): avc: denied { map } for pid=8756 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:27 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f0000000080)={0x80, 0x9}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2344.314761] audit: type=1400 audit(1555635627.173:43305): avc: denied { map } for pid=8756 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2344.380388] binder: 8762:8766 ERROR: BC_REGISTER_LOOPER called without request [ 2344.435447] binder_alloc: 8762: binder_alloc_buf, no vma [ 2344.465166] binder: 8762:8766 transaction failed 29189/-3, size 0-0 line 2970 [ 2344.471281] audit: type=1400 audit(1555635627.233:43306): avc: denied { map } for pid=8756 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2344.507814] binder: send failed reply for transaction 2928 to 8762:8766 01:00:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x541f, &(0x7f0000000040)={0x2}) [ 2344.534575] binder: undelivered TRANSACTION_COMPLETE [ 2344.540410] binder: undelivered TRANSACTION_ERROR: 29189 [ 2344.596343] audit: type=1400 audit(1555635627.263:43307): avc: denied { map } for pid=8756 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:28 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x8000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2344.698923] binder: 8762:8766 ERROR: BC_REGISTER_LOOPER called without request [ 2344.723907] binder: 8762:8778 got reply transaction with no transaction stack 01:00:28 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() socket$inet_udplite(0x2, 0x2, 0x88) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2344.749128] binder: 8762:8778 transaction failed 29201/-71, size 0-0 line 2762 [ 2344.749298] audit: type=1400 audit(1555635627.273:43308): avc: denied { map } for pid=8756 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2344.827824] binder: release 8762:8778 transaction 2931 out, still active [ 2344.834783] binder: undelivered TRANSACTION_COMPLETE 01:00:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2344.955661] binder: release 8762:8766 transaction 2931 in, still active [ 2344.968685] binder: send failed reply for transaction 2931, target dead 01:00:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5421, &(0x7f0000000040)={0x2}) 01:00:28 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x40140, 0x0) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f0000000080)={0x1, 0x3, [@random="8bf432d95e29", @random="11fa8654e699", @local]}) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) fstat(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000140)={r0, r6, r7}, 0xc) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000240)=ANY=[@ANYBLOB="2700000003000000000000000000000000000000000000000600000000000000766d6e65743100512da138d6ec39dfd85c1849c48359d66eed9ee33d0f4469a84bb04c19ff354d5100f54de74b1754069aca77f07cf41d370d0cc94c000ba88b579e9d9add0a47c691819529cb5abb5f6cd99c955dbde4cccb4b3905b13a873deba2c5f35c20ccb23a9d9cd57567250f2b97530f806e99d84eb1f209be88dc1d4aa9a0dbee22008c4874bcbe"], 0x27) [ 2345.347785] protocol 88fb is buggy, dev hsr_slave_0 [ 2345.352905] protocol 88fb is buggy, dev hsr_slave_1 [ 2345.507749] protocol 88fb is buggy, dev hsr_slave_0 [ 2345.512934] protocol 88fb is buggy, dev hsr_slave_1 [ 2345.518165] protocol 88fb is buggy, dev hsr_slave_0 [ 2345.523260] protocol 88fb is buggy, dev hsr_slave_1 01:00:29 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() socket$inet_udplite(0x2, 0x2, 0x88) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2345.684429] binder: 8794:8795 ERROR: BC_REGISTER_LOOPER called without request [ 2345.771997] binder: 8794:8798 got reply transaction with no transaction stack [ 2345.804107] binder: 8794:8798 transaction failed 29201/-71, size 0-0 line 2762 [ 2345.843902] binder: release 8794:8795 transaction 2934 out, still active [ 2345.857222] binder: undelivered TRANSACTION_COMPLETE [ 2345.936908] binder: release 8794:8795 transaction 2934 in, still active [ 2345.953934] binder: send failed reply for transaction 2934, target dead [ 2345.991003] binder_release_work: 2 callbacks suppressed [ 2345.991010] binder: undelivered TRANSACTION_ERROR: 29201 [ 2346.002014] binder: 8794:8798 got reply transaction with no transaction stack [ 2346.002034] binder: 8794:8798 transaction failed 29201/-71, size 0-0 line 2762 [ 2346.075785] binder: release 8794:8806 transaction 2937 out, still active [ 2346.114091] binder: undelivered TRANSACTION_COMPLETE [ 2346.125207] binder: undelivered TRANSACTION_ERROR: 29201 [ 2346.160877] binder: send failed reply for transaction 2937, target dead 01:00:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:30 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:30 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() socket$inet_udplite(0x2, 0x2, 0x88) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:30 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:30 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x100000040001420, 0x3) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="27000000e30000000000000000000000000800000000ff000600000000000000766d6e65d869d3e1b2dbbcdaf8794af02ec62482f9ccd6c1e10e0b59e641681ea05d5ae95250f5e2a286c2e9663d449b4f062b4fb6fd95fa950d6696f6fc37e44d617df553b99661412703704d2dc876e2ca9b59bac7507dac2a71f0ab8f77ec7e48a61fad1bb5b9bbb68257f11b82c0f04b3076c83115eb6d6a14b7eb298aef02ef50fafc2b88e8b525026556035acc97ddc02b8df2fc07c05761d85d46b9beef2dfb51a10291d75671c87490d8c7291013bd5520abaf866e4f4904f6e77dfe961386"], 0x27) 01:00:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5423, &(0x7f0000000040)={0x2}) [ 2347.427721] protocol 88fb is buggy, dev hsr_slave_0 [ 2347.432901] protocol 88fb is buggy, dev hsr_slave_1 [ 2347.473456] binder: 8819:8824 ERROR: BC_REGISTER_LOOPER called without request [ 2347.486726] binder_alloc: 8819: binder_alloc_buf, no vma [ 2347.492841] binder: 8819:8824 transaction failed 29189/-3, size 0-0 line 2970 [ 2347.510745] binder: send failed reply for transaction 2940 to 8819:8824 [ 2347.529927] binder: undelivered TRANSACTION_COMPLETE [ 2347.535280] binder: undelivered TRANSACTION_ERROR: 29189 01:00:31 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5424, &(0x7f0000000040)={0x2}) 01:00:31 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000080)={r2, r2, 0x4}) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="270000000300ceac20bfd7f6a65ef318121d102a000000000000000000000000000000000000060020000000fff7766c6e65744c00046989d8f2579e0983ad7c772012c9bafbf4fdadd371b13c80f5e7f7022064a272d6bdb823badbc3aa6197bdfc9389de717710db449ea4a2be496d9e67e6ff9ba74cc2ae9e6ce23517bca97ac7cad6126dcf2ec3b1ffeba9e0b684454f6fc9ec8f5ae86db581703c"], 0x27) [ 2347.662273] binder: release 8819:8832 transaction 2942 out, still active [ 2347.675807] binder: undelivered TRANSACTION_COMPLETE 01:00:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2347.744520] binder: undelivered TRANSACTION_ERROR: 29190 [ 2347.750178] binder: send failed reply for transaction 2942, target dead 01:00:31 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xfeffffff}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:31 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:31 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5425, &(0x7f0000000040)={0x2}) [ 2348.501080] kauditd_printk_skb: 130 callbacks suppressed [ 2348.501093] audit: type=1400 audit(1555635631.943:43439): avc: denied { call } for pid=8846 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2348.506102] binder: 8846:8852 ERROR: BC_REGISTER_LOOPER called without request [ 2348.556202] audit: type=1400 audit(1555635632.003:43440): avc: denied { map } for pid=8848 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2348.641548] binder: 8846:8855 got reply transaction with no transaction stack [ 2348.677719] audit: type=1400 audit(1555635632.053:43441): avc: denied { map } for pid=8848 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2348.712716] binder: 8846:8855 transaction failed 29201/-71, size 0-0 line 2762 [ 2348.762897] binder: release 8846:8852 transaction 2944 out, still active [ 2348.782043] binder: undelivered TRANSACTION_COMPLETE [ 2348.818504] audit: type=1400 audit(1555635632.203:43442): avc: denied { map } for pid=8856 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2348.906120] binder: 8846:8852 ERROR: BC_REGISTER_LOOPER called without request [ 2348.926306] audit: type=1400 audit(1555635632.223:43443): avc: denied { map } for pid=8856 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2348.946459] binder: 8846:8855 got reply transaction with no transaction stack [ 2348.948714] net_ratelimit: 4 callbacks suppressed [ 2348.948720] protocol 88fb is buggy, dev hsr_slave_0 [ 2348.948772] protocol 88fb is buggy, dev hsr_slave_1 [ 2349.024649] audit: type=1400 audit(1555635632.243:43444): avc: denied { map } for pid=8856 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2349.039656] binder: 8846:8855 transaction failed 29201/-71, size 0-0 line 2762 [ 2349.056110] binder: release 8846:8861 transaction 2946 out, still active [ 2349.070387] binder: undelivered TRANSACTION_COMPLETE [ 2349.125466] audit: type=1400 audit(1555635632.243:43445): avc: denied { map } for pid=8856 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2349.132439] binder: undelivered TRANSACTION_ERROR: 29201 [ 2349.198538] audit: type=1400 audit(1555635632.293:43446): avc: denied { map } for pid=8856 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2349.203488] binder: release 8846:8852 transaction 2944 in, still active [ 2349.274613] binder: send failed reply for transaction 2944, target dead [ 2349.293888] binder: undelivered TRANSACTION_ERROR: 29201 [ 2349.301263] audit: type=1400 audit(1555635632.333:43447): avc: denied { map } for pid=8856 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2349.333447] binder: send failed reply for transaction 2946, target dead [ 2349.387678] audit: type=1400 audit(1555635632.343:43448): avc: denied { map } for pid=8856 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2349.507777] protocol 88fb is buggy, dev hsr_slave_0 [ 2349.512984] protocol 88fb is buggy, dev hsr_slave_1 [ 2349.667723] protocol 88fb is buggy, dev hsr_slave_0 [ 2349.672897] protocol 88fb is buggy, dev hsr_slave_1 [ 2349.678146] protocol 88fb is buggy, dev hsr_slave_0 [ 2349.683312] protocol 88fb is buggy, dev hsr_slave_1 01:00:33 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:33 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:33 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xfffffffe}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:33 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5427, &(0x7f0000000040)={0x2}) 01:00:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:33 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r3, 0x0, 0x40, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000140)=0x54) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2350.756854] binder: 8876:8883 ERROR: BC_REGISTER_LOOPER called without request [ 2350.814901] binder: 8876:8890 got reply transaction with no transaction stack 01:00:34 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(0x0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:34 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5428, &(0x7f0000000040)={0x2}) 01:00:34 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x10, &(0x7f0000000080)={0x8000000000}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2350.856713] binder: 8876:8890 transaction failed 29201/-71, size 0-0 line 2762 [ 2350.885393] binder: release 8876:8883 transaction 2949 out, still active [ 2350.901017] binder: undelivered TRANSACTION_COMPLETE [ 2350.980308] binder: 8876:8890 got reply transaction with no transaction stack [ 2351.027759] protocol 88fb is buggy, dev hsr_slave_0 [ 2351.033038] protocol 88fb is buggy, dev hsr_slave_1 [ 2351.049309] binder: 8876:8883 ERROR: BC_REGISTER_LOOPER called without request [ 2351.085026] binder: 8876:8890 transaction failed 29201/-71, size 0-0 line 2762 [ 2351.124395] binder: release 8876:8892 transaction 2951 out, still active [ 2351.136294] binder: undelivered TRANSACTION_COMPLETE 01:00:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2351.161773] binder: undelivered TRANSACTION_ERROR: 29201 [ 2351.198595] binder: release 8876:8883 transaction 2949 in, still active [ 2351.238043] binder: send failed reply for transaction 2949, target dead [ 2351.265185] binder: undelivered TRANSACTION_ERROR: 29201 [ 2351.287143] binder: send failed reply for transaction 2951, target dead 01:00:35 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x1000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:35 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5437, &(0x7f0000000040)={0x2}) 01:00:35 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(0x0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2351.766004] binder: 8912:8913 ERROR: BC_REGISTER_LOOPER called without request [ 2351.825164] binder_alloc: 8912: binder_alloc_buf, no vma [ 2351.838990] binder: 8912:8913 transaction failed 29189/-3, size 0-0 line 2970 [ 2351.846359] binder: send failed reply for transaction 2954 to 8912:8913 [ 2351.929919] binder: undelivered TRANSACTION_COMPLETE [ 2351.935576] binder: undelivered TRANSACTION_ERROR: 29189 [ 2352.058681] binder: BINDER_SET_CONTEXT_MGR already set [ 2352.064026] binder: 8912:8913 ioctl 40046207 0 returned -16 [ 2352.131767] binder: undelivered TRANSACTION_ERROR: 29190 [ 2352.141001] binder: 8912:8917 transaction failed 29189/-22, size 0-0 line 2855 [ 2352.194348] binder: 8912:8915 ERROR: BC_REGISTER_LOOPER called without request [ 2352.218515] binder: 8912:8919 got reply transaction with no transaction stack [ 2352.260540] binder: 8912:8919 transaction failed 29201/-71, size 0-0 line 2762 [ 2352.306238] binder: undelivered TRANSACTION_ERROR: 29189 [ 2352.407306] binder: undelivered TRANSACTION_ERROR: 29201 01:00:37 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:37 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000080)) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:37 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(0x0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:37 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x300000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5441, &(0x7f0000000040)={0x2}) 