18/02/28 09:17:35 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000fd090000000000000000000000000028000000000000007998489f39526f03c6d41ac78343cf9200000000000000746cfc025573a7da00f55c95dd6712ccfbeb9d7fd767dd092e40c86c1635561638efdfefa17649f728e91fb856598f71e5ae6633ca541e299e1bc63d869674b0ed31fd344d02fcaff4087f71e7aed891d48cdac90e538e508e9791a2b0481c1700d9713b927914b898c17e81b5554df9b0eec9d61e5b3c99f030de52c50b70c5da601a57a1576c229f64396e8d3732b7b9229f1972a5c534a3f6112f81812ad93a827a6efbabdb98bf3c44a8651d78bcf40008e64681dd1d8b2edb100ac954712fe62b1414b02ba31750ed8cbf23554983e38b4c322a6ce93f14983a16d65bf93a578687b12808720c349d2e2af68353f7fdb19c4ce965d915cd5bcd252f8fb37c66fb49f5a68505c01d78c268ab7c5f66af6fc3c62bb593931615f2a4c586c9a5289d2dcb17c88a5d8f701af2eace1fc994bdcba7ca80ec0aa9e63a3d245c4d303e85ab9215ec5f24f5d31c340550577a4ec85d94611feb2be66794abb2c845f78f150522267648486ea299e73d6cd261", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="f1ffffff8c9174dd6f513270098a18ffc6fdd37c5aae9d5cc12a257aabfee7d7df1657dd954507ae7f0c5d84e580a22380f2ae6d7292092c20051ac16659e4831a4204c3139ed23f106633f0e81405813a4a9a5e11fa22409498587726a9d3c4192e630d2b0515185b9a8a63cf3395e5dd2d12e0f4540dae5e92de18f6cd6cfcb7f44f5a971ccc664ae4e84663fd30a78ac7926700c37287f0697dedc86366949be482f5db009a3fca441e2408add4dd3a4242", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:35 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  130.153200] name failslab, interval 1, probability 0, space 0, times 0
[  130.164481] CPU: 1 PID: 18735 Comm: syz-executor5 Not tainted 4.16.0-rc3+ #242
[  130.171835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  130.181185] Call Trace:
[  130.183771]  dump_stack+0x194/0x24d
[  130.185613] binder: release 18732:18741 transaction 324 out, still active
[  130.187392]  ? arch_local_irq_restore+0x53/0x53
[  130.187405]  ? __save_stack_trace+0x7e/0xd0
[  130.187435]  should_fail+0x8c0/0xa40
[  130.187452]  ? fault_create_debugfs_attr+0x1f0/0x1f0
2018/02/28 09:17:35 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[], 0x0)

[  130.187463]  ? kasan_kmalloc+0xad/0xe0
[  130.194406] binder: undelivered TRANSACTION_COMPLETE
[  130.199013]  ? kmem_cache_alloc_trace+0x136/0x740
[  130.199022]  ? binder_transaction+0x13c1/0x81c0
[  130.199029]  ? binder_thread_write+0xc57/0x3840
[  130.199038]  ? binder_ioctl_write_read.isra.38+0x261/0xcb0
[  130.218943] binder: release 18732:18741 transaction 323 out, still active
[  130.221043]  ? binder_ioctl+0xb72/0x1417
[  130.221054]  ? compat_SyS_ioctl+0x151/0x2a30
[  130.221066]  ? entry_SYSENTER_compat+0x70/0x7f
2018/02/28 09:17:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000000080)={0x6, 0x7, 0x101, 0x0, "7279b6a4de464beaf2ac4d32791c3eb9c87d63ddd6deb8282f31fe734a51ab462589050be10f9a63fedc51a2", 0x8001})
r2 = getpgrp(0x0)
socket(0xa, 0x80000, 0x80)
ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000100)=r2)
syz_emit_ethernet(0x4e, &(0x7f0000000140)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, "4cc4f7", 0x18, 0x2b, 0x0, @empty, @local={0xfe, 0x80, [], 0xaa}, {[], @icmpv6=@mld={0x0, 0x0, 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}}}}, &(0x7f0000001400))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627775a19d30", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]]})

[  130.221079]  ? trace_hardirqs_off+0x10/0x10
[  130.221100]  ? find_held_lock+0x35/0x1d0
[  130.221148]  ? check_same_owner+0x320/0x320
[  130.221158]  ? lock_downgrade+0x980/0x980
[  130.226043] binder: undelivered TRANSACTION_COMPLETE
[  130.230628]  ? rcu_note_context_switch+0x710/0x710
[  130.230653]  should_failslab+0xec/0x120
[  130.250503] binder: 18747:18750 transaction failed 29201/-28, size 2621440-5924941918927126528 line 2963
[  130.251843]  kmem_cache_alloc_trace+0x4b/0x740
[  130.251858]  ? __lockdep_init_map+0xe4/0x650
[  130.251886]  binder_transaction+0x1433/0x81c0
[  130.251903]  ? rb_erase_cached+0xf50/0x3540
[  130.251912]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[  130.251923]  ? print_irqtrace_events+0x270/0x270
[  130.271962] binder: undelivered TRANSACTION_ERROR: 29201
[  130.273522]  ? rb_next+0x140/0x140
[  130.273563]  ? binder_transaction_buffer_release+0xbc0/0xbc0
[  130.273573]  ? print_irqtrace_events+0x270/0x270
[  130.273584]  ? find_held_lock+0x35/0x1d0
[  130.273601]  ? print_irqtrace_events+0x270/0x270
[  130.273626]  ? __lock_acquire+0x664/0x3e00
[  130.292560] kernel msg: ebtables bug: please report to author: bad policy
[  130.301306]  ? __lock_acquire+0x664/0x3e00
[  130.301320]  ? print_irqtrace_events+0x270/0x270
[  130.301343]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[  130.301361]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[  130.301372]  ? print_irqtrace_events+0x270/0x270
[  130.301384]  ? __lock_acquire+0x664/0x3e00
[  130.301398]  ? __lock_acquire+0x664/0x3e00
[  130.301407]  ? find_held_lock+0x35/0x1d0
[  130.311084] binder: 18733:18738 unknown command 19
[  130.314860]  ? __lock_acquire+0x664/0x3e00
[  130.314870]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[  130.314889]  ? lock_pin_lock+0x360/0x360
[  130.314907]  ? trace_hardirqs_off+0x10/0x10
[  130.314922]  ? trace_hardirqs_off+0x10/0x10
[  130.314941]  ? update_load_avg+0x249/0x2d80
[  130.322342] binder: 18733:18738 ioctl c0306201 20000080 returned -22
[  130.324404]  ? find_held_lock+0x35/0x1d0
[  130.324431]  ? __might_fault+0x110/0x1d0
[  130.324444]  ? lock_downgrade+0x980/0x980
[  130.324461]  ? lock_release+0xa40/0xa40
[  130.324471]  ? check_same_owner+0x320/0x320
[  130.324487]  ? lock_release+0xa40/0xa40
[  130.336845] binder: 18733:18738 ioctl 358f37d8 20000140 returned -22
[  130.338164]  ? check_same_owner+0x320/0x320
[  130.338182]  ? __might_sleep+0x95/0x190
[  130.338207]  ? kasan_check_write+0x14/0x20
[  130.338229]  binder_thread_write+0xc57/0x3840
[  130.338263]  ? binder_transaction+0x81c0/0x81c0
[  130.344522] binder: 18733:18738 ioctl 8070ae9f 20000180 returned -22
[  130.348767]  ? lock_downgrade+0x980/0x980
[  130.348784]  ? lock_release+0xa40/0xa40
[  130.348812]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[  130.348844]  ? kernel_text_address+0x102/0x140
[  130.348861]  ? rb_first_postorder+0xa0/0xa0
[  130.348873]  ? unwind_get_return_address+0x61/0xa0
[  130.359181] binder: 18733:18738 unknown command 20
[  130.361853]  ? trace_hardirqs_off+0x10/0x10
[  130.361896]  ? find_held_lock+0x35/0x1d0
[  130.361921]  ? __might_fault+0x110/0x1d0
[  130.361934]  ? lock_downgrade+0x980/0x980
[  130.361949]  ? lock_release+0xa40/0xa40
[  130.375741] binder: 18733:18738 ioctl c0306201 20000080 returned -22
[  130.377794]  ? check_same_owner+0x320/0x320
[  130.377823]  ? __might_sleep+0x95/0x190
[  130.377852]  ? kasan_check_write+0x14/0x20
[  130.377874]  binder_ioctl_write_read.isra.38+0x261/0xcb0
[  130.377884]  ? __lockdep_init_map+0xe4/0x650
[  130.406682] binder: 18733:18738 ioctl 358f37d8 20000140 returned -22
[  130.410325]  ? binder_thread_write+0x3840/0x3840
[  130.410336]  ? __init_waitqueue_head+0x97/0x140
[  130.410348]  ? init_wait_entry+0x1b0/0x1b0
[  130.410369]  ? _raw_spin_unlock+0x22/0x30
[  130.410384]  ? _binder_inner_proc_unlock+0x2c/0x50
[  130.414659] binder: 18733:18764 ioctl 8070ae9f 20000180 returned -22
[  130.419761]  ? binder_get_thread+0x320/0x870
[  130.419777]  ? binder_inc_ref_for_node+0xbc0/0xbc0
[  130.419797]  ? check_same_owner+0x320/0x320
[  130.419822]  ? __might_sleep+0x95/0x190
[  130.427969] binder: release 18755:18763 transaction 326 out, still active
[  130.428146]  binder_ioctl+0xb72/0x1417
[  130.428168]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[  130.432560] binder: undelivered TRANSACTION_COMPLETE
[  130.436769]  ? check_same_owner+0x320/0x320
[  130.436785]  ? rcu_note_context_switch+0x710/0x710
[  130.666625]  ? __might_sleep+0x95/0x190
[  130.670576]  ? _cond_resched+0x14/0x30
[  130.674440]  ? selinux_file_ioctl+0x444/0x690
[  130.678909]  ? __fget_light+0x2b2/0x3c0
[  130.682856]  ? selinux_capable+0x40/0x40
[  130.686898]  ? __sb_end_write+0xa0/0xd0
[  130.690846]  ? exit_to_usermode_loop+0x8c/0x2f0
[  130.695494]  ? security_file_ioctl+0x7d/0xb0
[  130.699873]  ? security_file_ioctl+0x89/0xb0
[  130.704257]  compat_SyS_ioctl+0x151/0x2a30
[  130.708466]  ? do_fast_syscall_32+0x156/0xf9f
[  130.712936]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[  130.718532]  ? do_ioctl+0x60/0x60
[  130.721962]  do_fast_syscall_32+0x3ec/0xf9f
[  130.726265]  ? do_int80_syscall_32+0x9c0/0x9c0
[  130.730820]  ? _raw_spin_unlock_irq+0x27/0x70
[  130.735291]  ? finish_task_switch+0x1c1/0x7e0
[  130.739761]  ? syscall_return_slowpath+0x2ac/0x550
[  130.744662]  ? prepare_exit_to_usermode+0x350/0x350
[  130.749651]  ? sysret32_from_system_call+0x5/0x3c
[  130.754473]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  130.759292]  entry_SYSENTER_compat+0x70/0x7f
[  130.763670] RIP: 0023:0xf7f65c99
[  130.767008] RSP: 002b:00000000f776109c EFLAGS: 00000286 ORIG_RAX: 0000000000000036
[  130.774698] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000c0306201
[  130.781939] RDX: 0000000020008000 RSI: 0000000000000000 RDI: 0000000000000000
[  130.789180] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  130.796421] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  130.803664] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
2018/02/28 09:17:36 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[], 0x0)

2018/02/28 09:17:36 executing program 2:
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)

2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:36 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="852a62773e8b839d92e9b139cf8300000100cd8937f2e71f8dde05d5953b3633fe6f6f2bccea5f9e07bde76fd5bedb4bc25698cb51d3582a49389d62", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB=' '], @ANYBLOB="010000000000000000000000000000000000000000000000df7e4f1d9a836b0ebcb12100900aebefae86e713de128e10407419fc9a89951b18ee98c75ba208d4d3fd3370da755c90694029ee7083c10dac0edca287f43b1b57e4b3c1db5ec7eaf8341a19bd7cff0000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
prctl$setmm(0x23, 0x5, &(0x7f0000fff000/0x1000)=nil)
r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x7f, 0x10000)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
connect$l2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e20, @broadcast=0xffffffff}, 0x0, 0x2, 0x1, 0x1}}, 0x2e)
r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000200)=[], 0x0)
ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000040))

2018/02/28 09:17:36 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0x0, 0x2, [{{{0x11, 0x40, 0xa, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:36 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
r0 = socket$l2tp(0x18, 0x1, 0x1)
fcntl$addseals(r0, 0x409, 0x8)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = open$dir(&(0x7f0000000300)='./control/file0\x00', 0x0, 0x0)
r3 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r2, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000, 0x10, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xc0, 0x0, &(0x7f0000000280)=[@acquire={0x40046305, 0x1}, @release={0x40046306, 0x2}, @clear_death={0x400c630f, 0x0, 0x3}, @reply_sg={0x40486312, {{0x1, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000040)=[@fda={0x66646185, 0x1, 0x1, 0x2a}, @ptr={0x70742a85, 0x1, &(0x7f0000000000), 0x1, 0x4, 0x19}], &(0x7f00000000c0)=[]}, 0x1ff}}, @release={0x40046306, 0x4}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000200)=[], &(0x7f0000000240)=[0x18, 0x28, 0x70, 0x78, 0x38]}, 0x3ff}}], 0x0, 0x0, &(0x7f0000000380)})

2018/02/28 09:17:36 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="0800000000200000b02b61133c0f8b050180000000000000e5964bb73b3cdf0e03f6c5cc66ad8e7ec47df8286f69fbb725cb3715f0427524b31e8e493acd7d35b3493b88faba38b874478963524778e42e3444bf4fa7f85387930154787652ac0d8ca1d9d77b222214efe398ee31ce5032d81a66da1dedc6b2d1570cc3f98cabaa5b21e9bb4304547839a0df55ae51aa3562da2496a9bceb53c578072a00bbdfe90772861dc98d977b9ded87717d542cb7f42153bff640089b2bcd852648306efae34652adff74596e990a9800e206e72844a17211996a09749a5114f5eb29945a805e7243e2adfb8988ec7f15a7acf57443c66d94916cc4f09459e3d4976899b141ee3e23321a23507e6a349078f48251be760a6ed935eaecb80a83a17bf3b0520464564a091d1904"]], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x4, 0x10000)
ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f00000000c0))
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x10000, 0x0)
openat$vnet(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-net\x00', 0x2, 0x0)
r3 = fcntl$getown(r0, 0x9)
getpgid(r3)
ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r2, 0x800443d2, &(0x7f0000000080)={0x2, &(0x7f0000000140)=[{}, {}, {}]})
ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000180)={{0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xe}}, 0x4, {0x2, 0x4e22, @empty}, 'ip6gretap0\x00'})

2018/02/28 09:17:36 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[], 0x0)

[  130.811053] binder: 18731:18735 transaction failed 29201/-12, size 40-0 line 2914
[  130.821494] binder: undelivered TRANSACTION_ERROR: 29201
[  130.844977] binder: 18786:18789 Acquire 1 refcount change on invalid ref 1 ret -22
[  130.852765] binder: 18786:18789 Release 1 refcount change on invalid ref 2 ret -22
2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  130.860520] binder: 18786:18789 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[  130.867507] binder: 18786:18789 got reply transaction with no transaction stack
[  130.867552] kernel msg: ebtables bug: please report to author: bad policy
[  130.874962] binder: 18786:18789 transaction failed 29201/-71, size 72-0 line 2763
[  130.880565] binder: 18788:18790 got transaction with invalid offset (35184372088840, min 0 max 40) or object.
[  130.897566] binder: release 18791:18793 transaction 328 out, still active
[  130.900356] binder: 18788:18790 transaction failed 29201/-22, size 40-8 line 3026
2018/02/28 09:17:36 executing program 5:
pipe2(&(0x7f0000000000)={<r0=>0xffffffffffffffff}, 0x80000)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x0, <r1=>0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000180)=0x14)
sendto$packet(r0, &(0x7f0000000040)="882e3b28ff29c065628666bd690b40a0d31fba06b7343cd45e8360dbf4906cddd2f9de985697efb7164b6d410e89fe8f26cad80079b422e4206b1b2a94597e0db3716147167b1c401d4a3c902d0510f4641439e3d8cd0513bf054d8643fe4b949968c0d8d0e8ce5edf61498df68ef1912eff164ef0e861a0de9c21e9051e608c1f2e9caf9f811d8d29f17eb5700374497c8198fc51881e3355692e8610fd2d30bb196ad66717459744cb9cbf6789ae602cf1076a23c451d1a15dd8b82be8228c7575b3c70b2db4bdb9c65d6f17c400", 0xcf, 0x1, &(0x7f00000001c0)={0x11, 0x0, r1, 0x1, 0x1, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x14)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x5)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="ff0000000000000000000e5a0b5cd3000000000000000000000000000001"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:36 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$inet6_udp(0xa, 0x2, 0x0)

2018/02/28 09:17:36 executing program 3 (fault-call:1 fault-nth:0):
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x10000000)
r1 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x401, 0x400000)
ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000200)={{0x2, 0x4e24, @multicast1=0xe0000001}, {0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x7c, {0x2, 0x4e21, @empty}, 'dummy0\x00'})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000004fbc)=[@clear_death={0x400c630f, 0x3, 0x4}], 0x43, 0x0, &(0x7f00000000c0)="2730334b24fbff070000583581000095b3000000080000abd6824f3786329b612038c88e14d97e5247989839b0409d132224326ad0deb108af18f8337c08718f000000"})
socketpair$inet(0x2, 0x800, 0xffffffffffffff25, &(0x7f0000000040)={<r2=>0xffffffffffffffff})
ioctl$sock_ifreq(r2, 0x8947, &(0x7f0000000140)={'nr0\x00', @ifru_data=&(0x7f0000000080)="2e21f9a7a89036bf725f83da8c081ee33a400751fda94277ebe76c2fac9644c5"})

[  130.906756] binder: undelivered TRANSACTION_COMPLETE
[  130.923436] binder: 18788:18790 got transaction with invalid offset (35184372088840, min 0 max 40) or object.
[  130.925253] binder: release 18791:18793 transaction 327 out, still active
[  130.940502] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:36 executing program 3:
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
syz_open_dev$audion(&(0x7f0000000340)='/dev/audio#\x00', 0x1, 0x0)
fstatfs(r0, &(0x7f0000000140)=""/126)
signalfd(r0, &(0x7f0000000100)={0x3}, 0x8)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4008641a, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[0x40, 0xfff]})
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
r2 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffa)
add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000240)="9e8d816e00b0770f368bb9e111db15785b9bd2a0b89af4af7d11c2e52f125014411317a8fb0ec3b1b652de938f74da8b5a9e5cb5f920244459ddae3b57ce066678d1c4f802c98ccc0fbd35309c778af7b1783a7a9c6b96151c84bdd4bf7d56e3ff4c930c1050c3b74d400cb7468bed", 0x6f, r2)

2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  130.958622] binder: 18806:18811 transaction failed 29189/-22, size 40-0 line 2848
[  130.968195] binder: 18788:18790 transaction failed 29201/-22, size 40-8 line 3026
[  130.970688] binder: undelivered TRANSACTION_ERROR: 29201
[  130.990695] binder: 18814:18816 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3
[  131.005792] binder: release 18807:18815 transaction 334 out, still active
2018/02/28 09:17:36 executing program 2:
r0 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x7, 0x200000)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000000c0))
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  131.012816] binder: undelivered TRANSACTION_COMPLETE
[  131.015644] binder: 18806:18824 transaction failed 29189/-22, size 40-0 line 2848
[  131.020283] binder: release 18807:18815 transaction 333 out, still active
[  131.032603] binder: undelivered TRANSACTION_COMPLETE
[  131.040444] binder: undelivered TRANSACTION_ERROR: 29201
[  131.041930] binder: 18814:18816 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3
[  131.054659] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:36 executing program 3:
r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0)
syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0x0)
ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000180))
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc00c64b5, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0, 0x0], 0x3})
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:36 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000340)={0xaa, 0x10})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f00000003c0)={&(0x7f0000011000/0x2000)=nil, 0x2000})
pipe(&(0x7f0000000000))
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000380)={&(0x7f0000013000/0x4000)=nil, 0x4000})
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000000300)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:36 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = getpgrp(0xffffffffffffffff)
process_vm_readv(r1, &(0x7f0000000140)=[{&(0x7f0000000000)=""/130, 0x82}, {&(0x7f00000000c0)=""/79, 0x4f}], 0x2, &(0x7f0000000300)=[{&(0x7f0000000180)=""/81, 0x51}, {&(0x7f0000000200)=""/137, 0x89}, {&(0x7f00000002c0)=""/13, 0xd}], 0x3, 0x0)

2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:36 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x3a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:36 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000000c0)='/dev/snd/midiC#D#\x00', 0x7ffe, 0x200000)
setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000040)=0x2, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:36 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x800, 0x0)
getsockopt$inet_buf(r1, 0x0, 0x29, &(0x7f0000000300)=""/70, &(0x7f00000000c0)=0x46)
r2 = gettid()
r3 = fcntl$getown(r1, 0x9)
kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r1, &(0x7f0000000100)={r1, r1, 0x101})
r4 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x400040)
r5 = getuid()
r6 = getuid()
sendmsg$nl_netfilter(r4, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x422}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="700100001106200026bd7000ffdbdf2500000008adee4a8294175c6c6cf1c913835c7a395d5034c44d40d707ef7fe4191f3359fdffc8f708c1fb24ec428fe5e52205e3eb9985206f9d450f70fe3d60027f094231ccb5209b795305b369e840a777e23940c459ed264a2ae43ee4441ece6e932cab97c755f303e4a6b020cb75777e70a7cfec2d105dc1e6346f1ef3bfeffb7935d35ff4ed8fe8233c0119ed8af49e8a8639256a726fe1fcd58f1de14e87c000750018008700000000006367726f75706d696d655f74797065000c006c0000000000", @ANYRES32=r5, @ANYBLOB="4d3fe9a512244941e070f1870fa75c7a2a08a0859dedf1f20b7811244eb46ab2c974db97be9d56316b82de16a8be06eb4dcf72c513e6d78cbf9f8429a7b9e203c453c46e52093d596ea7cce3d82b061382b85e0a220c5b28353e0263bc285a9a0eae79b166b1712a3e1e3d17640a8ccc76132815d74fadbe04476b4a2230030c00780000000000", @ANYRES32=0x0, @ANYBLOB="0c00050000e82d000000000000a6300069d445e58a4a5c0000", @ANYRES32=r6, @ANYBLOB='\x00'], 0x170}, 0x1, 0x0, 0x0, 0x4000010}, 0x80)

2018/02/28 09:17:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x404, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0x70, 0xb8, []}, []}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  131.070721] binder: undelivered TRANSACTION_ERROR: 29189
[  131.076227] binder: undelivered TRANSACTION_ERROR: 29189
[  131.082475] binder: release 18827:18829 transaction 336 out, still active
[  131.089447] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0xfffffffffffffebd, 0x0, &(0x7f0000000000)="7336603b25901f0ad4ee51c1e7fc74c3601abc586e222d340a608400f4b9642bc1e6acd7e57d1705c054efbbf999bdcab32cac8488baeefc31a0e7b1099582aea4a7563b14cc83ee2198adde64039a7b80c4b9845e384c8175c1551c8b86599f029acd493ef7b3e91b09e070fe570d2c9b1b97097d2f5f004d4ad44c4f6262796ef19cf49a8940e9447bf3c0b37f2caac8174f5badd873ca52b7d37b7650a4cfe8965898200e1dcee15d0b4b9ad2c235f2ca927afd87bc6b25dcaf9016d2b14eba9fc0e821a07927ef8dfdd3384ed4ad8ec2e2601f000000000000000000000053445799177512cfc4a29eb6936525393819062f0e8feb1143"})
r1 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x838, 0x0)
getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000200)={<r2=>0x0, 0x3e, "e9ae0e896b7cb1ffe834602d86cfe317a105a95a411bc419162aa9fcbd5408380c6ba81aef639fb617a0160a50694fccaa1cf49a91929b51d3e1e207c273"}, &(0x7f0000000280)=0x46)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={r2, 0x0, 0x3}, 0xc)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000140)=@sack_info={<r3=>0x0, 0x1}, &(0x7f0000000180)=0xc)
setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={r3, 0x800}, 0x8)

2018/02/28 09:17:36 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1, 0x280080)
ioctl$KDADDIO(r1, 0x4b34, 0x4deb)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:36 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
write(r0, &(0x7f0000000080)="082e12c79d232f7d81fb6dff5b59df7a8ca4ae925c0f827b7b79e2a9a735515572df84d52422ee3853d4cd81c8de6f53b7c3c4b965e62143d863521029d2bde538ff726e204a8f61a5c95d953acb2bd6443cf2d1e68be73e6c73608e50b7c664bc4a6157ace85fef1433a613b7c438bf2c82c821c69ac7b60a4e17b4ceffc31e6215ffb8b4a3d767623610c688099cedf6784197d0ae8e1138570a6e2d9f096c8f79", 0xa2)
getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000380)={@remote, <r1=>0x0}, &(0x7f00000003c0)=0x14)
lseek(r0, 0x200000000000000, 0x3)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000400)={@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @ipv4={[], [0xff, 0xff], @empty}, @remote={0xfe, 0x80, [], 0xbb}, 0x339b, 0x7ff, 0x8, 0x400, 0x3, 0x40, r1})

2018/02/28 09:17:36 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627742909a05", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000080)={0x0, 0x9, 0x4, 0x4, 0xffe0000})
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)

[  131.129135] binder: release 18837:18841 transaction 337 out, still active
[  131.136163] binder: undelivered TRANSACTION_COMPLETE
[  131.149919] binder: release 18834:18840 transaction 342 out, still active
[  131.156922] binder: unexpected work type, 4, not freed
[  131.162235] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:36 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x801, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000300)={0x2, 0x1, 0x3, 0x2, 0x1f})
r3 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:36 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x4)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x46200, 0x0)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={<r2=>0x0, 0x8}, &(0x7f0000000140)=0x8)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e24, 0x7fff, @mcast2={0xff, 0x2, [], 0x1}}}}, &(0x7f0000000240)=0x8c)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x2, 0x0)
ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:36 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x50, r0, 0x0)

2018/02/28 09:17:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x600, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x9)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x7)
mq_unlink(&(0x7f0000000040)='/dev/binder#\x00')

2018/02/28 09:17:36 executing program 3:
ioctl$ION_IOC_HEAP_QUERY(0xffffffffffffff9c, 0xc0184908, &(0x7f0000000100)={0x8, 0x2, 0x1, <r0=>0xffffffffffffffff})
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x1)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x7ff, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000000)={0xfffffffffffffffe, 0xfff})
socket$alg(0x26, 0x5, 0x0)

[  131.172069] kernel msg: ebtables bug: please report to author: Wrong len argument
[  131.186456] binder: release 18838:18845 transaction 346 out, still active
[  131.193449] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:36 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x404, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0x70, 0xb8, []}, []}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:36 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a62770000003a8239d216847dea7d7a913adf00aaf134c8", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

[  131.219980] binder: release 18838:18845 transaction 345 out, still active
[  131.224521] kernel msg: ebtables bug: please report to author: Wrong len argument
[  131.226999] binder: undelivered TRANSACTION_COMPLETE
[  131.235391] binder: release 18854:18858 transaction 347 out, still active
[  131.246824] binder: undelivered TRANSACTION_COMPLETE
[  131.263733] kernel msg: ebtables bug: please report to author: Wrong len argument
[  131.274837] binder: release 18887:18888 transaction 360 out, still active
[  131.281864] binder: unexpected work type, 4, not freed
[  131.287167] binder: undelivered TRANSACTION_COMPLETE
[  131.293719] binder: release 18870:18875 transaction 359 out, still active
[  131.300912] binder: undelivered TRANSACTION_COMPLETE
[  131.306070] binder: release 18870:18875 transaction 358 out, still active
[  131.313028] binder: undelivered TRANSACTION_COMPLETE
[  131.318196] binder: release 18867:18878 transaction 356 out, still active
[  131.325119] binder: undelivered TRANSACTION_COMPLETE
[  131.330257] binder: release 18867:18878 transaction 355 out, still active
[  131.337182] binder: undelivered TRANSACTION_COMPLETE
[  131.342333] binder: release 18866:18884 transaction 357 out, still active
[  131.349258] binder: undelivered TRANSACTION_COMPLETE
[  131.354387] binder: release 18866:18872 transaction 348 out, still active
[  131.361313] binder: undelivered TRANSACTION_COMPLETE
[  131.366464] binder: release 18868:18871 transaction 352 out, still active
[  131.373387] binder: unexpected work type, 4, not freed
[  131.378673] binder: undelivered TRANSACTION_COMPLETE
[  131.383796] binder: release 18868:18871 transaction 349 out, still active
[  131.390725] binder: unexpected work type, 4, not freed
[  131.396000] binder: undelivered TRANSACTION_COMPLETE
[  131.401171] binder: release 18834:18840 transaction 339 out, still active
[  131.408185] binder: unexpected work type, 4, not freed
[  131.413483] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:37 executing program 2:
r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
fcntl$addseals(r0, 0x409, 0x5)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000016c0)={<r1=>0x0, @remote, @rand_addr}, &(0x7f0000001700)=0xc)
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000001740)={@mcast2={0xff, 0x2, [], 0x1}, 0x8, r1})
syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mq_timedsend(r0, &(0x7f0000000040)="4c4a7885345695cf74a2397df078023011346dcdc20fd9621ff4442ab0a26c283e9145fb0d4eb3aa2388e64ac1", 0x2d, 0x3, &(0x7f0000000080)={0x77359400})

2018/02/28 09:17:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x808)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 0:
r0 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x3, 0x4000)
ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f0000000100))
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xfffffffefffffffe)
socketpair(0xf, 0x4, 0x1, &(0x7f0000000040)={<r2=>0xffffffffffffffff})
connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00 \x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x404, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0x70, 0xb8, []}, []}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:37 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x3a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:37 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x800080000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:37 executing program 3:
r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x200002)
ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140))
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$inet_tcp(0x2, 0x1, 0x0)

2018/02/28 09:17:37 executing program 3:
r0 = socket$inet6(0xa, 0x1, 0xfffffffffffff801)
setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:37 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4080000, 0x30)
ioctl$VT_ACTIVATE(r0, 0x5606, 0xd79e)
syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063404000000000000042ef34c6d6876b9e0000000000000000000000000000000000000000000000280000000008000000000000000000007f656f0f1711b459229f0483fab7853f058f6576597d107809df22036fde56bbc43ac4fe4102eb1ab74b9773b780a6cfb79772130196cb96d20cdb6610009cda78620963fc4d4e056fcde2b3392dae5a2fb08b4a4195f11698cc2d5350f686050fb5c4b951fa089881383c575cbcea1728f189bc0a048b1f1389032e23", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  131.418667] binder: release 18835:18843 transaction 338 out, still active
[  131.425640] binder: undelivered TRANSACTION_COMPLETE
[  131.444588] kernel msg: ebtables bug: please report to author: Wrong len argument
2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000240)='/dev/cuse\x00', 0x1, 0x0)
write$fuse(r1, &(0x7f0000000280)={0x50, 0x2, 0x0, @fuse_init_out={0x7, 0x1a, 0xb81f, 0x38, 0x200, 0xf157, 0x5, 0x181}}, 0x50)
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x222240, 0x0)
getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000040), &(0x7f0000000080)=0x4)
getsockopt$ax25_buf(r2, 0x101, 0x19, &(0x7f00000000c0)=""/50, &(0x7f0000000100)=0x32)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="00c2ce24000000e5ff000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
fcntl$getown(r1, 0x9)

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x0, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a6277007c8e00c66d9fa2eae5ee88097afffd7a0f3e2e943f6a03c0cf31d4f0e6eaa0700f28d68e4b7b481a0ae40d277e3bb40ff2e9bf20b0b78f711039d4d40496fb5132d6e397c2338203dc7765b6671aeb95785441e854702762769d40bf1608f55fea6814bc763922a7956b2b7eca9d184f93eb701acea24cce6e1137a29cce4fa3008da95c26c753cc9783a04d0b9a37d1d9aa2299cd0397ed13feeb818351e1c02f74d55728039670795354f077c07ada078c0e55b84b27c71f29ae1d0fc92738ec7bb7b639056cd9f55e732faa47da30", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3f, 0x80040)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000040)={{0x6, 0x7}, 0x0, 0x3, 0x80000000, {0x6}, 0x80000000, 0x1})

2018/02/28 09:17:37 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x11c, 0x0, &(0x7f0000009000)})
r1 = gettid()
get_robust_list(r1, &(0x7f0000000040), &(0x7f0000000080)=0xc)

2018/02/28 09:17:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
socket$packet(0x11, 0x2, 0x300)
r1 = socket(0x11, 0x100000802, 0x0)
sendmmsg(r1, &(0x7f0000007980)=[{{&(0x7f0000000ec0)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x0, 0x0, "7ec90fd0f15979c640f35e732363a895b7305693e8a49fdc80ab9d094053c30cf878b7ad83a3865c26c01c2791d3b13a4d6ba09698cfd3fe807bcb8b89e006"}, 0x58, &(0x7f00000014c0)=[], 0x0, &(0x7f0000000040)=[]}}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socketpair(0x5, 0xa, 0x8c7, &(0x7f0000000000)={<r2=>0xffffffffffffffff})
ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000f40)="cba6fe8bbf2d78a110971a44727cc7532ea01f37819b095bd56ec2248a84f78ee671e853b6d7a725bc4332840db2ead33fef765fc7bb8ad182d1b78595381057e8777e61dded0bce44f4e9ce3c2045600562e0d899daaca116007eae00073218c47dc654234ec1ec7f3b30e8c30169ad6948bca8b4ffc34dac23d380a56542eb990fa337888c1ea18c68d7fe550d71a08033ba65b3fbe04264d169179e03d2455026b48a78e582085add82ed838c10724e3ed0c8cdfa9ecd070b0dd82ec6356821e24ae1f54ded09e4b107bc6d55e3fcfbbc71a9a0e2f4507d07f2b0ff89bef5c31c9bdeaf43c5eb5d114f240f6b8c809a829e0448aa175d963aa8f31758c1b35ca7ee282981f298f91755a60e9dafab55c8957eb0f60c2b88f61bddcee4b79fc2503770759271c28921b93aa9beda8d5d5b1322d1a64faa55cd77a052d0c2c4355ee3bb8a785df6fac163fc80a286c3020b0064ab9fe31a1b72b69f21c65fbed7ac4d385ec21332b70e7140b7d12bf35d508fc40913109baee37cd40220bcbb64e33cf91dc54c1df88cfbe7109c3149e16ba324c253abafb79a2bd3668daea611fc91ce066bb1244a5d34b5054662a932948733f0e7f4991a0f37a58c870f0a2ad37ed6573371f84a178317b751caa446789e0f1cb94b2e0ccfcbbf0804c99b7da18b294013f6f6e6499ec4bddbefcff55ff61341b8a7c138ac17bff2f11fc5ae49dcceb5d4f559f2885040bf45ac11a9e3acfddeee3b439302afd6df4af50c683fdfbd7039b3173013162e66d112dbe7f158017fa5b25264c7b5139181302fdad9d6c069c7f40120293ddc2e98a490889a424a707acd877e3a9bd353d85d516a0196bf912441f3b136b6281be81a8d5ff6e4ced4681de9a17932fbc4ae5f126446a4459cb138ccdee1688a86edf3fbaadb4203b4a796cfefaf11901f20f419c060cd8111cd22f0a3a16967f3abedb308f2d42ba8b20cc824c90c35bc385f2626f9e9ab82b2d474d44bf7faa6f6357852e77b32d61b811e1c1e98287cf93c63b4eaaf269b3a5ad897e3ce20cc79a54ace37073f2521555ac74f603cc88f213ff5aaea6ff9c3c0029fba999a4b02646d047f11aac953a2fc6400607e07f4adcdf3f4c4a14bccf71ff49abe1d2cc347f0c8d9e880a06489311e22c416b725c7d5f782cf084445900f63b4ecc57f1d02cab179dd1f6b81248a3bc81c5434f04b013777c36bcb6213c79ed4e0aa710283b21aff7f47b69e4fc9eacd13840cd388dcde97675a60452aa60b5ab3dbb99f3bbd6d786875ebec5b8e995681ba5a49b1295a8e96cc7b119e909052ab9133a6e4f725c0c47821f4e83e6259408a2e536ac460552b33edbce5c4d69509c307e72bbc77b5bdf2be924d8358511ffa1b63b19a5b8ee099f7223979aa1705a8c5ae421ecf580e717a47ea1273c2b734ae7a20b74660050dabd645a0b7fc0566822b3954d47ddddb57ee5cdb11d66026225a0c8f40825568de3a4bed13e71717d0d199f4459203e15b97fa03efc059c622f55ec49254022893965b707abce781f2a7f5bd35ee9510c0ec06c8bc7a73deb79fe3b1148e4793f360da16128c08dc99e101f4e4e475a15907a5a7c94eaac0f5670eebf2fabdef806ab580dc00fc7a561fae6fcd3798e6ff12978f6ec06e445ceace16974339d13ce0ed7cb8d632b052ffd93ac39cd9074749991cca2b26fe6a90f84ef8bb80569c62e8997418825c7349e1c9bb4523ff9b0aa5873d0890cd7267fa90021bfb5aa3f75f2b64c0dba6e80f5f5c759e9294408ef12828bba825c9bac8037e9cd9203f9c378db4dc2aabe09b2e28a91b8baec0b89e6969c431c19ee152604dbd28608d2c62312609d1061c58d35e76bcb52b845f59680bab1093100c354ddef5b89f1bb57092e7bde02640c8402dfc9994274ae9f022bfdbf9b01113e6ea67205e8ed481eea5835515bfe01b0ce730253810e6955c3f17720b0fd046aef5e9a986c06d50269941876cd7833c58d7c5db7b5e540a9cd4a2a116b4a01ef5a6f19d3fdd2b8f22fb445a85ee625fb57f8f7463a452616a2944d42b67a09d0011b18608a5695b1038f0abd69801ed43124e780236f5ec2bd267889d8f30fb25bf61239f8445c6b1b0e1f1e34a6cad2467096b91e646ff85f882e67a36ef9939b9eb0c6a0ea6df1e817bd34ddbcbadb1edc34315fb1527da99e7f56758fe4a608f7ed44e796aa67c74ff728738a9ca9ec9160bb0e6f3daafba824604ec69cef22fed5755ac4dbdd8037f1054d542532b05a5ed6632e605c8e3549ef28ea1607f868d01a73ffe8f89a81fc5417cdb4b68bb6745fbb57d305c007ce37c381aedab4d6a858e164b328370272e8adbe16a3af388ec8ae1576854155a9b4e8ecde200ea2cc8040ef4af7b16918a23095b96db2b9587aeffc93258de76b8393d8d4510c90dd70856052d787db54db1c548a292e5f6272861ac0e02d9869b6ccbff0fd9350d0b6883a1ab6c08d26403f4aedf6bf3f7f9099f97dc561f71503640343bc3bbab423ccec7347c3dcfb597cd35c9d4fc56c513b1583ffbe9ada1d2b76cc3fbaaa94499b25efdc14fb26951daa1e0141cd5a1d4ea84102db97c9040f99fa45ba1e5116554de5206147b5eedecfcc82b68cd80ec963a3ee600bf27361d900a56a9a27f0ea6cf1d937cc07e49d22ad08929a219af67f79cf8f36c5087e05e2dabb57990a588e2df6283094dea9891ed4c22091fb11276a49a8e1c37c29ae816b819e8408ca697c7fa3bd33ac28f560d0ffc84c0f04ef8e5d23bf28b3a341c4280424bf3168280b8d8dc348b771a59992d40ee46e8efec616c8ff0c05d820cf6987b8e7de896b2d2a84461f373ef0758e79e108869bc8e3d7f0faae918a412a3865d9136d7342fb9d89a7af73e989fe9ba53300ee78f2f325dc012fb1c386b36db86835f6a7c0d6877ec95833ad3a5afd64922ac7a8e9f89d029d850f882d6c79f753f752619b036c00eab5fdaada7c40b640c77f8ab54644b88fbf694dd8635821774378f927559c061d40c0301ca42f81aecb77b23ceaab77b7127d7481c8a6007fef0921a0d7310f866f48930abfcf7c1c029779862919ae4ca0d3a5366831c39795fccfed04ea81a9f700d04ee131b5e064f7372ac5fab4fdac5c964f0d6949cfe2bffeedd828ef1003407157f85fee88846a993b3ddb854bfb0c4910704e797c67d5d33216fd294be7a9c3eec47ea2068195f3ffe06e802e0b08140d20842136714975e6c09541199cdf3733aedcf1be43f36a16687984e52b334ccdeb0b2c82a3865ecbda7af120ec4c164dbfe1bd1adabc0168b0f42fe88014f3ae37ee4e3558a2f1b390c92a38ddc44a76141bb966e4814bdf60656325ee1a00fe86b80b7a74845bfe0d0a11a3d92c3caa65a32d9dc87e9e7d271436d03a7c46fc5c6eca15e866ad9218ffa6ae5c301792830a635a9d2da172a3a2d8d88a7ee29d4069ddcd3267e55ea68a61543b7fa361c92ebeaba65f6063db64f6742d58e9d0f45bcbddd15f6439040db6bce2497f43479ff36b6ae93f78ad675fa42871465432b3a77792dcf8b721561c2a1a949557f5326f0b6778fd3d8bcfeeecb80158454a461d361f5c0f607f942bb3da23fd84ee105c7d357628f443f44469cd30210b6bb301a0ffac1b7593f64ccdac9ce8d650bf1a10f1328524e29379fd36b46cd5b737aaa4e954273e93454a3f1fbf15792cb1df56bbf47be58b91c3c8da580564be79e4ccd467d4377cea0d0299d7a40f9a3beb1c68ed875f13d91b4165aca2f0082e0b5384604f7504a5ed8f13d7b691e9b0f0e4dd9150962f1b8d3bade45d841c8a5e5aacfeb8b4deb49d8ed635496eee06ba954cbd1d2b935f1a10bd894806c9fa960224af86c60fd17247445d759df0760a9755938c4ed47bb4d93a66cb47e9581fd2749c8a16a9bcedcefcbb8bf613aecfba1f0c5311d0cfa2bcfdcfdafd99c8da0508276602280d79d5fd985039770026823d5676c56b2481c8007062faee37e04f2d3454012d230457aa3e98295b4a4b861b88d75941293237c9e5bd5924da3b71e6c464ac220bef51a70a932154694e2c3add54079d1363453733cc360d5de840a021db3c8accab50a8019bb441a03838b03e7e4cb0f1cf3845e6959f0ab6ce9ea2b7b951da0509f78d7bfa52d1b538e61f95d8f069248e6d940785fe7037f64997df54e16f59446afff85a619fc5f142ebf8de291a31da8ba8d723d016e9812f2998ab2a35b502f34cfa23bda9e7986e70c31cadda36b1bcb39b59c1fcca9bf2fdf325a53e7b2a110952095e425ca2acf0260f3db98295783def58dc6ff17c0212045b09ac4223de2c9121a42c58648064689b31671e81973ed769449542ee07d1918f8ad321e164017fb3ba9ad1934b386cad01688cd72cc8f092cadcf2c1de63044008af5d435cdc5f4da29b83e5a2fae401f06c00f89752ff4fed6761af5d884a4dc3abc8c74d6934b8aa5659cb2db6d9261f20df366890c90cf767535127d4dba41232fdcf6bd53ebcf65e14d7bfc127ecabf5440240bbea51b19a7c5a223a36c46c35a363ae2ca970a2a05f9eb24e03c4e08323222eb3055d18eb8482c5aab0305b03274474535cd6be1c01f5fa1ca0e7cef350f6789fffea2bdbb54b2cceb0382143b7b5c5947a2d4382fdbf69844e9954b0cbb6c7f556d615d8a0b75fabb8daede257116bad874e36e32a96b8bf3f2fee68b662e15774a7fbaeb25a892feb2e9b12e965d5f4a46569ca9fda339b5dd063f697fb1bdadcc7ad02aab417d7b27356ce564bc3e844f6b679acbcd0dac61610d8420a311cb75ce77b7598edca50e62a0de5e6e62fb338c6fd9de3dcb3ff1fb8f82d80c7cddc3fa6d236a8f8520ada43323526d0a738e25841a2d96cb0bc24f53b653599519287e1c08996ce8435c40ea7d495b94b5f1bb61ad8a8950f8e4e617fa8f8aad1e8ef7df088903ee419404fbd3e73ca205eb9aeb913bd4304290cf15cd26f9a5af8ebe174da9098b1d602b1d3fd4883f48a42bbd1149b6ab2a7b0a155d22559dd1a68ad8b79474748e93ff8ae0526a6c05fc875ebc9f3935889d1f52fbcd2ba42d16755106459b0416a5965a37bb9afeb7b2251e33720db4c4c9908c1c49629615e7662245682d826c1031edf20a9046dd42b19f9b557a44de6f02cd953ce89a3312156a7e5aeced535cfc252fc2036d24e6b894fdff5fd5665925d489f7d15bd9907de09dba5b56e3379e2dad99192478186da887581d1550f1c32c00961efc139f3cf5b03813c60f0b4d4527eb211f8af352365a62c91b29626300f907bf8b88b4c8317ba3620df4d51ea2a36f651df9a9335d7cbb647080a38712ee39714833d5610f21a4b922eb83b3fef1c3e34c917ef3a065c9a51b09e720805e64e047e563bed383b36d5918703f644b98042034dbd08fd1a2b855b0dd9c31bc023e9ac2d68a3fa7e9fae5388d4e52c74313607298f7367165e766139294cb6a9e4499fc5a70e073e53ef9b847decc0879a2a939e91f95fd3c01726c015b3ea95f8ae5b33e9f3bab104f36d28c4d283eacf7c00f17804713e9e5dfe05243888b5ed87ab7a3a0a4baa6925d88500a536ae7571ca2302c26de40f41134e97707ad5e57c6f0f2e89753c9d6993c855da991bdd4a34b7e07d6c07e46bf287118d266cbfcec95586a0a8fe93f6e298c03415f676ababf1523a110b96ea2feef64a17bafeb43e1f41657c80b41851d25d7aa645c44e4d758597c3db76fc4e53bd66a524b59fc750f9afc3ad1b2")