01:00:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2354.268037] kauditd_printk_skb: 123 callbacks suppressed [ 2354.268052] audit: type=1400 audit(1555635637.713:43572): avc: denied { map } for pid=8941 comm="syz-executor.2" path="/dev/binder0" dev="devtmpfs" ino=15674 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 2354.332591] binder: 8941:8946 ERROR: BC_REGISTER_LOOPER called without request 01:00:37 executing program 4: r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5450, &(0x7f0000000040)={0x2}) [ 2354.371543] audit: type=1400 audit(1555635637.723:43573): avc: denied { set_context_mgr } for pid=8941 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2354.407880] binder: 8941:8953 got reply transaction with no transaction stack [ 2354.421756] binder: 8941:8953 transaction failed 29201/-71, size 0-0 line 2762 [ 2354.456373] audit: type=1400 audit(1555635637.773:43574): avc: denied { call } for pid=8941 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2354.496965] binder: release 8941:8946 transaction 2959 out, still active [ 2354.510464] binder: undelivered TRANSACTION_COMPLETE 01:00:38 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) setxattr$trusted_overlay_nlink(&(0x7f0000000040)='./bus\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L-', 0x8001}, 0x28, 0x2d95ecfe751a760d) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) close(r3) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="2700000003000000000000000000000000000000000000000600000000000000766d6e6574310017e9e3e550012f24f53735139802a84a2182de5e5b73f7"], 0x27) [ 2354.582273] audit: type=1400 audit(1555635637.803:43575): avc: denied { map } for pid=8949 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2354.630401] binder: 8941:8946 ERROR: BC_REGISTER_LOOPER called without request [ 2354.663215] binder: 8941:8953 got reply transaction with no transaction stack [ 2354.674701] audit: type=1400 audit(1555635637.803:43576): avc: denied { map } for pid=8949 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2354.704267] binder: release 8941:8957 transaction 2961 out, still active [ 2354.720674] binder: 8941:8953 transaction failed 29201/-71, size 0-0 line 2762 [ 2354.732350] binder: undelivered TRANSACTION_COMPLETE [ 2354.735906] audit: type=1400 audit(1555635637.863:43577): avc: denied { map } for pid=8949 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2354.806580] binder: undelivered TRANSACTION_ERROR: 29201 01:00:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2354.864485] audit: type=1400 audit(1555635637.893:43578): avc: denied { map } for pid=8949 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2354.895258] binder: release 8941:8946 transaction 2959 in, still active [ 2354.914596] binder: send failed reply for transaction 2959, target dead [ 2354.952519] binder: undelivered TRANSACTION_ERROR: 29201 [ 2354.980766] binder: send failed reply for transaction 2961, target dead [ 2355.022428] audit: type=1400 audit(1555635637.923:43579): avc: denied { map } for pid=8949 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:38 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x800000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5451, &(0x7f0000000040)={0x2}) [ 2355.150207] audit: type=1400 audit(1555635637.943:43580): avc: denied { map } for pid=8949 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2355.293455] audit: type=1400 audit(1555635637.943:43581): avc: denied { map } for pid=8949 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2355.683335] binder: 8971:8974 ERROR: BC_REGISTER_LOOPER called without request [ 2355.710737] binder_alloc: 8971: binder_alloc_buf, no vma [ 2355.716473] binder: 8971:8974 transaction failed 29189/-3, size 0-0 line 2970 [ 2355.730835] binder: send failed reply for transaction 2964 to 8971:8974 [ 2355.747107] binder: undelivered TRANSACTION_COMPLETE [ 2355.752426] net_ratelimit: 2 callbacks suppressed [ 2355.752434] protocol 88fb is buggy, dev hsr_slave_0 [ 2355.752494] protocol 88fb is buggy, dev hsr_slave_1 [ 2355.821431] binder: undelivered TRANSACTION_ERROR: 29189 [ 2355.865201] binder: BINDER_SET_CONTEXT_MGR already set [ 2355.907726] protocol 88fb is buggy, dev hsr_slave_0 [ 2355.909503] binder: undelivered TRANSACTION_ERROR: 29190 [ 2355.912938] protocol 88fb is buggy, dev hsr_slave_1 [ 2355.918636] binder: 8971:8974 ioctl 40046207 0 returned -16 [ 2355.923544] protocol 88fb is buggy, dev hsr_slave_0 [ 2355.934342] protocol 88fb is buggy, dev hsr_slave_1 [ 2355.939772] binder: send failed reply for transaction 2966 to 8971:8982 [ 2355.947140] binder: 8971:8982 ERROR: BC_REGISTER_LOOPER called without request [ 2356.002100] binder: undelivered TRANSACTION_COMPLETE [ 2356.005549] binder: 8971:8984 got reply transaction with no transaction stack [ 2356.069863] binder: 8971:8984 transaction failed 29201/-71, size 0-0 line 2762 01:00:40 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 01:00:40 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5452, &(0x7f0000000040)={0x2}) 01:00:40 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000340)='./bus/file0\x00', 0x2, 0x15, &(0x7f0000000240), 0x4, &(0x7f0000000380)={[], [{@dont_appraise='dont_appraise'}, {@context={'context', 0x3d, 'root'}}]}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./bus\x00', 0x0, 0x8}, 0x10) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="2700000003000000000000000700000000000000000000000600000000000000766d6e65743100"], 0x27) 01:00:40 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:40 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x900000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2357.654554] binder: 8990:8996 ERROR: BC_REGISTER_LOOPER called without request 01:00:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x545d, &(0x7f0000000040)={0x2}) [ 2357.700415] binder_alloc: 8990: binder_alloc_buf, no vma [ 2357.744107] binder: 8990:8996 transaction failed 29189/-3, size 0-0 line 2970 [ 2357.774940] binder: send failed reply for transaction 2969 to 8990:8996 [ 2357.808194] binder: undelivered TRANSACTION_COMPLETE [ 2357.813519] binder_release_work: 2 callbacks suppressed [ 2357.813526] binder: undelivered TRANSACTION_ERROR: 29189 [ 2357.827749] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.832999] protocol 88fb is buggy, dev hsr_slave_1 01:00:41 executing program 4: r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:41 executing program 1: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f00000000c0)={0x0, 0x0}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) shutdown(r1, 0x1) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007f9, &(0x7f0000000080)={0x2, 0x200000004e23, @loopback}, 0x10) sendto(r1, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0) timer_create(0x6, &(0x7f00000001c0)={0x0, 0x25, 0x4, @tid=r0}, &(0x7f0000044000)) r2 = gettid() r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = syz_open_dev$sndpcmp(&(0x7f0000000340)='/dev/snd/pcmC#D#p\x00', 0x4, 0x80100) write$UHID_CREATE2(r4, &(0x7f0000000380)={0xb, 'syz0\x00', 'syz0\x00', 'syz1\x00', 0xd5, 0x3f, 0x6, 0x4, 0x4, 0x9, "12725dd4317a1186cb9d0dc3cfe9756702853c96a4d1e692932abf39c8702b0e7d51d8f0d94b95f3b5796987c175076f4fedac50d688787f6abb990828d670ddd370abea6a78a0045dc613c23b0da198dae4c2c84c64e3df7c919ad573367259b50456c0ed833de23150023aaa2e4b724d062e3a736bd8d3a9bf5c55ef623cf531cab24334ead2916cd1dcc481bc25056ff907b1261e7d998fbb536a65a46cdbf6e531f358feb339d92e414a36706728f921fa9cc391f621142bdb1ebf2fdfbad9e8788edab8a201dfe4d3ff6309aa67d07d7a6d18"}, 0x1ed) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1a, &(0x7f0000000240)=""/143, &(0x7f0000000140)=0x8f) r5 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000580)=r2) r6 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r6, 0x0, r6, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r2, 0x13) gettid() fdatasync(r4) socket$vsock_stream(0x28, 0x1, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r5, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2357.950410] binder: release 8990:9007 transaction 2971 out, still active [ 2357.957300] binder: undelivered TRANSACTION_COMPLETE [ 2357.987720] protocol 88fb is buggy, dev hsr_slave_0 [ 2357.992881] protocol 88fb is buggy, dev hsr_slave_1 01:00:41 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2358.074279] binder: undelivered TRANSACTION_ERROR: 29190 [ 2358.080279] binder: send failed reply for transaction 2971, target dead 01:00:41 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5460, &(0x7f0000000040)={0x2}) 01:00:41 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) ioctl$TCGETA(r2, 0x5405, &(0x7f00000000c0)) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000140)="50975a005e2ad2c49f261e831ada688c", 0x10) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x14) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:42 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0xfeffffff00000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2358.793922] binder: 9021:9023 ERROR: BC_REGISTER_LOOPER called without request [ 2358.859424] binder_alloc: 9021: binder_alloc_buf, no vma [ 2358.864964] binder: 9021:9023 transaction failed 29189/-3, size 0-0 line 2970 [ 2358.927841] binder: send failed reply for transaction 2973 to 9021:9023 [ 2358.959482] binder: undelivered TRANSACTION_COMPLETE [ 2358.964868] binder: undelivered TRANSACTION_ERROR: 29189 [ 2359.036024] binder: undelivered TRANSACTION_ERROR: 29190 [ 2359.079190] binder: 9021:9023 ERROR: BC_REGISTER_LOOPER called without request [ 2359.117190] binder: 9021:9028 got reply transaction with no transaction stack [ 2359.144959] binder: release 9021:9028 transaction 2976 out, still active [ 2359.160526] binder: undelivered TRANSACTION_COMPLETE [ 2359.168974] binder: 9021:9028 transaction failed 29201/-71, size 0-0 line 2762 [ 2359.241762] binder: release 9021:9023 transaction 2976 in, still active [ 2359.266199] binder: send failed reply for transaction 2976, target dead [ 2359.295671] binder: undelivered TRANSACTION_ERROR: 29201 [ 2359.712281] kauditd_printk_skb: 130 callbacks suppressed [ 2359.712304] audit: type=1400 audit(1555635643.163:43712): avc: denied { map } for pid=9038 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2359.804337] audit: type=1400 audit(1555635643.163:43713): avc: denied { map } for pid=9038 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2359.900122] audit: type=1400 audit(1555635643.183:43714): avc: denied { map } for pid=9038 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.005528] audit: type=1400 audit(1555635643.193:43715): avc: denied { map } for pid=9038 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.100031] audit: type=1400 audit(1555635643.213:43716): avc: denied { map } for pid=9039 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.229285] audit: type=1400 audit(1555635643.223:43717): avc: denied { map } for pid=9039 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.318586] audit: type=1400 audit(1555635643.223:43718): avc: denied { map } for pid=9038 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.374518] audit: type=1400 audit(1555635643.233:43719): avc: denied { map } for pid=9039 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.433005] audit: type=1400 audit(1555635643.243:43720): avc: denied { map } for pid=9039 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2360.464902] audit: type=1400 audit(1555635643.253:43721): avc: denied { map } for pid=9038 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:44 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 01:00:44 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x40049409, &(0x7f0000000040)={0x2}) 01:00:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:44 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000080)="a24548dbfb688a80eb1fefcb265bb2a464a554f24e5e89089f3936cc1c3adbe46aed7d48d0b9f1df", &(0x7f0000000340)="7318f9a0f56e51898d8e285a973bb48203b0eb05758df85509132fdd89bcca9d9c35693569900ea2239b5d4439debbde8f07150ba1b6c94e75b7c7ac6bb58ba26d58eb6bea4e94c4a8acb462e091b4f3b21df76911236539bc86f869d9f3f1a8707176c87c4c33915684fa1646bf6faf894ee334a1d5e287c589b80a673e697fa4184887e625f15559256f1d0336e534dd00f685cffb9e9dc0c3af0bbffb56985d88b7b67d057a86e170cd20adb4540d8ec52fdf67053b0041d26f0ab4ccd00407f276db693ac849ee4acf0ec8362fbdc25cb3f65ef2d9b39d648771c115e74ebc640efba27978cec0"}}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2360.924477] binder: 9046:9049 ERROR: BC_REGISTER_LOOPER called without request [ 2360.966486] binder_alloc: 9046: binder_alloc_buf, no vma [ 2360.988474] binder: 9046:9049 transaction failed 29189/-3, size 0-0 line 2970 01:00:44 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x40086602, &(0x7f0000000040)={0x2}) [ 2361.015782] binder: send failed reply for transaction 2979 to 9046:9049 [ 2361.046882] binder: undelivered TRANSACTION_COMPLETE [ 2361.052352] binder: undelivered TRANSACTION_ERROR: 29189 [ 2361.172233] binder: BINDER_SET_CONTEXT_MGR already set [ 2361.199379] binder: undelivered TRANSACTION_ERROR: 29190 [ 2361.214709] binder_alloc: 9046: binder_alloc_buf, no vma [ 2361.243447] binder: 9046:9057 ERROR: BC_REGISTER_LOOPER called without request [ 2361.262312] binder: 9046:9049 ioctl 40046207 0 returned -16 [ 2361.310457] binder: 9046:9060 transaction failed 29189/-3, size 0-0 line 2970 [ 2361.364307] binder: undelivered TRANSACTION_ERROR: 29189 [ 2361.427746] net_ratelimit: 6 callbacks suppressed [ 2361.427755] protocol 88fb is buggy, dev hsr_slave_0 [ 2361.437872] protocol 88fb is buggy, dev hsr_slave_1 01:00:44 executing program 4: r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:44 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0200ff810040010000000058000b4824ca945f64009400050028845a01000000000000008000f0fffeffe809000000fff5dd00000010000100070c1000000000000004fcff", 0x58}], 0x1) r2 = gettid() r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) timer_getoverrun(r0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r5 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r5, 0x0, r6, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r2, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r4, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:45 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 01:00:45 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:45 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x40087602, &(0x7f0000000040)={0x2}) 01:00:45 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:45 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000080)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:45 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) [ 2362.421057] binder: 9078:9081 ERROR: BC_REGISTER_LOOPER called without request [ 2362.556603] binder: 9078:9092 got reply transaction with no transaction stack [ 2362.587895] binder: 9078:9092 transaction failed 29201/-71, size 0-0 line 2762 [ 2362.627261] binder: release 9078:9081 transaction 2983 out, still active [ 2362.641813] binder: undelivered TRANSACTION_COMPLETE 01:00:46 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x4020940d, &(0x7f0000000040)={0x2}) [ 2362.747039] binder: BINDER_SET_CONTEXT_MGR already set [ 2362.810084] binder: release 9078:9081 transaction 2983 in, still active [ 2362.811039] binder: 9078:9099 transaction failed 29189/-22, size 0-0 line 2855 [ 2362.817209] binder: send failed reply for transaction 2983, target dead [ 2362.838253] binder: 9078:9081 ioctl 40046207 0 returned -16 [ 2362.889362] binder: 9078:9092 ERROR: BC_REGISTER_LOOPER called without request [ 2362.906789] binder: undelivered TRANSACTION_ERROR: 29201 [ 2362.960944] binder: 9078:9102 got reply transaction with no transaction stack 01:00:46 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0xc200, 0x0) ioctl$LOOP_SET_FD(r5, 0x4c00, r2) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="27000000030000000000000000000000004a8bb533c95bcdce70c0785dd2fd00000000000000060000000000"], 0x27) [ 2363.002592] binder: undelivered TRANSACTION_ERROR: 29189 [ 2363.044582] binder: 9078:9102 transaction failed 29201/-71, size 0-0 line 2762 01:00:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4603000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2363.126276] binder: undelivered TRANSACTION_ERROR: 29201 01:00:46 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x9}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2363.798584] binder: 9111:9114 ERROR: BC_REGISTER_LOOPER called without request [ 2363.840712] binder_alloc: 9111: binder_alloc_buf, no vma [ 2363.846397] binder: 9111:9114 transaction failed 29189/-3, size 0-0 line 2970 [ 2363.887762] binder: send failed reply for transaction 2988 to 9111:9114 [ 2363.928023] binder: undelivered TRANSACTION_COMPLETE [ 2363.933231] binder: undelivered TRANSACTION_ERROR: 29189 [ 2364.018248] binder: undelivered TRANSACTION_ERROR: 29190 [ 2364.044612] binder: 9111:9114 ERROR: BC_REGISTER_LOOPER called without request [ 2364.067712] protocol 88fb is buggy, dev hsr_slave_0 [ 2364.072899] binder: 9111:9119 got reply transaction with no transaction stack [ 2364.072905] protocol 88fb is buggy, dev hsr_slave_1 [ 2364.097233] binder: release 9111:9119 transaction 2991 out, still active [ 2364.109134] binder: undelivered TRANSACTION_COMPLETE [ 2364.117964] binder: 9111:9119 transaction failed 29201/-71, size 0-0 line 2762 [ 2364.195626] binder: release 9111:9114 transaction 2991 in, still active [ 2364.203917] binder: send failed reply for transaction 2991, target dead [ 2364.221394] binder: undelivered TRANSACTION_ERROR: 29201 [ 2364.237729] protocol 88fb is buggy, dev hsr_slave_0 [ 2364.243467] protocol 88fb is buggy, dev hsr_slave_1 [ 2364.249206] protocol 88fb is buggy, dev hsr_slave_0 [ 2364.254974] protocol 88fb is buggy, dev hsr_slave_1 [ 2364.940877] kauditd_printk_skb: 148 callbacks suppressed [ 2364.940891] audit: type=1400 audit(1555635648.393:43870): avc: denied { map } for pid=9124 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2364.970677] audit: type=1400 audit(1555635648.403:43871): avc: denied { map } for pid=9124 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2364.994621] audit: type=1400 audit(1555635648.413:43872): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2365.020807] audit: type=1400 audit(1555635648.413:43873): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2365.052960] audit: type=1400 audit(1555635648.433:43874): avc: denied { map } for pid=9124 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:48 executing program 4: timer_create(0x0, 0x0, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:48 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x300}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:00:48 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x80045432, &(0x7f0000000040)={0x2}) 01:00:48 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, &(0x7f0000000080)={0x3, 0x5, 0x1}) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) modify_ldt$read(0x0, &(0x7f0000000340)=""/74, 0x4a) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000240)=ANY=[@ANYBLOB="2700000003000000000000000000000000000000000000766d6e6574578b471328aa476f000000000000dea69378e185e2a42bc7255adb171963aee6f62fdd9a2345f7b220882b4a5f410b26000000000000000000"], 0x27) 01:00:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4703000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2365.088473] audit: type=1400 audit(1555635648.443:43875): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2365.200349] audit: type=1400 audit(1555635648.443:43876): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2365.307990] audit: type=1400 audit(1555635648.453:43877): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2365.370372] audit: type=1400 audit(1555635648.463:43878): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2365.394567] binder: 9127:9135 ERROR: BC_REGISTER_LOOPER called without request [ 2365.415376] binder_alloc: 9127: binder_alloc_buf, no vma [ 2365.426468] binder: 9127:9135 transaction failed 29189/-3, size 0-0 line 2970 [ 2365.441279] audit: type=1400 audit(1555635648.473:43879): avc: denied { map } for pid=9124 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:48 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x80045440, &(0x7f0000000040)={0x2}) [ 2365.473556] binder: send failed reply for transaction 2994 to 9127:9135 [ 2365.491782] binder: undelivered TRANSACTION_COMPLETE [ 2365.514594] binder: undelivered TRANSACTION_ERROR: 29189 01:00:49 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 01:00:49 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2365.569791] binder: release 9127:9143 transaction 2996 out, still active [ 2365.587707] protocol 88fb is buggy, dev hsr_slave_0 [ 2365.592869] protocol 88fb is buggy, dev hsr_slave_1 [ 2365.607440] binder: undelivered TRANSACTION_COMPLETE 01:00:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2365.691011] binder: undelivered TRANSACTION_ERROR: 29190 [ 2365.696719] binder: send failed reply for transaction 2996, target dead 01:00:49 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x80086601, &(0x7f0000000040)={0x2}) 01:00:49 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x900}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2366.589680] binder: 9159:9160 ERROR: BC_REGISTER_LOOPER called without request [ 2366.660306] binder: 9159:9162 got reply transaction with no transaction stack [ 2366.695038] binder: 9159:9162 transaction failed 29201/-71, size 0-0 line 2762 [ 2366.733913] binder: release 9159:9160 transaction 2998 out, still active [ 2366.746108] binder: undelivered TRANSACTION_COMPLETE [ 2366.810715] binder: release 9159:9160 transaction 2998 in, still active [ 2366.820741] binder: send failed reply for transaction 2998, target dead [ 2366.861383] binder: 9159:9160 ERROR: BC_REGISTER_LOOPER called without request [ 2366.869184] binder: undelivered TRANSACTION_ERROR: 29201 [ 2366.900367] binder: 9159:9162 got reply transaction with no transaction stack 01:00:50 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x40000800000fffd, &(0x7f00000001c0)="0ab563a32ca83f4bf7f770") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2366.936761] binder: release 9159:9162 transaction 3001 out, still active [ 2366.949706] binder: undelivered TRANSACTION_COMPLETE [ 2366.955100] binder: 9159:9162 transaction failed 29201/-71, size 0-0 line 2762 [ 2367.029006] binder: release 9159:9160 transaction 3001 in, still active [ 2367.044005] binder: send failed reply for transaction 3001, target dead [ 2367.099270] binder: undelivered TRANSACTION_ERROR: 29201 [ 2367.667781] net_ratelimit: 2 callbacks suppressed [ 2367.667790] protocol 88fb is buggy, dev hsr_slave_0 [ 2367.677921] protocol 88fb is buggy, dev hsr_slave_1 01:00:51 executing program 4: timer_create(0x0, 0x0, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x80087601, &(0x7f0000000040)={0x2}) 01:00:51 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") creat(&(0x7f0000000080)='./file0\x00', 0x1) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:51 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:51 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x3000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2368.575082] binder: 9183:9187 ERROR: BC_REGISTER_LOOPER called without request [ 2368.598851] binder_alloc: 9183: binder_alloc_buf, no vma [ 2368.612588] binder: 9183:9187 transaction failed 29189/-3, size 0-0 line 2970 01:00:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0xc0045878, &(0x7f0000000040)={0x2}) [ 2368.629404] binder: send failed reply for transaction 3004 to 9183:9187 [ 2368.648519] binder: undelivered TRANSACTION_COMPLETE [ 2368.653793] binder: undelivered TRANSACTION_ERROR: 29189 [ 2368.713715] binder: undelivered TRANSACTION_ERROR: 29190 [ 2368.751738] binder: 9183:9187 ERROR: BC_REGISTER_LOOPER called without request [ 2368.771971] binder: 9183:9190 got reply transaction with no transaction stack [ 2368.797196] binder: release 9183:9190 transaction 3007 out, still active [ 2368.813623] binder: 9183:9190 transaction failed 29201/-71, size 0-0 line 2762 [ 2368.823384] binder: undelivered TRANSACTION_COMPLETE [ 2368.898537] binder: release 9183:9187 transaction 3007 in, still active [ 2368.917669] binder: send failed reply for transaction 3007, target dead [ 2368.936389] binder: undelivered TRANSACTION_ERROR: 29201 01:00:52 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 01:00:52 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000080)='./bus\x00', 0x2, 0x10) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:52 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:52 executing program 4: timer_create(0x0, 0x0, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:52 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0xc0045878, &(0x7f0000000040)={0x2}) 01:00:52 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f00000000c0)=r0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0xfffffffffffffffd, 0xfffffffffffffffd) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) setsockopt$inet_udp_encap(r4, 0x11, 0x64, &(0x7f0000000080), 0x4) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2369.503777] binder: 9200:9209 transaction failed 29189/-22, size 0-0 line 2855 01:00:53 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2369.629707] binder: 9200:9207 ERROR: BC_REGISTER_LOOPER called without request [ 2369.660360] binder: 9200:9207 got reply transaction with no transaction stack [ 2369.712992] binder: 9200:9207 transaction failed 29201/-71, size 0-0 line 2762 [ 2369.770539] binder: undelivered TRANSACTION_ERROR: 29189 [ 2369.787922] binder: undelivered TRANSACTION_ERROR: 29201 01:00:53 executing program 0: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2f5c52050a2e133300006847caadb3fc7170e6427ef4e066aeaa93e163b7fec444932e1d720e3074871cdaa62e9e7da35a1fea902067afa6"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 2369.940618] binder: 9200:9220 transaction failed 29189/-22, size 0-0 line 2855 [ 2370.008701] binder: 9200:9209 got reply transaction with no transaction stack [ 2370.048965] binder: 9200:9207 ERROR: BC_REGISTER_LOOPER called without request [ 2370.069208] binder: undelivered TRANSACTION_ERROR: 29189 [ 2370.069897] binder: 9200:9209 transaction failed 29201/-71, size 0-0 line 2762 [ 2370.131171] kauditd_printk_skb: 129 callbacks suppressed [ 2370.131186] audit: type=1400 audit(1555635653.583:44009): avc: denied { map } for pid=9222 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2370.175485] binder: undelivered TRANSACTION_ERROR: 29201 01:00:53 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2370.250769] audit: type=1400 audit(1555635653.613:44010): avc: denied { map } for pid=9222 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:53 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0xc0189436, &(0x7f0000000040)={0x2}) [ 2370.366444] audit: type=1400 audit(1555635653.633:44011): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2370.467794] protocol 88fb is buggy, dev hsr_slave_0 [ 2370.473001] protocol 88fb is buggy, dev hsr_slave_1 [ 2370.478258] protocol 88fb is buggy, dev hsr_slave_0 [ 2370.483399] protocol 88fb is buggy, dev hsr_slave_1 [ 2370.522711] audit: type=1400 audit(1555635653.643:44012): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:54 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) ioctl$TCFLSH(r2, 0x540b, 0x200) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f0000000300)={{r5, r6+30000000}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x13) setsockopt$TIPC_MCAST_BROADCAST(r4, 0x10f, 0x85) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="27000000030000000000000000000f000000000000e3ff000600000000000000766d6e657431004fae4a8791"], 0x27) [ 2370.671430] audit: type=1400 audit(1555635653.683:44013): avc: denied { map } for pid=9222 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2370.763513] audit: type=1400 audit(1555635653.733:44014): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2370.897996] audit: type=1400 audit(1555635653.743:44015): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2370.993104] audit: type=1400 audit(1555635653.773:44016): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2371.031353] binder: 9236:9239 ERROR: BC_REGISTER_LOOPER called without request [ 2371.072867] audit: type=1400 audit(1555635653.783:44017): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2371.102905] binder_alloc: 9236: binder_alloc_buf, no vma [ 2371.123244] binder: 9236:9239 transaction