[  131.465319] kernel msg: ebtables bug: please report to author: Wrong len argument
[  131.475349] binder: release 18899:18912 transaction 366 out, still active
[  131.482385] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x80)
r1 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x6, 0x0)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0xb04, 0x7, 0x1000}, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000004000000000000000000000000000000000000000000009355de65b8f1c187382e335aa9e00000000000002800000000000030bf476168e509128dbc7e09fbc1ab21126a2bddccedbb", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="0092ea39bf3a58b98485858c228ba3dd0d9b8503ee3d57a6a10388628441c787e8b6c27e8a90762fe4d8498ee68ad435269b45fd8b7a966f4b32b40df41d88a992f9903516da5047b46701"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  131.516521] binder: release 18899:18904 transaction 364 out, still active
[  131.523568] binder: undelivered TRANSACTION_COMPLETE
[  131.553161] binder: 18935:18939 got transaction to invalid handle
[  131.559516] binder: 18935:18939 transaction failed 29201/-22, size -2258174562284304447-11258999068426240 line 2848
[  131.573828] binder: release 18926:18931 transaction 370 out, still active
[  131.580820] binder: undelivered TRANSACTION_COMPLETE
[  131.586357] binder: release 18926:18931 transaction 369 out, still active
[  131.593398] binder: undelivered TRANSACTION_COMPLETE
[  131.598905] binder: undelivered TRANSACTION_ERROR: 29201
[  131.604396] binder: release 18919:18928 transaction 368 out, still active
[  131.611346] binder: undelivered TRANSACTION_COMPLETE
[  131.616468] binder: release 18919:18923 transaction 367 out, still active
[  131.623417] binder: undelivered TRANSACTION_COMPLETE
[  131.628708] binder: release 18896:18910 transaction 365 out, still active
[  131.635682] binder: undelivered TRANSACTION_COMPLETE
[  131.640808] binder: release 18925:18943 transaction 373 out, still active
[  131.647741] binder: undelivered TRANSACTION_COMPLETE
[  131.652870] binder: release 18896:18908 transaction 363 out, still active
[  131.659801] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:37 executing program 3:
r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9, 0x800)
setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000080)=0x9, 0x4)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:37 executing program 4:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc\x00', 0x2, 0x0)
mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000003, 0x30, r0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x44, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0063404000000000000000000000000051193c4700000000009678f1ef00279d14288d979409000000000000280000000000000000000000000000806e6857fd480bc3dfd3f5abc9a95a315eb952f41dd46f71f187b01d1c327ccee2596b4dcfd21e1371b19f650cc50cbbf8a1582545ed29528ffa069cce1910b6", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYRES32=r1, @ANYPTR], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x67, 0x0, &(0x7f0000000000)="00105ed732b57e8ca2adbe72662ce3ba2f565591c271d1c6c7cdef8ced6184216a0e3e994543ac95e41a5d8ad91f48943de3fb19ac24fa1e6ae1f4f931f0a486baf92088a774389330b297d9b143a768dca00931988923f34563d99b7d2e53a60499a402bfbd9a"})
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000140)=0x5, 0x4)
r2 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x400000000, 0x3)
unlinkat(r2, &(0x7f00000001c0)='./file0\x00', 0x0)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000280))

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x0, 0x0, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, <r1=>0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000040)=0x14, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000009c0)='/dev/snd/midiC#D#\x00', 0x26e7, 0x34001)
ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000a00)="3a0d605a774036c8544d7ba79f7b9e746542ecfc0599daabc5d47ef60f2bd8c3feca66ba9f88947c532be6f50bbe0c76bd0fbe6d7b57361e948f61802651cab35c2a3f642df377b844a7db0bcbe412c350587eebf35a415990865373584c270e5c0915ae9740b05e02c0279cb569f3126fd28735dfb0ef82860becca609202ab7b653a3b3a829e6c0a5511057950c49c060c19f4f98aae5c4e1f37db4341773c7d63276e5e1c8abb8142d6b4dfbb26fec82bb218954c8fa7b612d12ac6c19a2379879341e9102200a8716750c52b957e116aca0f")
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{{@in=@rand_addr, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000180)=0xe8)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@local={0xfe, 0x80, [], 0xaa}, @in=@multicast2=0xe0000002, 0x4e24, 0x5, 0x4e22, 0x2, 0x2, 0x80, 0xa0, 0x37, r1, r3}, {0x1f, 0x4, 0x9, 0xffffffffffff8000, 0x0, 0x1, 0x1ff, 0x1f}, {0x4, 0x9, 0x8a0, 0x7}, 0x0, 0x6e6bbf, 0x3, 0x1, 0x1, 0x2}, {{@in=@broadcast=0xffffffff, 0x4d4}, 0xa, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0x3500, 0x2, 0x3, 0x40, 0x1, 0x6, 0xfffffffffffffffc}}, 0xe8)

2018/02/28 09:17:37 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x12, 0x0, &(0x7f0000000040)="1b78c0e8c2ef30b045df7af0040700afd4a0"})

2018/02/28 09:17:37 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x10010, 0xffffffffffffffff, 0x3)
r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0)
ioctl$sock_bt_hci(r0, 0xc00448df, &(0x7f0000000300)="db68bf26e58004eb82f71c0c43a3d0c4550dcf02a8e9d688dc41e9de0aad7897fff4d3e52944788509dba4ce6f013ef5b43e3fdc27cd92a047cd181f454d992fe9949e5927a4a1350e91f6f0e85ce28ebe7ee0bf2bcb13fde02f2b4a5716d0901b79903febb8f0ed925602cdc145bee4f43e14935c69cff44516a1883cd055a82fe44f601698c2196027d9ab3e92c9bc5a62c67975ec405b44bde728dd09ddc87115388b2262232fef2ff748c23cb739daee1fccddb8710e4470f521326a7e3daf9dfcf47bc56bc768f8295e30e450e033bd09160e4c4a91c32d7e351134754e559c2281b66175ae4f241d910dca6a577caed3b1dd40e6bce74cfac3226d7fd8e261ad60d9bb1efc0f67956d078a0270bb64bd413ae6572272645e05a6811f98c9c2c8f19431eeb620577d529390e5377dbce3e238a958addade011bd3a5e964609ebcae68165b83a432d80b9823290047b577301515ec67dbc19a02cb0a1ac05194f392faff0e4a71efe8d4078a9126998436f212e931be4ba066ce97fc5f615f7859c6474601174c2ce02433fda4537a3af8174e89143e095e4568901bb13df01fc3bbc80319375b6ec56d1c385bcbf1557c7d8aacd8c283fbe212f1e372429adc28d832c6bc942ad9dccc2501410df4e6013d3512f68a3fa0f6e40ec575b4be0a7c611af2829b52a0199f2c8c6ab5c55afb8ef4e132632266349fa9487bc1e5657fb821e425cd0a60308eade7295bb6e91a44871049f2e0ced91a4eaae91a6935e500467bb0c4c494d3e8153d2732e476bfdc397785630b1b01d4854135933a5dd2077bcef3827b95d899760b4ce02f626e1634299395542d07ad36cd3c056907dc5db01a016f5ef8cedda69ccf70ce21969b7cd087eb8b5acef3817f21901a6d695f378a6f3b99ef6fd5d0d5f114a09f558094d9e648e5644c2571cc2d8de7199420bcefbe23d0ff4f2ec473a970bbd1dfee86dc00f96786b81c84ecc97744829568357b9a6a1986c9a457afc76781af6f854202bb01abcb61199c7baa70f1434618d5f82b57b1194c3476d882cf178483f24e5a4ec7593ac9f6a80a55dbcafde51df01810219219aff6db618256af05325d7092f26a3eff8163f82b25d9f8b2de960af3d8b2eb092c0afe9e8b1cd7734cf34d910c73f243cae51d8b8c7cce06f7763dae25d48828ad0f9fef99b2410d0faf47628adace7559fa06f6e42e42ddc247d15225a3fcea9a0f38393ef86926481643083d73d3bdfd755ec535983397132bcd6a87a84208ad628367b69f4dfe50a2099038491a9a0a427bba3a52b25c4ebd97ef5d8a7abe70e4499bcd74435e4aaa36a8569ae46a021b39df33fb04ae63d9ed952672e9505bbfa7151363fb7a74a7526739e50b7f5460a0b61127e0db76b7cc431a082e8bef951641ce25abe95b94a2ea3634b6f681dc4f281572eeda3f4cf56792aa361fa7e52f04d54731477a6fcac9da931d752ba1da4ea41d32d8dd64232d271d431acba6643a381abffaf013a8007d1852e1ee3acf7453492654d566e5d02d5e140be2f672884051d7ca95ec577012473abdc856581ab07e17c0c530936d2f943afe0406e130519a175c214a581b450571d505e8b92253a82e4e268f91f3cd0108a7a513b285f8190ff2734ca252cd92c344dd32a3b9faf0fc1f05cc70fd12b3dff234814dc79a69b4207282e62a84b2b7826ca7b286a0367b1fbbfbc43717b592b347a9b7084f021c9b4ae0aa7580b2ccb743dd3fc9a62dd165daac32c1a3d3d47a55253692cab2c6365b0a90b38bff6c7ab1616243cfb53f3f0a1784610d06340524464ff999d043cec9c528f661fa31ee3c2cd2f97b19c9c6b0b0eb6433f41ae71a8351a1b625cca25d2067df2ed2e8a53368210eaa2a5d0512c60cd3582e319e15651351436bcdaa4723c134978799dd018b00c7640b4fbce786046892a461eab3a4b8da706083491e36c286d76d94bc61fd310709494df6f32b3e30cd300f9de00387443f2b1b7a4173209e66bf45d28cc39e3f02c7200669b0fbc72656bb70547c223d6b3bfe0bcf4d2efbd7e02938ec3a7731f6dc47776844d50cce809d5291a5e0f07e0a5cc435fe0301abeb729028a66eeda182992fc7184a321dc2bb7a19c744f568f32b2107e43c6b0bbd6edfbcd1df70e57d0f15f3f2f9ee3d06bddd5ffafc2fb8121489e940bfdbfbf27137205e2683f59d7fa7a8b75a4f684a4a8caee341e55c76943e6e021724493e746e47bb3a62c8970043592a6381e75c5ed83a4aa9ef345614b99ab4b043080e25b37b658e28c332450df63c8a54decda640c3308fd60f9552ca2cb24fdffcaf1a8d8b8ef35cf7a23861ae4163eaa41b886063c6376a21c8433d0a9b2cbb482012fed8af78db8e667ff0e127434efd7aca28c9fe4bde90d991b5f3c0200d0f611383c7ac96d3bb82fcc43c63ba5e9011df2e3ece6ac8cb0e3968c2c05f1b123f56a23b4ac73398ac588353c6f2d003b39218a3da2c6606b0750c7c696a18c5e10798adbd803ee6641331ed78e14f1feaafa26009997ada9a9e8298da1d7da0f5882a8512809d653431d084ae78d7918ea5b8e0d76676851139c987522cdb0135028d69edace7132edc6eeaa1c4baf81eb8c9947e4d05158fcd5c4de9ddef8054d70f399c8e78a573951ed01f15be493d144af9cb5f27f807010fd21f33ec4e0fbce36c952a0aefd95c027a171682d316963410dc2fa981c4459682152192bd8dc0bcc884d5e2947fce5603166f85ea79be2864eb00bc465c10c614a25cdbd59658ccb3c9c6afe9df96793bf729b2b1704cc7287f8707333fcc1afaffea91cc24cd412b6fd5731218042d9400f02d4b22dd36a6c28f065eb4279af77364589049851fdc41192e2d27b7dfbd7731916e81515b14cffaeb79e470e37e1c73b83048229cdcd73b8f57211107c66ee7ebfe3d4819cf6502fea7c2f866ce88b023c3041ecd5f4fc508f91f4100e1d2854a9dbcaf1c55ade314db3f4fe353270ccf7766fd759a74ef328324a5c04f46d81bf53e32370935cc478ab9fd7f5e90fa11b0ba7434a8204e54c577afa9c62d6e9b36999c6bc6ae7b86818417ca05913c60c14885deef4b3ff84082079ec0e59608ef1b65fb0672740938a838690ab45978940f2c3a8ef214c4ef8c6907039ef73ba87bd61bfd43a0d6453caac22b8ad62562ccfdd7551bdb7eaa6ba17a5c5ee98fac5485300762d9f73c55560ec8c1bb384e5e21b6e61e9e1e6ddea508c23bc261d35a714e1e2820aa08bfdcaa9fdd8441f382051907aba2b66e76a8ac47387a04ca0f76616a479f079e918ad4c72689f92b54df836496999bab00464c2dc159b3d7561cc1a88bb5ccb86f2bbd6a4cea4b2ba5555cd9d5ecc979ee703d5b34772bb927085d7f34efc9cc21a63d9b6dc478107d68b7498ad3317cbc89822ed6688b9f5573550c0f96d465fe4136fcf3086fd03827055973968eb55df3026cc94c347e7a12195d3d5055880dde54889dd5175cc62a9f9895eb1a7dcec608882072a3b5a85a2605ed1a0dccf09b3b26368b464b655e43b0274e90afa13f24da420daa3bf9000eb485c45d43ef02238f7df0a61c6d104db5dd446e760aab5a253846a6b20d8685a2e7dae47a7da5b9ab1e1697f72b272518e5d80a8a9e3818a1c89036b23f492d998eb3d5f63a90a3ab32ca46299851a1d140bbb120a2be1fd4b854d51c098b8646f49df84fd29a3dc09119e9fc5d75f903c2bae3f3704ee8359cde59cc7d006a2cd4c066aeead1ef5acfeda774dcc3e535bac346ebde296dab8359c2b65997381d4b897af47422580adefa2b8fbe23d3a4d1178ff3a7ff2309813da62c80547cb33c8871cd0441462a7898c49b7befad8e4c70d3792dce2d9b60b8cb568efe34d564dc75d47a4e25998332235e2add02465441df847b99626994d2c1dfe7d025f22baed014c66c45b616a3cef3c1d7f059f47d05df4a8dc3092685e0c1816817bf2ae77d16ae73b60e7eb0dab5df471478b6abca71e384a858a259bf13ce462468b8bb1d46346164a378eef302b0179f48740d5d4197b4ec0195c1779baec95904ab37f70776b187e090f1a2333dc072a4e4120ad6f5da5c7882f3ed446eac9421246cc2a2d01aedc6baddd1dcd1960816ce8b2fdc56971828d5d3b8b7ea3d2d2dd5c261d876b2f093347d841796dcfbceb6e7347a3ac14f1a6391d182ac80cb5e5a9dd0fe1f656a6ff3cc694b82dd2e519f06025f3e429c7ba1a352eba4d96ee17d163df5206b6a9a60d8c949bf4547bfa89558325efc7cfb010ed178d280e911dc29a7dec6b295557104a3fa07ed2a9988b9632d07c9d80e024b214905db352daa490612bd9f1560de3ee1a7ec2100adaa45644bddb7fcd7812266820f054c0192c378ba0c1faadfe3e8a4257112f74cb6486abf86593ba7b0232aec03becc240dd1504c44ba4469f23bdde4acfb7e364919ad01b3d0d7bf2636a3afbac262597fc98d887cae867b8f19eb186b93c579f92ef761dbe8bcb657f08f1126ff2f96c9a481696cfa434af21cfd50088c0e6ee886e204969587a9e809998ea31c22f06caf3707157781e1334d8e2ef7a5838d183e91404c089b064d4d99e64cec09031205b5ec312d9d6c6948172eaf8a0e29a4c4011b1e8d17edf4228e22e0f7639348228acd54b7075af52d9e909ca524bb286c1d4edee9bb17931831234e83a06721f987686f4ef350a7c7e69d38b269819e7dc234e1eb3b7519a99570a520f664892019df9902507f09a480915f124ca0437248f3546f883fb2a5c88bf5970423fa865d312bcb0f524a7f16ebc4f418c0a212b19bda07c36befd3fc5f4cc4bba91dc62f5c756adf567001eb83f6cf3b1905493a700c240728d44f2cba5f90fc7e3416752cc2408b35a54af33f29c547a4a426e6181d59fcd80c69b7ab196191baa5df8e58b61e76179a8a3dd64e15c1060277862ce172f003d52191fcda8cc6a7fadae1615a3acf55e41f296b7d5402d78e41e20c834a5572402100026cddb7e3eb069c78ce0f214c6a783a24ffdcc6197a7c9dc48ea4d16becc7af4b1067037f59f96a3cb44859afe4fc63b3007dd5406d2459c5ab0bc995f4f9b28b77a793e797db73e39f4b869b4ee3f254b6ecdf9efae25278db16fe528edb1d5211492329c9ea510ea6eac4fa43559fcf7920308ddd5eb464fb04da119d6cc81cc6f921c209a9256f3bf068a1aad17ae9804d7166ef82110d1371416078d684fb8943d1cedd7d04478fb704ea1179749ecc57dcb2c79fd5fb85fee73c58cf37f7fef5ea5476f5732ad262c3ef13e94d63a79898dad352e142298ddd9c4d3e3af799b06e40cf8fff02db67ed801dc13afd8fa005c0d6f23cbc4917f1274674314f6aadebcc7c0fab4f06c795488e3d71088f7b4ba06ace0b330e55b809560407de4121cc33c9b183b23c108605b87bf6a7f094f41cbdea39b7454f4fa7fc7de3af9f0a80e74622108af3487832de0c28621586d038ab99f79170b7397abedd06d24c197f28c184b0a72fe371f47f2d6bb9f735044c95e63930f8610158127479ee531987528664c623b2ef5482d8840900ce2f7bbf40ccdd065a7765824a3f411f0a76b1fa870861ab1064f14a05f867e40dd5e41440257158b618f6b68fda056a36d17ad73924d101c7955031bb6fbafbeb17b68d6727914e3195cdb3c210499a276242b6a003af56ac08e44d9d38c231c6d5ca738a0a000c27e290c2cf497b9a8e8c1e3ad64b1efefcd54c967239b45a15b2528ff36227c8a8")
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r3 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r2, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:37 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x3a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  131.677190] binder: release 18925:18933 transaction 371 out, still active
[  131.684175] binder: undelivered TRANSACTION_COMPLETE
[  131.703763] binder: 18949:18956 transaction failed 29189/-22, size 2452-40 line 2848
[  131.719126] binder: release 18952:18957 transaction 377 out, still active
2018/02/28 09:17:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x50d3, 0x0)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040))

2018/02/28 09:17:37 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000180)=0xe8)
ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000200)={&(0x7f00000001c0)=[0x1, 0x7, 0x729, 0x5, 0x100000001, 0x81, 0x0, 0x3ff, 0x8000, 0x1], 0xa, 0x2, 0x4, 0x100, 0x4, 0xfffffffffffff0dd, {0x40, 0x3, 0x6, 0x8, 0x64323d1c, 0x4, 0x69, 0x5, 0x4, 0x100000001, 0x10000, 0xfff, 0x7, 0x8, "326d79f2f9d0d6b507835b8732b9a0f0e82277f27a8d6f623cfdf612aea64e68"}})
getpeername(r0, &(0x7f0000004940)=@hci={0x0, <r2=>0x0}, &(0x7f0000004980)=0xc)
sendmsg$nl_route(r0, &(0x7f0000004ac0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000004a80)={&(0x7f00000049c0)=@setneightbl={0xa0, 0x43, 0x324, 0x70bd2b, 0x25dfdbfd, {0xa}, [@NDTA_PARMS={0x6c, 0x6, [@NDTPA_LOCKTIME={0x10, 0xf, 0x3}, @NDTPA_RETRANS_TIME={0x10, 0x5, 0x100000001}, @NDTPA_IFINDEX={0x8, 0x1, r1}, @NDTPA_BASE_REACHABLE_TIME={0x10, 0x4, 0x3}, @NDTPA_PROXY_DELAY={0x10, 0xd, 0x5}, @NDTPA_MCAST_REPROBES={0x8, 0x11, 0x3ff}, @NDTPA_PROXY_QLEN={0x8, 0xe, 0x6}, @NDTPA_IFINDEX={0x8, 0x1, r2}, @NDTPA_UCAST_PROBES={0x8, 0xa, 0xcf}]}, @NDTA_THRESH3={0x8, 0x4, 0x5}, @NDTA_THRESH1={0x8, 0x2, 0x79a}, @NDTA_GC_INTERVAL={0x10, 0x8, 0x2}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000}, 0x44)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:37 executing program 0:
r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x1, 0x22000)
getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000140)={<r1=>0x0, 0xffffffff80000001}, &(0x7f0000000180)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f00000001c0)={r1, 0x6, 0x11, "86e86d4e148680b334edbc2f98f301c571"}, 0x19)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a6277cd86b7e58f2f9d657b3ade34f1b3ecef00000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="2218bccb3ec6dddc379fb08eeeaf1f8d7a87bdf50a3740cdaa4c271acfb364f9da618e80672fb24c579e28d79b80272faa11bcf65ca68cd3a6b78d19f3c30b951e1afb6307a98a95a641cbbc4be9a2ee913c5ebafe11bad5498d1a9365f5bf10363574c9b77132bac037df7778518d39b30b53c556843590f2e477644c216be79fe96cde9c5dab8ee12fc59d3e1c000000000000000000000000000000"]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 5:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x200, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000006b80)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000006c80)=0xe8)
setsockopt$ax25_int(r0, 0x101, 0xf, &(0x7f0000000280)=0x87f, 0x4)
setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000006cc0)={@local={0xfe, 0x80, [], 0xaa}, r1}, 0x14)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r0, 0x50, &(0x7f0000000100)}, 0x10)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000001c0)=<r3=>0x0)
migrate_pages(r3, 0x9, &(0x7f0000000200)=0x2, &(0x7f0000000240)=0x8000)
r4 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7fff, 0x80000)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r4, 0xc05c5340, &(0x7f0000000040)={0x0, 0x40000092, 0x3, {0x77359400}, 0xfffffffffffffff8, 0x100000000})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioprio_set$pid(0x3, r3, 0x7)

[  131.726161] binder: unexpected work type, 4, not freed
[  131.731508] binder: undelivered TRANSACTION_COMPLETE
[  131.760801] kernel msg: ebtables bug: please report to author: Wrong len argument
[  131.768634] binder: 18949:18956 transaction failed 29189/-22, size 2452-40 line 2848
[  131.768742] binder: release 18950:18955 transaction 375 out, still active
[  131.782391] binder: 18973:18980 got transaction with invalid offset (-2531649442503976926, min 0 max 40) or object.
[  131.783618] binder: undelivered TRANSACTION_COMPLETE
[  131.795068] binder: 18972:18979 transaction failed 29189/-22, size 40-0 line 2848
[  131.799964] binder: release 18950:18955 transaction 374 out, still active
[  131.808988] binder: 18973:18980 transaction failed 29201/-22, size 40-8 line 3026
[  131.813979] binder: undelivered TRANSACTION_COMPLETE
[  131.820181] binder: release 18967:18975 transaction 381 out, still active
[  131.831770] binder: 18972:18982 transaction failed 29189/-22, size 40-0 line 2848
[  131.833852] binder: undelivered TRANSACTION_COMPLETE
[  131.837368] binder: release 18967:18975 transaction 380 out, still active
[  131.853486] binder: 18973:18984 got transaction with invalid offset (-2531649442503976926, min 0 max 40) or object.
[  131.853624] binder: undelivered TRANSACTION_COMPLETE
[  131.864447] binder: 18973:18984 transaction failed 29201/-22, size 40-8 line 3026
2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x0, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:37 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x801, 0x0)
ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}]})
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)
ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f00000001c0)={0x1, 0x20})

2018/02/28 09:17:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000001f000000000000000000000000000028000000000000000011000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = socket$l2tp(0x18, 0x1, 0x1)
ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000000)={'yam0\x00', @ifru_flags=0x1})

2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="852a62b700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000000000000000000000000000000170070a14123caed43f9194d6dcde8d196e624f90fa1dfdce2bbdf3bae7a2d3a78c8abeedaf62d585fcc2028f3d000ccf52b2a65153acdd6ff4fe83bb27582c702368c59c28c839f2c"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x2000, 0x0)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0)

2018/02/28 09:17:37 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x0, 0x40, 0xa, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:37 executing program 0:
r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
connect$unix(r0, &(0x7f0000000040)=@abs={0x1, 0x0, 0x4e24}, 0x8)
ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f00000000c0)={0xf7c, 0x800, 0xfffffffffffffff9})
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB="00000000f1900800"]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

[  131.869319] binder: undelivered TRANSACTION_ERROR: 29189
[  131.882616] binder: undelivered TRANSACTION_ERROR: 29189
[  131.894884] binder: undelivered TRANSACTION_ERROR: 29201
[  131.900377] binder: undelivered TRANSACTION_ERROR: 29201
[  131.909086] binder: 18985:18987 got transaction with invalid offset (2411164575203328, min 0 max 40) or object.
[  131.917248] binder: 18991:18993 transaction failed 29189/-22, size 40-4352 line 2848
[  131.927082] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  131.933516] binder: 18991:18993 transaction failed 29189/-22, size 40-4352 line 2848
[  131.936511] binder_alloc: allocated: 6296 (num: 135 largest: 96), free: 1896 (num: 3 largest: 1848)
[  131.936537] binder: 18990:18997 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  131.937495] binder: 18985:18987 transaction failed 29201/-22, size 40-8 line 3026
2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:37 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000300))
r3 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="ffefff7f0600ffffa8dd3d943c04df415667929fdd3a671f36a9fc6f168c4cec5fad22a66ce4f1c473f1a60f9c4c47f5d2a2cb73904d65747863d400507d443c52a5cb70925ac45644e6f067867e5c17d48be4951527a4d58bea0f87fb10a6efe804e7ca5260ff3b5bd2d6de9d7216681da9330f4304966da2e3fa7e6119e8a0fd1ddb949cd533e23a5242d6036237741b2c23ed6f19317264a88d30b59140969359df38598389dbdf0be6c26e0f43be8488c731167364b76959a839fec0aa61ed1b7e1a152c780bfa00", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/31, 0x1f}], 0x1b4f9356)

2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=<r1=>0x0)
sched_setparam(r1, &(0x7f0000000040)=0x2)

2018/02/28 09:17:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x10000, 0x0)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={<r2=>0x0, 0xa7fa, 0x6}, &(0x7f00000000c0)=0x8)
setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000100)={r2, 0x8000}, 0x8)
openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x40000, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x410, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  131.952974] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  131.965845] binder: release 18992:18998 transaction 390 out, still active
[  131.971122] binder_alloc: allocated: 6248 (num: 134 largest: 96), free: 1944 (num: 4 largest: 1848)
[  131.971146] binder: 18990:18997 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  131.980324] binder: undelivered TRANSACTION_COMPLETE
[  132.049537] binder: undelivered TRANSACTION_ERROR: 29201
[  132.058060] kernel msg: ebtables bug: please report to author: Wrong len argument
[  132.060256] binder: release 19017:19023 transaction 395 out, still active
[  132.072684] binder: undelivered TRANSACTION_COMPLETE
[  132.079594] binder: release 19019:19020 transaction 396 out, still active
[  132.086611] binder: undelivered TRANSACTION_COMPLETE
[  132.092289] binder: release 19016:19022 transaction 397 out, still active
[  132.099237] binder: undelivered TRANSACTION_COMPLETE
[  132.104390] binder: release 19017:19023 transaction 394 out, still active
[  132.111318] binder: undelivered TRANSACTION_COMPLETE
[  132.116467] binder: undelivered TRANSACTION_ERROR: 29189
[  132.121931] binder: undelivered TRANSACTION_ERROR: 29189
[  132.127428] binder: release 18992:18998 transaction 389 out, still active
[  132.134356] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:37 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x2c0c80, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:37 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="00000000000007ff", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000040)={0x1})

2018/02/28 09:17:37 executing program 4:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x10000, 0x0)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x5, 0x1, 0x1000}, 0x4)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x1)
setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x8001, 0x401, 0x8, 0x1ff}, {0x1, 0x2, 0x8, 0x3f}]}, 0x8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
fcntl$setflags(r1, 0x2, 0x1)

2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB="bc"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="0078dc413deee209f716fe8205b822da0120e85e28be36d5fa41d34f9f5dfdef0211ec88be36ab5e1211c298d9f14803fc12ce8646086e6af3735fd2fa3f98f1fd516ec8eaf2dfc4b1"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0)

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x410, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:37 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000000)={<r3=>0x0})
ioctl$DRM_IOCTL_RM_CTX(r2, 0xc0086421, &(0x7f0000000300)={r3, 0x3})
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:37 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x0, 0x40, 0xa, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:37 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast1={0xff, 0x1, [], 0x1}, 0x0, 0x1, 0x3, 0x2, 0x100000001, 0x7b, 0x5}, 0x20)

2018/02/28 09:17:37 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = fcntl$getown(r0, 0x9)
fcntl$setown(r0, 0x8, r1)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$TUNDETACHFILTER(r2, 0x400854d6, 0x0)
ioctl(r2, 0x9, &(0x7f0000000080)="3a3db575b6")
sendmsg$alg(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="1bd7da2336897d4571b8db23b15f8ad2f4a78aae0fc1dc8c737988a06d67b9c157bd7534888fa13be671d71b8ddf0627e13c47c0b34cb9c8908962d175e76e9017f3f37e68eb72dbfe246024cc3ea1910dca4ffeffecc68bb3d16304b785c86f0e2f7890b0f4ded3e417ed970d9849c17e2f9003cdbba0b598985c8b373ea3a4e71e7f0e6776af02e0eade2adbb07e06c2f549e729d03c772f916ccace0558dc22b6918baea9584fcfe0c79ce763be49c5f45154da643e6f65d04788f51b7ec29734159e3b7de460ab99b06403e9be2492b65cb59f4eb8242ae8f08f0c130e8007b49c0ab63959dc71617d9cd624f213373dc74644b5b2", 0xf7}, {&(0x7f00000001c0)="06810cb1ca6c6cc0ea3622c86713ff6f0606a7487d1ba89139a2a7ac08c1366453b5c59a50df1f75a7e39360d38935335fbdcca69b35d524528eb8bb200e1b523861f58ecef246eb66aa195f4d536697bafdb421ed7e1c561908ad77531064728c41a1b6b3c612dcc1b7c62663b54204c88e460f1f22ddb1be22d68d68d6a310a85f6f314cb35184255bc6d37eebe69a55a30da67894b7a5c2e7c1344a625397d711815525a335895d65ea284d9a2aba28aab9389bee297209db8a9a4f8834318bc0034b6290f8c18d9f3f2ed19196ce32f1707bc61c4ab7c35e7ab4764aba60fa81ec16796c8627c943b5782bd15751e3f323c5e98f51768581", 0xfa}], 0x2, 0x0, 0x0, 0x40000}, 0x1)

2018/02/28 09:17:37 executing program 2:
r0 = getpid()
r1 = getpgrp(r0)
r2 = gettid()
rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8)
rt_tgsigqueueinfo(r1, r2, 0x1d, &(0x7f00004ca000)={0x0, 0x0, 0x1})
r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb0}, 0x8, 0x0)
read(r3, &(0x7f0000b0a000)=""/128, 0x80)
r4 = dup3(r3, r3, 0x80000)
socket$l2tp(0x18, 0x1, 0x1)
ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f00000000c0)={r4})
r5 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xf4a, 0x208000)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r5, 0x84, 0x65, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x4, @mcast1={0xff, 0x1, [], 0x1}, 0x1f9274d5}, @in6={0xa, 0x4e23, 0x6, @loopback={0x0, 0x1}, 0xd85}], 0x38)
r6 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  132.221221] binder: 19037:19043 got transaction with invalid offset (0, min 0 max 40) or object.
[  132.228594] kernel msg: ebtables bug: please report to author: Wrong len argument
[  132.232508] binder: 19037:19043 transaction failed 29201/-22, size 40-8 line 3026
[  132.249781] binder: release 19042:19044 transaction 401 out, still active
[  132.256761] binder: undelivered TRANSACTION_COMPLETE
[  132.262790] binder: release 19042:19044 transaction 400 out, still active
2018/02/28 09:17:37 executing program 4:
r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x20)
ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e05411, &(0x7f00000000c0)=""/227)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$ax25_int(r0, 0x101, 0xa, &(0x7f00000002c0), 0x4)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000200)={0xfff, 0x0, 'client0\x00', 0x4, "8517c510bed8f98b", "fe4860b99baff216ff1d9e010be2ea3a79ecc04b66ccec6cfd280d8fa3f9dec1", 0xdd4, 0x1})
setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000040)=0x20, 0x4)
fstatfs(r1, &(0x7f00000001c0)=""/5)

2018/02/28 09:17:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x410, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = pkey_alloc(0x0, 0x1)
pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, r1)