failed 29189/-3, size 0-0 line 2970 [ 2371.149495] binder: send failed reply for transaction 3014 to 9236:9239 [ 2371.156778] audit: type=1400 audit(1555635653.823:44018): avc: denied { map } for pid=9222 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2371.159683] binder: undelivered TRANSACTION_COMPLETE 01:00:54 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0xc020660b, &(0x7f0000000040)={0x2}) 01:00:54 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2371.260878] binder: undelivered TRANSACTION_ERROR: 29189 [ 2371.282528] binder: undelivered TRANSACTION_ERROR: 29190 [ 2371.375550] binder: 9236:9245 got reply transaction with no transaction stack [ 2371.419869] binder: 9236:9239 ERROR: BC_REGISTER_LOOPER called without request [ 2371.427848] binder: 9236:9245 transaction failed 29201/-71, size 0-0 line 2762 [ 2371.442638] binder: release 9236:9247 transaction 3017 out, still active [ 2371.452341] binder: undelivered TRANSACTION_COMPLETE 01:00:54 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:55 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2371.553367] binder: release 9236:9239 transaction 3017 in, still active [ 2371.562734] binder: send failed reply for transaction 3017, target dead [ 2371.609137] binder: undelivered TRANSACTION_ERROR: 29201 [ 2371.827730] protocol 88fb is buggy, dev hsr_slave_0 [ 2371.832885] protocol 88fb is buggy, dev hsr_slave_1 [ 2372.169248] binder: 9257:9259 ERROR: BC_REGISTER_LOOPER called without request [ 2372.220452] binder_alloc: 9257: binder_alloc_buf, no vma [ 2372.253911] binder: 9257:9259 transaction failed 29189/-3, size 0-0 line 2970 [ 2372.280890] binder: send failed reply for transaction 3020 to 9257:9259 [ 2372.311615] binder: undelivered TRANSACTION_COMPLETE [ 2372.376108] binder: release 9257:9265 transaction 3022 out, still active [ 2372.385748] binder: undelivered TRANSACTION_COMPLETE [ 2372.387775] protocol 88fb is buggy, dev hsr_slave_0 [ 2372.395988] protocol 88fb is buggy, dev hsr_slave_1 [ 2372.437478] binder: send failed reply for transaction 3022, target dead 01:00:56 executing program 4: timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:56 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x3}) 01:00:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:56 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xfeffffff}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2372.946664] binder: 9272:9274 ERROR: BC_REGISTER_LOOPER called without request [ 2373.001873] binder: 9272:9277 got reply transaction with no transaction stack [ 2373.054701] binder: 9272:9277 transaction failed 29201/-71, size 0-0 line 2762 [ 2373.092422] binder: release 9272:9274 transaction 3024 out, still active [ 2373.107885] binder: undelivered TRANSACTION_COMPLETE [ 2373.173758] binder: 9272:9277 got reply transaction with no transaction stack [ 2373.188777] binder: 9272:9274 ERROR: BC_REGISTER_LOOPER called without request [ 2373.221301] binder: release 9272:9281 transaction 3026 out, still active [ 2373.230626] binder: 9272:9277 transaction failed 29201/-71, size 0-0 line 2762 [ 2373.243332] binder: undelivered TRANSACTION_COMPLETE [ 2373.373764] binder: release 9272:9274 transaction 3024 in, still active [ 2373.390988] binder: send failed reply for transaction 3024, target dead [ 2373.414132] binder: send failed reply for transaction 3026, target dead 01:00:56 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x4}) 01:00:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:00:56 executing program 0: r0 = memfd_create(&(0x7f00000002c0)='trust\x01\x01\x00\x00\x00\x00\x00\x00H\xea\xbc\a\x00\xc4g\xb9G\xd9\x84@,\b\xa8|B\x94\"^\xaa.\xa2\xf5\xed\xdc\xaf\x93\a\a\x14ZV\xd6\xf4U\xb4\xfa\x14\xbd\xef\x87S\f\xb9\n\xc0\x82\x16\xa9^7_\x8b\xdb}\xafh}\r\xab\xc6\x0f\"\x9f\xf8+\xc0\xf5J%n\xc8=\x10\x1e\xe2\xdc\xb6\x02\x9b\xd7\t+j>\xb9\xd0\xb1\x12]P\xa2[~A\xe8\x95\xc1g\xc8\xd52l\xadV6\xab\x8f\xbc\xf2\xf5\xed?\xd0\xe8\xe6+IBV\xe1\x05a:\xbfT\x92\xe2\xd8\xef\x03<\x04\xb5\x02\"E\xfe4\n\xb8\xa0A\xecDM\xe9>\'E\xe2h/\xfa\xa4\x03\x016\x1f\xfeQ\xa1k\x96\xaa\x14\xc9\x81\xf7\x9f\x1d1t\xf6\\\xd6\xd2\xcb\x81M\x8a*\xea*$\xf5(\t\xa9S\x0f\xb0\x82M\f\x06f\x89r \xbaF\xb3\xab\x19{u\xb3toK \x9b\xb4w.\xa5\xbf\xbeEN{\xb4h\xe6\xe2\xc3\x0f[\x95', 0x0) finit_module(r0, &(0x7f0000000000)=']!!,ppp1security!eth0vboxnet1vboxnet0/\xdfGPL\x00', 0x2) r1 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x1, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000140)={0xa7, @broadcast, 0x4e21, 0x3, 'lblcr\x00', 0x4, 0x6, 0x56}, 0x2c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dc86055e0bceec7be070") r3 = semget$private(0x0, 0x5, 0xbf51f4b1f8a9bf5) semtimedop(r3, &(0x7f00000004c0)=[{0x3, 0xa49, 0x1800}, {0x3, 0x4, 0x1000}], 0x2, &(0x7f0000000500)) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x1df, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x1ff) mknodat(r1, &(0x7f0000000180)='./file0\x00', 0x41, 0x5) clock_gettime(0x0, &(0x7f0000000440)={0x0, 0x0}) select(0x40, &(0x7f00000001c0)={0x4, 0x80000000, 0x9, 0x7, 0x0, 0xfff, 0x20, 0x38c}, &(0x7f00000003c0)={0x2, 0x4, 0x6, 0xe1, 0x3, 0x20, 0x5, 0x7f}, &(0x7f0000000400)={0x2, 0x7, 0x100000001, 0x8bd, 0x800, 0xebc6, 0x0, 0x5}, &(0x7f0000000480)={r7, r8/1000+30000}) write$FUSE_ENTRY(r0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x638}}}, 0x90) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x80000000004, 0x100012, r0, 0xfffffffffffffffc) clock_settime(0x0, &(0x7f0000000080)={0x0, 0x989680}) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)) 01:00:57 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x5}) [ 2373.907759] net_ratelimit: 4 callbacks suppressed [ 2373.907767] protocol 88fb is buggy, dev hsr_slave_0 [ 2373.917871] protocol 88fb is buggy, dev hsr_slave_1 [ 2374.114579] binder: 9289:9292 ERROR: BC_REGISTER_LOOPER called without request 01:00:57 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xfffffffe}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2374.177465] binder: 9289:9296 got reply transaction with no transaction stack [ 2374.226100] binder: 9289:9296 transaction failed 29201/-71, size 0-0 line 2762 [ 2374.275684] binder: release 9289:9292 transaction 3029 out, still active [ 2374.288676] binder: undelivered TRANSACTION_COMPLETE [ 2374.388906] binder: release 9289:9292 transaction 3029 in, still active [ 2374.395773] binder: send failed reply for transaction 3029, target dead [ 2374.444800] binder: 9289:9292 ERROR: BC_REGISTER_LOOPER called without request [ 2374.469469] binder_release_work: 4 callbacks suppressed [ 2374.469476] binder: undelivered TRANSACTION_ERROR: 29201 [ 2374.534847] binder: release 9289:9299 transaction 3032 out, still active [ 2374.538660] binder: 9289:9296 got reply transaction with no transaction stack [ 2374.579587] binder: undelivered TRANSACTION_COMPLETE 01:00:58 executing program 0: r0 = socket$inet6(0xa, 0x82000000003, 0x810000000000010) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000140)=@ethtool_cmd={0xa}}) [ 2374.605812] binder: 9289:9296 transaction failed 29201/-71, size 0-0 line 2762 [ 2374.727080] binder: release 9289:9292 transaction 3032 in, still active [ 2374.736755] binder: send failed reply for transaction 3032, target dead [ 2374.761604] binder: undelivered TRANSACTION_ERROR: 29201 01:00:58 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4010641c, &(0x7f0000000140)={r2, &(0x7f0000000240)=""/108}) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r5 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r5, 0x0, r6, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r4, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:58 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x8004000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2375.214101] kauditd_printk_skb: 152 callbacks suppressed [ 2375.214116] audit: type=1400 audit(1555635658.663:44171): avc: denied { map } for pid=9309 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.347355] audit: type=1400 audit(1555635658.703:44172): avc: denied { map } for pid=9309 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.502962] audit: type=1400 audit(1555635658.723:44173): avc: denied { map } for pid=9309 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.650396] audit: type=1400 audit(1555635658.733:44174): avc: denied { map } for pid=9309 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.708842] binder: 9312:9314 ERROR: BC_REGISTER_LOOPER called without request [ 2375.745550] binder_alloc: 9312: binder_alloc_buf, no vma [ 2375.758760] audit: type=1400 audit(1555635658.773:44175): avc: denied { map } for pid=9309 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.788776] binder: 9312:9314 transaction failed 29189/-3, size 0-0 line 2970 [ 2375.824118] audit: type=1400 audit(1555635658.843:44176): avc: denied { map } for pid=9309 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.849202] binder: send failed reply for transaction 3035 to 9312:9314 [ 2375.863409] binder: undelivered TRANSACTION_COMPLETE [ 2375.869291] binder: undelivered TRANSACTION_ERROR: 29189 [ 2375.966318] audit: type=1400 audit(1555635658.853:44177): avc: denied { map } for pid=9311 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2375.994479] binder: 9312:9314 ERROR: BC_REGISTER_LOOPER called without request [ 2376.017872] binder: 9312:9323 got reply transaction with no transaction stack [ 2376.025205] binder: 9312:9323 transaction failed 29201/-71, size 0-0 line 2762 [ 2376.036764] binder: undelivered TRANSACTION_COMPLETE 01:00:59 executing program 4: timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:00:59 executing program 0: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_G_EDID(r0, 0xc0245628, &(0x7f0000000080)={0x0, 0x0, 0x8001, [], 0x0}) [ 2376.104408] audit: type=1400 audit(1555635658.853:44178): avc: denied { map } for pid=9309 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:59 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x9}) 01:00:59 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x1000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2376.150483] binder: undelivered TRANSACTION_ERROR: 29201 01:00:59 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() open(&(0x7f0000000140)='./file1\x00', 0x400000, 0x66) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x100000001, 0x0) ioctl$BLKROSET(r2, 0x125d, &(0x7f00000000c0)=0xc4) mknod(&(0x7f0000000240)='./file1\x00', 0x800141e, 0x5) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000040)={0x27, 0x3, 0x0, {0xffffffffffffffff, 0x6, 0x0, 'vmnet1'}}, 0x27) prctl$PR_SET_TIMERSLACK(0x1d, 0xffffffff) read$FUSE(r5, &(0x7f0000000640), 0x1000) [ 2376.183291] audit: type=1400 audit(1555635658.863:44179): avc: denied { map } for pid=9311 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:00:59 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xe400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2376.246451] binder: undelivered TRANSACTION_ERROR: 29190 [ 2376.252243] binder: send failed reply for transaction 3037, target dead [ 2376.351797] audit: type=1400 audit(1555635658.883:44180): avc: denied { map } for pid=9311 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:00 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x11) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 01:01:00 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0xa}) [ 2377.158331] binder: 9337:9339 ERROR: BC_REGISTER_LOOPER called without request [ 2377.226372] binder: 9337:9344 got reply transaction with no transaction stack [ 2377.344246] binder: 9337:9344 transaction failed 29201/-71, size 0-0 line 2762 [ 2377.400989] binder_thread_release: 1 callbacks suppressed [ 2377.401002] binder: release 9337:9339 transaction 3040 out, still active [ 2377.451213] binder: undelivered TRANSACTION_COMPLETE [ 2377.499344] binder: BINDER_SET_CONTEXT_MGR already set 01:01:01 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r4, 0x5382, &(0x7f0000000080)) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2377.580078] binder: 9337:9361 ERROR: BC_REGISTER_LOOPER called without request [ 2377.604163] binder: release 9337:9339 transaction 3040 in, still active [ 2377.620274] binder: 9337:9356 transaction failed 29189/-22, size 0-0 line 2855 01:01:01 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0xd}) 01:01:01 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f00000000c0)="3058020af10cb8b56c96d27c44d58e94ea51a7dfc59e92e80d9482ca7839173a8f1143a711f5a939b4fd0072693a46c08df6616dd21be3453ecf73039a20f43acbc5376139a9070ae27dd847474d1e59b2697801e6ebd80f75ca", 0x5a, 0xfffffffffffffffd) nanosleep(0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) [ 2377.627937] binder: send failed reply for transaction 3040, target dead [ 2377.646572] binder: undelivered TRANSACTION_ERROR: 29201 [ 2377.667086] binder: 9337:9339 ioctl 40046207 0 returned -16 [ 2377.681206] binder: undelivered TRANSACTION_ERROR: 29189 01:01:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2378.616678] binder: 9375:9379 ERROR: BC_REGISTER_LOOPER called without request [ 2378.684621] binder: 9375:9383 got reply transaction with no transaction stack [ 2378.768501] binder: 9375:9383 transaction failed 29201/-71, size 0-0 line 2762 [ 2378.799388] binder: release 9375:9379 transaction 3044 out, still active [ 2378.812682] binder: undelivered TRANSACTION_COMPLETE [ 2378.888172] binder: release 9375:9379 transaction 3044 in, still active [ 2378.901462] binder: send failed reply for transaction 3044, target dead [ 2378.938503] binder: 9375:9379 ERROR: BC_REGISTER_LOOPER called without request [ 2378.954811] binder: undelivered TRANSACTION_ERROR: 29201 [ 2378.973994] binder: 9375:9383 got reply transaction with no transaction stack [ 2379.011990] binder: release 9375:9383 transaction 3047 out, still active [ 2379.024097] binder: undelivered TRANSACTION_COMPLETE [ 2379.035910] binder: 9375:9383 transaction failed 29201/-71, size 0-0 line 2762 [ 2379.127052] binder: release 9375:9379 transaction 3047 in, still active [ 2379.137753] binder: send failed reply for transaction 3047, target dead [ 2379.157447] binder: undelivered TRANSACTION_ERROR: 29201 01:01:03 executing program 4: timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:03 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x300000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:03 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0x2000000fffffffd, 0x3) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000340)={{0xd000, 0xf004, 0xf, 0x2, 0x3, 0xffffffff, 0x1, 0x100, 0x8, 0x80000001, 0x1f, 0x3}, {0xf000, 0xf001, 0x3, 0x7, 0x3f, 0x1, 0xc11, 0x9, 0x3, 0x1, 0xfec, 0xff}, {0x10004, 0xf000, 0xf, 0x3, 0xffffffff, 0x9, 0x5bd7, 0x3ff, 0x0, 0x6, 0x2, 0x6}, {0x6000, 0x101000, 0xf, 0x6, 0x808000, 0x3, 0x1, 0xb552, 0x7, 0x800, 0xe00, 0x4f7e}, {0x4, 0x4000, 0xe, 0xfffffffffffffffa, 0x7a, 0x2f04, 0xd9, 0x7, 0x6, 0xff, 0x3, 0xff}, {0xf003, 0x4000, 0xd, 0x8, 0x4, 0x6, 0x1000, 0x7fff, 0x79, 0x7, 0x8, 0x80}, {0x10f002, 0xf000, 0x3, 0x41, 0x10001, 0xffffffffffffffff, 0x7, 0x6, 0x1, 0x4, 0x1f, 0x5}, {0x3000, 0x1000, 0x0, 0x0, 0x2226, 0x8, 0x6, 0x7fff, 0x35a, 0x6, 0x8, 0x124e}, {0x1000, 0x1000}, {0x5002, 0x4}, 0x10000, 0x0, 0x0, 0x0, 0x2, 0x8000, 0x100000, [0x0, 0x0, 0xfffffffffffffffc, 0x2]}) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="270000000300000080000008a69574e6dd60603719111d23db000000000000090002000000000600000008000000766d6e65743100"], 0x27) 01:01:03 executing program 0: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) chmod(&(0x7f0000000040)='./bus\x00', 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x20000002812, r0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1081}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x1) mmap(&(0x7f0000004000/0x4000)=nil, 0xa07000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 01:01:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:03 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x14}) 01:01:03 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17}) [ 2379.978209] binder: 9392:9399 ERROR: BC_REGISTER_LOOPER called without request [ 2380.015138] binder_alloc: 9392: binder_alloc_buf, no vma [ 2380.037073] binder: 9392:9399 transaction failed 29189/-3, size 0-0 line 2970 [ 2380.068003] binder: send failed reply for transaction 3050 to 9392:9399 [ 2380.085423] binder: undelivered TRANSACTION_COMPLETE [ 2380.090779] binder: undelivered TRANSACTION_ERROR: 29189 01:01:03 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x200800, 0x0) ioctl$BLKBSZGET(r2, 0x80081270, &(0x7f00000000c0)) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x200000, 0x0) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) getsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000380), &(0x7f00000003c0)=0x4) ioctl$CAPI_CLR_FLAGS(r2, 0x80044325, &(0x7f0000000340)) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r5, 0x4008af23, &(0x7f0000000400)={0x0, 0x7ff}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000240)=ANY=[@ANYBLOB="55498e2be13a54f192838caf270000000300000000000000000000000000000043a7b65bf35d7b370000000006000013808c9f73dfb859e92f3aa2c07f3433f5225036549282135ab54611b0a00b04fff455804eb8a7f3b2652f0eabaf471416fe6565ea1ac5468bea7302610489b0510574b803db165f1bff7201591dba07b4bfcd1b8cf7a383d09dbf5cbe8ba0e5936ebfe928ba7c3fcbd3e825714a13a0778fc410c573189bfd4e6256"], 0x27) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f00000001c0)) fcntl$setownex(r3, 0xf, &(0x7f0000000440)={0x2, r0}) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000040)={0x3, 0x800, 0x6}) [ 2380.147761] protocol 88fb is buggy, dev hsr_slave_0 [ 2380.153043] protocol 88fb is buggy, dev hsr_slave_1 [ 2380.204616] binder: 9392:9399 ERROR: BC_REGISTER_LOOPER called without request [ 2380.230407] binder: 9392:9406 got reply transaction with no transaction stack 01:01:03 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') open(&(0x7f0000000280)='./bus\x00', 0x141042, 0x0) [ 2380.278470] binder: release 9392:9407 transaction 3052 out, still active [ 2380.285472] binder: undelivered TRANSACTION_COMPLETE [ 2380.319507] binder: 9392:9406 transaction failed 29201/-71, size 0-0 line 2762 [ 2380.363572] binder: undelivered TRANSACTION_ERROR: 29201 [ 2380.369364] kauditd_printk_skb: 178 callbacks suppressed [ 2380.369378] audit: type=1400 audit(1555635663.813:44359): avc: denied { map } for pid=9408 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:03 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2380.474673] binder: undelivered TRANSACTION_ERROR: 29190 [ 2380.480698] binder: send failed reply for transaction 3052, target dead [ 2380.528099] audit: type=1400 audit(1555635663.813:44360): avc: denied { map } for pid=9408 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2380.647409] audit: type=1400 audit(1555635663.843:44361): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2380.707773] protocol 88fb is buggy, dev hsr_slave_0 [ 2380.713197] protocol 88fb is buggy, dev hsr_slave_1 01:01:04 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0xffffff80}) 01:01:04 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2380.823152] audit: type=1400 audit(1555635663.843:44362): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2380.968161] audit: type=1400 audit(1555635663.873:44363): avc: denied { map } for pid=9408 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2381.102605] audit: type=1400 audit(1555635663.903:44364): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2381.290381] audit: type=1400 audit(1555635663.913:44365): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2381.477965] audit: type=1400 audit(1555635663.933:44366): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2381.619721] audit: type=1400 audit(1555635663.953:44367): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2381.647517] audit: type=1400 audit(1555635664.033:44368): avc: denied { map } for pid=9408 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2381.774308] binder: 9428:9431 ERROR: BC_REGISTER_LOOPER called without request [ 2381.822566] binder: 9428:9435 got reply transaction with no transaction stack [ 2381.872816] binder: 9428:9435 transaction failed 29201/-71, size 0-0 line 2762 [ 2381.926873] binder: release 9428:9431 transaction 3055 out, still active [ 2381.940551] binder: undelivered TRANSACTION_COMPLETE [ 2382.023270] binder: release 9428:9431 transaction 3055 in, still active [ 2382.045346] binder: send failed reply for transaction 3055, target dead [ 2382.089330] binder: undelivered TRANSACTION_ERROR: 29201 [ 2382.108875] binder: 9428:9435 got reply transaction with no transaction stack [ 2382.116212] binder: 9428:9435 transaction failed 29201/-71, size 0-0 line 2762 [ 2382.208192] binder: release 9428:9441 transaction 3057 out, still active [ 2382.215085] binder: undelivered TRANSACTION_COMPLETE [ 2382.227728] protocol 88fb is buggy, dev hsr_slave_0 [ 2382.232828] protocol 88fb is buggy, dev hsr_slave_1 [ 2382.292142] binder: undelivered TRANSACTION_ERROR: 29201 [ 2382.297938] binder: send failed reply for transaction 3057, target dead 01:01:06 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:06 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x80, 0x0) ioctl$EVIOCGSND(r2, 0x8040451a, &(0x7f00000000c0)=""/34) syz_mount_image$bfs(&(0x7f0000000140)='bfs\x00', &(0x7f00000001c0)='./bus\x00', 0x5, 0x4, &(0x7f0000000540)=[{&(0x7f0000000340)="a0eaf1736be358f50741add8d796e57c65f763e55e67535e8b745f8dc4c33b36200ead1396c4bcec625d2926efdd3b5620372a8982bdcd5f318a5bba3adc4d0663c9d4ac0d79d920428ce9594c0b9bb559faa57a5b61ac7194f6c62c413bd6ecc451f2e38d39860877999d79bb4a4f2cce9e9e6a54c253527a77407fbe553242bc8f044db117165757e4143ba8c6c2d727ff86ac8d26829616cbec030c0e71671752e6f862a7262d3184ec0734f8c32b7df070db9f5b07cba4bb7f0372fa597fb09fcae57d0bf049bc0ea41dcfaffa42d10dc6a034e0c310b7d13e7312730588766993c96d24cac22429ed90e8b6ec35788f57", 0xf3, 0x3ff0000}, {&(0x7f0000000440)="2f87fe9d68600ea11203bea9483350de4903667fa24a5d9a1dfab68776e0cdf9e61cd0f77a773f13ae640e2c80648db819bc84d9b5a0c6fcf4cb9812a43d3ded42a1413afd70146d30d0c035130c0cccd15ca5c69d1fe90cebda795f47f00e0cd9b741509e294af82008302096abbfaffbbf157ece31ae6022ab79c2ac3df04b0e60f142b73ab8b6184a57ffcf10c2650c8d36190a3bde47b2c716541f4b895f5e9d189bf02d269002db0653c430afa87ab3ab2749d6e810a4f6db9b68c53cad3865494854da53e66bae31e451d2addf795bab9aabfe2402456b2abfe6587d0b39a414e811c4d97338fdf41448d8fe9c2af73756ba1eccbf", 0xf8, 0x200}, {&(0x7f0000000640)="f7bcdd8ab35abac441a619ffcce68f94b667c0d3253d7dc611100c8e3b2b8daa2064e8c4fe4dab8968d019d79306ac640e01cdc2ad88db35a82a2040480e369717293deacd333eff51ee935b52de980ba6b4b0b61af569d376391b7371c970bf7146963a08024102f31c26381e87f4883faea536fd909e57ab7d8fad5b6ffbe51bcdc29265f66b4c8409a3e89b1a2ca22f981ccb3af7861649d5b3ba0aed106c70570bc517b5b768f45400ae6c572415b898be154b8ed30197d1cc7f056b85943e059d0ad6106e191b8f7814240f8cd90604e7b2a99da639e62671640f27df", 0xdf, 0x101}, {&(0x7f0000000240)="9c503ffa8e1e40e360a39b949fea5b094fc9e11854e6700441491d4f1cc6f2ec06803b99bd187c405ce72cb92a0f628669fc261d71c63f0f445632a550302ec6831fb52a5deb26d07b2d2a89f8df11bb40390e8ce9070b35da77", 0x5a, 0x4}], 0x10, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="270000000382445b034eee4ad5624f1d0000000000000000000000001600"/39], 0x27) 01:01:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0xffffff81}) 01:01:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:06 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x900000000000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@dstopts, 0x8) sendmmsg(r0, 0x0, 0x0, 0x0) [ 2383.344234] binder: 9453:9457 ERROR: BC_REGISTER_LOOPER called without request [ 2383.381126] binder_alloc: 9453: binder_alloc_buf, no vma 01:01:06 executing program 0: dup(0xffffffffffffffff) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'e \x00\b\x00', 0x2}, 0x18) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x8916, &(0x7f0000000000)) ioctl(r1, 0x8936, &(0x7f0000000000)) getpgid(0xffffffffffffffff) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x200, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3f, 0x7fff, 0x7, 0x4, 0x100000001, 0x0, 0x7fff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x71ed, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x1, 0x7fff, 0x5, 0x20}, 0x0, 0x0, r0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000040)={0x2, 'bridge_slave_1\x00'}, 0x18) 01:01:06 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0xffffff82}) [ 2383.402783] binder: 9453:9457 transaction failed 29189/-3, size 0-0 line 2970 [ 2383.415465] binder: send failed reply for transaction 3061 to 9453:9457 [ 2383.449013] binder: undelivered TRANSACTION_COMPLETE [ 2383.454209] binder: undelivered TRANSACTION_ERROR: 29189 [ 2383.503702] binder: undelivered TRANSACTION_ERROR: 29190 [ 2383.531314] binder: 9453:9462 transaction failed 29189/-22, size 0-0 line 2855 [ 2383.609675] binder: 9453:9466 ERROR: BC_REGISTER_LOOPER called without request 01:01:07 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x10001, 0x40) write$P9_RSTAT(r2, &(0x7f0000000540)=ANY=[@ANYBLOB="650000007d020000005e00000002000000a00100000007000000000000000000040001000000c500000017ffffffffffffff070073656c406d75780e0028657468315d73f1047697cfa99ab0656c696e7578bc01002c1500706f7369785f61636c7f616363"], 0x65) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) ioctl$EVIOCGABS2F(r2, 0x8018456f, &(0x7f0000000640)=""/73) syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f00000000c0)='./bus\x00', 0x6, 0x3, &(0x7f0000000240)=[{&(0x7f0000000140), 0x0, 0x8000}, {&(0x7f0000000340)="4f137326f1e9e097a3203cb97a920705176d105937281c75113e0365d7fef33a1389b76af483635861ea36e496aee126895dcee36a958cdfa82857d77fe8bfc6d6be6c1137f52aaf24a192e1549bf0bd7830db560937e76044afdc31b868783fb46645a9bdd3cfb937321a92dd3bb505701dedcb49bc216b5fb5f190e5f6812774346d584ff4ebc5a4c90271f16f8a84ee7dddfcfc94c8ba2fed360fa28d11c8fc6023af6993f4372d6ae9c8a2e900d66a50e289a43c070c117b10b74e4ef8ca51409a", 0xc3, 0x80}, {&(0x7f0000000440)="42060da76924cae4643eef626b180eb05581e68b8531036c3132b362f0a64eedeb5a386a3dddf328ee3133b8caae00cde4a588338adfc487c917424e4181197d9eaebd7a51fa33d70fb5e82e422c880dd251260db27c7c1126f9d5a55146e72e8618460271aba0e0a7df509797603c2578f201c0be9403839420b082487b9f90f2f25a88369630b3a871fe2df02794af078cb978b2016f8afc3f3478fe9b5b59c165c3e83a9a82136c5038c52584b72436c6d7d031124d86e815f619f276ffc643a0006f37e0a4c463150ca07d0cbd56719fdce1a8033676ba11e0578d318508dc22937d4e919f284d746a05a6468578", 0xf0, 0x8000}], 0x400e4, &(0x7f00000001c0)={[{@nodots='nodots'}, {@fat=@flush='flush'}, {@dots='dots'}, {@nodots='nodots'}]}) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="2700000003000000000000000000000000000000000000000600000000000000766d6e65743100"], 0x27) [ 2383.674761] binder: undelivered TRANSACTION_ERROR: 29189 01:01:07 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:07 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x2}) 01:01:07 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0xfeffffff00000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2384.674415] binder: 9485:9487 transaction failed 29189/-22, size 0-0 line 2855 [ 2384.742202] binder: undelivered TRANSACTION_ERROR: 29189 [ 2384.819387] binder: 9485:9493 transaction failed 29189/-22, size 0-0 line 2855 [ 2384.897780] binder: undelivered TRANSACTION_ERROR: 29189 [ 2385.027717] protocol 88fb is buggy, dev hsr_slave_0 [ 2385.033010] protocol 88fb is buggy, dev hsr_slave_1 [ 2385.038316] protocol 88fb is buggy, dev hsr_slave_0 [ 2385.043450] protocol 88fb is buggy, dev hsr_slave_1 [ 2385.384709] kauditd_printk_skb: 161 callbacks suppressed [ 2385.384724] audit: type=1400 audit(1555635668.833:44530): avc: denied { map } for pid=9500 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2385.451934] audit: type=1400 audit(1555635668.833:44531): avc: denied { map } for pid=9499 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2385.478962] audit: type=1400 audit(1555635668.833:44532): avc: denied { map } for pid=9499 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2385.506814] audit: type=1400 audit(1555635668.873:44533): avc: denied { map } for pid=9500 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2385.914772] audit: type=1400 audit(1555635669.363:44534): avc: denied { map } for pid=9503 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2385.944432] audit: type=1400 audit(1555635669.363:44535): avc: denied { map } for pid=9503 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2385.974745] audit: type=1400 audit(1555635669.363:44536): avc: denied { map } for pid=9503 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2386.006889] audit: type=1400 audit(1555635669.363:44537): avc: denied { map } for pid=9503 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2386.039102] audit: type=1400 audit(1555635669.363:44538): avc: denied { map } for pid=9503 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2386.067343] audit: type=1400 audit(1555635669.383:44539): avc: denied { map } for pid=9503 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:09 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:09 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x20200, 0x0) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) getsockname$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000000c0)=0x1c) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:09 executing program 0: ioctl$DRM_IOCTL_MAP_BUFS(0xffffffffffffffff, 0xc0186419, &(0x7f0000002980)={0x2, 0x0, &(0x7f0000002900)=[{0x0, 0x0, 0x6, 0x0}, {0x0, 0x0, 0x0, 0x0}]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x69) connect(r0, &(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80) sendmmsg$inet_sctp(r0, &(0x7f00000003c0), 0x3a301e0909ff38c, 0x34) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 01:01:09 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:09 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x3}) 01:01:09 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:10 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x4}) [ 2386.797069] binder: 9506:9512 ERROR: BC_REGISTER_LOOPER called without request [ 2386.863675] binder: 9506:9518 got reply transaction with no transaction stack [ 2386.891100] binder: 9506:9518 transaction failed 29201/-71, size 0-0 line 2762 01:01:10 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8000, 0x0) ioctl$CAPI_NCCI_GETUNIT(r2, 0x80044327, &(0x7f00000000c0)) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r2, 0x80e85411, &(0x7f0000000280)=""/2) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2386.923818] binder: release 9506:9512 transaction 3068 out, still active [ 2386.947732] protocol 88fb is buggy, dev hsr_slave_0 [ 2386.952855] protocol 88fb is buggy, dev hsr_slave_1 01:01:10 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @initdev}}}}, 0x0) [ 2386.969895] binder: undelivered TRANSACTION_COMPLETE [ 2387.034347] binder: release 9506:9512 transaction 3068 in, still active [ 2387.045861] binder: send failed reply for transaction 3068, target dead [ 2387.075516] binder: undelivered TRANSACTION_ERROR: 29201 [ 2387.092746] binder: 9506:9512 ERROR: BC_REGISTER_LOOPER called without request [ 2387.107707] protocol 88fb is buggy, dev hsr_slave_0 [ 2387.112819] protocol 88fb is buggy, dev hsr_slave_1 [ 2387.118038] protocol 88fb is buggy, dev hsr_slave_0 [ 2387.123162] protocol 88fb is buggy, dev hsr_slave_1 [ 2387.127249] binder: 9506:9518 got reply transaction with no transaction stack [ 2387.144100] binder: release 9506:9518 transaction 3070 out, still active [ 2387.151832] binder: 9506:9518 transaction failed 29201/-71, size 0-0 line 2762 [ 2387.163461] binder: undelivered TRANSACTION_COMPLETE 01:01:10 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2387.289354] binder: release 9506:9512 transaction 3070 in, still active [ 2387.302686] binder: send failed reply for transaction 3070, target dead [ 2387.341424] binder: undelivered TRANSACTION_ERROR: 29201 01:01:11 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x5}) 01:01:11 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwrite64(r0, 0x0, 0x0, 0x0) [ 2388.139012] binder: 9538:9539 ERROR: BC_REGISTER_LOOPER called without request [ 2388.206659] binder: 9538:9543 got reply transaction with no transaction stack [ 2388.216756] binder: 9538:9543 transaction failed 29201/-71, size 0-0 line 2762 [ 2388.233351] binder: release 9538:9539 transaction 3074 out, still active [ 2388.251689] binder: undelivered TRANSACTION_COMPLETE [ 2388.302083] binder: release 9538:9539 transaction 3074 in, still active [ 2388.316714] binder: send failed reply for transaction 3074, target dead [ 2388.348488] binder: 9538:9539 ERROR: BC_REGISTER_LOOPER called without request [ 2388.356320] binder: undelivered TRANSACTION_ERROR: 29201 [ 2388.383454] binder: 9538:9543 got reply transaction with no transaction stack [ 2388.427492] binder: release 9538:9543 transaction 3077 out, still active [ 2388.442204] binder: undelivered TRANSACTION_COMPLETE [ 2388.449044] binder: 9538:9543 transaction failed 29201/-71, size 0-0 line 2762 [ 2388.531417] binder: release 9538:9539 transaction 3077 in, still active [ 2388.540849] binder: send failed reply for transaction 3077, target dead [ 2388.562227] binder: undelivered TRANSACTION_ERROR: 29201 01:01:13 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:13 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000080)={{0x8, 0x8, 0x0, 0x9}, 'syz1\x00', 0x3}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:13 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@dstopts, 0x8) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) 01:01:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x8}) 01:01:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:13 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0xe6}) [ 2390.144674] binder: 9553:9559 ERROR: BC_REGISTER_LOOPER called without request 01:01:13 executing program 0: r0 = gettid() pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) arch_prctl$ARCH_GET_GS(0x1004, 0x0) tkill(r0, 0x1000000000016) [ 2390.203227] binder_alloc: 9553: binder_alloc_buf, no vma [ 2390.233355] binder: 9553:9559 transaction failed 29189/-3, size 0-0 line 2970 01:01:13 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="270000000300000000000000000800000000000000000000060000000000473e407074cd6b0000"], 0x27) [ 2390.255213] binder: send failed reply for transaction 3080 to 9553:9559 [ 2390.270361] binder: undelivered TRANSACTION_COMPLETE [ 2390.275516] binder: undelivered TRANSACTION_ERROR: 29189 [ 2390.358884] binder: 9553:9567 got reply transaction with no transaction stack [ 2390.386471] binder: 9553:9559 ERROR: BC_REGISTER_LOOPER called without request [ 2390.407377] binder: release 9553:9568 transaction 3082 out, still active [ 2390.423929] binder: undelivered TRANSACTION_COMPLETE [ 2390.430040] binder: 9553:9567 transaction failed 29201/-71, size 0-0 line 2762 [ 2390.525536] binder: undelivered TRANSACTION_ERROR: 29201 [ 2390.547781] protocol 88fb is buggy, dev hsr_slave_0 [ 2390.552909] protocol 88fb is buggy, dev hsr_slave_1 [ 2390.606090] kauditd_printk_skb: 98 callbacks suppressed [ 2390.606105] audit: type=1400 audit(1555635674.053:44638): avc: denied { map } for pid=9570 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2390.685603] binder: undelivered TRANSACTION_ERROR: 29190 [ 2390.697165] binder: send failed reply for transaction 3082, target dead [ 2390.715585] audit: type=1400 audit(1555635674.083:44639): avc: denied { map } for pid=9570 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2390.788928] audit: type=1400 audit(1555635674.093:44640): avc: denied { map } for pid=9570 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:14 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x400440, 0x0) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) ioctl$TCSETS2(r0, 0x402c542b, 0x0) 01:01:14 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x300}) [ 2390.949090] audit: type=1400 audit(1555635674.093:44641): avc: denied { map } for pid=9570 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.107988] audit: type=1400 audit(1555635674.123:44642): avc: denied { map } for pid=9570 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.238251] audit: type=1400 audit(1555635674.153:44643): avc: denied { map } for pid=9574 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.375989] audit: type=1400 audit(1555635674.173:44645): avc: denied { map } for pid=9574 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.499564] audit: type=1400 audit(1555635674.163:44644): avc: denied { map } for pid=9570 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.612827] audit: type=1400 audit(1555635674.203:44647): avc: denied { map } for pid=9570 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.636070] binder: 9588:9590 ERROR: BC_REGISTER_LOOPER called without request [ 2391.680348] binder_alloc: 9588: binder_alloc_buf, no vma [ 2391.685883] binder: 9588:9590 transaction failed 29189/-3, size 0-0 line 2970 [ 2391.735960] binder: send failed reply for transaction 3085 to 9588:9590 [ 2391.746734] audit: type=1400 audit(1555635674.193:44646): avc: denied { map } for pid=9574 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2391.804175] binder: undelivered TRANSACTION_COMPLETE [ 2391.809438] binder: undelivered TRANSACTION_ERROR: 29189 [ 2391.893494] binder: 9588:9597 got reply transaction with no transaction stack [ 2391.950960] binder: release 9588:9598 transaction 3087 out, still active [ 2391.970348] binder: 9588:9597 transaction failed 29201/-71, size 0-0 line 2762 [ 2391.979328] binder: undelivered TRANSACTION_COMPLETE [ 2392.025251] binder: undelivered TRANSACTION_ERROR: 29201 [ 2392.128107] binder: undelivered TRANSACTION_ERROR: 29190 [ 2392.133636] binder: send failed reply for transaction 3087, target dead 01:01:16 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:16 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = semget(0x2, 0x4, 0x88) semctl$GETALL(r2, 0x0, 0xd, &(0x7f0000000340)=""/241) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000000c0)={0x7fffffff, 0x8, 0x763, 0x2, 0x0}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f00000001c0)={r4, 0x401}, 0x8) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r5 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r6 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r7 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r6, 0x0, r7, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="27000000030000000000000000000000000000deffffffff0500000000000000766d6e65743100"], 0x27) 01:01:16 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:16 executing program 0: r0 = gettid() pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) r1 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f00000000c0)=""/168) fstat(0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) tkill(r0, 0x1000000000016) 01:01:16 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x346}) 01:01:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:16 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x100000001, 0x400) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000080)=0x1, &(0x7f00000000c0)=0x4) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r5 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000140)={0x2, 0x0, 0x10003, 0x81}) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f00000001c0)={0x2c359e04, r6, 0x2}) splice(r4, 0x0, r5, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000340)=ANY=[@ANYBLOB="284b00400300000000000000006e58f600000100749dc7439c9500c7f7011400c7ed917bd7f8b69aacb5bb5a6b1ee72d1911b2f8db2fda85f60a0fce5e90a3359c6a87e03c0393e39f413e4cfc612cf9218463cc4987504b845ec16ab7e606c63abdc6f9b07836fc0167b720623019a80b75db0492c0ca7a325ecb5b52d4d8d808ff527f109eb76c124fae1fd7c755702ef2dc6675"], 0x27) read$FUSE(r3, &(0x7f0000000640), 0x1000) ioctl$sock_inet_tcp_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000240)) dup2(r1, r1) [ 2393.506547] binder: 9603:9608 ERROR: BC_REGISTER_LOOPER called without request [ 2393.532076] binder_alloc: 9603: binder_alloc_buf, no vma 01:01:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x347}) [ 2393.550789] binder: 9603:9608 transaction failed 29189/-3, size 0-0 line 2970 [ 2393.569615] binder: send failed reply for transaction 3090 to 9603:9608 [ 2393.588126] binder: undelivered TRANSACTION_COMPLETE [ 2393.593474] binder: undelivered TRANSACTION_ERROR: 29189 01:01:17 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg(r0, &(0x7f0000013000)={&(0x7f0000013fe4)=@in6={0xa, 0x4e23, 0x0, @loopback}, 0x80, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2800000000000000290000000500000021020201cb009f00"/40], 0x28}, 0x0) [ 2393.664628] binder: undelivered TRANSACTION_ERROR: 29190 [ 2393.682397] binder: 9603:9608 ERROR: BC_REGISTER_LOOPER called without request [ 2393.706037] binder: 9603:9615 got reply transaction with no transaction stack [ 2393.758380] binder: release 9603:9615 transaction 3093 out, still active [ 2393.770106] binder: undelivered TRANSACTION_COMPLETE [ 2393.782712] binder: 9603:9615 transaction failed 29201/-71, size 0-0 line 2762 01:01:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2393.912243] binder: release 9603:9608 transaction 3093 in, still active [ 2393.937459] binder: send failed reply for transaction 3093, target dead [ 2393.971043] binder: undelivered TRANSACTION_ERROR: 29201 01:01:17 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:17 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x101002, 0x0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000340)={0xe, 0x1, 0x200, 0x7, 0xdd, "c244680ed69b540bf9425c0c91688fdbf37a608da7c90a16577d434887fd59e34658171e0ad3dccf868993ad12528be468edfd0785ae4b5ec0f0b8b59c4cce326bac7252043de3b80741960310669d6bdc0646796853cb0a11823d86263a1aa7e6ee45c930f4cf75609d2e44f7ffdc5afc5ef553822d7cd560e67ffdd5b86af4620b07a6f5ead2c76ffc0a128b3656cba0a54a3beffcd80624e3252427d50ebc3d2e58f7c8f75679daa027df1eea46692177ca22a635ca4a2e3db36fa04be0b991558fc05f943325dd97ca7f30707c8c00c1e42571130abe63e954ced9"}, 0xe9) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x1, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) write$P9_RGETLOCK(r2, &(0x7f00000000c0)={0x29, 0x37, 0x2, {0x0, 0x100000000, 0xff, r0, 0xb, '\xa3md5sumuser'}}, 0x29) tkill(r0, 0x10000000000013) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000140)) ioctl$PIO_FONTRESET(r4, 0x4b6d, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_setup(0x80000000, 0x0) 01:01:17 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x480}) 01:01:17 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2394.794179] binder_alloc: 9634: binder_alloc_buf, no vma [ 2394.840088] binder: 9634:9638 ERROR: BC_REGISTER_LOOPER called without request [ 2394.847818] binder: 9634:9636 transaction failed 29189/-3, size 0-0 line 2970 [ 2394.923763] binder: 9634:9636 got reply transaction with