[  132.269779] binder: undelivered TRANSACTION_COMPLETE
[  132.278164] binder: release 19038:19046 transaction 403 out, still active
[  132.285141] binder: undelivered TRANSACTION_COMPLETE
[  132.290612] binder: 19037:19043 got transaction with invalid offset (0, min 0 max 40) or object.
[  132.298424] kernel msg: ebtables bug: please report to author: Wrong len argument
[  132.306754] binder: 19037:19043 transaction failed 29201/-22, size 40-8 line 3026
[  132.319279] binder: release 19053:19054 transaction 405 out, still active
[  132.326282] binder: undelivered TRANSACTION_COMPLETE
[  132.344915] binder: undelivered TRANSACTION_ERROR: 29201
[  132.357592] binder: release 19056:19063 transaction 407 out, still active
[  132.364566] binder: undelivered TRANSACTION_COMPLETE
[  132.369723] binder: release 19056:19063 transaction 406 out, still active
[  132.376665] binder: undelivered TRANSACTION_COMPLETE
[  132.381792] binder: undelivered TRANSACTION_ERROR: 29201
[  132.387267] binder: release 19038:19046 transaction 399 out, still active
[  132.394203] binder: undelivered TRANSACTION_COMPLETE
[  132.399347] binder: release 19040:19048 transaction 402 out, still active
[  132.406299] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0x0, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000001300)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r1=>0x0})
r2 = mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8, 0x11, r0, 0x9)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x50, &(0x7f00000001c0)={0x0, <r3=>0x0}}, 0x10)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000280)=r3, 0x4)
r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, r0, 0x0)
r5 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000002, 0x50, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0xf4, 0x0, &(0x7f0000001340)=ANY=[@ANYBLOB="03630890a06f7ad94a", @ANYRES64=r1, @ANYBLOB="0f630c400200000004000000000000000e630c4001000000010000000000000011634840020000000000000000000000000000000000000010000000000000000000000040000000000000002000000000000000", @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r0, @ANYBLOB="000000000000000000000000852a747001000000", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000004000000000000003e00000000000000"], @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB='8\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0000000000000000076304400000000003630840", @ANYRES64=r2, @ANYBLOB="1063084002000000000000000f630c4002000000000000000000000000634040040000000000000004000000000000000000000001000000000000000000000048000000000000001800000000000000", @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="852a6a770a010000", @ANYRES64=r4, @ANYBLOB="0000000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB="000000000200000000000000852a62770a000000", @ANYRES64=r5, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB='x\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0463044003000000"], 0x1000, 0x0, &(0x7f00000002c0)="4a43e160fc639dfacf9a1238228879580f97e39e05cd29dfaecb7449f6f577dd52bb427d5ffb37e5455d66f2de366db24906733260c4b346b8a3bc0b98edb999b39287099471b79f82c98c32dd178b643c8061debcbb7ac126f4561c3316ab8f531a4fe5a734841865ebe6b6217fd23863a143d610c650f8061054b71002b7c07a8240cb088ce05bd9ba20df5d289277e55c174638bbe392ac7fc1af5b11f046b6eb2f0b9124bd89badae1cbf27827ae0e4d0dc23214a718a6f3bed763b9a4ada31cdcd9b0bfee1bff37c4ab5dc8f3448edb185f7a8387b1160e6654d5e2d4abd00edbba778e7cd3ae3380fb03d0bdc3f0d3547dbd20d4e9fd3248a522c6fcf8a0ff3f1692483f3b74d102115c38bc4712cd3933e6e4e013a74d3de32b023b5ff67ab6f5be770714c291969ab5e05f47d81ac7ea3a02c204ee588cbb5d4388cbb82aeb0c269101f37ead3d3f27e69dac9bf41842c3fbe07e2886b9b5ee698087130561dc79e3ae2527549814321bda98de8b8ee473731a942bf13361261fa6eb2d78abee82a8079fa5ad37b52f07fe9580703af0cbe1e84632c9936fdb7c56f3b6e567149f23546f1225a22efb7b34bee24a0f3e34e3b52a848a610bfb1d36505d2db8112b69e56d0a096ce97ca2dd014a389b0b5421705ba1b4dac4931a75b46daba1ca678294b6e99138ec84194d5e49e3de72d9c11a8523e357c631406344b5684ea6c65b12525d193607c7e3539f68f38836c1f8cf4a2ec9dde7117e01aed020d2373909d815c3ada751169c7dc36a87f90c44a53087b3589e5cc6a2d77be2404f947c2cc851390a692b17cf5024a7dbb461dfbd6aea3b77d83b14faf9e8f07c5514a561f6b0193bbfdc3e67c2901ff7a367a9a2c35df09c9e8e09a9f92d532008eee0aa5960f192e4129894d1eff1a1ab0bb336efc04362b8d0a2e9a1b227077ace6282816a0fbffb708666e1927418c424cf1ae57b636942d545a70a87d83130b672b9fb1b166b40828bce5699f2a003c8d87c62ec7e5ec07dec336357848b03a498357c4915c29338ed26925a1185f2d9864b154035aa4093fe745f044978ef6f96974bd55f05af493f59ee7192c32b80ba6e74b8461bf099c06b90f6bc44cc39f6af13ce82f2743ab005c38f8ae87f4dbac0baee2329027d33ea474ed24642719ac178deba3454a12d8466c74f37be0db45116c58482af8bf113c7f024e7f247a91ef8dfbb3e883573d0410cb629b03bf986759dfd561feade7ac7b90ad6ec61deb1b686ee8736536e69f0d1471a0b43f0a2af47b87d4d4255215f8a1adcadd19db5296d6d80a1e0b640953ca63f4a3eca4201aaf0c875e9da06eef498d5f43d077d3f0ccffb7d75f1203fe9126715a32a8d4d260c49cd67a132b984129d8f8571e01b0799b513ef84ebc8e4c8be7bce86807baf13a8316eb443194840799992fcdaba2766d7d93c0e3232414f58b623524cc2d05fc011ab6775aa4c9e4ad556e9a0dc7fc1b3046c3c9e6cdb2e5850215a660ab4825db7085525b9303b2cb3e7cf4f77a37f5c16869681489031b1b81b32b5469cc211fa85e290c91b2f9ddd8469c6a373deba8a776e45b330e4ad1eb33f786927a899269ab3747f112c8860ea44d19b384ba4a735875c3e324004e230070e386adf8de4fdf546e5d31297ae886fb8f4e95222a96412a6450765cf3d8d8e07a065e546bbb6dbb02985b9fb53ef9fc1f31ae5b0a5b4519c970eec3c3c9ee0cbdb30a96d89871eea4d920a1b55f54e83ed3eb8f15b65fb7322ab25bda943bc60a05e6a5285b6d8259defec428cdd5107eb8b6f0e19b8d496d68e60049d68ade1551d90a8ad1ee319ba0b737f0f29dc4e67d83b9f439c79bd0e9ceca213add34b8d5add8230f0a0a0f5f16632fde857d7b020761596a52ee880cbb52e053932e490ac4dc0ef15fbf585920920204eb37e8aa6a1725b39dfd1015bdf5a1e98f2de7fe98fce534ae3ff3b6f75b1e614635247eb191dd4d69f76040afaacd51baafebfbf624d22da20ceaa117883757df280edf39e332f11815b0d340ad1a462d9857d786c02ad9b78d99769ee5716e7ab87e65ca36e7b2e861cbcdfaf69374c75155ff070049b832e1956a2e4d89e1b4f9751cab8dfc1f8f00fbc95ac155e4598fecba5bc0634b0865bfd3c87d28f46f8e5ce0ddf0c323cf76e61432f3680572052b1dc54e5f8f3bfc38a6e635442a5e6ecee25190d1d9f3f2202cd7288233ab6297474210906e5cf334121397c28848dee532610f171b4dc6885beafe2008369d287c3c9a8844be84830c1454fc00214ed0cf68426fcfe472e37d4ebbf44739b754ee967b31dc2ae891da0a6b4b10839cf5d419c933b90e84fdb6ac7c5d3407b6d06ca49d1252afb59a74036ae93a56a21a13e1b79d4b85c685fdcc2309ea832381cb00599b911a14a773dd2e7550e297df95c32f6791ce02b0a7b170c0b566014ae8ff5c9082fa3062ee96810537c1e114daa95183a22df6c4b97a6c709a52a880230579cddb63ed6e2cf2c5b9dcefd8ce81ec8656b4656cc62630cc55f1e4d984ab4539ac20ded21f31b3f82252018146c978cf99a4a8f56d176aaa0f22371c11d9792a3953c8a8cb40ce8c77e72bda3682d667c6f0258f1de67dfe2bfe4e52d4dbe7896a84ada795871003cc0528b555ef6d2e26059e1bfd690c6e2b76de46a0a9d9f3245e018013aaa54fbe921c1024d8a89ab4f9680bd260a42b9628453c6293bc3cc84db31de40429cc5ae2a182c8e7de0df7654127c255d6f3ce8c68afaceeffe0b8ed0aee2fb68fde27e5226bddfbe2260d398e2a3a65698f07f48eca867882a86415c1c1b9a7f2dfd216ea9a800c8acc99fa8a5a81129953e2bfe7addd0b0f8b7f25af08a7dc31a1b44fb25177ba16486ae5e124c0aeda0d1be77547b0454207600e320ee3651ba23ad0ba534f4ee22cfc9492aa900a38477cf9b357704dd9c277dc863e6f8b54f49bb42bac28bd577549c854c46226122470d1770894924349a2df65d562e653a6e29b7cab43b2dcaabd2a0b83cbd87a88193e1a43c32b3dccad5201c6b2e3ae508889d5ad38f24aabcd284021aceac3377359f4b36776f9390901fc9c2df5f866b3df073a7ed3a2d35816044b69cf0249d4817fd9fef5725642a5f9c423d6aac303ffdb397f15316fb09d6fee6b6e62841561ac774a646713f23812200434c0a4af8b9174aea041c661729acf8856244003e9cdcb0724999d2f39b014de848d829e496201c1beb29cd704fc3506640f3b9c4773442c8813a1d974fa9898addd4f6e0e7f44dd7374a9a92e00f2a694d5ec5790d2054c3e9b72bfe6c50599369b3d8f3edac83219af5d64a5c35af7d9f7c58eee5cbbdf3e372540bdb5b2e164ebdbf160ba458a7118aa0e084c2bfb93a2b998c765015688fc78db9bfc1ac57fc0acea2abf511d4bead76146476ede2d9dad82bf95f786a22c840f95c11b727b774b2eaf343b364ddeb0292e910a829be42464f231dc16565d0d5805cda9d289d2ce5efd36d5b96c23986bd0b1e73d3034d639e2367be3490865bdb21d738900be21163171c15fe30f2c1d6a43f480a86056dce4c7f4185aed1a1424808ed3a2227f32a56c86a2d53291026061727aa5884c0f06e91ef0b1af7b89d1e31beb86323720bea351300eae20db67af350e022ce543ecc905cd602bd8bf7affca9aa974a7f3422b5201c70b357d4a414618328a7dfd66dca7d331a51e8303ae7b37297bac15414fd465e586920b31d27661cb6207b376a86a8adc8878a840172f810745dd8a532ab44038b5f90d6e469c24fdc74da69d723faee70e62a3f784a6fa23222961ae6bceb4ee27664c545a3331949ff81c95a7c8cd8987719f8ef403f0d632d6bfe1ad759ee3011a37638999725d01fbfc693109f0f738c0ea6da774cadb90cd501f9f6f6e3df4d58e0de3ca6e5c48317b1ae4d948492c082e0a0661fa891f1435d42f46c7cb2e3520287ffa5de5ebf700a28f6b8c153b7536fc24855915788c3bea40582422215008e9c04e8a5e1a5798dd35edc5a722a058fd87b369ceb6cc70e56167a60f268d4b5a3a7820cef97891c10d3286ab642a7f3d6f1fda95b528b75f78ae6685de7c137f48b4df366507e398856c5c8987501705da7b244f1ac00622bb85ee0f7631a6b932bdc456e3ad7e6c5866f2ebbb75dfd273dfc2b03b467c8165a4594e44630877527c80e1f8a107ce5a3b0cec037813f2174b982d609158c6db3249e6239589dbbaff97a39fdbae24e2f40e8b6bdcb6237e5f094309fc16bbba5e45ebce9a1731dc75925889137cf61716118ab1f46b4f196645e59776d0af462b1717094536cf14890deebd741667b045ad24c8864afdc2527430a43ae4377838d7afbd9755e8d361c58debb26e725623912c87df12266d495f387f30890aae95d0c4c3301aacf2185bda2583b148d989c293193ab1dbe91e1a434e2c2e0e47a007b93c668ad0bfd9c562e1c42fa06e696015f1584e069b344b117d95c696e9c57b0aaa62b7c63ad88d41245ebcdf3888e609d835aca683dd57390ee6efa9be6a2dfe2138b021288c125d3e28bd593938e5fe6cd776b6e299a5fc9e0df257a2c020838e1ea9f6788906fa351417f121660ed26edbd5910b4bf6dd712a2ec8e9332cb484694afccf934cd080a08998eb6945545e62919be8c698c481eac1e8c4cbf438f0fe58c5725afae5ddb41c787813a4ae8898d43ac3156f40b56d65b3ed4f28ae3effe9c48734af862ca0a425417930007097f4fd5dae4d564b4bd1fdd1b45185f215ecf5f0cba5a769fa4b7de3e6defcdcf14a111eeca17afe5b57d08fa144f0d8495321c636f4063a4edead69d3c5433e7352bf5608ef3def1dae6008829b81660a321e55159255690662fc84af6c9dbb03504f79a497341da5441e46ee880c97239fe72ea49c40b190a7ecdc4515922890662f40f321c775f57825f79fceb46a8056bf6bc1c00b04819677c40f49a7d3951484619cd811ca3b46d3870f6585041595084ecf92ea8aff86873fdc1ed83a643bbedc82538816fd21ff4d44a789b756d9e41869b8916599b92c23c1b807b104f070011a786b87267af7bab1f9d83412748f2a6ab90f1c639248b7ebda948af52368239077a972336c5e739754fe9a97d9d172f006c669c831e913f34f138a6d55065c36a13d1e4a998198fafde84213c05eaa1ccb5eef14c308262cc60d77133715744a67a8412e8656e6318372da945c36112b96dae04d8ff49399bf136088309f57a45e0195f201019255743fcdc5a05267c58eccc7ceee1d980971913748ff78f538e7ea7cef9eff9ce3fe41f8b36125f90666039ba595e69f57a5c00cb886e1f3b6d34da0cb18804d3f09f41a9b5b5f5ceeedfc70771a7f5c6d194dbab0cc18e5a608a1c16a9944e16dda3000fa85644aeedf91a0d4466b28233304513e1dbc7dbe66469f67e15bfc444536266b0b68f90814bd7f9f27ac6db99468a409a37fcb11483a294b3c7b7bd4a05efdd5e1e30b7061085a0bdc57c7b8eba3613c33b2981bb488b12ba0f6b5183c4001d322d751571c7ee12ac301954da98681164e8364095d80cc44d8a0574edb050d60d7ce5a23c08448e543c7c02642041adf81b9e46e71d216b24b61b8f52fb1394d7e316b0d5bc80bd16fe4e87142413107d6bf3f09407d281faf6dbedcfa49da9a7ac5bff94f22294b8d08c352273cc55b62c72ee84445114a159e792ae91bda4ec6dc07860c4c4403c79d2fa9ccb4f76aead503f4230b9"})

2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000000)={<r1=>0x0, 0x3, 0x20, 0xffff, 0x6}, &(0x7f0000000080)=0x18)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={r1, 0xffff, 0x400}, &(0x7f0000000100)=0x8)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x3, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 4:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0)
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000040)=<r1=>0x0)
ptrace$setregs(0xffffffffffffffff, r1, 0xfffffffffffffe00, &(0x7f0000000080)="12766523bf8239d55679e9c6ffdf9510890cb603c3995078b0bd6f7911be416a9a51778e3c17b8c3adc0eb40c8a8de5889386d762cbf1e47627d4f4f8c3eefb0b17569d74a5a9bc2c324d0e8f091cda454ad45f15d01087414025a96e4c81735b9d4af2db35f01bccbb86caba4c8738c63eb5c692c76b2d7f52fb76ad9f4622cf69215650e0329531c7c3c624665b1f06f54")
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000cbffc2)=""/62)
r2 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x221, 0x101041)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, <r3=>0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000001c0)=0x14)
connect$packet(r2, &(0x7f0000000200)={0x11, 0x7, r3, 0x1, 0x8, 0x6, @random="4b2159f13922"}, 0x14)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
socket$inet6_icmp(0xa, 0x2, 0x3a)

2018/02/28 09:17:38 executing program 2:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0)
statx(r0, &(0x7f0000000040)='./file0\x00', 0x0, 0x2, &(0x7f0000000080))
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="85286200", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x2eb, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = getuid()
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000003c0)={<r2=>0x0, 0x0, <r3=>0x0}, &(0x7f0000000400)=0xc)
migrate_pages(r2, 0x7, &(0x7f0000000480)=0x800, &(0x7f00000004c0)=0x3f)
lchown(&(0x7f0000000380)='./control\x00', r1, r3)
r4 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r5 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000000600)={<r6=>0x0, 0x4, 0x800000000000000, 0x0, 0xfff, 0x4, 0x3025, 0xc99, {0x0, @in6={{0xa, 0x4e21, 0x44, @remote={0xfe, 0x80, [], 0xbb}, 0x9}}, 0x80000001, 0x4, 0x7ff, 0x1, 0x7}}, &(0x7f00000006c0)=0xb8)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000700)={r6, @in6={{0xa, 0x4e21, 0x1f, @loopback={0x0, 0x1}, 0x9}}, 0x8, 0x1f, 0x3ff, 0x1, 0x1}, &(0x7f00000007c0)=0xa0)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(r5, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000340)=0x4)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
fcntl$setsig(r5, 0xa, 0x2c)
getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000500)={<r7=>0x0, 0x800000000000}, &(0x7f0000000540)=0x8)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, &(0x7f0000000580)={r7, 0x9}, &(0x7f00000005c0)=0x8)
write$sndseq(r5, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/create\x00', 0x2, 0x0)
unlink(&(0x7f0000000300)='./control/file0\x00')
getdents64(r4, &(0x7f00000000c0)=""/235, 0xeb)

2018/02/28 09:17:38 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x0, 0x40, 0xa, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000000))
pread64(r0, &(0x7f0000000080)=""/94, 0x5e, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', <r1=>0x0})
setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000001c0)={@mcast1={0xff, 0x1, [], 0x1}, r1}, 0x14)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = dup2(r0, r0)
getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000080)={<r2=>0x0, 0x9}, &(0x7f00000000c0)=0x8)
ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000000)=0x20)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000100)={r2, 0xfff}, 0x8)
ioctl$TIOCCONS(r1, 0x541d)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0x0, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  132.464111] binder: 19080:19083 unknown command -1878498557
[  132.473896] binder: 19080:19083 ioctl c0306201 200012c0 returned -22
[  132.481756] kernel msg: ebtables bug: please report to author: bad policy
[  132.492908] binder: release 19087:19093 transaction 409 out, still active
2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x6, 0x20000)
ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000040)=""/69)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 5:
r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x10843)
ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x1d)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r2 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x4)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000140)={<r3=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x10c, 0x0, &(0x7f0000000240)=[@clear_death={0x400c630f, 0x1, 0x1}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000040)=[], &(0x7f0000000080)=[0x30, 0x20, 0x38, 0x48, 0x28]}, 0x7ff}}, @acquire={0x40046305}, @acquire={0x40046305, 0x4}, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0)=[], &(0x7f0000000100)=[0x0, 0x28, 0x20]}}, @increfs={0x40046304, 0x4}, @transaction={0x40406300, {0x1, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x50, 0x20, &(0x7f0000000180)=[@flat={0x736a2a85, 0x100, r2, 0x3}, @fda={0x66646185, 0x1, 0x3, 0x8}, @flat={0x73622a85, 0x1, r3, 0x1}], &(0x7f0000000200)=[0x18, 0x68, 0x30, 0x78]}}], 0x79, 0x0, &(0x7f0000000380)="e0a82973c91f3c644191d934648506b4c3c06873232cd0870276807b9e74c75707a365721c510da19553c80d13bec13d47bdfda274e93fd0b704ab88618dfb749107e73e6074b5f506781481a8d4165a521849b3b94c5a6f836996cdaaa9374da8a398b14745a9b8f246589f7e234e00a12d0abea759477529"})

2018/02/28 09:17:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000008000000000000000000000000000000000000028000000000000000000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x5, 0x0)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000040)=0x3, 0x4)

2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x802, 0x0)
getpeername$ipx(r0, &(0x7f0000000000), &(0x7f0000000080)=0x10)
mincore(&(0x7f0000ffc000/0x3000)=nil, 0x3000, &(0x7f0000000440)=""/243)
getpeername$ipx(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x10)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f00000002c0)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'tgr192-generic\x00'}, 0x58, &(0x7f00000003c0)=[{&(0x7f0000000340)="9341ada4f3c72a0bf5345b0c001589a140e8be969336141366d07d066e73c609b234bc8bb5ce03b6db6fc611c2d5043e471e63060666e816a5c4f12ce15b7d389ff8fd6ab799a11a55c38bcbefca3bf543718fb86dbab836f0cc49d236cea78949cd4b82", 0x64}], 0x1, &(0x7f0000001440)=[{0xe8, 0xff, 0xfffffffffffffffa, "72c395b3e0dfd3c199d9e88207ad73101cb295dd5ba081b9098a02eb28cb6fa343f4e8f901848adb701818aaa1fa28e9c43a3b5baa140803f8ce871397a2822b7aa075131ca1ece6a2d5cf28b581b291595c837d9feaa1b13e11116e1eb3a28a3bf38507ca909ff4dee9fee56217fd932b3333c07ac2e4e98d6e2936d812d56506ccb6993c4636e532b01014bc995785e0a5908d4c054dcf5c20035a8b470c38c17df834ec3a4f0ebd307ebb367e37f9ce9254d4c32b1d54905e231459fbee6423f70547679b0d58c3ff759c33979719e38f9e6a7a6740d9e0d5"}, {0x100c, 0x103, 0x2, "161a35ce550b3beb4d190e5ec81c2b9237a6ea47d4fd3308688ebe4a3034d36550f1b531ca65221f5ae950335a603ee17ced9cb63a23bbeb23ca6e804ba148d25286c77cdb4615b039d47769755ee606c166a2ad8933a8a316168d4ee0d5dae9c4f68eecd5941e4fc5de937d90d24f07113d60642818f26f03a9cccd8e712e34c877263b8cc3411765eb48692710f8f7137ef75a69a4c37ff70a8dbfd87d272d00b4e04eeaf359388e70e9691e7fa159923a377fbded49d843182fec2b07bf170540d548711d1be877bca5a62669f04daf8c2b80d3017f89c95797d4439e731c12400fa2ae95e309f2e5608d46bc07b52b7fa5b974d4a56ece0ce1787d19f11d137d632e9e9f3c5a3c1a5cad497b399e3e2110692a620c5174ee59f71c5eb061a64a0cbac4da6ba7cf7140f306bbeaa26806cd25f8dc27f82498316f966166a5ca939360a7660517695c69677eb558e2736cdb8a07a636e0ec2f17e9f92ecca1bff8576ef75c69764aa05f5a9963e241b4155673b8a39dae8ec1936def536802e7f01121fd01007577b01ddde940070c9068f8df4517c62c3f315aecac1cf9f2f99808d2cb82bc6d20f132768312b982d715bde447b87a6dd031f314e4bff5b47534271d2292bd718dc4cbc145878a3db6efe18687832f8a072a5f30e11aeff717402b205ebc0065ece0542a0077d13397d524f82f1cbe19e105bac6931272a1f172b58aec24e5ba2a6763665823aa7e6a18ca338bbea297e58326946fc6746e8b78711f275ae1c788f32653c6aeb28424d267614b23fe7f01ca5fa517fec03109041425e8f751c32bbb304a532500d11f31d36c407d6dbbe0d4f741ad55c96ffca83b3196439283f9fa8de00524c00347a93f2b6b2a64d10409ea8f8f6dc833326a4720d8dbc3f798dff4eece2e35e5f083a74b45b9ec243fe631687e3212599258e5d3255ac7ff00b79acf4b9322bb589b4692057325d383ae40124c5efc7d786501937865073f4b63ae83e633c606f2d5984f351502c01a5a91593374bc53b4dc2a6e4ac89a947550938640da1203750e9a95c5213bf76f79a02da827a4d1e878240eeb89554d8aca6ed946346b04db28f2727835fd28d35a538e6d173aafbe40613b50a7a719548b2a4dfe5f1424fab7f94420a6e4aa1f1fc869f139cbc5c4347416f62e2cf1656257a6611eb3ecb1afbd89f98e661fcf0c33ad644443134e8360720b7dd7a9d53d8141bce7f407900d126693a294077253f1aa3eb586674e54640305d7d2344345fcf14b7a0f3039ff8f3ffdffd3e790c94e8a4f34d4ff7883e34fb24ad15580a94daf1ed71486c66ee2ed7a5c3ab42f18a093fd1734e1b3b0093dee6fea7073e309da752e9fb093cfd8ba3716149601dfd19ed74e36adf704f79651368a7a7137377b9a3a804dbbadbc6f8510f5d9c6d03d3fa33acc0b9b7ee16517818f5ce9a1f0233f61a97be6a55d6bc666f6257e7ddf53983be9e1380245140535a68aed9e1c9816f855f09fa0c7e8bf7f31af44b3bb0b68ee562b6426d85700210bd08b7449c8e1c36c639ae82da433b5480ef61f28ebb8d3bfa55f663aa9addf48908733728cd00fc3ae2b19b6eb30ae15bd2dfbd2f00830568080012c39c0746a1cfa98a6b759f13aab39b6b5af270457d3fea2eb13ef0bac19354e2577364ec3ffa2c014a2b04f06f4314cf024cc1f06b12a78eafb05e746112e029f79300cdf34aebdf8a5b8be1a7c8bf2db75685341ef7a5e7298473d61d21bdaf0b095fa0dac76f5cd9fcc0c3326319e503d4f3d5aca60a39fb6adac9412a5a180e1ca4d10f591609f88d3c5f525a7e111e6d93d55130a2ab43c813bdf22e1e739d5d1cea642892c00c5865f42dcb7d1527b2908f6c0e47ff84f0cd24b09ccca0e11b15914a700d73afce67af2cc3afebb9d793c197b4a2ba1f1ef859455dcbef7192d8902d3d965f86e2024d89bcd51d9b2dfab071bebdac1e0a40bbf82ee8c550792d8c869485849d0501c55503779464de0a41e893cc20298f125b6fedfadcdabde53f5bc3556494c32a3f85dc9f3d71f069d6e920bd66e79e6f463557791befba2a4c9dbeeacbaa7e2faefd71e4068331cc51351879f67375b3e2569d0eff6e14c3a878435764fbd13576e9bd2aa1aedb069e29e76c5801dd4a10caca915ee02872193db73ad52be8dc2325a80888efb3d05013f0e31f49d9f07a7a8d5b01f0056c4adc9f613042a6b21ec72f1baa270ece665a7215acad814bc0c3ae1af67a3b1b38267f71bfa928a8c2007b788399422a633da773d17dd36b2868e4b1b64d31f0999031d3a4ee15399017bfb392abe7f24af8150b8b891aa0a06119e1365dfe88535f4ba0873d7d9f9fb5e22b5751487c4870c1d0363b1bfa648b97610d1466fec75aafd858be35b5d8850e70c5201612761ebdb5d420220f24857c4039d85fe4e2ef5c67e623e88aaa38f6f2e7defaab762f7d7c09dc2d8387a70d94b7a29a787e20ee92e57c12895e95f1f869f1de5a30d8627208a3fc9bf71a4eaf722513b7369845e8a67306dda953df89939bb228dd2be535ea858a5d4d3615d2001bf081d39affd06d7ad5bba84329ab126875398b3272769ac4b68cdf3074de16a386afa92db9deff997e448e33ed831ecb6e10b7ee30a97d2a83f1e9fc5a9386a04e1329cc43b17c5eaa32bd82d705c023e10741ca32dd177d01d32bce263340ffb8c266638ad517e3ff0ece7bde2f08e8ee8de451a74b35780aa2503c82931c7266e9c6b87e458004a2cb17283b832ad4a838867bfd59f777a68f0b3640fdf25808a64fa3a50d4cc6226f88d16a89eb67c30066a19d0875e0749482c911bc4360fc77221aa4f2091edde2d89b2e91f995acec6101ed1ecc748e6df94c90dec317d71db6043dc706dbde3c11c3a97c21628eeaa06745bcc034e25d0300dceb695dc60ec69c16a0d058b5295abf2a2c5531d851c6ec14f643e32eb81235422919273c1db1ce99e7727bfa3d669c5b267cf1ba24c9808a11d0ccd38f0f48c53c73373d875e7f1905d555f6a7279204e3833a809e272aaf530b465f24bd4aede8f5c5903be3d13b731fbe3f109a4ae9c05a4fbe1f2cd8892782993fcfd26c86c499440426b453d366e46e20dcb2dba5162c5e9cda177e3c5fc3537fdb240bd9f1c05cd531c8b84fa2380cb146a6cae9e399da5a439e54bf30965766d2c0a2c2a0d7d9e0166fb2521445f380045a74f4791d9bdd44f7e3faeb3d1519327e600c2ba66084643700ea45ccf22a66f2f7cd55fed93a4d3c63ca11e728daf2c18e13e344715771ca0ccf3be0b8cf8c85f9f3b4ba53f94c2e3418208d0ddc4cc05843e1ceefba4682a58efa62666c8d5e043dac1af7817cf61440929b6f07f147b53bdd4b90b8e0bd1f793094e79a8ce2eed268c825601aa333b5039b5fb333ed4d6404ff73bc642916fb1ccdd101f767e6f5f0416b0f1b6e6657c647d63b0e511f290073d0ff574ce6a778b100edbdf3bfffa5800754cc04e50d508168601ac90d6f2bc67a61c6965b3fa8ae7d963d5e0b01aa25b164170c0b95571f49dfdd04dcfe2ad342acb0b71939c7148566354eaec1db99c667c46816fd979c40a5d030dd0800fb8475940d76397affdfe0306aa9e327005e990ae0345ae1cd6381359d43e5bfbdf78f79f0e17106d8199863d42c07ff4b1781be236705452c555d5255a7b64715b6db2b66c336114f5ae0b4d7eeea3d777bcc1b587fb45b6ef0d455c9eed300c3e205377123eb477e699b29c4e1215d4fda8b595802dc396577349d8dbfca4bc69e2426b6c9e4955c50790df31769c946d7d573403e1d4efffc99142cba000f178d88c0ea085dca424203a1aaac35a5f22df5b8e7d6f87835948ffd06c8ec72eccd8eb33b2dfad2a6881f87acddf0e266570898e145be3afefd9243783be3f76fb5ed47f8378ea5155e6a7a27ee9d587a8161c9893040bc60444538a1d5735b1f9dfd1c284b7dd1f5cd1d58abe5f3346f885e9d1239c5fcde6fab043c349bb383d59061c32fd692ee7eba27f087278f8a083b2dcea012076e4eec690696ccefc93b2df160858b4b38ac59b7c74a20c3e2f2fbc31f51be7336589d6f14e41a909dfbe0032c42b5714d9957c75d9744c1ea0e3f41ab3b35d270595c5ca7d8d475de974c4556173ebcf23503ba97816484afcfda426aceea6193389d496646f938b8f12e5828df387fb56c89e7286a662b06a8fa7ee52aaae9295a435b56d6797136ab1eb2d851079d5fd01172dbe931b4984ce831e6e021863269cbfcc510e2e06612bb31bfec528c1bf0f50a2a6e3c35627ec15bbe500dc67b505cbb8940ef113969e8beb030b901bd4e0248e8a17af3527459f1f1259c0f4a55d7e6660b01b9aed14ef4e841e2646a649d091f4deeb164e7ec9c6d5886f5ecce4bbef4feb1fac236c8f2370867369cc4742b07c87256b6210f96085e1d278bee7c9a84df5b1c585896f93948ccae431688f809081b1aef3706c037872482e4decef51b4346f2c9697820231c420dfc08bd2088bfc82f8d60557fbc6b5c5b125f8769624dd88a3b7aeb311590e039bc83ed7538508460b4851c86d7dd2a977089b253d5fb6b3a0d0bd06b92c0621942c474084c8833b95bb20466b5b48a7d14947daf229624f842cc63aefbdb758dd6bb77bf043eea29c84b960b7fcd3b4288b51511c42a6d43b2eb3fbb540c1a40188ef20767bee6d14f2f22c085b8b8fe964d3b1911c51457c0e127952fec08428759ed84c456fd7800b76a303aa68cd1620cb8054503455e77523fe4c3ec0dac44473873ad92472c8c3400422287b4c78ae1fd25f07b2381f4a34d27d1863012e4a94718807803ba94a6e5a932ff45ab0dfe2ac53ca4bb9ee07f98c9f01e1a13019f06cf7c42c2d10b048746c04523a05cd871c3c755af915aab61b5f537a694f77c075ea38311bb7d374e0a82c404268249e3025942f1225c948838d99d5e7830c8511feb1acd45384c5d7ba6c8a2e262af212be110fe1250a8075a7de4618ca2185f0530872ac4c81d1ece7de63d08b66404de05fd77932af6a3bedaa84ce0af029c3d8c3a4563ecbd6a14d60ee543aa5bda58ede1302d8c5de20b119d4618ceb7b006f24389ac94b9131e7541724aac4356b2a5a747638abbe91a2c9d2298d25716d2637138a7cd48adee34d1b288fca102c1b49cb3708664f2b082eb8972158d2ae5c77b7e86065ea53e5d6d857a68bc9fad239231b28be3abddfb2563b01f9b073a031b562086dd1c0622870406d15d5e0bbe2e4d9507c3f6ce4f377bb074d103899c39bc55c26a417a14025f328364069c2dfe9f6a14043077435f72574d1b41ec0a645dd0595364bfc00e1043470fcd6c63221d86aea07c8097e8d69efb2fcfb9eba9308b82a617b3b5da3f73dc3981b1530911664fa35e346f5e1ff98ca3e93d3e8a6e2c18378d7b9c054fbd6a61667238e764527fcd18fce5481828181e6416d1119a8bef80b497bfac0a5aad3c66d2ad274bcc7908580ef9fadf590614025af18fd11faf20b768e757dfab4df778eb0cd0b4fb930cf401fa5f21db07eea86a80ab6df2afa93588693bda2fcf40963cbadbc34f673de3c52a65a01cd456315404210a3269f613e6747806d5bcc7a04c3d4869dd72c6c1efe22023584e19c10bae055ac9d918162956040f06a271f70404bfcba0f90f9212f0541533dbca8c871431a9241109bd7376890a705567e07e80b6034e5fe22d64cdea1111e25dcf49bf2603188b35f74cc5cb9923776ce3970f8b4"}, {0x10c, 0x116, 0xffffffff, "388253474b48ead8dadd1087374a2437fa632802faccac090705708fa7d7085bb81419cf62cacaedd48cfc5982a8ac7394a4537df33fb23e6eb327c1138bc72fc41a769c7ec03e987d6c5f5270385cd0af208586912fc0642ef820124388ebdea24f5155244a1a8fd21ca00df92cc26e237864bb0c8fa4081b45715bf54a8e78f579880348867f87a4c5916aca05c602b18d6fb4b8484ee43103073a700d93cd3aa13bd75f0371620b506b1a4a9100950eb75985175d13ecbc89904df761483cd57ce7f8345c1ff9e4def8085de8df07b67b02945e43507ccd7a898da391a1b6ca1e389e6d68a2b7bf84febd1e0f26f30597d67fccb0aec72043674418c0"}, {0xdc, 0x10c, 0x2, "5786e801f4a9ef29af67fb613c3eed892ddf4f1307adab1cd855ba096ee0ff61e35503055193dc4704327e473aa7cdb5d1b5dd0a8ac3715aa96f325ee685ac6914baa911cbb9504e5f4bda4a08b3e3bb737bc362415208039a6482092b6953b3383be8b8750e1a2e0146c6dec89b4c47ec1fa17022907baea8af918a7e64ca87b051963f3100a01e55e51f4bfcc01017040893643e5f5b66062860a66cc6b33b5a5abf79853525ed0b5bea6e4726193340a22af55e37fb10ea1bb6c110644258a744431d4ef0f45652a0a029a42c2ad0"}, {0x100c, 0x139, 0x8000, "e2b2bb35c109fbff5d1cba8df3bf3b45950ed5bda701f2a3f1c304c0782c2c69412f29b5a3a83482e8ffb8efb4f9c6cda1c979b5ed4347e7abd278d83f7cce80fd250417b8a3afb2029adf3ec56aa2c6fe84b9a1e1a763b10124f8cd71a76c30811446823ac31dfbe729e3df2b1390391bb0d58960d9be284f87e19e2196509dbb96518b4a9a8b7640fdfd8c8503f7155dba3eac77604d1676e6165f95409265391b781cfaf2ca3def424c020f7ebd1708f664795852bcc8cfe26f5cbccabcfea8947168e6d477bb2b1627ade7389b871769537bd1bd0d2004905aad40939241a8055c4337ef8afa6934638072cd9f094a73ecb59e12987f6c4bcc29a4722babb274c3c8a14f58cf2ddfd18bac765b866a14b6c36f32178ecc97bdf66553c2aca7a05e41d8f293f238ff7a5d458f894056feb9ba039b0a7dbfbd7ba0e7e856e6c786a772be4a2c27ee624d7a6d9ec01ffdcb9f8ea45c345168ccb918dd33d2447dbd09b85fffb68aa507bccf4d3d581af8a157aec75284fd439691e0ebe9236090a198d67d09c8e8d8b68343da6083daca9be56493f746a74f95b707fa650359f8b2be43fd0b3c951ba9655d9a3d0e4837eff982a6be6425e75e75abe9942b272cc29f764511a30b271abcb96470ad77722457d3a939dd7a55909930d8508b4ebf53520cf1dfd73c224a563975dbe0d92dc8a7cd65c86a39a218c6eeffd79827ba9c0a2ce79fb2b6d4526b1725648242b0bb08280700abbfd6554077f8722996e0c5d32f48a558049928822c3e8c6cf6ed4aca549f10eda3dd54b53c6daad1e2e79b42d708f38f60d0605ea545131326e4fdbd2cc5c8755a6a0a590b8ca523a3d1b8006197a05b926d235aadd819796853527bb1ba51a3a84da9c834fb79a7994a2256fb56fbd56cfcfb8545dab2b6c5290a57861ac5f074bb518fc2c0a9e081ffcfb29d0842aa48422fd47d719d2b02deb254a0ea61bd3eb91476d604066e8f5c7e713346c4b94c4fca3da0be79ce46d7014bff4f043af29309b9de50b50d690dc3b0a26d35b01d78521c1e34d065e809fdffc96c3ef64d2238aaeb79084119f4a6e4a1bf3005597bef1bd56dbceea11d1f16627ea467829944ae28e2e2622bd72223effd7ebbd6d5fd0227af94f941003440a5ec55c55d95f4d5c2c0d0cd14fc498e01432a0a56d841d4280a0cb41c56d351e1e9a173fbac9c89021870bfc69ba8c55f7c1d97a33a3b960581e72c8db7877b7093af2e282a2b1abf009ac52008b19454a34d44dba7c8070dc485b9fd9803dc59966079942a789b6d2e31997d4bd17c15d146ecdfd709cbfd6180c8dd4c9f5e57fa3d931315fb47b2b144e2a8c0e76bb39fa1ec634676e4c4135c216631b42c3886cbc1fce2e0ab2989e2da5fe870d8c90918ed13a9164c933ed490d805f328439ab3ddffb32f591783372a5e9bc741fdd5a9d412f68795442988507909ee288b5f2455edb7f19a046a98e41b63bd955c7422af8f9d56fe13999059d4502ef5cd28daf910666e2edb773be3b99452403284c491e8a8eb2d4b9ea0aafbdda317f4caae63ac6f9e2fd3ffa2336eb960ff38809c58474d18b3ae669bb36f81a4d0cc5f27dd6ef87ab28e78ab7e0d528ab6c315ecb3c851ac58584c6c91b36bd205336490f1222f5d0474b89568a199dadae44d25c149f4881de08041587d7b09fd41dd46a056ea301458a285239a954d00f6f856cf01366fa920cb2aac35fb3c982505434a390d0eaae03dbbf66b8888af82345b37bef8682686db40a703693ff6f28efa8da86439d90c3c1f558fa8b891308544fc1f2e88adcab5af390811ef672c5f93e88e266d5d9a4b9718acf77a216f501970a4b8f592597e38debc1cafbde560ae15439857354ec9a6f9679800d16302d8f87163838d62acdd23ecb7941cad717b11b42052d7a753e0ba9fa1c244d624cf07df9b8b739c90ee43518ed0c27edde81ff18bfc419691c8c68a91a594cd4b1bfeb26bfba2622371ec7e41932fa319db4948bc276f182919818dfcf9d4495d6ee7c96304850e816cb2be74eabbc486c0216de57e8a36513f07f4254168795f75e9da9280369640ce12da2111bd93a5267ffa2c502fa9ba914bb4e78f903c72491ef202141c6e65f7b98f6f64e146e3aeef623794d555b774bef3d4e555c7397bd964b130373a8c05fda22e06108b6d1958111b763a5e0f9758faf07ca307cd4bf62f040a3271f76cfd496123b3a73a12155285631f1c3b5997c62cf579c6fe4dc1bf59e4ea7323597ffe5bc0436b17dfd8aca1bd9b1199d63cbfb4f891f156458d083cb697002fa359c38dca4ea4fb7abcbfd03690dd347509a70e242c36a18d77bd478910da26ea9d16b98773bda8452c65219ad61a9d062b81d081c5b467abc4f134e9720eb8d3155e3014ed9ef7c11b566793d885b0b5db6c1f74233c61de086f86992cf1d104af8998f50ec8a13ce3e255450faf41bedc6565d8d5d38059eed0a685a97c154b44b686edc3f5cc636b4e500689d504ce98526a4a492f6ca4f7e4ea5575569610f239fdd227330ed9d1c495c688dac0b09f92ef2efc08e13d1a8f81c4960589bbcd533688a1a84b1885043eaeea702ceed785d111a6e80272d10dbbaceafb5ce35d000622e807c18bf626f933f1279378e827b7ecf0c8b013ff06354e8850c0d3de4dae1c24f1853ed3b4769a50e2984850513eaf399ebe6b1f75b5628f0e1513312657cb098ce5b6d00f147dd8d9801f5235168aea7596a1b68fe8affc82f7c1f3e215ec2e372f7960e4440b91c6ee7373b72075eb126effa0b7e1db2f6873f4066a3ce2f3002581cf946bc730bdba988f412f2cc359e39fef4fddf7a732202d3c1df9947ceeafc9a2abf7169dd29696d941b05b362163b42ccf53d5150a41b78d0d3c260ecfef8d12dd62758bc6959e04187a664c87a8f8b46444cc5cc9a9d38ac1a4adc2a12e603747e0b16d5197d46fb4e3c7c513f2690a87185a1d5067e57d47eab3578996f2d408a19101a2701ad631e65bea21839befa756306e7e2d901a172ec7775ee109251a7d70ad97e818cecfc95224f23c7b6ed7bea80b474e9591b274f15674b0d3bea4d8d47eca68adda5d1bd09207daa77629f4fff0fb32001eadf65af602556e4d574c83c096593480a7dba7de857cbd829c9adb0cc16a473600816f1ae68c2bbf70ed71b864dd7d9b148e6919958d9c3f171d7ca256a857af48c8a2e96b9e0f0411e9b41244384baf0d9fbf49e39a73bbd6956a2456a6abf409559ef92de27f0b94622b5bc6bf1d23ac825f6270aef7fc98778f665ccb44289c0d882eedc38cda0aa9547b9e878538ef9a798042fb1d31decc892d839ddb8bf6a1a7bc91775eb85a8ea12f211e0038e79134e2c32d8ed7bf5d16e798b26253d3040e8ef8fb545f846ede0a2e2ecc2309462bcf599cfc98a6df13753752b56c04576afa6f0bc17fac86a9193835261b63c31ada59e782e17951c3d0dbadc5aee08004d85393d0cd6f5ce62784741b27d59ae722a715547583a6d4d4806a38812fc4009863c45071f837ebbda409ba9875afbb0ed851aba075d37d80ce780fa3f2e098f5ff4b5eac5394f6552375fb8dc6d3b3177f0d559fedc0e63709062c2ec5f9cdf6795cfa58ffe2263012ca1962157e40b0672c8236ec6f9294cebac587608f766087f17d8b6860a74d20f55a8557c9d1e2128db2dbb70250869cccc4a232841667300c9dc829f46a5bc319761c3b51d8c82046a42d0b30a4ac71d9ab0e740da003d2513f6c3935e9dd7d37b67ace39509537f0b0b8a350cba8b301b98dc7b609cdfdbad34378574d650c0bc16a50cc1c7eecd915499806a4fa811eb36d06161aa4704cbc8a830b526540f584f7943c6b255bee827824a0cb6454148e33559c124504b03a6ef2f3546bbc9938074a81e9f3d5df322830a142330b3a9b6d0d670630bfab0f5078495148e97b526dbfc272a0d0a6c288a15385f2882394a98320cab56dee5badeb71807c903e87d3096cd8537336df97f3daeee79a5a001ae48598263d92ecf2245e28f6724b55da15c9a80bee243095a9e402fef678a4a34efab33d812291c3c56b1495bfe87bd141f2cdf902a3c7735d9319c0026e0e8071da4b05aa9f513890378b6a6b8efc5891d47010b1ca4ed8e4c99b46a8c15f538857683e59c3cbba62f7cb692f383aa82840374cc81bebb2100285d002e897b80cf788aef64b916fd73a36c61881569afe3af9ded1fe237be89af2eb18a24958fba3cb6320b04d06e603aaf9932037987a806c6be10149e14e06698cbe71063d5fb57c59fe965edeaed9ba7b693255fe3028416017418d88a13c1a2cf6ae2a33edc39bc533a07432e5877a0966a44a6a436a4371cbc163de54c04500e7c8bfb69809053b17c3a8d7cede9792f055f376c99f937177e93361c6a1dff66f81ef48baaebfa7574cd1842aa03a2574f2056a760212334ad6c17f84aba21e9beb1640cb0fe84656fdfcc65584c42c8a1bd124feb28bb3322cd53ea822cb5a2531165de70734f8022f56b7388b16bc3b0347b71d5a397acb0c9f83bdb27e6736f3db6c2d3ea8685865e314a77a5e48e97904d30ae4bfa8f49a789da07be6a79fc490cba89e3ecc30116b5db0d2786f22cf1d17924c380354d169f157b2ab5efa4caefe4f834e6a25b545c1399b6b769880dc56097c34693213dff7e453d33b9a1c9f5b154bccb1acd3cb1194f4a15a227aa5bf7059e9f6b4b51898d2b0ecce1ef5d7a00756b04822053055d1a92c019a20d00a3882fcda1b49ebd8791112a3cc8bc200ddd0cf521d8639acab17eac872c2eeae0b2d4e8f4e19d472d7b092c348089b898b40b77f21a583acf00428335c23bf1fada4635b7c3594efa0436b5e868b35b5a997d8c8461f1ff99dd0193ea67b0c2b268f13231c33c5009c3b8a0d34e0a696b1d197ba9c5dd065efd1473d4fb1c51d5efa38aa0b1fd841a8c03b60b7f7f976ad55ea6a4745d308d42be652369c1c229f18aff0967eea4f264c1821318222a66efa8a92c6208bcbe9231bda9634f5d63f87cf1685116755c3be6b6e5e2f38e84e922b2ab4c483b7311b19ecbdf1b79e960f2a9eb0d04fb4ab86dfb9fd6bd3a0623cbd0aa702bcff9b7ca97fef558d512173c192496be77e5c3a35ea73a05d2fc0b4dbfa7179279ab2348d7bd5228af3291e30e793aa0fdbe8c544e0779cf5dc72a6f3812fc24cb9fa52baf8679372dff3ceb283408583d86d350510fc1cd95829b3df7a1e250d63ce38d65cb47901ff553c0850b17980e59b7cc788bf95c3c7d9e6376a70edb7f0a0d660feff3a4b1d98c304e1915ddc541092f0e32966f2912c47418fa708e62ec56cecc67c891cf82938081d961d837b2ba0860b844cf9032ad410b11fec3622db3c09542479394000a875559e66a3487d678b51ce72a12215e7ef287b69260ed0210654e8630242cd0e3a1fc52d62233318c3b8b04ebc5f3dd4db5ab01b2d008624f602891a8365ec9b3f11db10f314b146dba3cc9d54ddd56fdde7478e2c2019c8b1cd6a4ff767acf41e0d0e50710ced86702798757ea03ef6cfddba5fbba3cf8a1f675b1c5b66355b9da837485b1e69e620d8ed3f347a36a416d48970db558199379f30cc2612da268efac40afd8774e0dca3e8767adfd0248f25d7eb252bfd8545394aae44cef52875858444608fa03299a9069bc4d65d4f422687150acc5839c54c06e886a03590a3bec43cf7877131cb7252b23fc58f01014e3cb616204c44de2c8791782093"}, {0xd8, 0x113, 0x5, "0fea11976312b26ecb921ac5a5da03948f001d4d92fb4753abcecf0c81be4ce1dab098b77882659836364f196bfa54cd705c78edc471d99a6a534d9f452784acc1f260772d053267dbdd37cd2171d8c2749364a48562f9afe3f0de85370ffda23745f9d71fd2d29208a32806722e184f1414af689580ad0a14672aaf441dd32ebdbea2f36544aaf447f79b13660f2d7b9056edf8365f3f70ef3790b683aa408efce6c7b520ff74eba4afbb025cb2c57269a4fd000c22d0e7c60df14266bdd6408bb675e8a9a548d0fe5ae2"}, {0x6c, 0x115, 0xf92d, "49c268e040af53150ac2e3d29fc5c0488d7fec54b194029852b3c8bc9bb19d13cd9dc24a595206cba8681b9dd58da9bf6349787fe8a7ad1679f4708fc2dc240aa9cf41f525bc475edc3a032e81703bbbd2fe4768d903e8a0d40f9fe914"}, {0x94, 0x29, 0x7, "9fe45e0fbc459056f369a0bdecc19bd6cdcb6cd5af5945c21ef0e379e5897b54cc01cc1fbeb412e5d91f7300e5045434f7e4ff34b53bbcebbf237cd5ae51e88ac3459bda0b9a8b20b1cd385794aa59e10440549e08f93d76b733ad815966c5cadf7eee6c9008004184edf937f5a8dae5c32f50e6f891352b29f4284412a89acdddc6828c8a969710"}], 0x24c0, 0x40080}, 0x1)
socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000100))
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000180)={0x1, [<r1=>0x0]}, &(0x7f00000001c0)=0x8)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000200)={r1, 0x9, 0x7, [0xfff, 0x8, 0x8, 0xfffffffffffffffd, 0xfffffffffffffe93, 0xffffffff, 0x1]}, &(0x7f0000000240)=0x16)
setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000280)=0xba, 0x1)
fsync(r0)
socket$inet_smc(0x2b, 0x1, 0x0)