no transaction stack 01:01:18 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r2, 0x0, r3, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2394.978855] binder: 9634:9636 transaction failed 29201/-71, size 0-0 line 2762 [ 2395.034341] binder: undelivered TRANSACTION_ERROR: 29189 [ 2395.042018] binder: undelivered TRANSACTION_ERROR: 29201 [ 2395.139712] binder: 9634:9648 transaction failed 29189/-22, size 0-0 line 2855 [ 2395.149763] binder: 9634:9638 got reply transaction with no transaction stack [ 2395.188815] binder: 9634:9636 ERROR: BC_REGISTER_LOOPER called without request [ 2395.229911] binder: 9634:9638 transaction failed 29201/-71, size 0-0 line 2762 [ 2395.268617] protocol 88fb is buggy, dev hsr_slave_0 [ 2395.274051] protocol 88fb is buggy, dev hsr_slave_1 01:01:18 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x500}) [ 2395.285351] binder: undelivered TRANSACTION_ERROR: 29189 [ 2395.294010] binder: undelivered TRANSACTION_ERROR: 29201 01:01:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mkdir(&(0x7f0000000100)='./file0\x00', 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000540)='./file0\x00') [ 2395.427717] protocol 88fb is buggy, dev hsr_slave_0 [ 2395.432892] protocol 88fb is buggy, dev hsr_slave_1 [ 2395.438116] protocol 88fb is buggy, dev hsr_slave_0 [ 2395.443271] protocol 88fb is buggy, dev hsr_slave_1 01:01:19 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2395.910637] kauditd_printk_skb: 133 callbacks suppressed [ 2395.910651] audit: type=1400 audit(1555635679.363:44781): avc: denied { map } for pid=9661 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:19 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="2700000003000000040000000000000000000000000000000600000000000000766d6e65743100"], 0x27) [ 2396.026717] audit: type=1400 audit(1555635679.363:44782): avc: denied { map } for pid=9661 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2396.129149] binder: 9662:9668 ERROR: BC_REGISTER_LOOPER called without request [ 2396.140172] audit: type=1400 audit(1555635679.383:44783): avc: denied { map } for pid=9661 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:19 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x3f00}) [ 2396.216288] binder: 9662:9674 got reply transaction with no transaction stack 01:01:19 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x900}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2396.263019] binder: 9662:9674 transaction failed 29201/-71, size 0-0 line 2762 [ 2396.287361] audit: type=1400 audit(1555635679.393:44784): avc: denied { map } for pid=9661 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2396.333205] binder: release 9662:9668 transaction 3101 out, still active [ 2396.357699] binder: undelivered TRANSACTION_COMPLETE 01:01:19 executing program 0: open(0x0, 0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0xfffffffffffffe5b) r0 = gettid() ptrace$peekuser(0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0xffffffffffffff41) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) ptrace(0xffffffffffffffff, 0x0) write$P9_RWSTAT(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) tkill(r0, 0x1000000000016) [ 2396.417932] binder: release 9662:9668 transaction 3101 in, still active [ 2396.424802] binder: send failed reply for transaction 3101, target dead [ 2396.447679] audit: type=1400 audit(1555635679.443:44785): avc: denied { map } for pid=9661 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2396.447913] binder: 9662:9676 transaction failed 29189/-22, size 0-0 line 2855 [ 2396.507746] binder: undelivered TRANSACTION_ERROR: 29201 [ 2396.624006] binder: 9662:9668 ERROR: BC_REGISTER_LOOPER called without request [ 2396.645168] audit: type=1400 audit(1555635679.443:44786): avc: denied { map } for pid=9665 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2396.714766] binder: undelivered TRANSACTION_ERROR: 29189 [ 2396.783817] audit: type=1400 audit(1555635679.463:44787): avc: denied { map } for pid=9665 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2396.905792] audit: type=1400 audit(1555635679.473:44788): avc: denied { map } for pid=9665 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:20 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2397.033341] audit: type=1400 audit(1555635679.473:44789): avc: denied { map } for pid=9665 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:20 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2397.156673] audit: type=1400 audit(1555635679.483:44790): avc: denied { map } for pid=9661 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:20 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x4000}) [ 2397.357754] protocol 88fb is buggy, dev hsr_slave_0 [ 2397.362883] protocol 88fb is buggy, dev hsr_slave_1 [ 2397.507728] protocol 88fb is buggy, dev hsr_slave_0 [ 2397.512897] protocol 88fb is buggy, dev hsr_slave_1 [ 2397.775218] binder: 9696:9697 ERROR: BC_REGISTER_LOOPER called without request [ 2397.814436] binder_alloc: 9696: binder_alloc_buf, no vma [ 2397.835754] binder: 9696:9697 transaction failed 29189/-3, size 0-0 line 2970 [ 2397.862120] binder: send failed reply for transaction 3106 to 9696:9697 01:01:21 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2397.893941] binder: undelivered TRANSACTION_COMPLETE [ 2397.905410] binder: undelivered TRANSACTION_ERROR: 29189 [ 2398.038671] binder: 9696:9708 got reply transaction with no transaction stack [ 2398.039363] binder: 9696:9697 ERROR: BC_REGISTER_LOOPER called without request [ 2398.046050] binder: 9696:9708 transaction failed 29201/-71, size 0-0 line 2762 01:01:21 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) times(&(0x7f0000000080)) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="2700000003000000000000020000000000000000000000000600000000000000766d6e65741100"], 0x27) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x1) [ 2398.093157] binder: release 9696:9709 transaction 3108 out, still active [ 2398.110472] binder: undelivered TRANSACTION_COMPLETE 01:01:21 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x4603}) [ 2398.267796] binder: undelivered TRANSACTION_ERROR: 29201 01:01:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2398.329804] binder: undelivered TRANSACTION_ERROR: 29190 [ 2398.335525] binder: send failed reply for transaction 3108, target dead 01:01:22 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:22 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000280)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2399.143956] binder: 9724:9728 ERROR: BC_REGISTER_LOOPER called without request [ 2399.208946] binder: 9724:9730 got reply transaction with no transaction stack [ 2399.309064] binder: 9724:9730 transaction failed 29201/-71, size 0-0 line 2762 [ 2399.357666] binder: release 9724:9728 transaction 3111 out, still active [ 2399.364549] binder: undelivered TRANSACTION_COMPLETE [ 2399.410485] binder: 9724:9730 got reply transaction with no transaction stack [ 2399.432948] binder: 9724:9728 ERROR: BC_REGISTER_LOOPER called without request [ 2399.458172] binder: release 9724:9734 transaction 3113 out, still active [ 2399.465919] binder: 9724:9730 transaction failed 29201/-71, size 0-0 line 2762 [ 2399.476548] binder: undelivered TRANSACTION_COMPLETE [ 2399.499893] binder: undelivered TRANSACTION_ERROR: 29201 [ 2399.567853] binder: release 9724:9728 transaction 3111 in, still active [ 2399.576061] binder: send failed reply for transaction 3111, target dead [ 2399.608193] binder: undelivered TRANSACTION_ERROR: 29201 [ 2399.650503] binder: send failed reply for transaction 3113, target dead 01:01:24 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2401.277064] kauditd_printk_skb: 102 callbacks suppressed [ 2401.277079] audit: type=1400 audit(1555635684.723:44893): avc: denied { map } for pid=9740 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.340239] audit: type=1400 audit(1555635684.733:44894): avc: denied { map } for pid=9740 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.395519] audit: type=1400 audit(1555635684.743:44895): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.430149] audit: type=1400 audit(1555635684.753:44896): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.482708] audit: type=1400 audit(1555635684.783:44897): avc: denied { map } for pid=9740 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.507882] net_ratelimit: 10 callbacks suppressed [ 2401.507891] protocol 88fb is buggy, dev hsr_slave_0 [ 2401.510344] audit: type=1400 audit(1555635684.803:44898): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.512905] protocol 88fb is buggy, dev hsr_slave_1 [ 2401.518130] audit: type=1400 audit(1555635684.803:44899): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.577723] audit: type=1400 audit(1555635684.843:44900): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.605577] audit: type=1400 audit(1555635684.853:44901): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.633822] audit: type=1400 audit(1555635684.883:44902): avc: denied { map } for pid=9740 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2401.668102] protocol 88fb is buggy, dev hsr_slave_0 [ 2401.673324] protocol 88fb is buggy, dev hsr_slave_1 [ 2401.678584] protocol 88fb is buggy, dev hsr_slave_0 [ 2401.683722] protocol 88fb is buggy, dev hsr_slave_1 01:01:25 executing program 0: timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) timer_gettime(0x0, 0x0) 01:01:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x4703}) 01:01:25 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:25 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="2700000003000000000000000000000000000000000000110600000000004800766d6e45743100"], 0x27) 01:01:25 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:25 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x8004}) [ 2402.342739] binder: 9743:9756 ERROR: BC_REGISTER_LOOPER called without request 01:01:25 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffff7f7ffffffa}]}) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x3) [ 2402.404110] binder_alloc: 9743: binder_alloc_buf, no vma [ 2402.417762] binder: 9743:9756 transaction failed 29189/-3, size 0-0 line 2970 [ 2402.461340] binder: send failed reply for transaction 3116 to 9743:9756 [ 2402.937730] binder: undelivered TRANSACTION_COMPLETE [ 2402.946117] binder: undelivered TRANSACTION_ERROR: 29189 [ 2403.027725] protocol 88fb is buggy, dev hsr_slave_0 [ 2403.033018] protocol 88fb is buggy, dev hsr_slave_1 [ 2403.081307] binder: 9743:9771 got reply transaction with no transaction stack [ 2403.149825] binder: 9743:9768 ERROR: BC_REGISTER_LOOPER called without request 01:01:26 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0xe600}) [ 2403.204730] binder: release 9743:9773 transaction 3118 out, still active [ 2403.216648] binder: 9743:9771 transaction failed 29201/-71, size 0-0 line 2762 [ 2403.230793] binder: undelivered TRANSACTION_COMPLETE [ 2403.271708] binder: undelivered TRANSACTION_ERROR: 29201 01:01:26 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2403.587724] protocol 88fb is buggy, dev hsr_slave_0 [ 2403.592897] protocol 88fb is buggy, dev hsr_slave_1 01:01:27 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9000000}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) 01:01:27 executing program 1: timer_create(0x0, &(0x7f0000000140)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:27 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x20000}) 01:01:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2404.210942] binder: undelivered TRANSACTION_ERROR: 29190 [ 2404.216811] binder: send failed reply for transaction 3118, target dead 01:01:27 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:28 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x1000000}) [ 2405.084583] binder: 9796:9803 ERROR: BC_REGISTER_LOOPER called without request [ 2405.121692] binder: 9796:9801 got reply transaction with no transaction stack [ 2405.177922] binder: 9796:9801 transaction failed 29201/-71, size 0-0 line 2762 [ 2405.201739] binder: release 9796:9803 transaction 3121 out, still active [ 2405.223228] binder: undelivered TRANSACTION_COMPLETE 01:01:28 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)) mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:28 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = syz_open_dev$usbmon(&(0x7f00000003c0)='/dev/usbmon#\x00', 0x64d5, 0x4000) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f0000000400)={0x2, 0xffffffffffffffff, 0x0, 0x1000, 0x6, 0x80000000}) r1 = gettid() r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000340)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) unlink(&(0x7f0000000380)='\x00') getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000640)=ANY=[@ANYRES32=r4, @ANYBLOB="f400000090e68c9d894a1b7fa1e7bfd20ee6999e5e16d83cfc28a5ad068f92d19dc13cb9d22dfe954145467c8af2f70aa1192fa0c21944b46bc71672696a182a0cc60a05eff295b27c839f404cf1d86015d9d6384a0757886e22167b8a1ff41b72c1d7df8a13164075c381997235df3306472b5cbb6b7f864ed5d4c73ec9f51c99e427eb2f750ac0f6e0628c7ac8e20f3442363e0da2560944e8364a1670037723fcc98620eeb519e622981b38521b35317679638868f7c1bc78f615e16355cff840f5ac269cf4f7d57cfae20998310b6e79a4ed3bb9ec59b57451ad2327a55db74ef6e43a75779b67ab1c090452b5a3418b1735c3b3e1edb056ef4aee76de1392490cfb57370dd0a188120a49702611063f304302d6a46d7f1a944cf9dceebd6a88d2e4a0ac5a76f6e660c6cf598209608cf793f8fc7a5b122e6e9ae1c40691ce484a17f6fbbd3409929d05b6a2f8a4f547f1563f0c0033dac92c1c4572cdb227aa3ebd85be4888c69de3eb"], &(0x7f0000000140)=0xfc) r5 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x80) socket$nl_xfrm(0x10, 0x3, 0x6) splice(r5, 0x0, r6, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000540)=""/164) tkill(r1, 0x1) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000840)=ANY=[@ANYBLOB="5220f7a8527b846747c569029d63bbe17e2e8fa0e05aed6054b8d58ec64d5fcebbd87974b768833aaf3c02c1b971f07d4895529dc7815d747ff28df63aec585275363b8c96a72effd2ad94068e40e9ab57f92a6c289345f5e5f80bf31e982a6938b546fb8b2ba3ace2283eba8d9dd660a263f7000db3180000"], 0x27) stat(&(0x7f00000001c0)='./bus\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGABS3F(r3, 0x8018457f, &(0x7f0000000540)) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000440)=0xc) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000480)={0xa0, 