[  132.517326] binder: release 19080:19098 transaction 413 out, still active
[  132.524351] binder: undelivered TRANSACTION_COMPLETE
[  132.527634] kernel msg: ebtables bug: please report to author: bad policy
[  132.531859] binder: release 19080:19083 transaction 408 out, still active
[  132.543438] binder: undelivered TRANSACTION_COMPLETE
[  132.550712] binder: 19101:19107 ioctl 400454d4 20000000 returned -22
[  132.560499] binder: 19101:19107 ioctl 541d 0 returned -22
2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0x0, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = getpid()
ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)=r1)

2018/02/28 09:17:38 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0xfffffffffffffdf8, 0x0, &(0x7f0000000000)="b44e51aa25156fc4bdaffd90a79ed810a5519404b6426738662c785bf26fa2c3680b50e441908cbfb2102919c00cb88b47ecc91233cf791674c9dc"})
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800)
r1 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x0, 0x0)
ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000100)={0x14000, 0xf004, 0x7, 0x20, 0xffff})
r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r2, 0x111, 0x3, 0x0, 0x4)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000140)={<r3=>0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x30, 0x0, &(0x7f0000000180)=[@dead_binder_done={0x40086310, 0x4}, @acquire={0x40046305, 0x2}, @increfs_done={0x40106308, r3, 0x4}, @increfs={0x40046304, 0x3}], 0xff, 0x0, &(0x7f00000001c0)="c72f782b36f7311db27b107db8428bb304eebe013738fc95bc677be68e6e48257955117403232923d680fa711f805eaeca46576463038d69729e424d94a0c18d232f6a40a71c4224f7815e4d66661fb53269b27f3183541aa34731b82862fd5acfb81be659532daba03b0f2c860ac116b87f6feeecc2493577089b04bb4b93ee19610f169b9ef10f8bf52f9266ee3077e48b4e6029c43af5991f703b2eaecc1e1fbb2bcb5a5a4e1f01f92d108e323d5bfe1d7673e2340289e8da6a41c0a952b641964daf02b732e547799645f59d04500e70d0e533733b64b47538ebfcc9cb8a057ee240dc41b8a6cfa68ee56beeac8c7166610ea3a8a26a3493550cdb6ed8"})

[  132.568417] binder: release 19085:19090 transaction 410 out, still active
[  132.575414] binder: unexpected work type, 4, not freed
[  132.580746] binder: undelivered TRANSACTION_COMPLETE
[  132.587419] binder: 19101:19107 ioctl 400454d4 20000000 returned -22
[  132.595373] binder: 19101:19114 ioctl 541d 0 returned -22
[  132.599123] kernel msg: ebtables bug: please report to author: bad policy
[  132.609327] binder: release 19109:19112 transaction 419 out, still active
2018/02/28 09:17:38 executing program 4:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200000, 0x0)
ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000040)=0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 2:
r0 = dup(0xffffffffffffff9c)
ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000000100)={0x800, 0x0, 0xfffffffffffffff7, 0x10, 0x7})
r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  132.616361] binder: undelivered TRANSACTION_COMPLETE
[  132.619871] binder: 19121:19129 ioctl 8901 20000000 returned -22
[  132.626991] binder: release 19115:19123 transaction 421 out, still active
[  132.634705] binder: undelivered TRANSACTION_COMPLETE
[  132.649660] binder: release 19101:19120 transaction 422 out, still active
[  132.656727] binder: undelivered TRANSACTION_COMPLETE
[  132.665710] binder: release 19121:19129 transaction 426 out, still active
[  132.672731] binder: unexpected work type, 4, not freed
[  132.678138] binder: undelivered TRANSACTION_COMPLETE
[  132.683544] binder: release 19121:19129 transaction 423 out, still active
[  132.690523] binder: unexpected work type, 4, not freed
[  132.695913] binder: undelivered TRANSACTION_COMPLETE
[  132.701160] binder: release 19132:19133 transaction 429 out, still active
[  132.708185] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x400000000000800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
accept4(r0, &(0x7f0000000000)=@in={0x0, 0x0, @multicast1}, &(0x7f0000000080)=0x10, 0x0)

2018/02/28 09:17:38 executing program 4:
sysfs$3(0x3)
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x80040)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x344, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0xa, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:38 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r1 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f0000000300)=""/235, 0x3546db8276b1216c)

2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x249, 0x0, &(0x7f0000000080)=[], 0x0, 0x0, &(0x7f00000000c0)="3283a52cf642b689239da2dd19e7b9ea9007dee8d174194b1c66528cb917fa5132d6256c70d4dcf8a2e18e03d78228198031024911fc4737249c269d7c61fa5651aa4106000000df445a0219666af2da0349c3beed473d3d6c84440b07472d41e479cb90f19640f2006df9214a14d9393604dd7f5dac3e5be91641cbd190b428d991334bf7aa378c25e054fa62af62977f6afa6a"})

2018/02/28 09:17:38 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0xfb081a62c9fdaca, r0)
ioctl$DRM_IOCTL_AGP_RELEASE(r1, 0x6431)
r2 = getgid()
socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000140)={<r3=>0xffffffffffffffff})
setsockopt$inet6_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000180)={0x8902}, 0x4)
nanosleep(&(0x7f00000000c0)={0x77359400}, &(0x7f0000000100))
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000040)=0xc)
r5 = eventfd2(0x6, 0x0)
read$eventfd(r5, &(0x7f00000001c0), 0x8)
r6 = getgid()
setgroups(0x3, &(0x7f0000000080)=[r2, r4, r6])
fcntl$dupfd(r0, 0x406, r0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  132.713348] binder: release 19101:19107 transaction 415 out, still active
[  132.720283] binder: undelivered TRANSACTION_COMPLETE
[  132.725422] binder: release 19115:19123 transaction 420 out, still active
[  132.732352] binder: undelivered TRANSACTION_COMPLETE
[  132.737531] binder: release 19109:19112 transaction 414 out, still active
[  132.744505] binder: undelivered TRANSACTION_COMPLETE
[  132.749723] binder: release 19108:19111 transaction 416 out, still active
[  132.756683] binder: unexpected work type, 4, not freed
[  132.761980] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x344, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = dup2(r0, r0)
getpeername$unix(r1, &(0x7f0000000000)=@file={0x0, ""/108}, &(0x7f0000000080)=0x6e)

[  132.772552] kernel msg: ebtables bug: please report to author: Wrong len argument
[  132.779790] binder: 19146:19156 transaction failed 29189/-22, size 40-0 line 2848
[  132.781376] binder: 19149:19158 unknown command 0
[  132.790686] binder: 19146:19160 transaction failed 29189/-22, size 40-0 line 2848
[  132.793380] binder: 19149:19158 ioctl c0306201 20000180 returned -22
[  132.803544] connsecmark_tg_check: 15 callbacks suppressed
[  132.803547] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
2018/02/28 09:17:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = dup(r0)
ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000000)=ANY=[@ANYBLOB="f8ffffff7e020000f45fe1b9004b9954ad5f36e987774bbe3eab24991a5f4ed1307aab0ad0ae1c83d38bcdcf88b5768f468810136be95f5a6209c26d4145dcf6d783ae6be28cfb3b3ff0b5db2e520aa78e98fa82f90817e34f1769d94a997216d31e5f67a4b4f953a00d92ffcf051a92f9a62dbad2a86ba9ad02f890a855fd253da4bfe48c6e945f992708b4f9def9cbb921580718ab53c50f7c86bc3fb682219ec02e4adc55afa0d6048026b5e455c2b1e520fd58ff23d62504cbc2d9639b"])
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 3:
memfd_create(&(0x7f00000000c0)='trustedlo&(\x00', 0xfc121e567de51292)
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0xffffffffeffffffe)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB="0000000200000000"]], 0x0, 0x0, &(0x7f0000009000)})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x80000)
ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000040)=0x7fff)

[  132.829932] binder: undelivered TRANSACTION_ERROR: 29189
[  132.835438] binder: undelivered TRANSACTION_ERROR: 29189
[  132.836845] kernel msg: ebtables bug: please report to author: Wrong len argument
[  132.843129] binder: release 19147:19153 transaction 430 out, still active
[  132.855586] binder: unexpected work type, 4, not freed
[  132.860886] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x208000, 0x0)
setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000040)=0x7fffffff, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xfffffffffffffcec, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f00000000c0)="f5fb41b3504f2ecfddbb5335bdf617000067b92f07c63cd0866a3a13a3109e5d8a34919d983c65a8c7c308108be9287d902740e48507c959e4fa36eafa4f7aeea56cbbfefd88c3a2c63deb38efd8a98a199ee614"})

2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8, 0x10000)
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000180)={<r1=>0x0, 0x400, 0x4, [0x9, 0x7, 0x40, 0x8]}, &(0x7f00000001c0)=0x10)
setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000200)={r1, 0x1f, 0x30}, 0xc)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000040)={<r2=>0x0, @in6={{0xa, 0x4e23, 0xb4e4, @mcast1={0xff, 0x1, [], 0x1}, 0x1ff}}, 0x4}, &(0x7f0000000100)=0x98)
setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000140)=r2, 0x4)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000a61e0000000000000000000000000000000000000000000000002800000000000000080000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='H'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x344, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 3:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
preadv(r0, &(0x7f0000000380)=[{&(0x7f0000000080)=""/129, 0x81}, {&(0x7f0000000140)=""/110, 0x6e}, {&(0x7f00000001c0)=""/216, 0xd8}, {&(0x7f00000002c0)=""/182, 0xb6}], 0x4, 0x0)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:38 executing program 5:
r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xfff, 0x101000)
socket$vsock_stream(0x28, 0x1, 0x0)
setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000040)=0x4, 0x4)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  132.874878] binder: 19173:19180 ioctl 40085203 20000000 returned -22
[  132.877573] binder: release 19168:19170 transaction 440 out, still active
[  132.888399] binder: undelivered TRANSACTION_COMPLETE
[  132.902392] binder: release 19168:19170 transaction 439 out, still active
[  132.909394] binder: undelivered TRANSACTION_COMPLETE
[  132.922385] kernel msg: ebtables bug: please report to author: Wrong len argument
2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x100, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  132.930398] binder: 19173:19191 ioctl 40085203 20000000 returned -22
[  132.939401] binder: release 19150:19163 transaction 438 out, still active
[  132.946392] binder: undelivered TRANSACTION_COMPLETE
[  132.946843] binder_alloc: 6345: binder_alloc_buf size 3145728 failed, no address space
[  132.959760] binder_alloc: allocated: 7656 (num: 168 largest: 96), free: 536 (num: 6 largest: 464)
[  132.962327] binder: release 19173:19185 transaction 441 out, still active
2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0x0, 0x800)
r1 = creat(&(0x7f0000000140)='./file0\x00', 0xa)
setsockopt$inet_group_source_req(r1, 0x0, 0x2dc1e7b71978085b, &(0x7f0000000280)={0x9, {{0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}}, {{0x2, 0x4e24, @multicast1=0xe0000001}}}, 0x118)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000002e5cce3200000000000000800000000000001f0000e7ff"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0xffffffffffffff18, 0x0, &(0x7f0000000180)="975e268b52ede26aaaf12e53a74270abd56be4d995da56ec9a9dda167f46d2d7d717cff0ee9cc21099de9f8be1125e72c14f55bbdb91529aab5e9a0726a0391702f09d7eaba82e3a98c3b5c4576634cbb5749de1ac28664ffeb8a9ce449f342a6605a491023eb3b8af9ee046cfa013b30a2a60701fd10e9349f947ae3c822bdf06b4c4e3c29eee8243740214d3cbc49439c1d30e8ab7a0bef3f81311a55fac8582bc7f741761cadee8e937ab148e1aa49911dfd9c798c0e1d3e10e68959abefb06000000442a70c063cf9f927629b4dde4dc8c751b66a546f88e"})
socket$kcm(0x29, 0x2, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={<r2=>0x0}, &(0x7f0000000040)=0xc)
ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000480)="3880e80c047159f2b98f7b75235db8867e7a472ed107bc452bed3bec873b5432514823fcdbbbb3eca5d82aaf77152c4188a4dcf29a52be174e23328e74420d8454bbc747746a20e4c3f836defefd267165cf6262a3b58d66a513017b2f8dae5d6cd09479168405ad3fe13d7a9e631b4cf579166c0ed075c77bdf4e84fe16bb32003e18b64c7d9709d0d3e60fe1cebe6e9030318bc0765ecbbe12f5766767ead54b9b8f30eeba94f01fa568ef39471748440f8e8ca64ff91b5b58b8b3d53f363796e770e57c403c48f3757a128c6f0bc3c4bb87f644238bba1990b84fc436")
fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x3, r2})

[  132.968823] binder: 19192:19199 transaction failed 29201/-28, size 2621440-524288 line 2963
[  132.975707] binder: undelivered TRANSACTION_COMPLETE
[  132.989672] binder: release 19147:19159 transaction 435 out, still active
[  132.996703] binder: unexpected work type, 4, not freed
[  133.002000] binder: undelivered TRANSACTION_COMPLETE
[  133.009857] binder: release 19197:19198 transaction 442 out, still active
[  133.013623] binder: 19204:19206 transaction failed 29189/-22, size 40-0 line 2848
[  133.016811] binder: undelivered TRANSACTION_COMPLETE
[  133.016831] binder: release 19197:19200 transaction 443 out, still active
[  133.016836] binder: undelivered TRANSACTION_COMPLETE
[  133.021319] binder_alloc: 6345: binder_alloc_buf size 3145728 failed, no address space
[  133.027300] binder: 19204:19206 transaction failed 29189/-22, size 40-0 line 2848
[  133.029775] binder_alloc: allocated: 7656 (num: 168 largest: 96), free: 536 (num: 6 largest: 464)
[  133.066536] binder: 19192:19208 transaction failed 29201/-28, size 2621440-524288 line 2963
2018/02/28 09:17:38 executing program 4:
syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0x0, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:38 executing program 5:
r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
getsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, &(0x7f00000001c0)=0x7, &(0x7f0000000200)=0x4)
r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0)
r2 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x5, 0x220000)
sendto$llc(r2, &(0x7f0000000140)="c0239b4ffe62090aca6905bcafeb0cdd1ef7d92704a6f9cb00dba54cb38f19875478eb8d706d85321d18b929e968344b", 0x30, 0x4004, 0x0, 0x0)
r3 = socket$can_raw(0x1d, 0x3, 0x1)
sendto(r3, &(0x7f0000000000)="c20ce0e652ed0d58da990b9a498544a3ef6d7b1e7fd0ee6933af5448a860f60a9ac7c2506019839e4ababbdfccb98abd02aa56c971ee5f6928d9c4ea2ea53705cbc33581d5e7bcf4eeeaaf91a0733860ee069747ad0e325095790facf0cb2bf86000d7edf325b95f3d81ad", 0x6b, 0x20000040, &(0x7f0000000080)=@nfc={0x27, 0x100, 0x10001, 0x7}, 0x10)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
setsockopt$netrom_NETROM_IDLE(r1, 0x103, 0x7, &(0x7f0000000040)=0x7, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0xa05fe, 0x0)
ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000000)=0x1)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:38 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
r2 = socket$nl_crypto(0x10, 0x3, 0x15)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000000)=0x14, 0x4)
r3 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)
getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000300)={<r4=>0x0, 0xffffffffffff8001}, &(0x7f0000000340)=0x8)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000380)=@sack_info={r4, 0x7, 0x3ff}, 0xc)

2018/02/28 09:17:38 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0xff, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:38 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000d2c1da36"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
recvmmsg(0xffffffffffffffff, &(0x7f0000002bc0)=[{{&(0x7f00000000c0)=@pppol2tpin6={0x0, 0x0, {0x0, <r1=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast2}}}, 0x32, &(0x7f0000001180)=[{&(0x7f0000000100)=""/53, 0x35}, {&(0x7f0000000140)=""/62, 0x3e}, {&(0x7f0000000180)=""/4096, 0x1000}], 0x3, &(0x7f00000011c0)=""/6, 0x6}, 0x3ff}, {{&(0x7f0000001200)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x10, &(0x7f0000001380)=[{&(0x7f0000001240)=""/134, 0x86}, {&(0x7f0000001300)=""/123, 0x7b}], 0x2, &(0x7f00000013c0)=""/177, 0xb1, 0x2}, 0x3}, {{&(0x7f0000001480)=@ethernet={0x0, @remote}, 0x10, &(0x7f0000001740)=[{&(0x7f00000014c0)=""/172, 0xac}, {&(0x7f0000001580)=""/50, 0x32}, {&(0x7f00000015c0)=""/158, 0x9e}, {&(0x7f0000001680)=""/132, 0x84}], 0x4, &(0x7f0000001780)=""/136, 0x88, 0xd589}, 0x401}, {{&(0x7f0000001840)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000001880)=""/221, 0xdd}, {&(0x7f0000001980)=""/126, 0x7e}, {&(0x7f0000001a00)=""/65, 0x41}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000002a80)=""/58, 0x3a}], 0x5, &(0x7f0000002b00)=""/181, 0xb5, 0x2289}, 0xa4e}], 0x4, 0x2000, &(0x7f0000002c40)={0x0, 0x989680})
getsockopt$nfc_llcp(r1, 0x118, 0x7, &(0x7f0000002c80)=""/97, 0x61)

2018/02/28 09:17:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000040)=[0x1ff, 0x1f])

[  133.079299] binder: undelivered TRANSACTION_ERROR: 29201
[  133.084801] binder: undelivered TRANSACTION_ERROR: 29201
[  133.101651] kernel msg: ebtables bug: please report to author: bad policy
2018/02/28 09:17:38 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4c, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x20, 0x40, &(0x7f0000000040)=[@fda={0x66646185, 0x9, 0x4, 0x3d}], &(0x7f0000000080)=[0x58, 0x40, 0x48, 0x0, 0x78, 0x58, 0x30, 0x0]}}, @register_looper={0x630b}, @enter_looper={0x630c}], 0xb5, 0x0, &(0x7f0000000140)="9ee5655ee37308026213e86293769390588c4656083f8ea59fa94750c017413723fc20d6887f02a88e71b925ce89c928877cc45eb9335c439b2284b1d45b72b06d50e4bae40e6f9c03d3e625b73b6ef66cb5c1fa35f5d9390c327a70286c2408ac2d38e255866d5b654332b492c8a050e544f8662b182e489d93feaa8ef16cc5ba01e3fb90081fe67c6763b8b23048e8649622ef370313b5677e2d8cf6ddbf1dd789b04f42c4d2bf305c4092cb69fd51fd3538f072"})

2018/02/28 09:17:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="be824d04e9ee70030e32a5250ff35900880900a9467511"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:38 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x280802, 0x2)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  133.117747] audit: type=1400 audit(1519809458.821:110): avc:  denied  { setopt } for  pid=19220 comm="syz-executor6" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1
[  133.122520] binder: 19214:19223 transaction failed 29189/-22, size 40-0 line 2848
[  133.148004] binder: release 19215:19219 transaction 448 out, still active
[  133.156362] binder: undelivered TRANSACTION_COMPLETE
[  133.167234] binder: release 19227:19229 transaction 451 out, still active
[  133.174226] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:38 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0x0, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  133.180828] binder: release 19227:19229 transaction 450 out, still active
[  133.187880] binder: undelivered TRANSACTION_COMPLETE
[  133.196950] kernel msg: ebtables bug: please report to author: bad policy
[  133.200217] binder: 19235:19243 got transaction to invalid handle
[  133.210208] binder: 19235:19243 transaction failed 29201/-22, size 32-64 line 2848
[  133.218416] binder: undelivered TRANSACTION_ERROR: 29189
[  133.220354] binder: 19236:19240 transaction failed 29189/-22, size 40-0 line 2848
[  133.224184] binder: release 19222:19226 transaction 452 out, still active
[  133.238596] binder: unexpected work type, 4, not freed
[  133.243898] binder: undelivered TRANSACTION_COMPLETE
[  133.243943] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  133.257805] binder: 19235:19249 got transaction to invalid handle
[  133.261043] binder: undelivered TRANSACTION_ERROR: 29189
[  133.264139] binder: 19235:19249 transaction failed 29201/-22, size 32-64 line 2848
2018/02/28 09:17:39 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fadvise64(r0, 0x0, 0x5, 0x1)
r1 = accept4$inet(r0, &(0x7f0000000000)={0x0, 0x0, @rand_addr}, &(0x7f0000000040)=0x10, 0x80000)
getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000080)={<r2=>0x0, 0x46, "a42b46df4f76f092d34e10ddf203cf54e5877f7cd5fe9f34c4b44c26df22822bc8872c3e72e3ab12508bf8f2dd5bdddce71f8d5760ff6e56459e6ef10ea1ec2567c60313508a"}, &(0x7f0000000100)=0x4e)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000140)={0x975a, 0x7, 0x8000, 0x65, 0x9, 0xfff, 0x3ff, 0x187, r2}, 0x20)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010700009110e36c48c60000001e0000000000993986188d"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0x0, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
personality(0x800000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 3:
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=<r0=>0x0)
getpriority(0x1, r0)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[], 0x0)

2018/02/28 09:17:39 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x22eca169, 0x30800)
ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:39 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r1 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r1, &(0x7f00000000c0)=""/235, 0xeb)

[  133.292086] binder: release 19235:19243 transaction 458 out, still active
[  133.299044] binder: undelivered TRANSACTION_COMPLETE
[  133.304651] binder: release 19235:19243 transaction 455 out, still active
2018/02/28 09:17:39 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400080, 0x0)
ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000040)={0x2, 0x0, [{0x8000001d, 0x6, 0x100000001, 0x4, 0xffffffffffff0000}, {0xc0000001, 0x3, 0x5, 0x100000001, 0x6}]})
clock_nanosleep(0x7, 0x0, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100))
unlink(&(0x7f0000000080)='./file0\x00')

2018/02/28 09:17:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="d6189036929a47d23bca7d40622120b00baf03adfddd90eddffb85d03e89774cd2188fea17d35058c1c62d717d5b38329145d19b5c713c82600bd9f98ba60d64014e"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
r2 = getgid()
syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0x0, r1, r2, 0x6, 0x8000)

[  133.355610] kernel msg: ebtables bug: please report to author: bad policy
[  133.363912] binder: release 19254:19257 transaction 460 out, still active
[  133.370882] binder: unexpected work type, 4, not freed
[  133.376206] binder: undelivered TRANSACTION_COMPLETE
[  133.386722] binder: release 19259:19265 transaction 465 out, still active
[  133.393731] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:39 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x29, 0x5, 0x0)
getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x374, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x0, []}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:39 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000240)={<r1=>0x0, 0xfffffffffffffffd}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={<r2=>r1, 0x68, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0xfff, @remote={0xfe, 0x80, [], 0xbb}, 0xffff}, @in6={0xa, 0x4e20, 0x7, @loopback={0x0, 0x1}, 0x80000000}, @in={0x2, 0x4e23, @broadcast=0xffffffff}, @in={0x2, 0x4e20, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e20, @multicast1=0xe0000001}]}, &(0x7f0000000180)=0xc)
setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={r2, 0x0, 0x50d, 0x3, 0x6, 0x1f}, 0x14)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  133.408464] binder: release 19261:19270 transaction 466 out, still active
[  133.415443] binder: undelivered TRANSACTION_COMPLETE
[  133.424603] binder: release 19259:19263 transaction 463 out, still active
[  133.431590] binder: undelivered TRANSACTION_COMPLETE
[  133.437771] binder: release 19255:19264 transaction 464 out, still active
[  133.444774] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:39 executing program 6:
mkdir(&(0x7f0000000240)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000400))
r1 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0x7, 0x0)
r2 = socket$rds(0x15, 0x5, 0x0)
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000003c0)={r2, r3})
r4 = open$dir(&(0x7f0000000040)='./control\x00', 0x0, 0x0)
linkat(r4, &(0x7f0000000000)='./file0\x00', r4, &(0x7f0000000300)='./control\x00', 0x400)
r5 = creat(&(0x7f000028f000)='./control/file0\x00', 0x80)
clone(0x28080100, &(0x7f0000000080)="99767bf7d5ac7ae579c3ff9cf1b557629c0f0627598328d011649c91021eeb137039208749ceada3aca4a451c4bdde6a0b5900f00be1b440435a9e58", &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)="80dd623708a668a176222fffeaf389778f88126998d196c5d414b6931576365d5d8478ee89143bdf6ce497702c4f26807327c8ae919738d3b4e9cb6529821a0c81090e83fc622013f7732a638375c3d266a64989")
write$sndseq(r5, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000f86000)='./control/file0\x00')
getdents64(r4, &(0x7f00000000c0)=""/235, 0xeb)

[  133.475532] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.483221] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.492113] binder: 19275:19276 transaction failed 29201/-28, size 40-0 line 2963
[  133.496428] kernel msg: ebtables bug: please report to author: Wrong len argument
[  133.510730] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  133.518491] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.518693] binder: undelivered TRANSACTION_ERROR: 29201
[  133.527367] binder: 19280:19283 transaction failed 29201/-28, size 40-8 line 2963
[  133.541159] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.548877] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.557763] binder: 19277:19287 transaction failed 29201/-28, size 40-0 line 2963
[  133.559400] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  133.573169] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.578270] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  133.582066] binder: 19280:19283 transaction failed 29201/-28, size 40-8 line 2963
[  133.589147] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.594366] binder: undelivered TRANSACTION_ERROR: 29201
[  133.597687] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.613549] binder: undelivered TRANSACTION_ERROR: 29201
[  133.619554] binder: 19281:19284 transaction failed 29201/-28, size 40-0 line 2963
[  133.632714] binder: undelivered TRANSACTION_ERROR: 29201
[  133.654601] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.662274] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.671162] binder: 19281:19296 transaction failed 29201/-28, size 40-0 line 2963
[  133.682324] binder: undelivered TRANSACTION_ERROR: 29201
[  133.687843] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:39 executing program 4:
socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = getpgrp(0x0)
fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x2, r1})
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x289, 0x0, &(0x7f0000004fbc)=ANY=[], 0x0, 0x0, &(0x7f0000000000)="b4e54cdfd19b3dfd01000000c5ef90196072db48955a136b47b582d8b80a9827292ba73d7cb25acac89020"})

2018/02/28 09:17:39 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000000)={0x2b87, 0x6, 0x0, 0x4, 0x3, 0x3, 0x3f, 0x10001, 0x52aa0b28, 0x8, 0x1f, 0x23cb})

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x374, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x0, []}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:39 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x29, 0x5, 0x0)
getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4)

2018/02/28 09:17:39 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0x0, 0x0, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:39 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x400000, 0x0)
ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x40, 0x0)
setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000080), 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a627700000075cb2300f2cde0cb5c367fa92e2fe072df9867f6151566a97d6c3ce6a753e5c92fe5556919fce6524783b7a1d14e338e66ca318cc77356ad038fd6d5f86789c402c43960c985e2485104a39d03a00735d5fd919986ef7ab1a375a48a8af27c698164cf80897353643733f4c665e0b16be60cce19e871ff63d16e6605bc513ef84d5cb1675ba62fb8bda37498e73d23207b12949d0a3b36ce1b6ff3bedc4e6d174eeed9ea4c0985d38a1f0a2836810d1d763a8ad5255e282afc76f73f2199a338e0eecd53ac9eaa643d5f267033bda781a9d4dec548341c5fa7da8380d33e646a098ef35453886ba1ef89164f95d6ad9ccac142fcd1bc54a4535b4ab3c0e9d4ec058966577e40", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  133.790306] kernel msg: ebtables bug: please report to author: Wrong len argument
[  133.802505] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.804981] binder: 19308:19309 unknown command 0
[  133.810178] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.810216] binder: 19312:19317 transaction failed 29201/-28, size 40-0 line 2963
[  133.815961] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:39 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x0, 0x0)
readv(r0, &(0x7f0000000000)=[], 0x0)
getsockname(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0009da00feb272d5f6a966d385414a2ab8002600"], &(0x7f0000000080)=0x10)

2018/02/28 09:17:39 executing program 0:
r0 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x7fffffff, 0x20002)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001480)={0x8, 0x9, 0x6, 0x1, 0x14, 0xffffffffffffff9c, 0xfffffffffffffe00}, 0x2c)
r2 = getuid()
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000014c0)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, &(0x7f00000015c0)=0xe8)
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001900)={0xd, 0x8, 0x2, 0xffffffff, 0x5, 0xffffffffffffffff, 0x2}, 0x2c)
sendmsg$nl_generic(r0, &(0x7f00000018c0)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001880)={&(0x7f0000001640)={0x230, 0x10, 0x428, 0x70bd2d, 0x25dfdbfb, {0x1e}, [@typed={0xc, 0x49, @fd=r1}, @nested={0x19c, 0x2a, [@typed={0xc, 0xb, @uid=r2}, @generic="faf1b2ea351ef74861d2f6661609bc2cde2f029d2f373e475c36d2da522225fa2f0e18cc5fed23777d687f106ad5c44ff1721574535fdb933a2540d0947936c28f8db545ffb1c7152167f4930c545e28c00e442b28113666c42632512fbea2ee44ac3b5f7c88ec346096abee7fca9f15f0e3e81c746de659709c085d376314008b00d481fbd81bfbfd362c8c898df5d0c06e323b1dc54667d5aad9d34776eb542ac508", @generic="492f05a67723c44011d8ddc59484ed6f2c3c5c8a349385b5c0410c47c844d91948ef8f02998187ded78bbf5d18de2cd2caa8634d5feb61d25f4176117a04664fce35cfa159fe758c03a4aab4d7f9ee95709e636197bc322092ecdaee9bea38dede614c3bd6fd85e51f1067752e1e983846f41c7511b8fbdccef46c6101867ea1a51ecd2072eb1699d6420281874a04c3ad1e4d276f30d5db83fa17eb8445655bd695207646a4573dfc8da7cd159b45606f5f91260737f143f5190c6daf707494f4a74c9fef3c2c5f164ce185ed3c", @typed={0xc, 0x72, @uid=r3}, @typed={0xc, 0x79, @fd=r4}]}, @generic="f6e39b6e5f39c0ece5e82c0e9b4bd49ec4af9b9ff959a13c04b7e6c54f343ba2d57d6a89264d159ea3ad20d8d6e40699c1f6d36e6db5d7842adcbd99d814846052df4c771ca28f69fb173501828175dc92ec17825b588db85402f4", @typed={0x18, 0x90, @ipv6=@empty}]}, 0x230}, 0x1, 0x0, 0x0, 0x4000}, 0x11)
r5 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r6 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x12, r5, 0x0)
syz_emit_ethernet(0x39, &(0x7f0000ea7cfa)={@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], {@ipv6={0x86dd, {0x0, 0x6, "c000e2", 0x8, 0x2f, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@echo_reply={0x81}}}}}}, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x58, 0x8, &(0x7f0000000000)=[@fda={0x66646185, 0x8, 0x1, 0x1c}, @fda={0x66646185, 0x9, 0x3, 0x2c}, @flat={0x73622a85, 0x1, r6}], &(0x7f0000000080)=[0x38]}, 0x71}}], 0x0, 0x0, &(0x7f0000000180)})
r7 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f00000013c0)=@filter={'filter\x00', 0xe, 0x6, 0x117c, [0x0, 0x20000240, 0x20000c80, 0x20000f38], 0x0, &(0x7f0000000100), &(0x7f0000000240)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x5, 0x0, 0xf6, 'irlan0\x00', 'syzkaller1\x00', 'bpq0\x00', 'sit0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], @empty, [0xff, 0xff, 0xff, 0xff, 0xff], 0x98, 0x98, 0xc0, [@connlabel={'connlabel\x00', 0x4, {{0xb2b, 0x2}}}]}, []}, @common=@STANDARD={'\x00', 0x4, {0xffffffffffffffff}}}, {{{0x9, 0x4, 0xa00, 'ip_vti0\x00', 'bridge0\x00', 'dummy0\x00', 'syzkaller0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], 0x8e0, 0x928, 0x950, [@among={'among\x00', 0x84c, {{0xe285, 0x2, 0x3f, {[0x1000, 0x3, 0x0, 0x8, 0x0, 0x1ff, 0x4d52, 0xffffffffffffffff, 0x1ff, 0x65, 0x100000001, 0x0, 0x401, 0x9, 0x9, 0x6, 0x9, 0x4, 0x9f8a, 0x1, 0x4, 0xffff, 0x1, 0x52, 0x10001, 0x2, 0x80, 0x7d7d, 0x1, 0x3, 0x200, 0xff, 0x401, 0x52, 0x40, 0x9, 0x6, 0x9f, 0x1632, 0x40, 0x4, 0x2, 0x1ff, 0x1, 0x3, 0x7, 0x101, 0x7, 0x3, 0xfffffffffffffffe, 0x8, 0x0, 0x6e, 0x6eacf10, 0x8, 0x2, 0x7, 0xffffffff, 0x4d53, 0x80, 0x101, 0x80, 0x7, 0x400, 0x2, 0x1, 0x9, 0x80, 0x7fff, 0x400, 0x401, 0x9, 0x6, 0x9, 0x9, 0x101, 0x1, 0x1, 0x4, 0x3, 0xfffffffffffffffe, 0x0, 0xa9f, 0x7, 0x800000000000000, 0x40, 0x4, 0x400, 0x1, 0x0, 0xffffffff, 0x6, 0x4, 0x7, 0x80000001, 0x5d2, 0x1, 0xeac, 0x0, 0xfffffffffffff800, 0x8001, 0x2000000, 0x4, 0x0, 0x6, 0xb90, 0x8, 0x6, 0x1, 0x0, 0x3, 0x4, 0x3, 0x100000001, 0x6, 0x1, 0x80000000, 0x80, 0x2, 0x6, 0x2, 0x8, 0x7, 0x800, 0x0, 0x4, 0x2, 0xe2, 0x9, 0x3, 0x8, 0x100000000, 0x1f, 0x1, 0x6, 0x8, 0xfff00000, 0x3f, 0x8, 0x2, 0x2, 0x7, 0x7, 0x6, 0xfffffffffffffff9, 0x6, 0x20, 0x20, 0x3f, 0x0, 0x3ffc0000, 0x6, 0x6, 0x3f, 0x3, 0x2, 0xe73, 0x3, 0x7, 0x7, 0x2, 0x1, 0x401, 0x6, 0x8, 0xfffffffffffffffa, 0x7f, 0x7fffffff, 0x4, 0x3, 0x81, 0x0, 0x80000000, 0xe774, 0x3800000000000, 0x9, 0xfffffffffffffffc, 0x7, 0x4, 0x6, 0x3, 0xffff, 0x400, 0x4, 0xffff, 0x10001, 0x7f, 0x2, 0xffffffffffff0001, 0x3, 0x2, 0x9, 0x1000000000000000, 0x7fff, 0xfffffffffffffff9, 0x400, 0xfffffffffffffff9, 0x4, 0x6, 0x1000, 0x2, 0x10000, 0x7fffffff, 0x6, 0x54ad, 0xa98a, 0x3, 0x6, 0x1000, 0x0, 0x2, 0x4, 0x3, 0xaf9f, 0x401, 0x2, 0x2, 0xdc, 0x45, 0xec74, 0xfffffffffffffffb, 0x80, 0x0, 0x1d6b, 0x8, 0x0, 0x7, 0x400, 0x7, 0x800, 0x3, 0x8001, 0x5, 0x0, 0x3f, 0x81, 0xfffffffffffffffc, 0xe70, 0x4, 0x740, 0x5, 0x3, 0x6, 0x7, 0x7f, 0x8, 0xbc, 0x9, 0x1, 0xa2, 0x6, 0xffffffffffffff9e, 0x100000001, 0x101, 0x1623c00000000, 0x9, 0x1], 0x2, [{[0x2, 0x54c], @empty}, {[0x0, 0x3], @dev={0xac, 0x14, 0x14, 0x10}}]}, {[0x39, 0x4, 0x401, 0xa83b, 0x4, 0x80000001, 0x100, 0x100000000, 0x1, 0x2, 0x54f, 0x3528, 0x6, 0x7ff, 0x4935, 0x5, 0x100, 0x40, 0x0, 0x9, 0x2882829e, 0x1, 0x2, 0x7fff, 0x4, 0x1ede0daa, 0x6, 0x1, 0x4, 0x1, 0x3, 0x7, 0x2, 0x1f, 0x9, 0x5, 0x3, 0xfffffffffffffe00, 0x6, 0x7, 0x6, 0x7fff, 0x7f, 0x1272, 0xa8, 0x6, 0x101, 0x4795, 0x400, 0x96, 0x4, 0x2, 0x3, 0xffffffffffffff20, 0x4, 0x7, 0x1, 0x2, 0x5, 0x7fffffff, 0x4, 0x101, 0x7fffffff, 0x8, 0xffffffffffff7fff, 0x100000000, 0xc3e0, 0x8, 0x4, 0x4, 0x0, 0x20, 0x401, 0x40, 0xffff, 0xfffffffffffffff8, 0x3f, 0x1, 0x9, 0xf710, 0x7f, 0x81, 0xfffffffffffffffb, 0x4b, 0xcde0, 0x100, 0x0, 0x2, 0x9, 0x77, 0x0, 0x0, 0x0, 0x4, 0x5, 0x6, 0x3, 0xe1, 0x6, 0x9, 0x1000, 0x8000, 0x100000001, 0x6, 0xa1, 0x80000000, 0x6, 0x80000001, 0x4, 0x8000, 0x9, 0x89, 0x81, 0x1, 0x7ff, 0x92, 0x10d, 0x100000001, 0xbc7, 0x5, 0x0, 0x100000001, 0x20, 0x8, 0x7ff, 0x88, 0x2, 0x1, 0x1aee, 0x400, 0x4a62, 0x7f, 0x12c1, 0x380, 0x8, 0x3, 0x8, 0x39a9, 0x1000, 0x0, 0x3, 0xffff, 0x78, 0xba95, 0x0, 0x96, 0x1f, 0x4, 0x8, 0xb1c, 0xfffffffffffffff9, 0x5, 0x3, 0x1f, 0x6, 0x1ff, 0x101, 0x1, 0x4, 0x3dc0, 0x5, 0x1, 0xda, 0xa6, 0xfffffffffffffffb, 0xfffffffffffffffe, 0x7, 0x6, 0x3, 0x8, 0x80000000, 0x7, 0x3f, 0x4, 0x7, 0xd3, 0x5, 0x0, 0xc9, 0x3ff, 0x6, 0xfff, 0x4, 0x5, 0x1, 0xfffffffffffffeff, 0x80, 0x400, 0x5, 0x7, 0xffffffffffffffe7, 0xf0b, 0xfffffffffffffff7, 0x100000000, 0x6, 0xffffffff, 0x2d5, 0x3, 0x1, 0x20, 0x8, 0x200, 0x7, 0x1ff, 0xa9, 0x9, 0x5, 0x5, 0xfff, 0x5, 0x5, 0x7, 0x8001, 0x401, 0x6, 0x5, 0x0, 0x8, 0x9, 0x8, 0x400, 0x7c67, 0x3ff, 0x1, 0x13addc55, 0x8, 0x464b, 0x100, 0x5, 0x7, 0x8, 0x2, 0x1, 0x80000000, 0x80, 0x1ff, 0x7, 0x400, 0x7, 0x9, 0x3, 0xd3d5, 0x78, 0x9, 0x8d, 0x0, 0x10001, 0x9, 0x2, 0x7, 0x7, 0x4, 0x7, 0x7, 0xd6b, 0x2, 0x50], 0x2, [{[0xffffffff, 0x3], @multicast2=0xe0000002}, {[0xa44, 0x9], @broadcast=0xffffffff}]}}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0xfffffffffffff000, 'syz0\x00', 0x7f0}}}]}, @common=@AUDIT={'AUDIT\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x15, 0x40, 0x11, 'ip6gre0\x00', 'ip6gre0\x00', 'bridge0\x00', 'ip6gretap0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x12}, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x17}, [0x0, 0xff, 0xff, 0x0, 0x0, 0xff], 0x9c, 0x9c, 0x10c, [@m802_3={'802_3\x00', 0x8, {{0xd4, 0x46, 0x1, 0x5}}}]}, []}, @common=@nflog={'nflog\x00', 0x4c, {{0x8001, 0xfffffffffffff7cd, 0x9, 0x0, 0x0, "7d6b91a5c22201dae8c066a0c20ed4319330cc8db92f9f02f138768010209bb18d3fe4652fda71301f31676590760814c8aebb57ed052c6527f975e5096e76cd"}}}}, {{{0xd, 0x7e, 0xe8ff, 'sit0\x00', 'ipddp0\x00', 'bpq0\x00', 'irlan0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x13}, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], 0x104, 0x154, 0x17c, [@physdev={'physdev\x00', 0x44, {{'syzkaller1\x00', {}, 'syzkaller0\x00', {}, 0x1}}}, @cgroup0={'cgroup\x00', 0x8, {{0x6, 0x1}}}]}, [@common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x9}}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0x3}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}]}, {0x0, '\x00', 0x4, 0xfffffffffffffffc, 0x2, [{{{0x7, 0x8, 0x0, 'vlan0\x00', 'lo\x00', 'dummy0\x00', 'vlan0\x00', @random="7982dd4bd7ab", [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0x0, 0xff, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@redirect={'redirect\x00', 0x4, {{0xffffffffffffffff}}}}, {{{0xd, 0x18, 0x88e7, 'bcsh0\x00', 'gre0\x00', 'ip6gretap0\x00', 'teql0\x00', @empty, [0x0, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0x0, 0x0, 0xff, 0xff], 0x30c, 0x35c, 0x38c, [@ip6={'ip6\x00', 0x4c, {{@mcast1={0xff, 0x1, [], 0x1}, @empty, [0xffffffff, 0xffffff00, 0xffffffff, 0xffffffff], [0xff000000, 0xffffffff, 0xff000000, 0xff000000], 0xbdb4, 0x3f, 0x2, 0x0, 0x4e20, 0x4e21, 0x4e20, 0x4e22}}}, @bpf0={'bpf\x00', 0x208, {{0x27, [{0x10000, 0x9c, 0x7fffffff, 0xdb3}, {0x9, 0x4, 0xed1}, {0x6, 0x3, 0x0, 0x2}, {0x3413, 0x4, 0x1, 0x2f}, {0x7, 0x800, 0x3, 0x5}, {0x7f, 0x1ff, 0x5}, {0x1, 0x3, 0x6}, {0x30973aeb, 0x1ff, 0xa286, 0xfffffffffffffff9}, {0x0, 0x1, 0x7ff, 0x8}, {0x5ab, 0x1, 0xeb44, 0x100}, {0x1ff, 0x3, 0x6, 0x5}, {0x1000, 0x8, 0x5, 0xffffffffffffff80}, {0xcab, 0x6, 0x20b, 0x7}, {0x7, 0xcebe, 0xffff, 0xc474}, {0xb2, 0x7ff, 0x200, 0x6}, {0x9, 0xa75, 0x5571, 0x1000}, {0x1, 0x6e, 0x2, 0xfff}, {0x800, 0x2c, 0x7, 0x200000000}, {0x7ff, 0x0, 0x1, 0x7}, {0x2, 0x7, 0x4, 0xda8}, {0x4b, 0x3, 0x7fff, 0x20}, {0x7ff, 0x9, 0x5, 0xfef}, {0x0, 0xe5, 0x2, 0x81}, {0xf6, 0x4, 0x7, 0x6}, {0x3f, 0xf6e4, 0xff, 0x2}, {0x5, 0x8ed, 0x1, 0x80}, {0x6, 0x4, 0x1, 0x2}, {0x0, 0x0, 0x80000000, 0x7fffffff}, {0x99a3, 0x3, 0x401, 0x8}, {0x100, 0x5, 0xcf, 0x1}, {0x4, 0xfffffffffffffffc, 0x9, 0xff}, {0x81, 0x0, 0x40, 0x7}, {0x1ff, 0x5, 0x10d7ba88, 0x1d78}, {0x1, 0x8d, 0x1, 0x8001}, {0x2, 0xffffffff, 0xc41, 0x1a}, {0xff, 0xb1, 0x7fff, 0xff}, {0x81, 0x2, 0x0, 0x1ff}, {0x3f, 0x6, 0x100000000, 0x4}, {0x10000, 0x1, 0x7fffffff, 0x7fffffff}, {0x9, 0x6, 0xfffffffffffffffe, 0x4}, {0xfffffffffffff800, 0x2, 0x7, 0x1}, {0x53ae, 0x5, 0xffffffff}, {0x4, 0x1, 0x6}, {0x6, 0x101, 0xfffffffffffffe01, 0xc00000000000000}, {0x1ff, 0x7446, 0x4, 0x8}, {0x7, 0x3f, 0x1ff, 0x9}, {0x2, 0x5, 0x4, 0x1000}, {0x6, 0x6, 0x64, 0x4}, {0x6, 0x0, 0x31, 0x9}, {0x4, 0x5, 0x20}, {0x401, 0xfffffffffffffffd, 0x6, 0x9}, {0x6aa, 0x7fff, 0x4, 0x5}, {0x0, 0x8, 0x9, 0x1ff}, {0xfff, 0x7, 0x1000, 0x2}, {0x40, 0x2, 0x100, 0x3f}, {0x7, 0x100000001, 0x4}, {0x100000000, 0xb21f, 0x800, 0x90b}, {0xf43, 0x9, 0x9, 0x5c9b}, {0x5, 0x7, 0x3, 0x100000001}, {0x10001, 0x10000, 0x81, 0x3e}, {0x80, 0x7ff, 0x84, 0x1}, {0x80000001, 0x0, 0x0, 0x31}, {0x6ae5, 0x0, 0x101, 0xa7}, {0x3f, 0xbeab, 0x70, 0x2}], 0x7}}}]}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x4, {{0xffffffffffffffff}}}, @common=@redirect={'redirect\x00', 0x4, {{0xfffffffffffffffe}}}]}, @common=@dnat={'dnat\x00', 0xc, {{@random="9841397a0819", 0x10}}}}]}, {0x0, '\x00', 0x6, 0xffffffffffffffff, 0x0, []}]}, 0x11cc)

[  133.827198] binder: 19308:19309 ioctl c0306201 20008000 returned -22
[  133.831624] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.831649] binder: 19316:19319 transaction failed 29201/-28, size 40-0 line 2963
[  133.844488] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.847926] binder: 19314:19325 transaction failed 29189/-22, size 40-0 line 2848
[  133.854673] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:39 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000000040)})

2018/02/28 09:17:39 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x29, 0x5, 0x0)
getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x374, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x0, []}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  133.854700] binder: 19312:19317 transaction failed 29201/-28, size 40-0 line 2963
[  133.873411] binder: undelivered TRANSACTION_ERROR: 29201
[  133.881451] binder: 19308:19326 unknown command 0
[  133.886870] binder: binder_mmap: 19329 20ffc000-21000000 bad vm_flags failed -1
[  133.918065] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.921739] binder: undelivered TRANSACTION_ERROR: 29201
[  133.925745] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  133.925771] binder: 19333:19335 transaction failed 29201/-28, size 40-0 line 2963
[  133.931325] kernel msg: ebtables bug: please report to author: Wrong len argument
[  133.940456] binder: 19308:19326 ioctl c0306201 20008000 returned -22
[  133.947900] binder: undelivered TRANSACTION_ERROR: 29201
[  133.957508] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  133.975053] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:39 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={<r1=>0x0}, &(0x7f00000000c0)=0xc)
ptrace$getregset(0x4204, r1, 0x200, &(0x7f0000000180)={&(0x7f0000000100)=""/107, 0x6b})
r2 = gettid()
syz_open_procfs(r2, &(0x7f0000000000)='net/unix\x00')

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x0, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
sendmsg(r1, &(0x7f00000001c0)={&(0x7f0000000000)=@pptp={0x18, 0x2, {0x3, @broadcast=0xffffffff}}, 0x20, &(0x7f0000000180)=[{&(0x7f0000000040)="585f281920cecf251ef357926ecb943291de8271ecea9d45adba755d6ae6ec3574294f2c8b1f1feb9dd7497c4dc499bbc5f0d32c4d94fcf933d2c8791955e40745d197e569ce463ad182043b84fdfca2c91b29f4e9c564c5af80e8418f12ccfd6918424a76b5d7d73fb5ab105815809d9814740627cbf6e14aa2df378803124f635a54152226545e209851f991bb99afaf463c1b28e7513f92df1898f2f44416348a256141754c5817f4fce75588", 0xae}, {&(0x7f0000000100)="9d6522afbc8bbedd0e8069ee61d25822c8b4f7ad84294b3f74e5de3b706e8db4ac743efa3fef128a5d78ab6b1762fd454a97a0c9e175b07d0eed1b6360604b0d5c0dfed64a3024", 0x47}], 0x2, 0x0, 0x0, 0x80}, 0x84)

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x0, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:39 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={<r2=>0x0, 0x582b}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000140)={r2, @in={{0x2, 0x4e21, @broadcast=0xffffffff}}}, 0x8c)
ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000080)=0x6)
ioctl$TIOCSCTTY(r0, 0x540e, 0xffffffffffffffff)
prctl$void(0xf)
socket$bt_rfcomm(0x1f, 0x3, 0x3)
fcntl$setpipe(r1, 0x407, 0x1)

[  133.983970] binder: 19334:19338 transaction failed 29201/-28, size 40-0 line 2963
[  133.984104] binder_alloc: 6345: binder_alloc_buf size 216 failed, no address space
[  133.999348] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.004080] binder: undelivered TRANSACTION_ERROR: 29189
[  134.008226] binder: 19329:19330 transaction failed 29201/-28, size 88-8 line 2963
[  134.032878] binder: binder_mmap: 19329 20ffc000-21000000 bad vm_flags failed -1
2018/02/28 09:17:39 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$kcm(0x29, 0x5, 0x0)
getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 5:
times(&(0x7f0000000180))
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000000addce8d5175eb30000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0xe8, 0x1)

[  134.041796] binder_alloc: 6345: binder_alloc_buf size 216 failed, no address space
[  134.049565] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.058449] binder: 19329:19342 transaction failed 29201/-28, size 88-8 line 2963
[  134.058552] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.073860] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.082734] binder: 19350:19353 transaction failed 29201/-28, size 40-0 line 2963
[  134.090367] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.091443] binder: undelivered TRANSACTION_ERROR: 29201
[  134.098053] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.104155] binder: undelivered TRANSACTION_ERROR: 29201
[  134.112421] binder: 19357:19361 transaction failed 29201/-28, size 40-0 line 2963
[  134.118079] raw_sendmsg: syz-executor4 forgot to set AF_INET. Fix it!
[  134.128901] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.138056] binder: undelivered TRANSACTION_ERROR: 29201
[  134.139797] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.145257] binder: undelivered TRANSACTION_ERROR: 29201
[  134.154105] binder: 19352:19356 transaction failed 29201/-28, size 40-0 line 2963
[  134.160361] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.174873] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.183752] binder: 19357:19364 transaction failed 29201/-28, size 40-0 line 2963
[  134.183790] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.192088] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.206956] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.215835] binder: 19350:19353 transaction failed 29201/-28, size 40-0 line 2963
[  134.223534] binder: undelivered TRANSACTION_ERROR: 29201
[  134.229057] binder: undelivered TRANSACTION_ERROR: 29201
[  134.234571] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:39 executing program 2:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0)
fcntl$notify(r0, 0x402, 0x10)
fcntl$setpipe(r0, 0x407, 0x2)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000280000000000000000000000000000003844111c04ab3b0610dd3a542ec95bb16c22c04f731546a9ab9cb77f756b0e8ba1293522c3c0901f04932015700aa009efe3b5a7e44476c646195ef41e59893f6e27d952236866465d392ef499da1771f71b3b662ac15283c3ff25b6acf4be93f23ce2a0f4a599fed31f5fc9a88914ba0ccf81512d032d8c87f83e4f5ddedf7c000554fd6774a4f568c16ecc3147e3e6fff989f87f873203ba258b2610eb0b7a5e337822a99a2f8e9403f219882d9cd4d02cfdf43c75792fcf510ce455dc07f10b02b966d747443c4479bb31e9d6203c402d202d7c18041623f5ed8250976131959d", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000ec70000000000000000000000000000000000000039000000000000000800000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x0, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:39 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [0x0, 0x0, 0x0, 0x0, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:39 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4)

2018/02/28 09:17:39 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'gre0\x00', <r2=>0x0})
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', r2})
ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r0, 0x80045301, &(0x7f0000000180))
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
ioprio_set$uid(0x3, r3, 0x5)

2018/02/28 09:17:39 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB="1a"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x8000)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000040)={[0x6, 0x3, 0x2, 0x3, 0xffffffffffffffff, 0x7fd48f05, 0x4, 0x200, 0x4, 0x2, 0x5, 0x81, 0x80000001, 0xff, 0x7fffffff, 0x9], 0x7000, 0x4000})

[  134.240057] binder: undelivered TRANSACTION_ERROR: 29201
[  134.245518] binder: undelivered TRANSACTION_ERROR: 29201
[  134.281770] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  134.289443] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.297840] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.298330] binder: 19367:19370 transaction failed 29201/-28, size 40-0 line 2963
[  134.309123] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.321566] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.330444] binder: 19366:19368 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  134.330466] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.345824] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.350443] binder: undelivered TRANSACTION_ERROR: 29201
[  134.354709] binder: 19376:19377 transaction failed 29201/-28, size 40-0 line 2963
[  134.354773] binder_alloc: 6345: binder_alloc_buf size 72 failed, no address space
[  134.365892] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.367898] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.392188] binder: 19369:19372 transaction failed 29201/-28, size 57-8 line 2963
[  134.396431] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.400046] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.415538] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.422690] binder: undelivered TRANSACTION_ERROR: 29201
[  134.424418] binder: 19373:19380 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:40 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x2000000010002)
r1 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x2, 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f00000002c0)={0x1ff, 0x401, 0x5})
ioctl$PIO_FONT(r0, 0x4b61, &(0x7f00000001c0)="e57a255e87e05b26c4dc0c5e90af03e88b300d2d148429329fee62c9ac108dea787e65e96fe517eb7bc201c3ac12e2b2f9ed9d0100e54effa285d52b0c492368ac95e4bdee45bea397a149ddb204918c067221eb07cae2c2985361f59a8c1bd345dfcfd34dc7d21bf69b1d374f32a88f97f6beae59d87b008def5cac0784e5d0a358e7fddde14eeb87051ef497810d003597865e4cac112a5a2e0d4ac63e3fa0da5125e986823653876cb5273cf02122fd111b47722ae4586e664eab1bc3a2136726fb4dd5f7eefe23a079")
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a629108000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000000000000000a6f9ffff00000000000000000016c8727fd2a29731b0acb125fb36092953b3e157f727509905fa930f5dd52dd63df2"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x20000)
epoll_wait(r2, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x8)

2018/02/28 09:17:40 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x8400, 0x0)
readv(r0, &(0x7f0000000500)=[{&(0x7f0000000580)=""/235, 0xeb}, {&(0x7f0000000140)=""/205, 0xcd}, {&(0x7f0000000240)=""/80, 0x50}, {&(0x7f00000002c0)=""/110, 0x6e}, {&(0x7f0000000340)=""/1, 0x1}, {&(0x7f0000000380)=""/17, 0x11}, {&(0x7f00000003c0)=""/72, 0x48}, {&(0x7f0000000440)=""/70, 0x46}, {&(0x7f00000004c0)=""/2, 0x2}], 0x9)

2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x0, 0x40)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={<r2=>0x0}, &(0x7f00000001c0)=0x8)
mmap(&(0x7f0000e09000/0x1000)=nil, 0x1000, 0x0, 0x10, r1, 0x0)
pipe2(&(0x7f0000000040), 0x0)
getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000000c0)={r2, 0x3}, &(0x7f0000000100)=0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
close(r0)

2018/02/28 09:17:40 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:40 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4)

2018/02/28 09:17:40 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{0x2, 0x4e21, @rand_addr=0x8001}, {0x306, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x60, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xd}}, 'irlan0\x00'})

[  134.435076] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.443464] binder: undelivered TRANSACTION_ERROR: 29201
[  134.445183] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.459469] binder: 19367:19386 transaction failed 29201/-28, size 40-0 line 2963
[  134.460115] binder: undelivered TRANSACTION_ERROR: 29201
[  134.473949] binder: undelivered TRANSACTION_ERROR: 29201
[  134.479516] binder: undelivered TRANSACTION_ERROR: 29201
[  134.509215] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  134.516945] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.520255] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.525830] binder: 19396:19405 transaction failed 29201/-28, size 40-8 line 2963
[  134.526354] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.549030] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.557903] binder: 19400:19402 transaction failed 29201/-28, size 40-0 line 2963
[  134.559731] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.568100] binder: undelivered TRANSACTION_ERROR: 29201
[  134.573233] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.573265] binder: 19398:19403 transaction failed 29201/-28, size 40-0 line 2963
[  134.579232] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:40 executing program 3:
r0 = socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000))
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:40 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="00000000000040210bdea8b2db50dd1e7a415e525a455af9524d2942a58992f909a29e"]], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000040), 0x4)

[  134.602850] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.611718] binder: 19396:19405 transaction failed 29201/-28, size 40-8 line 2963
[  134.612236] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.621367] binder: undelivered TRANSACTION_ERROR: 29201
[  134.627050] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.627071] binder: 19400:19413 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:40 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4)

2018/02/28 09:17:40 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x5, @mcast2={0xff, 0x2, [], 0x1}, 0x6}], 0x1c)
getpeername$packet(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x14)

2018/02/28 09:17:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="85a4a08614d5d62b82", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x400, 0x0)
getsockopt$nfc_llcp(r1, 0x118, 0x7, &(0x7f00000000c0)=""/212, 0xd4)
ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000080)={'eql\x00', @ifru_addrs={0x2, 0x4e24, @multicast1=0xe0000001}})
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400, 0x0)
ioctl$KDSKBLED(r2, 0x4b65, 0x7)

2018/02/28 09:17:40 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  134.653399] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.655854] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  134.669010] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.677938] binder: 19426:19428 transaction failed 29201/-28, size 40-8 line 2963
[  134.678998] binder: undelivered TRANSACTION_ERROR: 29201
[  134.705725] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  134.713433] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.714941] binder: undelivered TRANSACTION_ERROR: 29201
[  134.722370] binder: 19426:19428 transaction failed 29201/-28, size 40-8 line 2963
[  134.734770] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  134.739949] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.748312] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:40 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000fc38230f95cc9449025027f60000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="00c90aaa8a5cb9950f491bfce31a8955f1fd1e9132d14ae7672275a610472a188e2b7770215b84aad43b26d1254d6b60e27780c81f7995252d9b90e792"], @ANYBLOB="010000000000000000000000000000000000000000001000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000000)='&\x00', 0x3)
epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
connect$rds(r0, &(0x7f0000000000)={0x2, 0x4e21, @multicast2=0xe0000002}, 0x10)

[  134.750995] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.751055] binder: 19433:19440 transaction failed 29201/-28, size 40-0 line 2963
[  134.756657] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.780735] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.789621] binder: 19434:19437 transaction failed 29201/-28, size 40-0 line 2963
[  134.799386] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:40 executing program 2:
getsockopt$bt_sco_SCO_CONNINFO(0xffffffffffffffff, 0x11, 0x2, &(0x7f0000000040)=""/22, &(0x7f0000000080)=0x16)
r0 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x4000)
setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x200, 0x7, 0x4, 0x2}, 0x8)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x400200, 0x0)
ioctl$DRM_IOCTL_RM_MAP(r1, 0x4018641b, &(0x7f0000000140)={&(0x7f0000fff000/0x1000)=nil, 0x6, 0x3, 0x80, &(0x7f0000ffc000/0x4000)=nil, 0x2})
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x3)
socketpair$inet(0x2, 0x200000000000002, 0x6, &(0x7f0000000100))
getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000240)=0x14)
r3 = getpgrp(0xffffffffffffffff)
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x8, &(0x7f0000000000)={0x9})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x441, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x92})

2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  134.807060] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.811445] binder: 19444:19447 transaction failed 29189/-22, size 2097327-0 line 2848
[  134.815965] binder: 19432:19439 transaction failed 29201/-28, size 40-0 line 2963
[  134.818337] binder: undelivered TRANSACTION_ERROR: 29201
[  134.829759] QAT: Invalid ioctl
[  134.838505] binder: undelivered TRANSACTION_ERROR: 29201
[  134.852535] binder: undelivered TRANSACTION_ERROR: 29189
[  134.860221] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.868096] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.868254] binder: undelivered TRANSACTION_ERROR: 29201
[  134.876973] binder: 19434:19442 transaction failed 29201/-28, size 40-0 line 2963
[  134.892982] binder: undelivered TRANSACTION_ERROR: 29201
[  134.898542] QAT: Invalid ioctl
[  134.907420] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.915112] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.918700] binder: undelivered TRANSACTION_ERROR: 29201
[  134.923998] binder: 19449:19453 transaction failed 29201/-28, size 40-0 line 2963
[  134.930051] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:40 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:40 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@rand_addr}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8)
fstat(r0, &(0x7f0000000cc0))
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000200)=<r3=>0x0)
fstat(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@local}, 0x0, @in6=@empty}}, &(0x7f00000003c0)=0xe8)
getsockname$ax25(r1, &(0x7f0000000d40), &(0x7f0000000d80)=0x10)
sendmsg$nl_netfilter(r1, &(0x7f0000000c80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000400)={0x838, 0x11, 0x9, 0x702, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x9}, [@nested={0x20c, 0x75, [@typed={0xec, 0x67, @binary="bcd44661f0a5aecebf82b2e5abd07bcce7d9f8110846866762f8beddeb97c773a5029677b00fe0657dd7a2d158ed0e72c3ac6c8e4ec879ce6bfa3a90f06faaa165c9c088d440dbe6043badd8af282b74eb91aa989246ca33a01947290d03db37b2de35918164fe0dfc6923a73b5f74b1c1a90e0fc71e02eddabea05f00824462239a7c92061abab937d9907b88b4601ca4aceafbb04d551b661f220a10fe0d5466814f387fd0478081ef1c033441199c6d3a156e613d4c28347935ff71b23b1e6e6ac9fca99a414040871010f2e6671fa50d5d8fbdb85311daf8c3a150346d2928261aa1"}, @generic="38e26c39ea23a21f0b6474a5646ad644a9d5beae500b6aa668e4b37c995008dd6dcf5f275a037ca7d1259d52ae21c38731ce1da85fc36a637341e1fc6830255d5464b01dc6853a166a67ce0ba45122cab3cf17ba27923124aef2ac314881beebe2b64c254d894bed0fc0ed6703ce3cb9015fbcf2e37a649e0c", @typed={0x10, 0x7, @u64=0xfffffffffffffff9}, @generic="ee50cc4ee302906df9682b9969144ecea7a98567fc742f2c5fb22bc26c0c1d577156f948298da4a2bb876019b8f2ccb346b13eb1eab43d040615fa3c368c5680e00a9c5d3e1ba036", @generic="492ff37e7f0df6fbd5e93b7787956367cce5ca99470a0c6f1d95d55700dfdc9aee4ed2dd80902ecbd4084f3ef8867117446959da51a10269b572c15c87d6a0e3c9c457809a03de11931c", @generic]}, @nested={0x278, 0x37, [@typed={0xc, 0x4a, @ipv4=@multicast2=0xe0000002}, @generic="8fee1a8cd170c4acb5223a6b84a7d7d89d6f4b64891ccefcb5c242999921ae852b3675eb25a48acdd1b31d5daa643e56495d09b9a4d591b88c447eda2fa9e3074f57a87d0a798412a19eb3f53086e64ad23c0de40f87f8b13539c9c435bbee27c09e60adb461da323f51553a0b2cc0ba5cf571ff36676e6abd5021d563d1d6dedf4596d52e2ec9517b6bb08b8ea484774cd9f808e48bcd842e1419d674e96b8b11626f9b6a3a85c3dd4b", @generic="f19d8c8fd514fec3c4f917e795e5ab2e096416da10262ad6cdaee87c6890fa0af27fc87c407c21ef6e6e6103976f2498d0da298921d3b035f4b0788b0ae2fc6531929608641b5dbc5171cb912704b90700b915ed773899d8412c89b8b7f3a23f5bfee7394da76e9eac69884e0656a894adcef1797dc8c59c6c8807e7d96462a5fe9553e9960cba95fb63391edc1dc3c68f17baef9a66e7267334b9138fc026ac544736b5701a30afd9962c71650816687168e2b202626a3973371677bb74e02f9c89f9cc11c12a608478945ad18379e9fed8f203deb35de2edb494b7469b0ee523bf3de1ae8250d68eeabc35f5cf4f98df65b83daa811c08d7e31b", @typed={0x18, 0x77, @ipv6=@empty}, @generic="7e2b08e5bbd249bf4435143d1173f3f059c9125751b84b60d56cd45950b87b706a70dd8149edd7a6c57abaf167d52d737576fed4a6b1ef51ba33267e12ccd52ac16cd55412efe4b0a08d043a059833d8062ef8f3e983a047c4215d95ce6f30420b6652a641751ddc8e160522afbedda4eff9654ac0016fff70f4e3323b86f9f35fa7cba229b926989932fa2929b22b8c198b9cc5ae131280e6594732678b9f1bf9c64eae761735ff"]}, @nested={0x224, 0x65, [@generic="d08dbe404a0551fe67ec860770ecd8ba540d01dd21b52f41fce7cfea514947772f2ede2754224f0c97573374a541d83520cab8c92b0f94892b8dc95aa18c5ae8ea00d57e2a37f54a8f90a40188195480f00beab12df2f83c8b65b4782de7cf8143f1e893041c39a7147378e25dada9ebe8bb238f293f1b02aa887e81ccebd5206810ed714ef29f72c3d6f3a3b2a2898fd4488f1c7b621da3c1e94d5198070dbf944f038d713f75a203fdc991", @generic="14a422f2e8b622d548876b9c1e18bf73f64db034f4e559cf9226111e2c3ea8876989e391db998991c894673037717e6a8ac7085a4cbca1fd4d57e57a23f61d418f56ccaecc286d5e91e10aa9b729d4b0b9f1eed2151d3824cb3f9c980afcd352a554653b8c32c4821ac303590f0f58c53d1cfa0c96310b4b3cfb91e232247026643bf6bef6e243bdb6f3becb672db9d0995bcd1f00ffe180afbada66", @typed={0xc, 0x22, @fd=r0}, @generic="b5c804db17ffd4c86020a774abf903b967ece92c0c87b953fb2defc18507faed05f6602d7614f444f9cedee3cc0bed9d538116693d01e0a57001ef52298c9d208fccaed6bf69cd5fbf974ec1755741cef65fe4f6cfc410", @generic="99c3d1a754b2b376f0baea14d3f4665d6e52bd22f72e983fe60c89899cf5403a88daba6013c0fafc3f92a1b5a65b0f3bd2e296cdaf10da603d5af9de54be9cb7ec0aec49a63852ef19532a25163579da6df6914acaf35f503aebc28f2656fa670bafa3333e46", @typed={0xc, 0x81, @uid=r2}]}, @nested={0x164, 0xd, [@generic="8bef1d7f5ee760f3087f1072031ed724b17d9b5b4eecacd6bfc3f0bd94bc43b2dba1443bd075c7f0b929d662fdc92adb3b00a036d73b7554ffe981", @typed={0xc, 0x1c, @pid=r3}, @typed={0xc0, 0x96, @binary="f598eacba546801a8a1ed72cb133cd36ef14eabe6aaa487bb36e94cd33aad712dd9f4654e464fa9ddf0a4e69262c594d6894ffbbaf8aec9892d925a1b617c1b3f75faa05052eabd7cd5ad3d797eda0f1342a457aa49f584d45b47071fa27b2d661079de80da0445d4a61ebaa351c816413c63abb576bc224196692525ffb6f53ab358673072f5cf00872c66558992ab7e5815ec380f7326ec38fee3c1c86826ecbd941eb6fc121dc462db15d5be0d2b38d8d3f63b8c21b31"}, @typed={0xc, 0x8, @uid=r4}, @typed={0x18, 0x5f, @str='keyringselinux+\x00'}, @typed={0x18, 0x43, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @typed={0xc, 0x13, @uid=r5}, @typed={0x10, 0x93, @u64=0x7}]}, @typed={0x18, 0x4d, @ipv6=@ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x11}}}]}, 0x838}, 0x1, 0x0, 0x0, 0x24000005}, 0x4810)
setsockopt$ipx_IPX_TYPE(r1, 0x100, 0x1, &(0x7f0000000040)=0x1ff, 0x4)

2018/02/28 09:17:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@release={0x40046306, 0x1}], 0x8d, 0x0, &(0x7f0000000040)="de521229cf982a01cec17d2454edba284270409105b14e8360585e12faf0f857634b8b7c9ba6af93c5166f24e44315ab5c240536822c2c8b97edfaa5d1339230b8c601e56c190133f6d067773ed64392878b001c46e0724dda5dbcc7013f50b6a8ac8b420894b1cff127ef64adbd9d92024e2117088bfec3be84c34cbca5959e985b2825676d6d8f88c6bfd986"})
r1 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x7, 0x20000)
ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f00000001c0)={0x7, &(0x7f0000000180)=[{}, {}, {<r2=>0x0}, {}, {}, {}, {}]})
ioctl$DRM_IOCTL_LOCK(r1, 0x4008642a, &(0x7f0000000200)={r2, 0x1})

2018/02/28 09:17:40 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@loopback, <r1=>0x0}, &(0x7f0000000100)=0x14)
r2 = getuid()
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0x4e24, 0x5, 0x4e22, 0x7, 0xa, 0x80, 0x0, 0x1, r1, r2}, {0x6, 0x0, 0x168, 0x6, 0x8, 0x8, 0x5}, {0x100, 0x1, 0x100000000, 0x3}, 0x8, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x4d6, 0x3c}, 0xa, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0x0, 0x7, 0x3, 0x0, 0x0, 0x4, 0x400}}, 0xe8)
ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f0000000000)={0x2, [0x10000, 0x975]})

2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:40 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0000000000000000000000000000000000000000834f1da808595512680be8dcfbfc12b09f845a75bdff9002c14c6a682f5f0b5f5ae7bc48d9c1736640ab8edf6d086dbec3977adf9746aa07c9debafb84171f5e4ff96723ede986623dde0ca96f18a1d7c468a056fd2e1c3db08890e9ccfb6071879f3643e9d8"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$sndmidi(&(0x7f0000000140)='/dev/snd/midiC#D#\x00', 0x5, 0x80)
ioctl$TIOCNOTTY(r1, 0x5422)
r2 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x1f, 0x2000)
ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000100)=0x106000)

[  134.958196] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  134.965875] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  134.974734] binder: 19449:19458 transaction failed 29201/-28, size 40-0 line 2963
[  135.005679] binder: 19466:19469 transaction failed 29189/-22, size 40-0 line 2848
[  135.010651] binder: 19465:19476 transaction failed 29189/-22, size 40-0 line 2848
[  135.018691] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  135.028722] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.029683] binder: undelivered TRANSACTION_ERROR: 29189
[  135.037604] binder: 19470:19473 transaction failed 29201/-28, size 40-8 line 2963
[  135.047726] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.056670] binder: 19466:19478 Release 1 refcount change on invalid ref 1 ret -22
[  135.058387] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.058411] binder: 19474:19480 transaction failed 29201/-28, size 40-0 line 2963
[  135.072239] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.090727] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:40 executing program 4:
syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x2a003)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x200003, 0x0)
dup2(r0, r0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  135.099616] binder: 19464:19471 transaction failed 29201/-28, size 40-0 line 2963
[  135.109105] binder: 19466:19469 transaction failed 29189/-22, size 40-0 line 2848
[  135.117183] binder: 19466:19478 Release 1 refcount change on invalid ref 1 ret -22
[  135.128234] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  135.135965] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.144869] binder: 19470:19473 transaction failed 29201/-28, size 40-8 line 2963
2018/02/28 09:17:40 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  135.145270] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.156474] binder: undelivered TRANSACTION_ERROR: 29201
[  135.160228] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.174556] binder: 19485:19491 transaction failed 29201/-28, size 40-0 line 2963
[  135.174645] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.189844] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.198733] binder: 19474:19480 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:40 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$dupfd(r0, 0x406, r0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:40 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x111200, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  135.210102] binder: undelivered TRANSACTION_ERROR: 29189
[  135.215916] binder: undelivered TRANSACTION_ERROR: 29189
[  135.246070] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:40 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x514])
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  135.254285] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.261937] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.270850] binder: 19500:19505 transaction failed 29201/-28, size 40-0 line 2963
[  135.285082] binder: undelivered TRANSACTION_ERROR: 29201
[  135.306563] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.313122] binder: undelivered TRANSACTION_ERROR: 29201
[  135.314268] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.320192] binder: undelivered TRANSACTION_ERROR: 29201
[  135.328530] binder: 19507:19508 transaction failed 29201/-28, size 40-0 line 2963
[  135.354626] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:41 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
socketpair(0x9, 0x802, 0x8000, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040))