0x0, 0x5, {{0x2, 0x3, 0x6, 0x7344ae12, 0x9, 0x10001, {0x5, 0x4, 0x40, 0x100000000, 0x1000, 0x6, 0x9, 0x1000, 0x800, 0x4, 0x8, r7, r8, 0x7, 0x1}}, {0x0, 0x7}}}, 0xa0) 01:01:28 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfeffffff}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2405.389374] binder: 9796:9812 got reply transaction with no transaction stack [ 2405.396754] binder: 9796:9812 transaction failed 29201/-71, size 0-0 line 2762 [ 2405.431010] binder: release 9796:9811 transaction 3123 out, still active [ 2405.445081] binder: undelivered TRANSACTION_COMPLETE [ 2405.568143] binder: undelivered TRANSACTION_ERROR: 29201 [ 2406.138668] binder: undelivered TRANSACTION_ERROR: 29201 [ 2406.144334] binder: release 9796:9803 transaction 3121 in, still active [ 2406.186183] binder: send failed reply for transaction 3121, target dead [ 2406.233770] binder: send failed reply for transaction 3123, target dead [ 2406.638672] kauditd_printk_skb: 107 callbacks suppressed [ 2406.638686] audit: type=1400 audit(1555635690.093:45010): avc: denied { map } for pid=9827 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2406.727981] audit: type=1400 audit(1555635690.093:45011): avc: denied { map } for pid=9827 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2406.776210] audit: type=1400 audit(1555635690.093:45012): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2406.827818] audit: type=1400 audit(1555635690.123:45013): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2406.888785] audit: type=1400 audit(1555635690.143:45014): avc: denied { map } for pid=9827 comm="blkid" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2406.940595] IPVS: ftp: loaded support on port[0] = 21 [ 2406.996537] audit: type=1400 audit(1555635690.163:45015): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2407.042580] audit: type=1400 audit(1555635690.163:45016): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/libblkid.so.1.1.0" dev="sda1" ino=2825 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2407.097677] audit: type=1400 audit(1555635690.203:45017): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2407.137692] audit: type=1400 audit(1555635690.203:45018): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2407.233979] audit: type=1400 audit(1555635690.213:45019): avc: denied { map } for pid=9827 comm="blkid" path="/lib/x86_64-linux-gnu/libuuid.so.1.3.0" dev="sda1" ino=2819 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2407.641223] chnl_net:caif_netlink_parms(): no params data found [ 2407.798818] bridge0: port 1(bridge_slave_0) entered blocking state [ 2407.805305] bridge0: port 1(bridge_slave_0) entered disabled state [ 2407.813079] device bridge_slave_0 entered promiscuous mode [ 2407.940716] bridge0: port 2(bridge_slave_1) entered blocking state [ 2407.947083] bridge0: port 2(bridge_slave_1) entered disabled state [ 2407.956767] device bridge_slave_1 entered promiscuous mode [ 2407.970837] IPVS: stopping backup sync thread 26877 ... [ 2407.991715] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 2408.007256] device bridge_slave_1 left promiscuous mode [ 2408.013796] bridge0: port 2(bridge_slave_1) entered disabled state [ 2408.063809] device bridge_slave_0 left promiscuous mode [ 2408.069636] bridge0: port 1(bridge_slave_0) entered disabled state [ 2411.511853] device hsr_slave_1 left promiscuous mode [ 2411.550943] device hsr_slave_0 left promiscuous mode [ 2411.593486] team0 (unregistering): Port device team_slave_1 removed [ 2411.606437] team0 (unregistering): Port device team_slave_0 removed [ 2411.619858] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 2411.684810] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 2411.766681] bond0 (unregistering): Released all slaves [ 2411.835205] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 2411.860957] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 2411.868662] team0: Port device team_slave_0 added [ 2411.876753] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 2411.885045] team0: Port device team_slave_1 added [ 2411.893142] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 2411.903432] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 2411.999783] device hsr_slave_0 entered promiscuous mode [ 2412.048109] device hsr_slave_1 entered promiscuous mode [ 2412.128398] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 2412.145166] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 2412.214848] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 2412.448340] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2412.474759] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 2412.495318] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 2412.503502] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 2412.515611] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2412.538408] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 2412.544514] 8021q: adding VLAN 0 to HW filter on device team0 [ 2412.581676] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 2412.596546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 2412.614650] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2412.624153] bridge0: port 1(bridge_slave_0) entered blocking state [ 2412.630586] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2412.653532] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 2412.669532] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 2412.689083] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 2412.697129] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2412.715082] bridge0: port 2(bridge_slave_1) entered blocking state [ 2412.721526] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2412.741251] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 2412.748351] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 2412.774711] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 2412.781847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 2412.806413] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2412.819773] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2412.838747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2412.862651] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 2412.870648] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 2412.884901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2412.903336] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 2412.910882] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 2412.923395] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2412.946312] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 2412.962028] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2413.031497] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 2413.082622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2413.124219] kauditd_printk_skb: 12 callbacks suppressed [ 2413.124234] audit: type=1400 audit(1555635696.573:45032): avc: denied { map } for pid=9835 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.159836] audit: type=1400 audit(1555635696.593:45033): avc: denied { map } for pid=9835 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.190351] audit: type=1400 audit(1555635696.603:45034): avc: denied { map } for pid=9835 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.222791] audit: type=1400 audit(1555635696.603:45035): avc: denied { map } for pid=9835 comm="modprobe" path="/lib/x86_64-linux-gnu/ld-2.13.so" dev="sda1" ino=2668 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.248734] audit: type=1400 audit(1555635696.613:45036): avc: denied { map } for pid=9835 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2251 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.273181] audit: type=1400 audit(1555635696.623:45037): avc: denied { map } for pid=9835 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.299586] audit: type=1400 audit(1555635696.623:45038): avc: denied { map } for pid=9835 comm="modprobe" path="/lib/x86_64-linux-gnu/libkmod.so.2.1.3" dev="sda1" ino=2811 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.326077] audit: type=1400 audit(1555635696.633:45039): avc: denied { map } for pid=9835 comm="modprobe" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.359273] audit: type=1400 audit(1555635696.633:45040): avc: denied { map } for pid=9835 comm="modprobe" path="/lib/x86_64-linux-gnu/libc-2.13.so" dev="sda1" ino=2784 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2413.386197] audit: type=1400 audit(1555635696.673:45041): avc: denied { map } for pid=9836 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 01:01:37 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffff7f7ffffffa}]}) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:01:37 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="270000000300000000000000000000000000ec5aef5e1bf7e7bb6094080000000000000600000000000000766d6e65743100"], 0x27) 01:01:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x2000000}) 01:01:37 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) 01:01:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 01:01:37 executing program 5: socket$packet(0x11, 0x3, 0x300) r0 = socket$inet6(0xa, 0x3, 0x84) socket(0x40000000000001e, 0x1, 0x0) syz_open_dev$dmmidi(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) epoll_create1(0x0) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfffffffe}, 0x0, &(0x7f0000000140)={0x1b9}, 0x0, 0x0) [ 2413.988082] net_ratelimit: 2 callbacks suppressed [ 2413.988091] protocol 88fb is buggy, dev hsr_slave_0 [ 2413.998136] protocol 88fb is buggy, dev hsr_slave_1 01:01:37 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000840)=ANY=[@ANYPTR], 0x8) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x77de, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x2, 0x3000000}) [ 2414.147693] protocol 88fb is buggy, dev hsr_slave_0 [ 2414.152909] protocol 88fb is buggy, dev hsr_slave_1 [ 2414.158193] protocol 88fb is buggy, dev hsr_slave_0 [ 2414.163324] protocol 88fb is buggy, dev hsr_slave_1 [ 2414.170405] binder: 9844:9849 ERROR: BC_REGISTER_LOOPER called without request [ 2414.215209] binder_alloc: 9844: binder_alloc_buf, no vma [ 2414.237899] binder: 9844:9849 transaction failed 29189/-3, size 0-0 line 2970 01:01:37 executing program 1: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$selinux_attr(r2, &(0x7f0000000080)='system_u:object_r:sysfs_t:s0\x00', 0x1d) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) open(&(0x7f00000000c0)='./bus\x00', 0x480000, 0x20) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="270000000300000000000000000000000000000000000000c4ffffef00ee0000766d6e65743100"], 0x27) 01:01:37 executing program 4: timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = gettid() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") mknod(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0xffffffff, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r0, 0x13) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000040)={0x27, 0x3, 0x0, {0x0, 0x6, 0x0, 'vmnet1'}}, 0x27) [ 2414.277751] binder: send failed reply for transaction 3126 to 9844:9849 [ 2414.336307] binder: undelivered TRANSACTION_COMPLETE [ 2414.341733] binder: undelivered TRANSACTION_ERROR: 29189 [ 2414.376347] WARNING: CPU: 1 PID: 22479 at net/xfrm/xfrm_state.c:2383 xfrm_state_fini+0x213/0x280 [ 2414.386057] Kernel panic - not syncing: panic_on_warn set ... [ 2414.386057] [ 2414.393463] CPU: 1 PID: 22479 Comm: kworker/u4:19 Not tainted 4.19.35 #3 [ 2414.400320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2414.409753] Workqueue: netns cleanup_net [ 2414.413842] Call Trace: [ 2414.416451] dump_stack+0x172/0x1f0 [ 2414.420097] panic+0x263/0x51d [ 2414.423310] ? __warn_printk+0xf3/0xf3 [ 2414.427226] ? xfrm_state_fini+0x213/0x280 [ 2414.431482] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2414.437050] ? __warn.cold+0x5/0x54 [ 2414.440703] ? __warn+0xe8/0x1d0 [ 2414.444091] ? xfrm_state_fini+0x213/0x280 [ 2414.448349] __warn.cold+0x20/0x54 [ 2414.451922] ? xfrm_state_fini+0x213/0x280 [ 2414.456187] report_bug+0x263/0x2b0 [ 2414.459841] do_error_trap+0x204/0x360 [ 2414.463753] ? math_error+0x340/0x340 [ 2414.467587] ? _raw_spin_unlock_irq+0x5e/0x90 [ 2414.472109] ? __flush_work+0x48c/0x840 [ 2414.476102] ? error_entry+0x76/0xd0 [ 2414.479842] ? trace_hardirqs_off_caller+0x65/0x220 [ 2414.484877] ? _raw_spin_unlock_bh+0x31/0x40 [ 2414.489308] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2414.494182] do_invalid_op+0x1b/0x20 [ 2414.496227] kobject: 'loop3' (000000004889d801): kobject_uevent_env [ 2414.497911] invalid_op+0x14/0x20 [ 2414.497928] RIP: 0010:xfrm_state_fini+0x213/0x280 [ 2414.497942] Code: 41 5e 5d c3 e8 de 3c 7c fb 0f 0b e9 09 ff ff ff e8 d2 3c 7c fb 0f 0b e9 68 ff ff ff e8 c6 3c 7c fb 0f 0b eb c6 e8 bd 3c 7c fb <0f> 0b e9 52 fe ff ff e8 01 9c b2 fb e9 75 fe ff ff e8 17 9c b2 fb [ 2414.497949] RSP: 0018:ffff8880526e7bd0 EFLAGS: 00010293 [ 2414.497962] RAX: ffff88809c3bc400 RBX: ffff888096c70040 RCX: 0000000000000000 [ 2414.497982] RDX: 0000000000000000 RSI: ffffffff85eef853 RDI: 0000000000000001 [ 2414.497990] RBP: ffff8880526e7bf0 R08: ffff88809c3bc400 R09: ffff88809c3bccf0 [ 2414.497998] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888096c71b80 [ 2414.498006] R13: ffff8880526e7cc8 R14: ffffffff891b67f8 R15: dffffc0000000000 [ 2414.498029] ? xfrm_state_fini+0x213/0x280 [ 2414.498069] ? xfrm_policy_fini+0x2b0/0x2b0 [ 2414.511664] kobject: 'loop3' (000000004889d801): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 2414.512762] xfrm_net_exit+0x25/0x70 [ 2414.512788] ops_exit_list.isra.0+0xb0/0x160 [ 2414.599575] cleanup_net+0x3fb/0x960 [ 2414.603314] ? unregister_pernet_device+0x80/0x80 [ 2414.608173] ? __lock_is_held+0xb6/0x140 [ 2414.612265] process_one_work+0x98e/0x1760 [ 2414.616535] ? pwq_dec_nr_in_flight+0x320/0x320 [ 2414.621229] ? lock_acquire+0x16f/0x3f0 [ 2414.625237] ? kasan_check_write+0x14/0x20 [ 2414.629568] ? do_raw_spin_lock+0xc8/0x240 [ 2414.633837] worker_thread+0x98/0xe40 [ 2414.637678] kthread+0x357/0x430 [ 2414.641073] ? process_one_work+0x1760/0x1760 [ 2414.645598] ? kthread_delayed_work_timer_fn+0x290/0x290 [ 2414.651075] ret_from_fork+0x3a/0x50 [ 2414.656015] Kernel Offset: disabled [ 2414.659894] Rebooting in 86400 seconds..