2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:41 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:41 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="75396a8d00008140c5be804710952b914507f8dd482bc6ae8f0917511c33c162972ccb6d8cdd6efe52d9c83c739fc99c5ae07b4d2097dea25ccc0e26ed66044d7433fcd9a3c2b83d26b8ac7b762e2dbd34b2f917e268a76178922b5396436bee93726040f99be16afe6647ed287a22eaa2eaba96f1f495ab43872892daeb7ee54ff2b5abb887cc88e87eac731391a988aff8008bc8bff817e54d89bb9df1acaa427d29398aabeba6b3d3c793d267bbc8c52bd6d6f0edb3addcdc49cfb1b7c83190", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
pipe(&(0x7f0000000000))
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a2000803d0000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$dupfd(r0, 0x406, r0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYPTR, @ANYRES32]], 0x0, 0x0, &(0x7f0000009000)})

[  135.365253] binder: undelivered TRANSACTION_ERROR: 29201
[  135.376457] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  135.433956] binder: 19516:19519 unknown command 536871040
[  135.435194] binder: 19514:19521 transaction failed 29189/-22, size 40-0 line 2848
[  135.440287] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.454915] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.457985] binder: undelivered TRANSACTION_ERROR: 29189
[  135.463782] binder: 19515:19523 transaction failed 29201/-28, size 40-0 line 2963
[  135.476219] binder: 19516:19519 ioctl c0306201 20008000 returned -22
2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$EVIOCSFF(r0, 0x402c4580, &(0x7f0000000000)={0x56, 0x873b, 0x100000001, {0x81, 0x4}, {0x2, 0x1000}, @const={0x1, {0x7, 0x400, 0xbe, 0x76}}})
connect$ipx(r0, &(0x7f0000000100)={0x4, 0x7, 0xffffffffffffff85, "b56586f55e7c", 0x18}, 0x10)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000004000)={<r1=>0xffffffffffffffff})
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000013000)={0x1, &(0x7f0000018000)=[{0x6}]}, 0x10)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000080)={'sit0\x00', @ifru_mtu=0x1})
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000000eff0)={0x1, &(0x7f000001dff0)=[{0x6}]}, 0x10)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800)
pipe2(&(0x7f0000000480)={<r1=>0xffffffffffffffff}, 0x4800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="852a627700000000c9ce7cd5aca44bb77441be7c18eeeb24a2c13a6e83b193fb0338a6d6eda0b2c53496d3426a678c85536eab9d95146fa82f4ec2aebe34785bc5a7fbf68ccb531d5cae6963008da8cf3cc880f82edccc82e534c7ccd1234679bafeeaa3785e22dee2e4b278be2d6cf683bd922d743f715877a882062c5754f21fc7ca756c7a4cb9c9cb2ff9f57485", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001300)='/dev/dsp\x00', 0x101000, 0x0)
splice(r0, &(0x7f0000000080), r0, &(0x7f00000000c0), 0x0, 0x8)
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000440)={0xb2ad, 0x20})
io_setup(0x0, &(0x7f0000000240)=<r4=>0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
io_cancel(r4, &(0x7f0000002400)={0x0, 0x0, 0x0, 0x7, 0x97e, r3, &(0x7f0000001340)="f0b08c1a3738f4da75f01e95b59efad93230d2c46262a7acc52e140ce117a9bf8288b72da7d2aa9376136014715ae53bae89846dc275a8daa5fe75c5cae14814bd3970b99c21a6e58173f3414d6e1b8485388f9404ccb405ef463dd161630d27916b4e64f56a525e26b98b5119828368e7ede63640191405387a53b4750699dad83555b48d94596352da5d6800eacfd651bf1417a8cd10d0c310cc7efd15d72c6096d85137daadcf8eefa3e63fc8e7179a1288eb6ed1ec13ad8d68aa79394933dea382b16b66823d745a36fa3cab4e1ba71cef2df8df3ff8ad04146267294e8f58c70a6493137b79d9a7cdcfbf1271dc5c538c3527007e5b85371dbc5d86bbc8b9454547e376541b9d9cf6eb95c3faea013b4e9303fc6fcccb4b2d5982e1bdbaa430ced76ab550bf01040613e1f55c0f7266094b59f73a7acb338c9df53a2862105b2dcf2537b76757beec61e96ca3828340ea04b49f5a4cbc6f13a6078104efc7efa01b19583a60a3845bad7991b1d0d6509fc6c0bb124e55b284df6f7631eccbe87a8f067ce295fd675620365b3b61a6a9599c2d47934407cb388047e3ce814f10ed800d2c8ba3fe38503ed675bd59328dee2d4456a27745fb6aefa00893161190860e56d85c7e40068bbb08ae27aaf8e368cce5bd0f68737bf02168fc0d5599a14e4868884892cdadd0b7b4c0ac62e44c0fb2802a08624737ac98c392ec66417791cba416cb1577b5c42b603a4293253c7b5646a37aee33fa51ac78daa2bdb01c2aabdeb341ec7beb0361e9b3820c64e08c3bf89ef5920509432d7f2f73a5f580f15aafcc72eeac4437e4671cd228b30c790b0fc31729f9aec86efc4ea094330f5b213ca87ad03dda05c844015a371f99b4027ec104008fb7903cc4225134588d7d46986b4e8962b5c7f63954b1e07550563d04ae568794732c21027f70f89a1763f5bed42c14b7fa0c85ee626754badea5f14cc2317ae93c09b2a1e49d4fc481f1e49897b4c830d14d847223717b04f7c7c7286bde95f894ba00c1a288ffdf4e98f5613f216242d1e4f10c37d35f15aeb8f71579580ca39a2ccdcc8bec0df8bd9e468d2df99652ea1eec60abaa8679c962009c902a79a3df5f3e65a96d2037a7ede6bdc8e1ee486af58d58c6f54ad99f4a228b1daceff0904d6a8b3743dad36e45204f7418cf3ad3d80240f00ccff881b5185a2d27f725c901946b23e48b6df8545d8163deb5c5ef9a5d31f638a2cf81a25e1dab75451b6a3387aa02bcfe67ed711eb8cf81060595ca72312132c39b62d8d63ed3e51abdee53bc3062b7c23ca2207b75bc16ae4581d4168da602f338851b17951920e883caa11406f3512f435afabe4a8722d4fe45e9834353b4739f6448b19fabe50a7bb4b0bcfaa3103d647f86cd430a00dcfc4eb5f15bfc032fa939eac63df483292d7a512bd5dbb92270022ec623a01c5744f3d803438ae51f9ae6ebe29d2fa53f92bcdabff5f4c2bb1700d8b9d9f90f6a802e9b68ec8d536604a074d3a4cc305469398c5d8a651c8feb28e8b2aad3b07a9dc148022a389a2727e321c54a57d66007e76b9b952c574d47894c5a2f26439eaceaf561cfadb70ac8e84f9a00fb5112af169c1238d4b3e9bff92d81125f98f1301fcc1d3b2c0f20dff32969bdad61860f48c349a2a4c627438cbc88a3b0c1915ef5d3bbd8038a6bcfb5ae2f3e8de50f5c0eefd1642e3a350293a757c00fe95dc38893e616612a71570e5d78804f87b18c8f81aea694870d001cabe11cee3447bf43aaea11ac83498ebabd8b7c9a91954f296fb770cbf59e460c2fa99a69093a243a003f8e3d2f740015f47b88541b06934ea579e7e0d9aaa18bcb837a52f8d510df404ce26770c6b3dfc70024b78e07ff3a2f5d0a758c33b49d95d512c52e73254d2a99955dc5313da41ffd2b03e05314c98f158e174592e5c62aaef344ee294a25d3cb4740b3d016a98ae8ea599fe67e0c285b0a3dceefb2b6ce0c63e1e9997ca4a4f4d92e1e8d89091cb89ebf4f89827e8957557e07e28f251478ded57d9c59e74b033aae74bea8f9a517b6cba8e65b60893edfbd8ef86323122f931d42abfff66b20c79dd10ab7a5f2c503365404c8f6103de8d260915e3a16154701558c475601b2cfd858226fd9f3e9b40208f1361300db4dc86fbf28ae3632479248d716243ffd5d72be2e246224c4c2bb528d05c54f0733e06c73cffad33f02aa29194b7dd2e9cd9b53790ee93d6a2e605c748ac19b3bf0f2a4d4453aac0b0a25938a56b42c8b5a0ea4356c9f63d2ca96ee5cee7779ff744f7f35346c6a439e475b2447edccd2a07337e079d0a9c7dd988380e625e4c9c009fccbd1ef6363e1f9c41f141a7514e85ea3d28f268972d8943653d209022f5af6be09b671bbc78b4f39ec4acb80b490efa62ec6b0ea5ed0b5358483c483e03091fbbb48f453d43df96a55d150c159ec97c857e1b3bd132be430f2c29c09a4f47b869104e42704249b28852494144b6af7f2408588a4d3c3a98865d50ba0a45795ff9caf2b62979a759367e609ced9ded8333e75d6dd75c02da2a5e505f5a42c98a8c1c1cbb9e5d3ab18151698ab65685d51356b2c73548e8a5cb6a9cc2b787e54a85495baca5a5863a81cb835acace87478338f02c629a59cbae2b4c56c9d574fadeb429b48fd3cd4d01297eeb7073ca4c4804a29e7f298ba4eee73ed67b4b2791ed86c44532319d66d945f2672c73030cfafaa98ef881a7001c45a447780897491586f25fc9c3807075ca1fda2978c1f28fcaed66fe7cb6ca24eb6d9e00eccd5828bf4f05edea2bede80a95790ca20e4621265d2dd3e2edddfe861f9abcc96ba867a0db0bf20f5157ead976690e3d313090f9b209cc5c37324aa03adec69ca71da8265990082a84045e14c200fda52cb54a89555431862425cefc77048ae976dd097618805709302d8a29b5126bd41fea25f67b490bd1b28b0e10c26d59437c8efb06f8142bb56e417a40cab7ffb51d677182e89a37e5c6154de2fb810f9755734a0e1c6350dbcee74d106f3c3ca10167dd14e665f0bb88f61d6d8e6f5eae8a918937b1e68ea9dc1d3996c45d6344f06f22cc1a9ae8283764af755fb6262bad40415e957a3faadaefa577887cfd18f2eaafef8d3f7c7322764f6d31afd16e70c555c6818190e2f2791ea3c83ab818203b5fb5b9db73c76263fc4a68e2050d41caf3302c936bf38f3fdf402d70d942b3a8d16a1972298b52c6851b69995ebd9911dbf8057e82814fd606e7683627c5970a0a03250f8d137dec5c9a6cf013f6c4e879c9ce82a8111cc972d3f89c934455fc5b24a1f9c3155c3f49a3ea4f61b38c790a7448eb9b45844add4752172408c2a08753814540564de49ecafad4fd6915072274490203ef3f0c83be8fe91efd1a996a976bf3bf53b5f9359d6fc97f062b8d73f9c074b33b6d1a5776e844b5e4839de83bfef72f674f9787d6697be5488f85b88e78c0407e52b92022d01a74ad632079417af8049976891af1de42426203c1aec9a41d0349b033afbe48a223abbab8da086500ab1c87d1604d7a3375efaa0db2140aec1d112e4bb9feb18565080a4cc59ccf151512f39b758387a579708bc92fd3b9d345b9fbc880a4f5831220b028dcb95f03eb494b74c164857922e52dbfb9490912e9b90165f6e21369a2223ce61ed6f7a26595ef0b5f926eb5560eecbdad2620a3f9146d4708b01ce87c92e42d72bc8e0547c287deeb082628b3cb167ac6e0e3996fd46aac0950dbe88a2a2e5f9077c87a8838050df8fab30ac285da240f8327c30cef714012fabfdb9d9ee05183ff32cc4675b67b2b19e4418832637e94e0501aac9db8b9d8428e5920f2b001089128b0a6068390ac2bb3dfb1ca20bd3e95a4dbd3d380b3998a3e0ae343c9e0e6853f94c89c3fcd912e2da750ae3d33e09beee3aa7739b16824aadd78765edcd9dcbef3044475ddc109a4e7b102585b9b6b070ecfeff2a9030df084be6c5b3bb8ad03364678303b25c244c6f182e605ff6e3affe6ddb25a18899f3d8143208d7563248cda4c1cfdb06fd41876f3ed20163b6a5395e4c5ce5b8d0347f809a7ce27b6a85a2f5bdae26262597ba615a4b015782b008697a88eb6534e4dee4ad5107dfbe070acedc0b7466650efdf4f02a8295f0a608b94f177d1f187565f28822548b17cead8591ecaf3fd4a118f2a07fac5ccdace11dab083c28d31184a5ae2fac22625a070ea724784d3277bc23609e27541933c9fe513075f2c04c2dcdc539b54aa89542f99ccc6510943bd011ed14ddab709e2d035a697448972e39bd44c157fef831e5afa1eb187d190802607fc076b429cff61670da600912429851432d19d16631b9836690d9ad14032e6c23e0a055cca067006abdff97e747872ac4bc00e546ee60c6ebf12a792bd152d2b50d291705f31adf897c6fc61e539208130b2ccd5507f6699804b41e3227cc883d2d791d199ee042b146b8757e56b9c563e8169748c1649d20c69f33bcc61331c0a8e69870eca29ae43c7a959d003021c25217f11017ff67aa0411a40b6ed654bd62f4b6965760f35a0278b10e5c6a463477aa743c21290a9a9ab9be8b5e4e360c5a9dbb5bf8574db967ba850bba195f0959a6a4dbc1b6494e31c021236d758a6f0631e7c6d8643a0d9dfc100d4e14bf160553d1d83506886a0d1b138dafb160f52d0f5d00a2fac03b3f704163ab172e609049884034305e507a9c1b460d5f3b5c1617741e246ef28fa0287c8ec3386b0a3148f34f18292bfc44d0e1725c516afe03c5bfd38095d362027374270358b7c082abf5063638613c658d0a159964b88ecdc1dd3e4106f694283593267d0e923cf8b849507e05634564a3ddc2ed6fe826c2def946462e40c3c24f392794db453998ff19e13d91646abf4277d724706ff4c4b6ce964a764cc390bde1d88bef71d0a0de5e3b384c1da280289e48c8bdc59236cf2d25458aa49386ffeda36a43fb87133a5cc366c734582dcd209409ae0a8a8bef964be47b0661cb50d996895ffeacc49248b6745ef626bdddd0b12640b43fc361217db952b191a736ee2512545f8fa25072b708b1a1e5b38ca2b81fcf78cc88e462bb0932818fc56d5d6874da25741160bf0a611d0bbff4b0bdb75fd42580e7dcb8927c1c8494718d670fac19952c5601bdf0b83037bf7b7f8c7c2a63d7773637d5c5fd4ca83b9c6ea04cadeba7e6a79e280ef7c56d866ed64a9655ea3172dd4d84e9b87e702145fc8a24491833a427a724e7a70c1a31ed3c7b0a7967905363b0040dfb1d1ae1d98660cb6a2d837b20920bd58db30e5177aeef09a4132c9e49bdf8fd1c7bfe645bf5a7f4028e21aea8ce17ee8ae3ab6b32babbb3b69b03a46dacaa486501ab70d2c26b21c52a715da17cffae4a4b260b726f5c486ddd1d61a17a29a01668b8f89f6eeb2c1c6c752ce9389e42a7c4ec4b4a65c14c734860ba2d5dab6b0f556a099f39975dd27fd8d1732cc024715381b250e691cbdefe4a2ca6f927986e9b2ba8bb05be0bcc1feb2ad3b8b4ed98058792af851a17c10c0ec33cb3025feb786b762fbce2389458c467c1be7709f65c9c23d8b7b5adabe948befd1cbd4c7dea540dafea640dcfc0f463bbd09d9d13e47bb5f2266fe776b417366ae67ba57d7b6e1ca461637e62312713fe58b63a455d59806ee49bfa2f22bb503dfdd04cdc834837870ad46d1736502557920e760280c1620839b89564ebb4e38ca2155e1dcaa66eba6be1508ffbd49ca3878ee8dac96b6bb24a998f91351f36137013082b8f6ecf74f58921123243ad97d7c0cea00cdd0963c00977a5a077b44c032a7d1a2adcab0ebeefaf9bf664c2e9868bb7e44c805eae8cf4366e404a962ec89eaa2c6c219cb013ae6b0a108d5e1f02d27402070d254d4c247a813c77eb619135202988d15e5a1fbd261e6a88a949bd6da2c3e2f441dc3f736319b99879ed4259361b000ce16d3827d733d6b43aea9b31de8de23aa95e4ad31eb486ee99f6ee0f3049e5d70863ef", 0x10a7, 0x0, 0x0, 0x1, r3}, &(0x7f00000012c0))
ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000200))
accept4$netrom(r3, &(0x7f0000000380)=@full, &(0x7f0000000400)=0x48, 0x80800)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r3, 0x50, &(0x7f0000000280)={0x0, <r5=>0x0}}, 0x10)
ioctl$KVM_GET_MP_STATE(r1, 0x8004ae98, &(0x7f00000004c0))
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340)=r5, 0x4)

2018/02/28 09:17:41 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xffffff90, 0x0, &(0x7f00000003c0)=ANY=[@ANYRES64=r2, @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="24b3f807db2c03e1f44cacb9ec476a97d47e1569a1880b6fbae48ac9bb08ad5f05ef214f369025126bcf8bb1e01ba7c7da11516f67132c1d8af044b5d7f25411f2ffaf8f9683aa0329e2a233ae23d1aa18f603590b98c37ea9879945935b7d1b8d97720c010b58a0db54a9659409e4062a7871cd10e8831c0dab", @ANYBLOB="0dcf053aee56af12e2c1cb35ddd4bd82a52ee2d8a86cffea6ee4c38b120dbc413fac0553dcdb062159a1f94adadb7b341500269cee2e72db43400f3f1f94a969a24591750ee724bcf814be955dd24d5504d1c7d57a86c66b9263206ee05fd317fb85aa2c8027c01b25460e7b1855caeb9aa418c707f2e6fbc580d53cc4ba440948e4b323dbc4b7d685876ecaaff587a088cdfb94de5afc6f6f0af84505a422e16cff802502326777f3455c9d44de29d942b5afd34fe099fada2a7bdc53565613170fc28421748fde16dfc1f7afd87e94a04617e10a772fd5d9e5f460c2b7e0124735913bbe4bcfc0e4b40fad4a1c3b", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYPTR, @ANYPTR, @ANYRES32=r0, @ANYRES64=r1]], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000000100)="bea2ba9f431f7f37c3deae3c7c3487c082e9610bc2a7eebe294d7daf76203d912288d37c"})

[  135.477552] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  135.491096] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.500006] binder: 19512:19527 transaction failed 29201/-28, size 40-8 line 2963
[  135.500490] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.515355] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.524275] binder: 19518:19525 transaction failed 29201/-28, size 40-0 line 2963
[  135.542938] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  135.546580] binder: 19538:19539 transaction failed 29189/-22, size 0-0 line 2848
[  135.550631] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.550657] binder: 19512:19527 transaction failed 29201/-28, size 40-8 line 2963
[  135.580166] binder: undelivered TRANSACTION_ERROR: 29201
[  135.586631] binder: undelivered TRANSACTION_ERROR: 29201
[  135.598694] binder: undelivered TRANSACTION_ERROR: 29201
[  135.607306] binder: 19544:19545 unknown command 21
[  135.615571] binder: 19544:19545 ioctl c0306201 20008000 returned -22
[  135.630106] binder: 19538:19543 transaction failed 29189/-22, size 0-0 line 2848
[  135.641338] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x410, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0x70, 0x9c, []}, []}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:41 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="bb3e60b3303fecdfdcf3a75858ca029431adb28b4e7c16a7fa4d9f92a26626a640007ce00363abf042339388f65dcaff67e68a575942864dc5bf6de5a153e4055ab421034615865c65a5c3fce9c906fa1fe34330c5b1777d3447ae25e83c0e8b31d590aafbc06c36ad42769b49e77fdb92ad39b0de1f857f9710e64c0c19f821ae11", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x7c, 0x0, &(0x7f00000000c0)="26fa4c4a90ee2fa940ff3a5122e4891ca305dc2d7a0d9565a757d4032d2f0097e2558a939114bd203926428df064b06abf28e7290b3ed09bf7684218ebf09cd23d6bf4a5ac6a6f3a246dfebf3e55d52c87126b1a2b0bb59b88d25cd76233985a767032b9a6788b2d6c0bfd3215ea6fc7a86fe5af892f6dced75b4e5f"})
dup(r0)

2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x802, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:41 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0xfffffffffffffe9f, 0x0, &(0x7f0000000040)="98601a3899a296fe857697a0a3aa60870f0bf43b972cf4ae5b"})

2018/02/28 09:17:41 executing program 5:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x400000, 0x0)
ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000040)={0x7, 0x5, 0x8, 0x8, 0x8, 0x5})
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x8000, 0x0)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f00000000c0)={{0x7, 0x80000000, 0xc0e, 0x7, 0x6, 0x5}, 0x5, 0xfc})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
pipe2(&(0x7f0000000000), 0x80000)
syz_open_dev$urandom(&(0x7f0000000100)='/dev/urandom\x00', 0x0, 0x2a4000)

2018/02/28 09:17:41 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000020", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$dupfd(r0, 0x406, r0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  135.669383] binder: undelivered TRANSACTION_ERROR: 29189
[  135.674923] binder: undelivered TRANSACTION_ERROR: 29189
2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x400000, 0x0)
ioctl$PPPOEIOCSFWD(r0, 0x4004b100, &(0x7f0000000000)={0x18, 0x0, {0x1, @random="2401cf65ac0f", 'gre0\x00'}})
readv(r0, &(0x7f0000000040)=[{&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/253, 0xfd}], 0x2)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
connect$netrom(r0, &(0x7f0000000080)=@ax25={0x3, {"3c4cf23c44aa2f"}, 0x9}, 0x10)

[  135.720627] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  135.728374] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.735109] QAT: Invalid ioctl
[  135.737274] binder: 19553:19563 transaction failed 29201/-28, size 40-8 line 2963
[  135.743890] kernel msg: ebtables bug: please report to author: Wrong len argument
[  135.748395] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x410, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0x70, 0x9c, []}, []}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000100)=<r1=>0x0)
get_robust_list(r1, &(0x7f0000000180)=&(0x7f0000000140), &(0x7f00000001c0)=0xc)
readv(r0, &(0x7f0000001400)=[{&(0x7f0000000000)=""/31, 0x1f}], 0x1)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000080)={{0x2, 0x4e24, @loopback=0x7f000001}, {0x306, @link_local={0x1, 0x80, 0xc2}}, 0x4e, {0x2, 0x4e23, @broadcast=0xffffffff}, 'gretap0\x00'})

[  135.763582] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.772471] binder: 19556:19560 transaction failed 29201/-28, size 40-0 line 2963
[  135.780518] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.788185] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.790110] kernel msg: ebtables bug: please report to author: Wrong len argument
[  135.797072] binder: 19555:19562 transaction failed 29201/-28, size 40-0 line 2963
[  135.803194] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000200)={{0x0, 0xff}, {0x200, 0x2}, 0x6, 0x4, 0x1})
socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000380)=0x7f, 0x4)
setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f00000002c0)={0x40}, 0x1)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000100)=0x4)
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000280)=<r2=>0x0)
ptrace$setopts(0x4200, r2, 0x4, 0x61)
ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000000080)="d1802a3b00d96395c5440ed636409b546b84f5fb8dd7beaa88bade19197083a5356c2cf32e72838f0fb9fef37f905d3553026b4b82c2f7f597068aecf215e047f4416e17521354c4f1ea6d0e005f1b38388f355811b2aadeded9884998b185a0477bdc2fa0c6cfae52ef565a02be7906a214")
getsockopt$inet_dccp_buf(r1, 0x21, 0x2, &(0x7f00000003c0)=""/218, &(0x7f00000004c0)=0xda)
ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000140)={0x10000, 0x8000})
capset(&(0x7f0000000300)={0x19980330, r2}, &(0x7f0000000340)={0xfff, 0x4, 0x41da, 0xff, 0x1ff, 0xffff})
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0x0, @tick=0x7, 0xff, {0x5, 0x6}, 0xc, 0x2, 0x6})

2018/02/28 09:17:41 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0001000000ffffff00000000000000000000e4ffffff000000000000000000d77125f3cbae028860f6b206810e569f1e7dace49a04000000000000007ee7b916", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  135.804865] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.825664] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.834559] binder: 19557:19561 transaction failed 29201/-28, size 40-0 line 2963
[  135.837344] QAT: Invalid ioctl
[  135.845381] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  135.853060] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.855046] binder: 19585:19586 unknown command 256
2018/02/28 09:17:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x802)
splice(r0, &(0x7f0000000040), r0, &(0x7f0000000300), 0x96, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)=[], 0xb2, 0x0, &(0x7f0000000380)="c9eab44d1bf30adc5aff7d4b7b0546aac9a5067d4c3f4a7bf90fe77e9f0e25a2b4506ea85e440f052a8aa0e1199cb67a8c4441d14bbe0d126ebe273b3c248b439fa2f243199dfc84a3a7cecd45ad9187b4c3b65bc2ec092e66c53d2bdad3e1bcf303e24cf97b7fb7f10660c5ef417bab09cb63a246b56ef3c71c8add19c3c0e3cc8c4598500a612d3d36c1642b28ecd862293228245d6bee64ea7ae098320721993a2dbc72c3efd2d49c9712363d7d21aeb7"})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x58, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="01634040000000000000000003000000000000000000000010000000000000000000000070000000000000001000000000000000", @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000000000d5060000000000003b00000000000000852a747001000000", @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB="cd78fdb00750a273f5a5ad33fde906"], @ANYBLOB="0100000000000000000000000000000025000000000000008561646600000000000000000000000004000000000000001a00000000000000"], @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="09631040", @ANYRES64=r1, @ANYBLOB="0100000000000000"], 0x56, 0x0, &(0x7f0000000200)="baa172de70ea4cac64fe107990ab6f28942dce79d4b7c5cefac206570737d953a1f50eb4d88ddf324d9003e1dae75f751a298e0d45267766ed3d996b2225466a7090392575244b8ad48a89ae00539e4da09fe75d96a4"})

2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc\x00', 0x40000802, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:41 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  135.861954] binder: 19553:19563 transaction failed 29201/-28, size 40-8 line 2963
[  135.862416] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.870699] binder: 19585:19586 ioctl c0306201 20008000 returned -22
[  135.874675] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.897682] binder: 19558:19565 transaction failed 29201/-28, size 40-0 line 2963
[  135.898144] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  135.912966] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  135.914355] binder: 19589:19590 got reply transaction with no transaction stack
[  135.921823] binder: 19558:19575 transaction failed 29201/-28, size 40-0 line 2963
[  135.937047] binder: 19589:19590 transaction failed 29201/-71, size 112-16 line 2763
[  135.937184] binder: undelivered TRANSACTION_ERROR: 29201
[  135.959800] binder: 19589:19593 got reply transaction with no transaction stack
2018/02/28 09:17:41 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r1, &(0x7f000074ffe4)={&(0x7f0000de2ff4)={0x10}, 0xc, &(0x7f0000403000)={&(0x7f00009bbeac)={0x18, 0x1, 0x2, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@nested={0x4, 0x1, []}]}, 0x18}, 0x1}, 0x20000000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x410, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0x70, 0x9c, []}, []}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

[  135.967330] binder: 19589:19593 transaction failed 29201/-71, size 112-16 line 2763
[  135.973204] binder: undelivered TRANSACTION_ERROR: 29201
[  135.981409] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:41 executing program 3:
keyctl$session_to_parent(0x12)
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:41 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 0:
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x9, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:41 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x2)
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x800, 0x0)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x200, 0x1)
fanotify_mark(r1, 0x40, 0x0, r2, &(0x7f00000000c0)='./file0\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x200000)
ioctl$VT_RELDISP(r3, 0x5605)

2018/02/28 09:17:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
finit_module(r0, &(0x7f0000000000)='self\x00', 0x1)

[  136.045221] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.046158] kernel msg: ebtables bug: please report to author: Wrong len argument
[  136.052934] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.052960] binder: 19602:19606 transaction failed 29201/-28, size 40-0 line 2963
[  136.065242] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.084765] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:41 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
timer_create(0x6, &(0x7f0000000080)={0x0, 0x17, 0x4, @tid}, &(0x7f0000000000)=<r1=>0x0)
r2 = getpgrp(0x0)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001680)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000001780)=0xe8)
getresgid(&(0x7f00000017c0)=<r4=>0x0, &(0x7f0000001800), &(0x7f0000001840))
r5 = fcntl$getown(r0, 0x9)
lstat(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, <r6=>0x0})
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001940)={0x0, 0x0, <r7=>0x0}, &(0x7f0000001980)=0xc)
r8 = getpgrp(0xffffffffffffffff)
r9 = getuid()
getgroups(0x5, &(0x7f00000019c0)=[0xffffffffffffffff, 0x0, <r10=>0xffffffffffffffff, 0x0, 0x0])
getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000001e00), &(0x7f0000001e40)=0xb)
r11 = getpgid(0x0)
r12 = getuid()
lstat(&(0x7f0000001a00)='./file0\x00', &(0x7f0000001a40)={0x0, 0x0, 0x0, 0x0, 0x0, <r13=>0x0})
r14 = getpid()
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001ac0)={{{@in6=@ipv4={[], [], @multicast1}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000001bc0)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001c00)={0x0, 0x0, <r16=>0x0}, &(0x7f0000001c40)=0xc)
r17 = getpid()
r18 = getuid()
r19 = getegid()
sendmmsg$unix(r0, &(0x7f0000001d80)=[{&(0x7f0000000100)=@abs={0x0, 0x0, 0x4e21}, 0x8, &(0x7f0000001600)=[{&(0x7f0000000140)="e4d1e1342d47859ffad3e02ef9c27a918413deecf5fb1d4f582a55d7e78ae56860c769fa7fed3d8e5ff646a81655cb5a6ffc119f7fd20a3baa2ad26ec75df39892dd73b1cb9094ece22c22d635635e9bd911a9860765499f345509d5bc2035eff6cb1c8e7bdb4a38350adf698a742202ea95bad444a5dc0b", 0x78}, {&(0x7f00000001c0)="c319a756affcf672c8c6f1dff17ae91238999f", 0x13}, {&(0x7f0000000200)="6cd7c16f34ee22a4703760a9fae92875ed98704a8d4b8cb2719bb39c20e2f17ccb6ac3fa750d0943e9131d972b97cf87db1c82e55132f9b6e51ca7c909134a0f337c128334022a129694cf38029a1afc3758d0dbea9b975e43dcd3a6fe321a18d96f17b4848a6f9e19a416e83b1a6b67ce3d0a8f9bd1c398", 0x78}, {&(0x7f0000000280)="d330851950ccb1566d2275afc0f203ed4a4749903d40185fb6365d1ed8213c6608096cc451f3956dfc90a7b757673469f8ad6a81d54067999e2ffdfbccd87d88b74dc4dd1132367e31bd9748899f37578cd0b5e8e9438714eb4b5d7f55ee0f48fd42bcf95507b8790d421aba647e5081b3cc7536d82e47c3d6056b7d8b810ba1d9e8e5c795b896d5a9807e3003ca6f48cd41042c8f2c55c4c2b7dd394df101bebfe277b0c587f86c2e19605a9ef600e9955a7b1e3676cc12822ff3c00dd85a1cda5c5e05d1fcc06c3cfcd7b81d366409f83b9045f0aeff2287c4a6ff0fcdadfb80e22a37ec5e01fdf120dbc54e8988241d9c7f0a7adfa667b7318f54f0f3abf7d1ba3832985195b123f10790bfeaa8e56bfa887f6c85ebf31c58fa74f090d15083d660e6ac5dd86413f8bc09b6d61609dcf08bd31821c3cd15565e80014d2a2d4eb71612d50ba8e27a60c0d411a00b4b71fa9848b48917075f66ebdfce29990a37bbca78627bc79bf2d740589ca5463a9ed52947dfbe6880e308c207f7f3de47c75ce3cb01329e44d576843e87c62b357448af43bb2d4b73485b4b0fc5efac9b6aa477688b2b05666d48bf4382ed2556c7959f97e6b47ec389bd953ca4d62b0bc9fee4ef40396161cc5773989d19906ee0f304b4b4cdf3333402eeb6aa9820764291db95bd5d85c092bbb3c8a37f050da47acb53add9f672477e6c6877c0253cc13e7e7086464a69612d3f9898d907c88ffc5208ba746d179774240046a40650af750dd38fa001fe77505a25868725a08985707ae2e3b6a940fe945467f9b2e9b0da23a5ecf191da8299e0cd1e1af140158ad28179a348b3711631846d348dde7cf714e81566df852ad515acd1d117e351804b07b97bda7dd250f6197ad90b4e430a997b3a742b64108ac0196f2c5cd6f431ddb80b69cb3d73d2715117044fe3833926c075f1ab7c31e0a3d5aefc46396c208c61ab133ff0b2cbc7153192352299848ff59f9f2e8b06a378fabaf557dfd73f34bc1e88fd386738d4ff19a8bb6a56c5bb996d4ba39db3b233f1801ae0eeb746be6ac11322477870f500baa43ec5f01c2b90dba545258ca8d80a5e78aaba963c5cb4e75258cd9854ed4d71f2f5e125ee0124057be0a9146e2d4137abaefe8c3fbafd818ec388c31d506af23383a583b4bd5cd8e4e0a7c91cc3e2def01ed0852fe49d859258490c11eed0c1ca12c2fb4ebd6ad30f546ba578a6f16e161af9d80576806e005afbdd2549063da2229ab9b267f86592e0ee768f59adef91e3e73fcedeb19cfe4240ba6f0ac166995aab8e0a43b2c3b44c469d33a783f12250c1dd1b81da498df90ae31cbf71ff48067df43698efdc73af32c8f32464ba77ccd4f7c3cc6fb3071f1194c9ab6fed983c1e3bba0a36efbdccd2aeeb765bc545de2fb2050876c6b8beecf8ffc2f8e12db54b922faf4a95c67a8f9037b377eddffb065b8fb412455969cee321e47de18a8473b97b2c9dee49b425240ced8a660161d5d529a3b6f1f8ae14ac0225d7da5721f08f67d4785b074f564476e6f3eaf741271f4e076a35cf57272636843aa3032ddf0e04a06be3d0fcba764ca986aac993a2bf4e5777de4027ece0c979ed967466ca6ee5d806216fffd14c384ad08e6243ab202a2c4adb1b3b21ec0ae4c1a7a17b94c26274caa32dd9c4da9b3d29dc58da7035608cbd560c68bd5ccfb714b87e00cdb8f1049741291223e0f9c99143162c58fe403d526bb6f18182be0c9f3ec6c50fdf913e06e3df6b309c54e21a9c4a6f3150187316a0bafa40a4203c8d6014286168d9c67e687135efcc9cd571f42766226b1e905b5ed5b72c5b584ce40a2302948aea8453b174e56f725b1b9e7338695bb2ee374a26eb811b5df80b0632226cb79b90c21101959562c7dff4a6f1bb45d9374ed2958b7d4fc7c63976a09828bc31444bdfe3107bf5e3cffe40e3b34dbdc31c6ab888be3c9d940e63991a79a0abb891c0725cf2beea3b5a0d0bb1984472f30928e35a94e4f8c2ef9ca23c031107c65fde86052fbcc3043dafedc2b1c67101c4a700fa5dfc76e5d5c96bfff4ef1bd6bff2ca5fccab780d3503c1262ad378d9d22f7272989b24ef482aff063365b1e60a6638a3e44ba46810dc6cfb3021ae05debe42db05251f269fa71649b4f7f5fd3c94cb37caed0198744ba42eb0b1d5057deab4100c617c190c8b0ed4b9fba55b58040e6ccf0d0780207fbd075cd6f8fa575759375bd18579381dcb0937b057a516bc252708f2bd3006d454d14b11511fbda40789c9c0818e6189d8d5d3a706d808e699685c060cdfff7ab16480932e17c0f85d243c794ad805b47c226d37c0773e4907a7d27261c1a1fbed001cda7580e234766455a1d3963e7fe5e608b935025bdea03e61e43b3d38d6908c33453927156749bcd486e4e93bc1ea90c5dea67f056513e4ca59b6ed317f4f15c88792da25166aa99ff49758d7aff0579a919de6bfab3593e2976d712892fa8e697711d11037b113be1f6d9072f49d139cabb670675288e609dee9fac1ddd1f2a28e672b5ec851214333aa5d672c605cacb07e8ef78281f5391e845d12d61c51ebe554a49b96567923c08e8a3f2c1efbcd22e6d88b965d3d16c70122ce1b386854a7e1a8bd8ad2c6e2023361514362b4e67472baf884236ffaffb04d2a36faccfd3aca71f79842f73e143368374b5fbc888328b902444b0f9821e8bc332153ef5bd793736576942d92548ebfbaad02202289921111a54578f9ea039a763226d7a14e936c512e732cbcb1ac0277af7728b4ef767d72f54a5938c96ab3e87ca49dde83a2c2eabeedd12068eec450cb99c9b57340239a97725d678a2ff266e260889c0c85a60fa305ca78db595d0ecacffe9f713e71b0973ce0d08224aa3f60b64ed90ead7a18674ce5e280c4bfc32ddcc5e1bd65261d28281ecdbc40e06029528a30258a51bd69f419915e0ecd8712dd50b79ccb5e0bd3393bc5c8289f66ab274f1d7b27c496ce71636236eea1c9e464ec5f49a51e3c89c19db3e39aa7adf5711266bc7af0a4ac942fd07719bcd9380bb4c8a395227605051104469453e7f552bb92807d80105b7ca7e01e9b21daff2a8aa0b37daa2f8b9d9c204f8495930e7f4e3174a850b6182e0f387a7964234e08f97fa7269b53ea96d032c990ab7c2913f7bce3063675d01a87d282a26f68649e12d59efae10bf265c044822a8fc03ecbb6a42bf4225711fcc7fe3a216e714cc86842d10ee084afe267aeb31891339e560243d89854d8f9541167b46c5f6c2af17c2d7f8eb2df2b4c163f986df63e1342a54c74978a3c88d2c8126415188f5180ec1ccd0b49fcf3fdd7b0fecf366082a046c8c86edc96bce7f85a33589b9303bec4fbd3eb8e161eb47a424c31af7e9ad7077bc67503e68eab05d05d4002d30d521ec3e44a717225a2cd4e55d42b93f58af69a1c4730b9cd7f29d293d0d37f06f01fdd795809166e99936ee1406a3d13677e32815b3b3402517f9e53b1d5d9f6c265c2a42ea1d4d987290ee8c8a49b1e1b053449191d3496e1d5e46631c8f6dbe59c7ae59c087bc1dfb3a9bb3fd690bb54f9ea691160579f20f714d241e43dc25eee3f363d05c89c89f6b201d598a1972469b7d63e5f0ef8dc9e185bb59040aac60bf2ba550b4923528cdbd26854db11c8cfffcf427871cdfc6c7f2d5dbdc1d8dcf8198d973222afe53a5242567bfbefda1df9a1741aec02bd76b2095bde012f8040b706391e73d29db77b7edd98fb4a5298d3a84d03f6620497fa060bf4dc5b5fb9c4e0ed932c0fac78c1113da12c269882434e3508db673f332c5d225c3e70464193667b5304f30845f1fa32367fa7550e9b053deed787d1fcca5c820a4fa2ffc6c8d7a097c4f59f046239fb5ecb4a0828223c94d24e680958a127a5a1dca7d2e4a8c96c8f233aa7e61b79b918bd4997781cf765ac64f868bfd144dd1ad5bb46f4ac671341ebf53b40479968d5f2bc119062e887f31ef6abc2712c66f8e6a991a411dd71924aa5c90f67a90632b953a283eef9f0cbdb63aa250f7d41d0b979249d6ef9b14d6ad68d40efa9bd1dfc8d8e81240db0ee441e77e37473b0c8c8c4581dee0781f9cace6a6c2acb9a8f7c5832c419505a1217c8e4056be7dd4ac2ecc68017615a2d2f4379432f68fd4a081f00ac2d5c6a291bfed7bfddd629cdf2ac13b4504f9732fbd93eef31fc9483dedeb70e090142110febec62784995c63a3e6b50e18793540d8c021448fc0c01a527a97b8d3dda87266ffb7062a33ccf6b1d69cc0d6cae07f8f03657ad75533897679e6c00f0fa265ca2637979eb4d391fae6975f175007b1bfe8cd7a112af1a2d3d39787608a248433d75da94f86e41cbb522d435908a5bcca61fbaaa39d0021602afc6ed2afba6282b7aae759872fd0e9eef1c688b026c8cbb1653e14f54d28b0e730e077f5a09ed8acea113308dfae05a7cceb76213788bce142ae44a0b5260ed2d0ff32d6790f2a66d83c7e05bda394363247e6f5ba4356a54bfd7d33cb95c8bbbc6505ad9cbfa2baff9718c25bf22e4181a39c58e8cd900382902335224bccdca0c55c4698435b94ff0f88dda95b25f1f6f154320b6e4ada368e156e291118cd63ef82f8a8ab71223fc1b54f0e95c04e06d5b7ad00696d3e8bc81a04568f5049fad1a4375896e372463b5d0d291a9dda931d27c43fe1964e75474ac21cce074bc047a2f64d802edfa5634231cffbd2d03024f16a0663ee341d81490563a8bd4de4411ca63d8c4d6fec0e250daada9e9e658905aba1fe1d01296272fb12f46a5160c14cd386765f47ae898be69298ed10320761bc145fe29cb153a7b0580b7f2ebdeb73f55316e379086564b42f2fbf2913fed65bfb136bcb6d42cce12142edbc6511d6f3a3708df90643c18a4f632802929c001a744a2876c9fa32eaa224db1653d27e9b4d3ab50e3ad9db3fc1ae814eab814d7be33539f2579bc931d56ede42338bf7055387ec8b20e4fbfa0a57dd80ceea0535cbacd31565365189ff9095db10ec9c6a4ec056d92c592ab6d381508b8effcb2767063ac26565f4953b07061ecb233158d53ea06c7609e0a725c0a4cc59d8b0e837164040143524025c12666a891402a9dc6d63953a47c505fc257f5a0ebb1bfd15bc9fa2eac36368972144755e7498a8016c144498b817468d0ddb01a078215485365f1cc1bfa48d99766c7497a28186305827403600da9bcd135dac6206f419a22d88ef23bbf264d59f5aab87f69e80ce8ddb16a2c6c9ecb20b31ef82fdd1fdbc6f21e3371b390eb2f04a68f30a91a0a95cf702880cf31298a7cc97f1d9f3b613fa1c07ac8f7a9055c081623dde67b68b1dac022ed59176e569a5109a1a81b148aa2d38789e28c78fd30399e5c487a1f56e57d2ac7df8ad7c1dd2277ebd358537eec3d9794f9e4d02a05df140eb46536ab2ab29d1fe33adf060f90d001f653cb72008d6ea9b6819b83e8e08abdcd16983b8488011c98432a81c607d4030c11303399bff5d544c1b955c6f6a2bb2f26493f92ed5de37c08c8334fbd7928638c899a7ba999be37a34049449ab49537e6ed4b405f48003f174797c46aca9990c87fa1e9c44c17f064e348a5131ed7ead2195ef8d74fd58b9ad3f642dc0348d92307edb8f047915b1ece12c5c92b0dfd158640bb6c07cb301dba790107c6054b6b6009be9b8563fbd5b1e07d68a7365df46dd0773146d0133a9c004e99561043a62d9e6d90954fbb6c2c9d3261a32711e2521c6a3338c4a28682ab7e59635e5ef0bec1", 0x1000}, {&(0x7f0000001280)="1ccef58aac2473435f9fd4872bfeced0eb3448f5ffb93eef9828e673998a4b4f2c59b30190cdeb33c88f714b8b4a3ab39cbe685727195bf5ce2b1129d0666cdadb6634373c33df78159ecab0fd35a12b8587", 0x52}, {&(0x7f0000001300)="f9ce5d7fe69e6da597acecb943bd2dd0b938943c70ac3df1e074a1430a37c8aaff4b9509383fa3ba58525041a39b4064d96dfd6cfb0ac32e8e56db3c69c86850273b3e45ffd096bc2de3592683860b150ce83e98c44cd3593ac932027bc806c4eeacc2e0d1ad224668ec32878802130ab421414b81ee1eaf70e37dc2fc930db8a6e7ba43881677f717455f696d05f7619391ab0718c0f94f8e0b4fd7bd02ee868cdfbc2b908046eca9443b9da5eb558db686", 0xb2}, {&(0x7f0000001440)="8a0c7968858e3106d2ecff1e15", 0xd}, {&(0x7f0000001480)="f261ffda36c7ccbe4999e2de4d5207d062cd7ea44e24734b6d3d867121582b1ef4d571aa86d62e1dc23c7f4ae1545752fa5217a5307fb6e497a1bbf10cf91a555663e9f61d2eea7338c07e6c51dcfeae728d9b04a451c25f8ad927f70cd6c9c8643d67000863e1020fecc0b9642ee82b1fc705563cf6dcdb525d3bdf6be6a075d170071bf4622715d012ae8921a5ee32e0012ff7e0fcc0d1b709008fd3485ca6b8c028d95df4b673cbc0b36b470d3346767508941091a84c7a88c8195ba1798c0ce412b69e5159a8cadaecf7f0014cfad91b73e891560f1cae3ff99fcb58d66eaf4ff1e3013c47fb96691820bc", 0xed}, {&(0x7f0000001580)="a9e8388d95cd2d65b14269d6091007b78e1713d678da714429b76acec2b0ff92929529bef447073ffe0519ad1c7a4ea1a126731024d2ed9104e0bdf8f29ebf8a8cc11be653fca241615586df05cc8cd2b1b5", 0x52}], 0x9, &(0x7f0000001c80)=[@cred={0x18, 0x1, 0x2, r2, r3, r4}, @cred={0x18, 0x1, 0x2, r5, r6, r7}, @cred={0x18, 0x1, 0x2, r8, r9, r10}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @rights={0x24, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}, @cred={0x18, 0x1, 0x2, r11, r12, r13}, @cred={0x18, 0x1, 0x2, r14, r15, r16}, @cred={0x18, 0x1, 0x2, r17, r18, r19}], 0xe4, 0x44004}], 0x1, 0x800)
timer_delete(r1)
ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f0000001dc0)=0x800)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  136.093674] binder: 19600:19607 transaction failed 29201/-28, size 40-0 line 2963
[  136.093706] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.103497] binder: 19605:19611 transaction failed 29189/-22, size 40-0 line 2848
[  136.109063] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.119314] binder: 19605:19617 transaction failed 29189/-22, size 40-0 line 2848
[  136.125519] binder: 19603:19608 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0x0, 0xfffffffffffffffd}}}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:41 executing program 6:
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xb8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  136.136051] binder: undelivered TRANSACTION_ERROR: 29201
[  136.143185] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.153998] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.162886] binder: 19603:19608 transaction failed 29201/-28, size 40-0 line 2963
[  136.171878] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  136.177255] binder: undelivered TRANSACTION_ERROR: 29201
[  136.179544] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:41 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xffffffffffffffdb, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x3d3, 0x0, &(0x7f00000000c0)="ea1b408ea31929e740808a6fbf36b41238c12ddb9f05a586ab8e0be0118d3d27b59ed418f17a548d60720c5813a5f96304c61196a50bb1bee8e84a4c9a8b02e8f1d45fb4eb0da0ace1c2be4d2b624d07075053175db883d42a878e331362505e9289c3c1e4694fe3cc64340cd1e68d8b92142347b2a2cae91e19a667c22549d69bd9702cf998be00d1d0e6d419000000000000000000000000000000"})
fcntl$setlease(r0, 0x400, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/enforce\x00', 0x1b1202, 0x0)
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)=<r2=>0x0)
getpgrp(r2)

2018/02/28 09:17:41 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xa8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:41 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="005f01c1071a6bcada11535cd9bbd940"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xcac5, 0x280002)
ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f0000000080))

[  136.179569] binder: 19601:19616 transaction failed 29201/-28, size 40-8 line 2963
[  136.188525] binder: undelivered TRANSACTION_ERROR: 29201
[  136.223154] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.231271] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:41 executing program 2:
r0 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x2)
ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000040)=0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000000080)={0x3, 0x0, [{0x8000000e, 0x100, 0x9, 0x2}, {0x1, 0x10000, 0x26d, 0x0, 0x7fff}, {0x0, 0xb86, 0x4, 0x0, 0x4bf3532d}]})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x20001)

2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:41 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x20010, r0, 0x4d)
r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffffff, 0x200000)
r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x2400, 0x0)
ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4008641a, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[0xda, 0x38000000000, 0x2]})
syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x8000, 0x50400)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_SMI(r2, 0xaeb7)

[  136.240158] binder: 19629:19634 transaction failed 29201/-28, size 40-0 line 2963
[  136.256328] binder: 19633:19637 transaction failed 29189/-22, size 40-0 line 2848
[  136.259195] binder: undelivered TRANSACTION_ERROR: 29201
[  136.266573] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.273208] binder: undelivered TRANSACTION_ERROR: 29201
[  136.277178] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:41 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)

[  136.277204] binder: 19635:19640 transaction failed 29201/-28, size 40-0 line 2963
[  136.284043] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.306855] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.307043] binder: undelivered TRANSACTION_ERROR: 29201
[  136.315738] binder: 19642:19645 transaction failed 29201/-28, size 40-0 line 2963
[  136.323071] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  136.336452] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.345326] binder: 19643:19646 transaction failed 29201/-28, size 40-8 line 2963
[  136.353084] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.353285] binder: undelivered TRANSACTION_ERROR: 29189
[  136.360789] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.372205] binder: undelivered TRANSACTION_ERROR: 29189
[  136.375056] binder: 19635:19640 transaction failed 29201/-28, size 40-0 line 2963
[  136.380700] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.395893] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.404788] binder: 19642:19652 transaction failed 29201/-28, size 40-0 line 2963
[  136.405241] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  136.412558] binder: undelivered TRANSACTION_ERROR: 29201
[  136.420089] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.425529] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xa8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x6, 0xeed4, 0x1, 0xde0, 0x1, 0xffffffffffffffff, 0xaef}, 0x2c)

2018/02/28 09:17:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)
ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f00000001c0)={0x1, 0x20})

2018/02/28 09:17:42 executing program 3:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff})
sendmsg$nl_generic(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x104, 0x35, 0x0, 0x70bd25, 0x25dfdbfc, {0x1d}, [@typed={0x8c, 0x7c, @binary="132551eb72523c6c43a712d541d67d65077c9bd3a4e53dbced8c53bec204830c55b9c93e35482bf43413933e71558f329ca36c0afda9bf1c64e20d5d209329a1922bd646683fa0c41e56085a4e305ad47f40d43e3a0a2bcbb6eb41afd2a9842a6b65a606d975015ed88337bd55e723bcd0d64265b9e112426789b59294f18e95330c1aaa"}, @generic="aadc66877ba8f8abca6e9cfad9d4d2da026818d12864efaad6300062f22148dd4aec7473e1f6f4123aad8bd11bdbcea9af15b5ec5ab4887ea8187578ede060025dc7a4691401f1ccea12afc5155ac74704f46d0b3fb9d3b7569bd9ca1bc6e6b023e4c23f"]}, 0x104}, 0x1, 0x0, 0x0, 0x40}, 0x0)
readv(0xffffffffffffffff, &(0x7f0000000080)=[], 0x0)

2018/02/28 09:17:42 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
flistxattr(r0, &(0x7f00000001c0)=""/84, 0x54)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x10040, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x6, <r2=>r1, 0x5})
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000080)="48b833e70000000000000f23c00f21f83502000d000f23f8f3ab3e2e26644c0f2083b9430a0000b808000000ba000000000f30f2260f0948b8da000000000000000f23c00f21f835010004000f23f8f2dc1c0c65490f01cbc74424006e000000c744240209000100ff1c243e67490f01ca", 0x71}], 0x1, 0x78, &(0x7f0000000140)=[@cr0={0x0, 0x40000014}], 0x1)

2018/02/28 09:17:42 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000000)={0x0, <r1=>r0})
ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000040)=0x2)

2018/02/28 09:17:42 executing program 0:
r0 = socket$nfc_llcp(0x27, 0x3, 0x1)
ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f00000000c0))
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4f, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000052fdadf241badfd297cd455f0000000000000000000000000000000000000000000028000000000000000800000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  136.434359] binder: 19643:19651 transaction failed 29201/-28, size 40-8 line 2963
[  136.447771] binder: undelivered TRANSACTION_ERROR: 29201
[  136.453269] binder: undelivered TRANSACTION_ERROR: 29201
[  136.458919] binder: undelivered TRANSACTION_ERROR: 29201
[  136.473326] binder: undelivered TRANSACTION_ERROR: 29201
[  136.474390] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.486521] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.489415] binder: undelivered TRANSACTION_ERROR: 29189
[  136.495416] binder: 19655:19661 transaction failed 29201/-28, size 40-0 line 2963
[  136.500981] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  136.517718] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.526610] binder: 19656:19662 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  136.527453] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x101002, 0x0)
getsockopt$ax25_buf(r0, 0x101, 0x19, &(0x7f0000000040)=""/75, &(0x7f00000000c0)=0x4b)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000100)={<r1=>0x0, @in6={{0xa, 0x4e20, 0x3ff, @loopback={0x0, 0x1}, 0x9}}, [0x6, 0x76822e34, 0x9, 0x5, 0xc1f1, 0x6, 0x400, 0x5, 0x2, 0x3, 0x4, 0x0, 0x100000001, 0x7ff, 0x5]}, &(0x7f0000000240)=0x108)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000280)={r1, 0x9}, &(0x7f00000002c0)=0x8)
readv(r0, &(0x7f0000000040)=[], 0x0)

[  136.544061] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.552942] binder: 19658:19663 transaction failed 29201/-28, size 40-0 line 2963
[  136.552957] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.568237] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.574515] binder: 19660:19673 ioctl c00caee0 20000000 returned -22
[  136.577116] binder: 19654:19667 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x4e23, @empty}, {0x1, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x4c, {0x2, 0x4e23, @multicast1=0xe0000001}, 'syzkaller1\x00'})

[  136.577355] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.598943] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.607854] binder: 19660:19664 transaction failed 29201/-28, size 40-0 line 2963
[  136.607929] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.623200] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.624656] binder: undelivered TRANSACTION_ERROR: 29201
[  136.632085] binder: 19655:19661 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)
ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f00000001c0)={0x1, 0x20})

[  136.632217] binder: 19665:19668 transaction failed 29201/-28, size 0-671088640 line 2963
[  136.648808] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  136.662805] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.671697] binder: 19686:19688 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  136.671738] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.689115] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x9, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7}, @in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0xa8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  136.698038] binder: 19658:19663 transaction failed 29201/-28, size 40-0 line 2963
[  136.708122] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.710462] binder: undelivered TRANSACTION_ERROR: 29201
[  136.715782] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.715808] binder: 19660:19664 transaction failed 29201/-28, size 40-0 line 2963
[  136.733558] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f0000000000)=""/31, 0x1f}], 0x326)

2018/02/28 09:17:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)
ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f00000001c0)={0x1, 0x20})

2018/02/28 09:17:42 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a82a627700100000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=ANY=[], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x6}, @in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x8c)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802)

2018/02/28 09:17:42 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4, 0x4010, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  136.750524] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.758221] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.767140] binder: 19690:19691 transaction failed 29201/-28, size 40-0 line 2963
[  136.774804] binder: undelivered TRANSACTION_ERROR: 29201
[  136.780297] binder: undelivered TRANSACTION_ERROR: 29201
[  136.785808] binder: undelivered TRANSACTION_ERROR: 29201
[  136.791301] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0)
syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x7fff, 0x1)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0xfffffffffffffc65}], 0x20000000000003f6)

[  136.805355] binder: undelivered TRANSACTION_ERROR: 29201
[  136.812295] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.817748] binder: undelivered TRANSACTION_ERROR: 29201
[  136.819983] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.834326] binder: 19693:19704 transaction failed 29201/-28, size 40-0 line 2963
[  136.834355] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100d4778c2500000000000000000000000000000019ab95dbfb193a86b243c2008f000800"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  136.849685] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.858564] binder: 19692:19700 transaction failed 29201/-28, size 40-8 line 2963
[  136.860766] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.873891] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.882761] binder: 19698:19705 transaction failed 29201/-28, size 40-0 line 2963
[  136.882788] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000140)={0x7f, 0x4040000000000000, 0x2})
ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r0, 0x81785501, &(0x7f0000000080)=""/131)

[  136.898057] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.905067] binder: undelivered TRANSACTION_ERROR: 29201
[  136.906956] binder: 19695:19699 transaction failed 29201/-28, size 40-0 line 2963
[  136.911406] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  136.927881] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.936768] binder: 19713:19714 transaction failed 29201/-28, size 40-0 line 2963
[  136.937062] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  136.948032] binder: undelivered TRANSACTION_ERROR: 29201
[  136.952087] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  136.952119] binder: 19693:19704 transaction failed 29201/-28, size 40-0 line 2963
[  136.962798] binder: undelivered TRANSACTION_ERROR: 29201
[  136.970956] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  136.988730] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
2018/02/28 09:17:42 executing program 0:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x5, 0x400000)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={<r1=>0x0, 0x1, 0x20, 0x10001, 0x9a0}, &(0x7f0000000080)=0x18)
r2 = socket$inet(0x2, 0x2, 0x0)
capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000001fe8))
setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f000088f000)="8608006600", 0x5)
syz_emit_ethernet(0x2b, &(0x7f0000ae8f92)={@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @random="5d5945a7f777", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1d, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @broadcast=0xffffffff, {[]}}, @igmp={0x11, 0x0, 0x0, @multicast1=0xe0000001, '\b'}}}}}, &(0x7f00003b5000)={0x0, 0x0, [0x0, 0x2ac]})
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={r1, 0x2}, 0x8)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$notify(r0, 0x402, 0x8)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="cdd0382e484a191e8d044eab1b08de4015c4e503a029a1c5f8f2d6d1f213033b8bd3f80a97c5adda1fc83c9a5b428a6886144f9a358e54c721fce288c52ca9980699fb0b190c3ceecc261da1cd53aaefa1c6225fd6"]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 4:
socketpair(0x13, 0x5, 0x6, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6, 0x8c010, 0xffffffffffffff9c, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)=[], 0xcb, 0x0, &(0x7f0000000140)="86251e06ee686716d783ba4d7ab5151a284d168d991b270a634a66c6b33315fda5686c5e9c6041792d87df4666520add3e8115183d554713f9d3066374d85861821385f16eac5218693710a22c322bcbd4837adb7a956dabeefec2f5e3d67de54f4c8e01f645e7a6e646d42170beb19e332bc743ebc6e1fe7432c5b22655c6e203a9868d96fe4762aebfe7a1e0e59e9303d4a6c8fa6789dedd65340231fbb307f067a25a0a304a8945dca5fee14514ec533c75d5499382e08741acf1d0151a85edaec98e34a22ef283184e"})
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f00000000c0)={0xfffffffffffff58d}, 0x4)
setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0x8000, 0x4, 0x2, 0x6}, 0x10)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000467da600000000000000000000dfff0000000000000000002800000000000000000000000000000000000000005b6b606713e6b197a1315f2e16c50ae28e48f9f975474c1b1eeab9b2a04d88760228b1513858119c001ceb18b3ad71465428103504be1693c078fb4ab7bd1564556bf91e4fadb6fad2f9df014cd2bec4b5353ea5b7f9b03966c64f3706b4595c37409305679e0a63e5c3ba5da117516fce52a77278433948bee8660c0ba7c4608bdf08255ce0a1ef3ee36c078c33dbac8296e3c3c62763183668e72b5593f98bdd87e8ef012832a49e05759bee04fcdd44439eca4490328361123a56d329349765b5943c708abaaf38433780cf136e3fcfd69277b163ef0bce858976d2ff32d6954684257faf99f4833c48c0858e3ab0d5e8de18e8ca6f77157da4f5c5571859e53ddc15e6878294d0c59853f24ac190de419a55ba4039e8744d39f1d36e758e18157cd85e77178b688402f03767bfc0093d295d51d4a32cdb9f06ad0223dc188981f6c3b71a1597333b582fd3b1052b073f1be3380ec876", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="872a070000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000080))

2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc\x00', 0xa2280, 0x0)
ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000000080)={0x0, 0xf000, 0x7, 0x8, 0x40})
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
readv(r1, &(0x7f0000000140)=[{&(0x7f00000013c0)=""/31, 0x77}], 0x20000000000001db)
ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f0000000180)={0x587, 0x8, 0x4, 'queue1\x00', 0xfff})

[  136.997651] binder: 19696:19702 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  136.997675] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.015133] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.021550] binder: undelivered TRANSACTION_ERROR: 29201
[  137.024033] binder: 19695:19715 transaction failed 29201/-28, size 40-0 line 2963
[  137.024530] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.036561] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:42 executing program 2:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="0000669569e75ea6e46aa540a91043e09f2bc9c0f96213c6bbf03f750725e2c3f0c5859cbd9321d5b14d00615c7fc134c8fa09a4fa3e27", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  137.037294] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.059114] binder: 19723:19726 transaction failed 29201/-28, size 40-0 line 2963
[  137.059139] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  137.074472] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.082081] binder: 19725:19737 got transaction to invalid handle
[  137.083349] binder: 19730:19731 transaction failed 29201/-28, size 40-8 line 2963
[  137.089581] binder: 19725:19737 transaction failed 29201/-22, size 0-0 line 2848
2018/02/28 09:17:42 executing program 2:
ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x80000001)
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc\x00', 0x200200, 0x0)
setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f00000001c0)=0x80000001, 0x4)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000040))
open_by_handle_at(r1, &(0x7f0000000000)={0xf, 0x0, "7dce7801282b1c"}, 0x22c0)
r2 = socket$key(0xf, 0x3, 0x2)
poll(&(0x7f0000000240)=[{r0, 0x2208}, {r0, 0x2242}, {r1, 0x8040}, {r2, 0x420}, {r1, 0x8000}, {r0, 0x8008}, {r1, 0x200}, {r0, 0x3cbad27230e1f0de}, {r0, 0x21}], 0x9, 0x8000)
r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x501000, 0x0)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f00000000c0)={<r4=>0x0, 0x80000, r1})
r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc\x00', 0x4080, 0x0)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000200)={r4, 0x80000, r5})

2018/02/28 09:17:42 executing program 5:
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)
socket$inet_dccp(0x2, 0x6, 0x0)

2018/02/28 09:17:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  137.104034] binder: undelivered TRANSACTION_ERROR: 29201
[  137.105689] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  137.116094] binder: undelivered TRANSACTION_ERROR: 29201
[  137.119403] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.119428] binder: 19735:19739 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  137.129706] binder: 19744:19745 transaction failed 29189/-22, size 40-0 line 2848
[  137.150187] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.158884] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.164563] binder: 19744:19751 transaction failed 29189/-22, size 40-0 line 2848
[  137.167765] binder: 19748:19749 transaction failed 29201/-28, size 40-0 line 2963
[  137.181883] binder: 19725:19753 got transaction to invalid handle
[  137.189497] binder: 19725:19753 transaction failed 29201/-22, size 0-0 line 2848
[  137.198119] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x8, 0x0, &(0x7f0000004fbc)=[@decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0)
ioctl$sock_netrom_TIOCOUTQ(r1, 0x5411, &(0x7f0000000080))
ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000040)=0x9)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@sack_info={<r2=>0x0, 0x6, 0xf}, &(0x7f0000000180)=0xc)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x1ff, 0x4, 0x524, 0x5, r2}, &(0x7f0000000200)=0x10)
ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000100)={{0x3ff, 0x107, 0x4bc, 0x3, 0x907a, 0x316d}, 0x7})

2018/02/28 09:17:42 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x810, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000000000000000155a086641dfa8f3c17233f136e6dbccb9b1251f776e4b67b7515fe68c7655bb71c1ac1f968cb0b7e98a83b3bc6f3b9257ccd2cba4abbd0000938fe38fddd9544b746f1477711c643aad7ce7ca83e29125e550b438d548884a3b2597c817d08578960f97d06e968b95f3ad149bfb42cddaaf3e844aac90863c5294cdadd7df80763edcb1458eff596f43f80e9b17cfa8525050faab6ad8"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:42 executing program 5:
syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

2018/02/28 09:17:42 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x2007fe, 0x0)
r1 = gettid()
syz_open_procfs(r1, &(0x7f0000000000)='net/tcp\x00')
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:42 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="0000020000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  137.204288] binder: undelivered TRANSACTION_ERROR: 29201
[  137.218401] binder: undelivered TRANSACTION_ERROR: 29201
[  137.223956] binder: undelivered TRANSACTION_ERROR: 29201
[  137.229517] binder: undelivered TRANSACTION_ERROR: 29201
[  137.251439] binder: undelivered TRANSACTION_ERROR: 29189
[  137.254688] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  137.256980] binder: undelivered TRANSACTION_ERROR: 29189
[  137.266156] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.279538] binder: 19756:19765 DecRefs 0 refcount change on invalid ref 0 ret -22
[  137.280473] binder: 19757:19760 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  137.288360] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:43 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2)
ioctl$KVM_GET_CPUID2(r1, 0xc008ae91, &(0x7f0000000000)={0x5, 0x0, [{}, {}, {}, {}, {}]})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000100)={[], 0x1000, 0x5, 0x8, 0x0, 0x10001, 0x5000, 0xd000, [], 0x6})

2018/02/28 09:17:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})

2018/02/28 09:17:43 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x10000, 0x30)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000040)={<r2=>0x0, 0xc189}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000300)={<r3=>0x0, 0xffffffffffffffab, "fc2455fae112f204008a8f02ae4924d680c367d200dfe52f5d1027fd030c42b89fdf9d28f1b3d261ed1af8e3b726b5316704379dd9e0fd71e5ec873583a8ce1a0505735f1413b2a2c3415fdf1fc8e99f3fa1dfcdad"}, &(0x7f0000000140)=0xe6)
getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000180)={r2, 0x7, 0x89, 0x400, 0x3, 0x6, 0x206a, 0x7ff, {r3, @in={{0x2, 0x4e23, @multicast1=0xe0000001}}, 0x4, 0x7, 0x7, 0xe1e8, 0x5}}, &(0x7f0000000240)=0xb8)

[  137.305604] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.314503] binder: 19758:19766 transaction failed 29201/-28, size 40-0 line 2963
[  137.322312] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.329975] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.338864] binder: 19761:19767 transaction failed 29201/-28, size 40-0 line 2963
[  137.348599] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:43 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000000)=[@in={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}], 0x30)
sendto$ax25(r0, &(0x7f0000000100)="b02f7456bf5509de17ea688adcb51053ffd14a02055b1b7cfcff5b00547c07ec0d8c3483e205364131d2b0cf726f3c852c0ce629035d163f645d217fed7ababb713e4681dea2c9418214cc4156c2a205ff1e9a3a3c30eddd758bfdeb26719b06d4dd19f4436a50ae535b3e48fb85a551eb06fc3eb7bf5cce50ca0a933acfa7c9014fa22184983e89c9c1e305ea08bba273babe1bfd25a892b6d288b527243352cceb205107bf1014e4b445c82a22144c4c2ee89925cf92a5d420e60a2b3e899703ddb47e3e6f2ff73a1e31d0edff4448ad401f9d8566a4f1e08dbd84bd15e57a12b2960a8b0de3e7eca30ed17db8dab45a86", 0xf2, 0x84, &(0x7f0000000200)={0x3, {"49c5d891353c69"}, 0x5}, 0x10)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
getsockopt$llc_int(r0, 0x10c, 0x5, &(0x7f0000000080), &(0x7f00000000c0)=0x4)

2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'ip6tnl0\x00'})
sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000e87000)={0x10}, 0xc, &(0x7f0000a3bff8)={&(0x7f0000000740)=ANY=[@ANYBLOB="340000001400092500000000000000000a000000", @ANYBLOB="08000800000600001400020000000000000000000000010000000000"], 0x2}, 0x1}, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="00caadb3996538c6dcd09aabdd7fa3bedba9533d0d7e9c50c259b7099918065929f1be6a9d47e10a71b4bad547b7f2bc1b42a5d608e26f34d00375e480bc3ec3551cce406e545e86ba5be3c9aa8bb04c44d94acf98e46291342a4630244582912aa748cda05fd03503b00e20bf4c7ec6d6c5f01cebd7a36a1acbdb596a1123cf380b43298e841a3249ed6f8553623eb3ce51893c17376bc2f4709d164daa7bc5bd7fd94bb73c5b5f5b844a1b6bbe50f0472982bd03d21229b75f65e4e5d4c2f6b27c36e9295f7f76e1824b3614ac86d8b7f5d2b22e810a20f5ad69cfa700222154a20104b5e77d16122f3b381e0356f22d2438a60a5cba325e0fa8be7628af8f6d7ebfef2d718d56907413785d14359e3dfc481d13c5527c34da05f1852972bf23d28a6311fe6ecf37fe4db9322b1b8c097b567e44eb5658a512cbd69ec6e6a27d4e7482b286499618729107cd10d29ce9566c580dc933a58400ae0f7f08c4f776e4ff568b274b8087eb109b59220a216b2bc2e6e167de40f9b863bf1a35d11bd4702341c39ed8f230ca000000000000000000000000"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  137.356374] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.365273] binder: 19776:19779 transaction failed 29201/-28, size 40-8 line 2963
[  137.366632] binder: undelivered TRANSACTION_ERROR: 29201
[  137.382537] binder: 19756:19781 DecRefs 0 refcount change on invalid ref 0 ret -22
[  137.383635] binder: undelivered TRANSACTION_ERROR: 29201
[  137.400070] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0xffff, 0x202)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  137.407822] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.416724] binder: 19784:19785 transaction failed 29201/-28, size 40-0 line 2963
[  137.424934] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.432631] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.441519] binder: 19778:19782 transaction failed 29201/-28, size 40-0 line 2963
[  137.444846] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:43 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
connect$bt_rfcomm(r0, &(0x7f0000000080)={0x1f, {0x5db, 0x7, 0x5, 0x1ff, 0x1, 0x3}, 0x4}, 0x1)
setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000)=0x100, 0x4)
ioctl$KVM_GET_FPU(r0, 0x81a0ae8c, &(0x7f00000000c0))

2018/02/28 09:17:43 executing program 5:
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000000)={<r0=>0x0, 0x80000, <r1=>0xffffffffffffffff})
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000140)={r0, 0x80000, <r2=>r1})
ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000040)={0x1, 0x2678, 0x5, 0x1, 0x1, [{0x3, 0x2, 0x79}]})
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f0000000100)={0x9, 0x187d})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000001c0)=[@release={0x40046306, 0x4}], 0x0, 0x0, &(0x7f0000009000)})

[  137.456847] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.465703] binder: 19793:19796 transaction failed 29201/-28, size 40-0 line 2963
[  137.465723] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  137.482542] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.490063] binder: undelivered TRANSACTION_ERROR: 29201
[  137.491416] binder: 19774:19780 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  137.495065] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.514273] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.519229] binder: undelivered TRANSACTION_ERROR: 29201
[  137.523148] binder: 19793:19799 transaction failed 29201/-28, size 40-0 line 2963
[  137.541680] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  137.545230] binder: undelivered TRANSACTION_ERROR: 29201
[  137.549446] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.554941] binder: undelivered TRANSACTION_ERROR: 29201
[  137.563697] binder: 19776:19779 transaction failed 29201/-28, size 40-8 line 2963
[  137.567384] binder: 19801:19805 Release 1 refcount change on invalid ref 4 ret -22
[  137.569257] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.592248] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.601140] binder: 19786:19791 transaction failed 29201/-28, size 40-0 line 2963
[  137.603185] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.609229] binder: undelivered TRANSACTION_ERROR: 29201
[  137.616402] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.621861] binder: undelivered TRANSACTION_ERROR: 29201
[  137.630696] binder: 19786:19803 transaction failed 29201/-28, size 40-0 line 2963
[  137.630763] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.644683] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})

2018/02/28 09:17:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x4401, 0x0)
ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc004240a, &(0x7f0000000000)={0x2, 0x0, [0x0, 0x0]})
ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f00000000c0)={0xa, 0x10000, 0x8, 0x100, 0x8, 0xae9})
stat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100))
fchmodat(r1, &(0x7f0000000040)='./file0\x00', 0x100)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="852a6277007b45265209000000045db9a9c3a7ce62b3c07f4779f095dd744ebb468e61510e3ab53f7173d4ce26689c94bacc19648555057b65f6e38c0c46b54368fb461e8fbe576fa3693da0006960811e2fded6fbfe392fc4b0a38e9cbf9a00e7f7e0865ad394d30501bb5a2dc44c0ff2ec8649a8344363b6403a75d81db4eb97b2c2c57176c9388970a21169839a2587c2c7f4b70376a332e767e655254cf44594d12c0de8a40f72962358d1b6fed073bf1c", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000057001a00000000000000000000cc05fee41e0fee270deb95543f52841c99e7c72f3407baeefcafdcdf1b1d9f352b8f765d13b4816003bc8f776eb5953669eb9d5d3c6b79fe117ba504c70904d8fa380d4a457ff70c747be7c1906c59cc5f14951c4a5374f973b0"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:43 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40000, 0x0)
ioctl(r0, 0x9, &(0x7f0000000080)="4125cb2a0356019caa6328204c313d0d993609f68932520cc9cd75e7fc474a8af364c47cb14a9d3ee1fedd0267f4edcc1b8cecd290e49e66af32654d9a90adca1c2520e9ebd561e6be6b341e8e8ac400f8fe1c1ca31aca2d65dedf04d8ea96dcaeddcb3437437f63abae56b61920f5a1c3274690972c08d5d0ba97a691ed4d5f7aece80dd9e693112de844616ead2c32cd99ad0587eb7ab1167e1a980a8c496345b723f782bdf769bdacde4582f547c077de64f4df8b97f569e31a7269241a798ca8752f7d154e497c07e0b7c72d9c8d8096169cc800bbba8fc76cd415080c3259ffc780d2f347eb239bf6cb3931dfacf63e27b3df640af64c23c207826cafb6e5b29c0e9a297d3e75e1687cd5aa37962d284ecf881a9566facce2159a07edaf4ce0b7e8995373d421960eccaa9e4c49a88d9e01ac9e2813cadee9037402fac2a93581303de193f2c1ee7a60d23fe198d01964d8a947a3b1b1c9ff6fed3653c64f9b20a1b5e2a394ef48e4ca0d948d0a976df9c85ae0d5363533647eda4d73c28ce4794e4fa840ec891583c1c8a53a998d63850ddc6c8c683213f3709ff745300f8118ec75b6e3b5cf484e08974ed5f7a36554a85d26aed8f77b309b5a676f59730ee8ef02c373839878b4982b44d875ffe7ceed8f8e8275139b923c008d052ec3bc001dcc943bc8cc4bad28c0644163c75d343964851f1a5e832fa4bc12c43c326920747353a08668c26ddc92ef9ec13e26e01a71b6eac5c0cb44cd0645c8ca4013305b452717b45ecbc4002e1c3178210d5ca1506d8ca6401119305858c3416e5712e78fa7ebf0d57ce44ec61d5c79dbd5ca746b4a85c48bcb54e8123d6023bd9c44672eabe44e14d9ea4ba12b43edfc5991a9d307ef6c616430e111571f806e5be9ab13f81eb7341236cc72c8198f4e79b70a32ee0eef1fef621d52767056bfae4d71e33e534bd3673182fa64f83e2f2b9ebb063fe44894ae4c27f22d2b83d56f9a8cecdc8959874e314abb50083381ba9e801c0a99433e301e458578a35361e8f4a8d422a0b05e57fc00ea2dbfd3c871c2870947455246e7e3b7b50ac7871aea54b6f65cefddc63cc8b19a03d33c1b975effff0a490a698235d700ac682b69b4555d2fbf0067cca1830cfaa3d3486157b0f85b01e2a77ccb9fda083a4f8a78e98e2e959759af4236dc52613704b97f950bf24c9a9e3714988466bb75d3412b78e3659de989fba5f447299249d38d4c0c6ccc81c411df1bf7ee84528fdb8fcdb3412afd47dc11037030db7f5ea1c80d0d5d964a3c0be8951e16aacf6d8ac2c4d0a9f4ecc6e0cfde9a4f355d340f416f2387f6b986ef0414d2d61fb84e2a48d94fcc539eaad3d39178785abc7f38c2f1ce38f46dc112bf8cebcc0c972e129517fb08ee285cf72359c2f1e7ebbf1231b6e6f6d114608bd2c351c79cf82f5ece54e05d373decfc159a95ef7a068b016bec6f93b2dca435e758f6d723180a5d464a048761c3738ee2831e1b611bd921681238a1e5ecb23514025fdd849900d1960461757c8c97c9aef229f35f3e499d16e7ac22f2b3b5b1b73371db9865267437239f0a7e45ec2006fa817416565a3612670c93541c87ae4ac6eac14e6f5a1414a17c67b1f4997970aadff71da18307fc9c295591988aee1c221ca08833439f101f20f4ed3d352de0657a6dddc72be666988f44153f718a6c9b32826273be58ccddb48ab6a29ed504ddfe1e784bfc3b26a16bf9a05b8e173438c1598ab2db00a71eda7a4cec8b7847d2c2b73fd4b1bd610ecf053bdd364c1612bce0445e5b16d1e00358d90f67ab5e39f5d3c200f16e8dfaf29c6477223590c3e7bce2a8310ed6db86fc7f8f66fdbc358a419273213dde00e984a36c5cb7cc12a264a0d9be2c835007e175088c63936cfe5fc8b258d39a07c7e87ec3d2ea0f95d5e1a96906d0b8013c62184ea39278f3fb22769b38628fcf819f09898ef78a892f5875c3be85a0c6bd69c3141dee7aeb4af6bcf242a3756c5175c3b3d640f53b49b90057f00d80e52a58ea29f13a3053fe6f02c037fc1fa52a124187db6d4178e9e128529b6c11df7bf4e1fec96c2f61e25b15ab464ba4d949800c7bb47df0fbcc837007268b09dae295f6e7389f1aa5689dd9e953a30db47b71c489f7740e65e86d87ac5f748231b7c3f201be062ab162f23d786d9d86f567fa1160fe6cc03110158c112b3948dcc7463a0f4af5c6093c427861e0f400a5147b6940a2258aa80296d8c185b655da09d7ac00637f108e04894f60ecf0e36a47d8f5d6935e26e4349b58f81027287a65fe266bbfe784a4854fe8346b72bd2894ef3ebc838aeb6ecb1e3b80f97fac9456e2627d18707aa8a490744ee42798d968a356764931f0d9c9ce90bcc4d8a7d6e1cd025a7d85321f2fa9f84af507f52c071d0ca0dba96da12e97d528346f1fbeb0a9572ea8e267c2ed00378389add41e72d01169ac13331a2231cb70c05bec2140fb74a6f42427cff3e924f40f2328322f742e81d555c23745f1d01c8963c22ea968affab6d8d988d2c534b292c50c1175cd02638b2aa15d33c465fbd03a7a3a801e9caf350349bf4f8861884d51dab3d567a2c9267f2d8863c6f454628712da1f6167f5b9e9f74d60416b8a7fe7c424df45b4e24d7a91cd6f48e7ab76bed0e6c220e75d82f2981cb8f69b49669d211b16c97648a050ab6c6167f81943414e4425137ea4ba40c075b05e915cbed8809618f94ebf34e4821c0d456a337b68789fbadeabe2d9dc9def399280e8905ee06ebf6091d4448c1b0801d813ff1bae08328f1f6caf32539d68c4a5320e8ac43ea05eba32e625326b971b63c3f5092a74928736e42f5827ff7d11df230d1335c83e9603af4be6ea607189f44115028f08538b1a9d20bb06a8c0a747b20819a809ec40eaf08a68f751c369fb18cf1fa4a4880657cbcbcfbb8b83b94970ac477513c4bb8c99502c26ff1642c0908814562cbd49cc4fdb69412496253db047f7703c8e4ce4ea5f6ac74ee0bae7edcafe01187ce8d14673e8782bf4bfadc15548fdb337e1d381e6c94224a8324408c682ae79e96251d8c03d6659e7aedac9d80e43e762bf8f5420ca45e8c20c891f171214b2896dc5fab23e447387a65ca557235ed2bf77b0b53f4100c1d18a918a9010b8d8456de5cb51bcc931a058e90d7e71d8d79d21cedcf0391ec26987ff252c8d37589483c1374a56a0db0f278fb1a81ca203dd35deac2e604800c94ca19ce7e6bb0ca90c985d2cd019098f1b823e371cf7bc107097ba79c928a7d7587d6fe6773866b9959718986dcfba3ec3a07fa17df3c2175818c077df02d6aeb584b93007349653bf2f328e7454f5f3ff67b49fab3c895c31774d25302b786a88f55a39abba9ee5f7fbdfa038435021a6ef9980900a138e49eb35d29d8ad55fb824a8928fc33733567d82b6e91301733093cd55185d624e51051aff406befbdaea22e2b60201e07c327850d0ac193490478139ffed73992cf22a8472dd011e2d08e081c15f34594e05f0d3731d91c7ac826dbf12d31d4ef0fe32d6ca167359208500350c0c01cfdb09f739730fa9372c7195be3040ecd718ed2806b2fd9bce85492c32d109541bdbce1c0850bfe383a5bcc892c45c62acb0a9d6da2b8eb210a682e815ae6252a4b30dc46edcc67916c7c8a8bfaabb6d9c573c87d3ecbd866d6a1879688ccf1854a4d3d47189edf80e78dd891cd66cf722d566f7b1978d5c57fe7417cb62eb48f1476cf97092bd8ec20b13afd73e1b5a6ded0e78647988907ba1cbebeb824359219e515b7048e290d8ea828d0f007a287f2c0efcdafdde8294434c01be1ab451aab1ba0e08440650114fa5eea259b9cae6aebad87efd559a14e30f24311a017532164159691bf58c4d18f91e35119c92b26676145d67956814fbfd0ed5da0a71b3640e8a46bd3fb4ee46dd2291193a822dc8c05c03ddd19bca0fbe7306df8b6973b378985bfb0a3606245fae9e68be254b96d71200285cdd0c3cce65d99e51e0c98b0d6ee296bea8c7af475adf332bdc24b190dcc800b8fd0196ba2b71932044b5d86ab13d4dea6e88e66532fb32acfceba28f96ba7619fa8cc882abf778872797ec5b49b4b328164e101267899aeebc500ab31496132d3b0449d212075ab486f3c76e97ff31753c8cb5b9b603bace64deb31a68c960764d8c3126259d8249df54722f37d4204d2db29abe960c71d34a14c2268c510afb9cf8909549796df3a82a665cb4ebf33257a473dca72d41bb3a59d0d99e8331b94b87df53823721550fd81a3ea182eea7bc9b2e28c2506bb02f66c3b5be7e5d6c2b8fd869bfe8a32b1afe6031213caff7062c1190e862f453148675edfd0b290c28631f04e16ffdad07734187ba852dba24799eaa7d78acbba0d1c7bde429090a17d95caf8c66eb34fbb73eb8ca4fd7a9f019832c786bb270075da2f071642ae9b8f3d20298140486c8d8a9ce97f76a69ada03981256053eb23e831c33575437548ccd0f82805fbed836f5dcf21f15c8c33f2dcf291ccc2b840de305f3274bcb7d296a52f1242c2d31309a2878be2b76884c669ba42fc0a897cb4cb69d0cf517ca52c36a279f8f7bad49181cb971f1e99bda80c407c7794b8618528dec13e7493adf9606fc839609aecd8ab2c49e775d292261a6c6292a149c43be71719af51713bffe73fe6dd14bd6ad110d1bdf284ad8d6b35c71c19a26e11c9b948a01e823a0be93b35c1f26469953ac7df4718f0b549315c2d39f2fc805f7df965d5222a85cf10669d8047732e7f04e042049158cdf85ea68f4095916d62b4878abca81163740fd7f63357e72bf3cad63b5c6c7e60ffdd437090f0d239d25fbfcbdeb0443765ea6e9f6ac3c234b4aef5a0b5cc23ec4ce8142bc75b31c81245002a9732aa599ddaacf86424ed077e1948e19c806f1b40c8fbe82a54efbfcec5894932020cb1e54d4905b1bb7322216910151e93e777cab53eae3c04e7a40adf449651aa3c499e077a2e47d72c1bbc38e3b0ddf2a3a12053a3266372f7c5699fe303f5ba5dc36ec35c3ff9f4ec809e466b1eeb49ec8f33c6be7d3c58a06ed22cf79d22c8fe21962e007f307a1d4a9878166e24a340e9ee8fb5e25303bdaeb36604565288c24c4d2894ee645b480c6879ac9ae8c3c9d720ed3928fdec07928532caaec0520d845dd0c86667e3c0bc5bc2f5a8c76c9f279f9590b05927aafba269a8c336857896c40ee234e08eadd9ad23d76a40fc6a78b10484dc18177f63167c6cd9c9ced63bc599979082b2902d8f40fdda7a6eecaa6310f7155426a4f4651119ba55c76a181f12cb840c2eebb89878942130ac7bba522ede6e7605a6a71a632c458a52093044abad66a427f27b13689e7687be36703c6afa1beb0a8f7ce9ec9826358aba8637d572c56936561adf1c177ef6bd12e289c87d9f2c048e594569b04bde4cc681ab7a792876241384f053f89ebc3152bbc9a26e7cf6c5327edfc146d79c9946fed35eff8e1bc3ae9a775e924e4dd86b54725785078115a51c484f80c64a3a34f5d7082d200612a96273960488a154ff8aef8397d4701a51d276050ba5c749a6ab10dacb62b2cd8130267a38ffdc373ab1d8202c1c27dd1efd579689ac8c6b823999179215238b35fe77f6ce717b228cce9a6c28d836241ff2e206dbba729bd260aa3b072a7d3b4298bf3b4c7626c42859f562836c84de68ce08483462d184e3e194c0ce3922384a6b560003e201be4e561858c774c1e5f004b0139335b93207c44ae9536e30d8120d963")
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:43 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000008000000000000000000000000000de4f0028fb31c24aa5c79cb9f1546ff3c96c94"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/arp\x00')
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={<r2=>0x0, 0x2}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000000c0)={0x5, 0xeb, 0x200, 0x3ff, 0xfffffffffffffff8, 0x10001, 0x0, 0x8, r2}, &(0x7f0000000100)=0x20)

2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@ \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="00426d7295f3a283fea585c45a8c5b92663fd1a42500039fb56de09d133da3cc1b4c08310477d8d773a09ad060f91d6521e13733e2dc2501dfa7fb951ebca812b373c485b38c048fc692b8e2d93b9a55bc8c574d55584c5ef326"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x4000, 0x0)
ioctl$VHOST_GET_VRING_BASE(r1, 0xc008af12, &(0x7f00000000c0))

2018/02/28 09:17:43 executing program 2:
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000040)=""/158)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040100000000000000000000000000000000000000000000028000000000000000000000000000001", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYRES64=r0], 0x0, 0x0, &(0x7f0000009000)})
ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0485510, &(0x7f0000000140)={0x18ae, 0x1, 0x101, 0x80000000, &(0x7f0000000100)=[{}]})
ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f00000001c0)=""/180)

[  137.651504] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.651527] binder: 19802:19804 transaction failed 29201/-28, size 40-0 line 2963
[  137.673618] binder: undelivered TRANSACTION_ERROR: 29201
[  137.683738] binder: 19812:19816 got transaction to invalid handle
[  137.688315] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.690069] binder: 19812:19816 transaction failed 29201/-22, size 281474976710656-1369094286722737856 line 2848
[  137.697683] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.716864] binder: 19809:19822 transaction failed 29201/-28, size 40-0 line 2963
[  137.716868] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.716877] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.727878] binder: 19819:19823 got transaction to invalid handle
[  137.732163] binder: 19810:19821 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:43 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
sync_file_range(r0, 0x9, 0xc00, 0x2)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:43 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  137.740985] binder: 19819:19823 transaction failed 29201/-22, size 40-8 line 2848
[  137.741223] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  137.771737] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.780629] binder: 19818:19820 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  137.780734] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.790959] binder: undelivered TRANSACTION_ERROR: 29201
[  137.798064] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.798097] binder: 19813:19815 transaction failed 29201/-28, size 40-0 line 2963
[  137.816132] binder: undelivered TRANSACTION_ERROR: 29201
[  137.820726] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.828054] binder: 19819:19833 got transaction to invalid handle
[  137.833190] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.839415] binder: 19819:19833 transaction failed 29201/-22, size 40-8 line 2848
[  137.848252] binder: 19810:19830 transaction failed 29201/-28, size 40-0 line 2963
[  137.867330] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.875115] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.884007] binder: 19809:19825 transaction failed 29201/-28, size 40-0 line 2963
[  137.891737] binder: undelivered TRANSACTION_ERROR: 29201
[  137.897265] binder: undelivered TRANSACTION_ERROR: 29201
[  137.902815] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:43 executing program 2:
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x10000, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r0, 0x4038ae7a, &(0x7f00000011c0)={0x4cf049a1, 0x8e1, &(0x7f00000000c0)="0b8ef20e9650ac7e24a5bcfa0e3a26b81da1f02dfe9d1baef10fe3b13d0062a431825d6061f266ae3dedd61f52da4e94fe3069a658aff7aa4baf4ade991b0b8dd7b8b8e2a72d9e121d7bb2aa6ce962cd6d7e3917533eef5181700970bfa2dd2bbf3884a0582eba2d467633f08569dac25cb7eaa23dc30c3dc3ce6b36fc8fe8024c82ca18fd1983a8bb98720a56d7557ebadbcef808eddeb7e448818675f169802ccb6b07b3886543363e4ca660f1b5352bd710c1814f4639477ec97a5ad9f1c2ceac26b0c94144f0224027be9457d7304a4ab8f57ff661ec16f3ffd030af172259bff31035fc195965b2c7f168fecedd24d9", &(0x7f00000001c0)="289d10034ab1e3260069e0231f63499d4b3daf3cb5b7177a8c7317261e271afc89eccff06a7bfd620dd910c47e03436d7b7320cd353ba6fb24ce072fb4031e46b7cd4a747871925a2001e9ce9dc227df8a580683d2972fd2c9a9b764afe2d9240d69147f79fbbbab62d0a87d023e990d88777fb3f05963393b7f71ce54f65346e3c1e917d9bd803f9fba98d528510179da9b90f4b1dc776a56b2c3369f634e9e4cfd13302259c033de9e2aa16de4bf8794f7309bf1047ee74c6945e0115d87825e3d0d30febca4123c1c112ad323980e103f39c8ee411ff806d8b256f664c1f518063e8c72e46c7c560f3fa0d68af340ef5006e877eaec0edf85e6d5f1f2b27b8c4ed3d82f2a906d7b897d1f152e6538a4336383accf5e53481a376a287b8a89dd8677714d601c32199eba0cede682d8b76ca507bedb9c04bab90a1f2922ba8096a767453e962e9151a4ddab4d882f7339a752a9dc6a96f749bef7da58173bda2bb50f4fcb15255530bd9cc2f3a2f17074bae8392436f6cae68988c61ef26b98aba42571c2d30ba0399e23a350b257b43849702604afdcd319ee4f960692f75a28d246dca3fbba1085623f9bee5746f5cceb1031abd4032d1c406c9820a6fc12c68349b20cfa753e8a2a95051995fddfb1186a53a731ad297c17de6ee1bdc5d5d21c7cfd9659781b87efdafed9c07cbe0f9caff924e5eec353ab8df97ba483fb2dcd07ea30f9706100490513a05dfa6504f2920a177bd0f15f31bea9f625f0e688ea6daa027649b82d39dc05164e2b53ca227699b2751fb18af1cf0457a5db02ce1959bcfabeabccb3d2db64de1d33ef7db000cdf80587978f208201840a98581049ab9c5ac091966029e2163da2b48617daf2c506e290b1c948e4baea0d9e7b5d43aa52b4229804a3f64e07c96260e70ccb715bac69cf2f6e40ced8a76ff90e8282bee897970afcd503bdec592e7281b32f551874d3cd83ba3cc7ee7ec87b535ee06a892d678065fdc5bd6ed7b9b385894636390b7034b0befcf8e9fb6cdbe0a19a2f441028714ce414ec07bfe337a07163112ed90dc3cfce4b257962275ec8bc23cdd252e518cc627e4dfade3a2c17f35d69f9eeafe1bdcb4529177027df58a3112290c6bb8e0c0d715c91cc8f340125c1b35beb216e5091df90d269d843445a08afe87e1ef175c0c992a58f4ae5cb52d401d1a6e6cd8b519aa7cd579199c03e50882ff7887303200c409730e9423d8b74cd586bb813dab197940a92c82b920c8f4c40262315aa508355d1a16ce556e7034b682d502653bdae16772984e2f78e7311b0f1dbfa21d44ceb1c60d6e232b6d42b9b522e8e53bbccdd150395089d37c37e202e9929fe4157ffba916f39f00e46198fbf243166ef868bdc6142525f29afb7f90d17106d4ee19f489c5221142a11c034f3edfb8b3b33abf299b63e6072b73fb429931e49310de714d1a81c2ab3cc5478a75512340dce176da1db4df39b3c1075f463ee6be7604b43ac6e0791710e65cac273e50a23ebdf3d4f9265061da2bf49b4643df6406bde6993e59752e10a01d4cd6ce245214ec20e49134613985abe31ca1648cdd457ad472a51f79eb2d05aa0abc779d235dfb536bd20d0cb27f91ecfceb57141138e9cab58be1bf6b58228feb545d49f9c1f88ac777c6fb36f41bf4627d91dda259913f5955c735fa78f4109b579728942564e7026f92ff37c6271865be4c5ee7d9de31ab8b81b1f782a888502be4bf2472612eac730ea9634b898ceb15728d55d3d8d553ec1295f2a9b0a6363dc477fae1db947b89561a396e9f958cbfeead08ff81f05210b38f18fc7d0b388f717d985f8fc65dc4dfc7a0b1e5682e028bb10facb3dee275560d739d2751ce52814ac68e04a46af884ea92ba15276f234c0c91f10f29e218732d6692ed0985778330b4165e54191f1ae5375aedd54b9e63944c46f49a149762a39710154ade1abd41313fe6e1e6f0aaa9ab0d561215b39d48643917182c6f122f58cda540af03d050220a46106839b0276fe646ba61da7bb95682ec418f75d48c2877012662df4646f75cc666a872f1cb2b030bf3892287d929682ee7f5a6836bb674abadd3e6fbe768611a775e3e34b28afc56baea817689b759cf7b357ad86d29a8021c61ed8abe68474b5b6d920b8b8d23b4bfc3e5dfe1bcc99391a1d9bc71778c2844c865a51a59d6c0e239a29a970b40de8fe4db1f5593085b28dd5163e0ac124ae15a6128eab9685a79e317ab48987f0cb8333f696638e0829e698d19c79baecd54663edbffbfcca038c555fe7a58ea9e3fa2c76c16419297ab6e9ad1c6120ca2784aacc1b4712dbdcea7c9669c57581774811cf17bc745e411b8c779b1ca9159f24954144f87223cfc0152bf83f984b24086e2e33466eff0ef4eb1beee48100393913ffecdde32b3d0e2b3d70e01c46a2dc7c75c139c6221490bc7ecdce830bd06aff0cfbb2714cb8aca02a335db4861a8993b0b0d20422bcff34ffd900aad7c420f47cb605bafe486f30c660f5135ac648a03cb3d07f97694a124d80604714450175b1e740721a095f134d8e447aea48df314c49ce438187c6dbb549229a3d92eabd98a33c7f426f79bdbfac72c35af35f6dcfe7ece823dae55f5bd9df2591542f607a764480484fe17cfa753362b444a1444ebe4ef31ccf24988e50776c5e5d6cf1434f475c168e5603e6282780764c07ac65dc15124fc9043fdd6ea297eb9d5d71267c7f9cbfa4f1a4db20c7bdfb8b9158550a630965c2f0484702616e68e47c80a13975ab53409fe6996f64925e54f21f4d44b04c2ccc86855577e1e271f483885189d5373540839b67197da3e42c2ca3d4933f43e2cf7f9ec220c03808900bc699b3d0766628409b3775d865167ee1c7b0111f337f163fcc7888e86626c0f33c05ab289ce502f1792fff3190064cd72af2437ec2609a64c74908f68e34c8874eefc2cfe0eaf76aaa26ddf8e705eb3b02263419d877f5c726449247f2e521113818b56c609ddab3061813ac1a708e938d5e9643ddb9626c7c4411eef5e701cbfb95f45cbb023f6a4e41fe0585555dab1de69c80cc0fa4646d42f1ea4c2e8cf3193b11739abaeefb7ef466f593636fd05407890b87c6a63dc34154dbb39342ef7f1850072e0cf2174f30ed910b526210f24206529e26092a4d02fb8f2fb9e3febf3b95578c2816491dee1bed625aba05539f0dfe337951cdfb3683c2934208c16de8cc056213a3e4aa9601b80c5c11fe39f9df21d0845a145b8a1bf6d89e4f92e1b48df44a718e417d3c59a52e09023d69fe3e724bb076bf6f47fe823c61704ce325a5b5cb7b0d3a8efba7bc7da8be5b37ffc1c7f29cea2b69842788d0ab26e0b7b92bef1821e6258d873aa6a1b92dc14dece93403cae8ed0087785ac060710344749f085ee71875b90b888bd83ec73217446437dd42c91a1f97639942183f1a43c1231cc33c8962241ab4b4443f8efac20128f997749f4e5657d38b87e893cf4bcb4b0a53d6a722383875b78ff834863e3d664423fe318aa6a0a75af068be5454428962692d7d0d1175297c067cc190649b50a8a7552d56268b91b3d9ffb82b2cd01fa9bdd86bf6a81bfe40bd1fd46117784bd56b2403eb2cadf87021f0d892a0726f8b74102440aecaeead552c916fe02664d92117f71397f41d3c16238d8b8ef3d376a78c34112689c5a167698e14207664e9979afaabfcafbcdfc40db384f4ebd0382e1bdd8562df5c8c9e4e8dee90c9d85f6f2e60b29e156fa1cc62ad6ac6f915851a06bb621c00b809610c379bf687f36169f84be0bfc20217c0a1c51622da144422d4ad7341fd904b9e2e53424178dbfb93b803afa6b661a79a6551c713786d89967128a6666903eefc157b202de10e29c4b643246649266b9e90c3301c3299224762687fcba4a52daf4d13dc3af1c256720d91ea4f025f75aa936fdbcc750feb629550ab4a8d80251748cf0c33b6dba76f63162e37fcf7b1d3ff0e5379687f7ae25d3c521c193f03c38400cad4a6c50db17e3b7142aa5a1d67382b50aa757df00238601502b3e27f96d129e02b9bf206f0f9593048a94b58e4702bfbfced7cc7fc3b7ea541fe67c83bd50cec7ed30ca0bd882f380f7dd6352beee16fa21ebe22d0fd70deeff7ba9eaacf9f1768056b603690c52ba91a83f56ad2581bc19c3cbedd7632dadc667e7fc07ffcfd15e4a206e10cff16f7688660f6c50f0bfb6c67f31c7ade9137e05c0361c7279eb3fcac71547e5e282ddfc4c44e6e19c095ccea6c10dc2bfd30efd5ffa966c3db75816a7664107d88172f3de845ef68579d5e0d8592fb6fb60404b7a4b5398d32dcf46ea65f01e3a7031e19080eaa171bd77ec02f7e17864e66acb386a908864d90e0ada27813e7e3f3c4732f6c81d8540d5d092e3b2e8b4ce66c26619929c88fecfb1d24462f8e86a19466bb7f4efc55b14a45b0df5bef014c46ea0978b8d2427448c3e7ecff27ab533a6e89b91467ac5fed5e81b1e1c8de03fe2b2b62bc5ec19506f8df39c81107d30c33d1c2375a2d0b3c7c12ed6ba2ebb46ebceb5ff8e679912685d459d8212e899945428d7303f1e9e51cd022be9161f554f525af84b39fd5d3cbd6217d2c7da6a78228650f32ee98c881c67710e07a29e6e825d0860a1048882e53645cbdebbf320696a06f7ce5b689c68c4a1183be86a77bdc169931a9cf7959a13e96ab156c65ac510a0600a1aa4a7e051788a84a10070c151d89ca45fce5a784e5c23cec988d1852176d38a27f2a02f405e193b38799f1227d7f5e1346cfb37b3bcd18db4e46e2d1f409049405fbe67fb997dbd91322ba7e034f5b300b8cf2b514f58926fe43f8be09860c4babf3c3a545295243c4923e320dbadf3c5224fb10ffec520b885d1b93638d0c083612f7fa179add14bab58ccaa2eb1885c9fe436c0c469beb9500c7a15b8af4e3660eee820fd87d632cf1628118996082c4f585d95952f7a1dfcc89201490f355be93f69bd4915c1b7461462cf704269bf40329b8573c3c8a95acdc53f729a1cbac85470cc996379a513db2c6159d6c92c95990a7984a287b270c0871a225a52c16376c761b1d27e2f6c9680d1931a5b49d57bbd28475b1d529d4cb5b83364a5f12e651b86111c06cdb6e8cc1b9db49ad24e9a16704826aaae3c5813711e6d7fb7153544676ab831ce006eb970a823ce18974a146819d3edef82c2ac8281a6a32afccbb70cc9a44f0d3b2c9a1c68fd39c2b58963cb92d0c460737c2aab4e60fec995b53363e8b383978afbeb5bc2c1df80454363e2aa6207ea921700b199f40c9d00eae22c7fb48e7317f093f5a2dcd682c29f6da823683d09d9b7a1b958045c070237736ba2230fa9f0af7ecdc7251885cb6733063e6992f28a8330863523232d770161623f928f0f952973b4bdea233f23259a0e4ebc4c03397803f3a198e5577e62ab2662aab1ed01d32b7f655c57a00e10e8ef4479ace8978f2ce1c4c203d7d1f1e33e365f0dabc11fa9ce18e4692e8403ab5151ffc7f9fe2042d3035c1ff37ea76ec798841f0525ea298d14290a774cbf493dd21c1ef818c58f59d0a23e72b0779b9ce29e74fe505424752f35f66185751a1320987dc7deb05e10ffe3253c72d4c9b1d4de094dff95a3f2a12fa55bb4dd68f03566787805a80b2bfc1c023f4ead4f0d6058034a0639f735a74cf4c56c2c4c2185122472a293d12c66679785cefcf3b04d4794763dccd88d575bc97e56b3377230d2db957bb9e5b7ae97b889a54b18bca41fa54e4b472d6", 0xf2, 0x1000})
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000400ff00000000000000080000800000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4, 0x20000)
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='westwood\x00', 0x9)

2018/02/28 09:17:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})

2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 0:
r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffff, 0x2}, 0xc)
r1 = dup2(r0, r0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000080)={0xffffffffffffff37, 0x40})
ftruncate(r0, 0x100000001)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000128000000000000000000000000000000000000000000000000000000007434e52c81fead7079ac1b71c0a74cf0eadc7d17ab733d313cc70312f771b63ad4cecf0cec88204e2b61c582a944bb2d44baa0af0514aa58384c4ae488c5970ddd225d2abec8afe3afafa22f9daf8447ed618524a7daecc9e055bcb4d978407d753e044b5e512e0ffe0d8da0a10b6523982909f8148ff88f09b6d58082beff7ca97ff011278133127df1cca8c8c5a0eb6835ecdbca183ec876969b56d87de247fa9d24530a968c538f59517173f9e389e2b5cf3188becac112fe2bfaba85b8d84eb17f8ca8e4", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x2, 0x8800)
ioctl$TCXONC(r3, 0x540a, 0x4d0a17cd)

2018/02/28 09:17:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x80, 0x0)
ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000100))
ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000040)={0x8e5d, 0x9})

2018/02/28 09:17:43 executing program 3:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0)
getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000080)={0x100, 0x4ba, 0x1, 0x1, 0x2, 0x0, 0x2, 0xffffffffffffff81, <r1=>0x0}, &(0x7f00000000c0)=0x20)
setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000140)=0xbaf, 0x4)
setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={r1, 0x4}, 0x8)
openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x0, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r0)
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r2, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/167}], 0x0)

2018/02/28 09:17:43 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x318, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:43 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000c8e70000000000000000000000000000000000000000000000000000000028000000000000000000e70000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x100, 0x4)
ioctl$sock_bt(r1, 0x5411, &(0x7f0000000100)="169a2a653ca7f845f694cefef77006d5bcacc0092f8f30d0faf48fc106ee6b00f3f1384b1c3890e11efdc50104d5636fc5702e46ec746b2b81057e7f161f0b1949dd40e96f09782d25d0230a5236c6ab0a82633a264594026876ca933d8cfde94e95733ff3cd0a13cfd05a0062ea5d97f3e96bef4c333278fa32c5250ef49e81856e8dc8511f3d58e72ee1ed0c989ae43359c2d78c4745c3e4d4")
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x10000, 0x0)
ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000080)=""/45)
r3 = fcntl$getown(r1, 0x9)
fcntl$setownex(r2, 0xf, &(0x7f00000001c0)={0x1, r3})

[  137.908305] binder: undelivered TRANSACTION_ERROR: 29201
[  137.913772] binder: undelivered TRANSACTION_ERROR: 29201
[  137.919281] binder: undelivered TRANSACTION_ERROR: 29201
[  137.924780] binder: undelivered TRANSACTION_ERROR: 29201
[  137.939905] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  137.945602] binder: 19848:19852 got transaction to invalid handle
2018/02/28 09:17:43 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x15c)
r1 = memfd_create(&(0x7f0000002901)='dev ', 0x0)
pwrite64(r1, &(0x7f0000890000)="9dc950c06083bc11b60e5917a3b1e391d8d5848d872d6a80386a9574772f9751a090881973ca53d5ea0341d8acd37ed7b7423079f969c09cdf9da7dd62dfb614db82cd5a241fcf943e50696b0fbd440bcce2edce8405b873cadab6fe917382f260eafc19857cd3ea9a4f6e3009b29d3c19246edd9abcdc9d255a7939ec48d55e1b5269a85eb8ee750bc2764d846901196621e2cefd7ed66e94d3da202d8d162c2e8d450475bb904177f30e7ed1fd030d2f5315c37e41644032e18fcf6cfdb715693e25c7a7be54dbe13b05b5a9cd46b62731021ad1924e86ecb7cf1204a4018488612fa9b3d2b06f6076b32baa2358a04a089de80ab05143c270d115f74256e9f462f9d739d6ee55138a7064e2a81deaae7c5a028466df7791e1aba48e2d1fe2f5cac4a5028b70de5ccd2815d3b170d9adaaf50b9228e230190c5f758ba8a08dff1f45e2bcf48e43263d48cbc5326fb01f1a473fd54ab0858d42d4adfab9cdd3e07a58823262af60036b438cae12b137f217ae420e99fb7058a5a2c87657846971eb5e9e877150a363cad9cdd09f9d2ae9f4d2d1aea0cd6d6e7760a63fd73c29dd90aa339d0adada70e45127a3e38dd15e08167532cefe9d91cdb6b78c683673cc5932b971a26349e4de696459c5c4382f21369bc3e5b7da519efb3069450611b7db8c983b2159c0b4d03703602074770f64520bf649a1db2cebd4ba36b205728afe8f9e28e416fbda28a719d225a3f19310eaac362ccbc66964daa007406701dd981080ce92e69319942014debbb86614b79011e751003f7a6b832bc98a877c771a814df72da53c3b8157c9830cfff07c215a686a6341b220569f8bf3efbf0d7970dba8c2915c6694e759775ede4aa5a96408e0af9de2e7cb99dfbabc456452c77b30210d626ee573997d4e9cf42e3baca2655707480d30410aa83cad86b379adb74ff7f07d350bbed7e36f6384e3080ccb5e2e38557ea5b427e2e29a26d5eebc5a229bf106b899ed00fdc0692aa450973a37cc764e4088a35e1756ac2f23e08b99ca9553b15bc39cc8eb7f996b5f6d339aa98917128fed938ef16491764da3045568c8c7868b18ce3b69a6b73ac034c69fc20ee08c2448dc69f714178a3b0d30b9d7916b8a08ac016f19836d4ef78f33dfb2e1131c19d34be8a724b8e03f40c7446143e397c060b52d962d4e222ad18515028cfd497167ad0d964e0cd9f5f35275f8933f58b9543d90ba813311da6d89d4735f0ea208ee473f8ce8a57ec040706e0a0b6b207b3eb5f4aeb36c2c1f11fcbd87c34aef9288f2d20f09f63c822d5bf284214c958c336d89d66d6f1c37d394f4f62442a103c24e9285de293057c483644e9191e7b68210f7b391f54c5dc8056a9d3135ec76113e8fc97318ee94163cf6d8bf3dc7f2a3537d2be8f54a590dd45d6a7836211fc93afd6e2b57d5953dfdddcd4794f2ec00d1e5b594481f47abab1aca9b96c5241de585f2f60eeead8c8ef85934b044d5092746ce51d9dbc36a2e66549a7723655a4afd9f83c97460af6ac078ed036cdccda382ec07452d574fa41a4f578d8472ed4c8ae8cde05395b5d014b42a7114454b9055266973afcb89033c222fc00a1f22b81730c2c19a13b7069a5541f2f535228367536aa45de4d4f7017ff15c6c5ff5aa391f783df4a9962b7e0b7ef0f02cce09499c9315f62dfe4fb65aef858d48ac8a0c15ca5d2e29b1446f9db9b59e0797aaa709e3bc74d601298b44fd2e73cf811cf0b26fd65a9f2543368caa93a3d2eaabbcdd6568462941b9a14ee0074bf733aefbb9d86ea8c407c423555bf56b2ddda11d6dd1af3bdea1095c0b059c1398a027b4c850bb1e0d0306ceb6bba14e5e121ee3465c21b33f45c7c5c5d082f1cc79673e9c7b80fdbb4e03f9fca74cd2e60222357d39ee28e19349134a8fff925a6f5b94e77e7d92d05ca40de217de189c4128b631a007a0875c54932294b7955c22b488693df3afbdfb42dbce8eb9c8b72092d29b9e10b9294797b87b685d0bc8800a2a8c0c4be49eab18594462881dcc152341676e9a68c62eab2e0b08c86157d9db9f97a86c0ae9807448499a483ee1853d448e48db379bb386b7cfab5cbe8d4ed73690af617cb4476f3397b01eaab28476caa31f9bf66c9ce3caf9d69a262cc4bdbbc5d4a1ea7485333dc39b75937e65bd846828f4a67b58fbbb4797fcf82e7b6f26fb960207ff610557ed9ded5396a998da45bd9d19e6126ea3ffeba7185f9da1e7565e4ab5ca7c3ca0840397759520f6932691c5da0b90ab6e7132c96b9c20ff9061d50f8365df70175bdf82ec932c551129309dc53d7c776ea878dd033682c71aac3f8fb52d1555aec7d3d88d9f846883d94219b619ec62967545b11f22011e32556512706993070fa67ed539d86b03f731d139a23342c668b1d1e6fb0b189f0c0f47c2301d97425f597c1c0dade82e01090b583793edbd96770aa567619a9d6e0750e2efefa14ddbf9c1a091e010b62aa1350c4551ac48ee24f41c7d9f5dbe9542e013458c981aee49e9c6c6f4350d594edacacfe8c33b8e2d4928be400972d24fc5561e57c0c79875fd360390d823790ab80ad90829ed4a551c10bcd5b2994b4a1c183c3f2a48fa4e928f79020a597f4cbea474f6831e8b808c4e8ea8431baf6b953a8ae1cfb301ca679df6483e3e6c621011ed256f3b7c1df7f21a8cbbe01d61e54eabc9434a2d2a4ac63c1554650d76cdf3cffbf4db1a7e4ac5a50607c205fe5a3fd5041de55e3ec218982144379c6b448df403b3a7529fa5112fa93400eb75af640afed84fa8808fea833c33ced0ac16e84a8c722a65f41112792f6270973ffcba1533d6c88b2531d25c88f46c380c17090c36865ac94456cd6912eb3a4237ec19aaf169058c50ad11e992c39e2504dd49da7338c626f7124b1ea0cfd5a502bbe5b44f5c0b852875880a447d4d001b2bfdf2d1de779644d1bcc352670eb4286c34bf21785c84fb73c6c3414b7c3c6ae61284d822f541d1e8b8bb3ec0c51f53eea919f92ac1e126f620cdf366c884d8603bb6e2dd8bfb98c760cb72b8653a036518114e2bc629190a4a89c4259626dbfefe35be37e74919d26226d9b63bbb6bc183bd4b3894601e15bf5ac5fd9ae997c4354b65b08c5790072db4b920d599717bc8f3d474ca02312192a55bfe45291b1375a2867547f8205d922105044e7b103ccc1660e220f139cc9eb1fd98e549da59b3d402956c3ed1d750f45ea626c19d1f8872a03e9600471a90a6d416e26c14708f4dedb7d2b65e37a81c0232d0ad6dc60e6671b69720a21420f806ced1deb15bf379a10df3838fcddceaa4e1ec5450fe1aec941fb97058e5639cd30892b0e935b2866b6966807817f06620ffe1bf1d7e2b9f1cf3103f2b98afacf14c1a14f91ebe91dd35b8ee2b4eb460d6653917492e7f9376aa7601f9cecaf0a495316ff20e3e203a3c761b452ac71f3b5d71e043f33b3d60073135dba94c64313336887a10357a4169c314ec6da3689ee0ac057fd14e171b19b156bf2efe76f2f88d37a98368ed6210f0e8fa243c1e603c1ba70e6abe3ee6d1a37142e799a8756b11c549040bc80a3bfd9f3bfe71a5b8c09de3a41a2eb8f2e7f3aa00e96f7139964392062b148c26479035a6594939dad502571c797b8e263d60524649bae450d1027cc456109ad99b1b8b31b48e4f5a766611db6b71264f6a9819b4612a64de111af86c5a0a5173eee8fec7254e76870e4bc99c03e0a4f071f6b72d8a00822abf25e59d66599ed7e319085176b64f7cc7f11ccfdfd20deee8bbe063b459f9de2466544347215071ee41bbd2b5921d58b34a5adc27cd5f9996c0718e0ced096bb89adcc6557813605549031d94648a24f6528a7723292fa4024be90b0c3a97ce66658566bb8730f4a6144a1d1ffa702e5832909cc194b71829390af245ad0044f663f6a60d9f7c76cd1abd44a40d735fb1277d86ccc256009f9b1bb4fa5937a253aa34a7d96594697e3f84b22e9d29920e2fb40dce1fe800f04ac25738fea53820fe1d6a911b02036d3580b0d96ac0e89e4c13b9916c707dfa8c5558d0668ce840c0406b8e4073bbbba869f00456880b05d3b818f4ccaa8f09ef301857cc238d697b5f3a2b51cd5bc22754efd6a703b4fa6d92acabcdca546f04bb1c716fbd1e4ea6a278c258741be26b4bae409efedaca79b6525d33b5702b5e99a035516626ea63338f8ead39c9001739887f720e094c77b75bf1f594067195749bcd4156d63f0b4ca835b506655cf17637bf6d11fd077eaeb3e54efeda6ba70e19e8109e0660c7259edbe2cef38e447f34ba65e95eb6d6a6eae14bff83a803f66690093ea6953aa28dbb4603bfc3b488885862f7184f582906f5f080ad1ad5feb3b0a490211f45d83776bb82f8f1d844e794575ee254c70d8729d002d3a7df78684981df2cfa639518c45a77ac7a99c753ca751e4c8623655a9947335baf66a9526076901e4e98d9e42c81f3f2203f95896291a7f88fc197d8b5b9770abc156e9eaabaf7d4b77731e8bc46a76570fb356faac1ca348560820ee9e8a8deb3fb1fadd8a57d0ff5c3e5105cafa7a3592a26bfefacd97471b3ff376f329daabfb745c389029cce2e32151eb48fcc781f79e6eb521dbd1dc85bda2b7b43a4ef203d552a91b94b35635cc2f6d436c0ec1b267ac3ab06685150bba44c6b3b7b65b4ffd38c22c3d0a1f8929cfb62f4ab55ccab218acb1b2e35f81fb1c5b7ebea060aadbf95c3f0315e7dd4bfe48e26e526c165f31dae20d3e854afe29acc2dd4ab32fccb8995959c54454b6d1b27a546d0ee64241d76bce0915377ea62da1b5a1648954ec2ad011872f7baca3ec02db0b19a3418d7f08a089e4d03a6a7031582e33ce397ce8708cac7f7ac2c29f4b7bde5403dc547086aa39620cb30c3552dc3a1f2c55305d536aa0af5c5cb114f5da363871dec240361b082e2aedbdadd073eb19289427e8b133943f0d1ed2b883d8e60d114a71b6b8cb7963bc0dec0ec7ee33c7cdb95585b0f3b0cc46bd49c83ef5e865b6bec95c98f9415af19ae1f2a89a7ec4bb5c7b015112c52b5834a32faa4047b7ced8853fe31cc1c19b0ed8ef0f7fa1cea4146eecb21f26d4044c8e67bbd5047f781e57f02d4ed39dd2c88a5338c0050cecf7edb2e4d2634b0794ebd7c9a2162f0b23186ee7ef3522beb354e662728eed3e4cab427b56276cbf504a5a8dedb1ecad01ea625a41967cb20c0c02f40dacb8798e7c97c81ab27e4263b1c63850d73bc80ca2b25e6eb1e8f053455f9f68b65c5b8a50fc9e8969efab6e3f51dccd93d3aba191d7bf483302e5a20655882b853ca30704d9a947fff1bbc92085bd0f95ff02813a510320bc80487aaa2e500474a753fb351d663606f0e6da99b0693e45437b24a401a2543c06c467abd852cce11827b18c53a469e89d8952a0bced12d00167174b65cee869d05b4bbba65974ec433c1b111559bfffa4e2ecfa11dbd6f1a95d12c980b893fbbc91b70442920ad70844dac76384e0a50959f225cdbf4781c7748932ae2969f77ef54c5b9f8f8ffd562c33e5449bf20ece4c8e79843117cf599f46f95d055eb5b967cbbbb9092e4e6cb8966e1975602963b8a054ee614679c307ab695ea4f6a00d7c6c0074a37304070880a5fc0c13b3069fd205bfa3fc679c9e9d51bcba979ea15e418be1078e221d3897cc61f93677aeaf999e09208345287e30861d7a232cd03c164951ddeb4354288f69aaedafa037531b19e5aa2e687873b87bbbc7af9813a3e30fec8", 0xffc, 0x0)
write(r1, &(0x7f0000002000)='v', 0x1)
sendfile(r1, r1, &(0x7f0000001000), 0xfec)
socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f00000000c0))
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r1, 0x0)
sysfs$1(0x1, &(0x7f0000000ffc)='dev ')
read$eventfd(r0, &(0x7f0000000040), 0x195)
syz_extract_tcp_res(&(0x7f0000000080), 0xf657, 0x10001)

[  137.947616] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  137.953825] binder: 19848:19852 transaction failed 29201/-22, size 40-15138816 line 2848
[  137.954808] binder: 19848:19852 got transaction to invalid handle
[  137.962716] binder: 19840:19845 transaction failed 29201/-28, size 40-0 line 2963
[  137.965881] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  137.971010] binder: 19848:19852 transaction failed 29201/-22, size 40-15138816 line 2848
2018/02/28 09:17:43 executing program 5:
r0 = syz_open_dev$vcsa(&(0x7f0000001000)='/dev/vcsa#\x00', 0x7, 0x181040)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x200000000000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
sysfs$2(0x2, 0x54d2, &(0x7f0000000000)=""/4096)

2018/02/28 09:17:43 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=ANY=[], 0x0, 0x0, &(0x7f0000009000)})
readv(r0, &(0x7f0000001480)=[{&(0x7f0000000340)=""/189, 0xbd}, {&(0x7f0000000400)=""/127, 0x7f}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x3)
r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000300)=[@in6={0xa, 0x4e20, 0x4, @empty, 0x7}, @in6={0xa, 0x4e20, 0xb47f, @mcast1={0xff, 0x1, [], 0x1}, 0x9}], 0x38)
r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x48080, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000040)={{{@in6=@dev, @in=@dev}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8)
ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000180)="c58259f3172f4d044b4cba4dbd51a91aca9dc88b59c8910e36a10368fd5ad044bd766fa6dfe1420fb00403b7b9ea9a712742bfc13ee6dafe2f7fff1024b060c67e9c52714d6a0fb2b2f275634a0aadbebc58ac563d6895511d87f7c45a61306b25010e6ca810944c3a8672478d6bf28a35fba24a979630558d15e47861cb2bc88ec4a77f181232915d5c41f6f9f3cb03a29a03a4d0f22c8968111a817e2586816ee56156f338a272025b47a66816715a8797e27fddd193db32ebc0a37654c08c753445a709de3da41da6a5163cfa004f2193a8ee3337ba379ffb32ec8c2cb1ae191e5b0c76c3347aa535586b95e1461ab899")
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000280)='scalable\x00', 0x9)

2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xffffffffffffffae, 0x0, &(0x7f0000004fbc)=[@register_looper={0x630b}], 0x315, 0x0, &(0x7f0000000080)})
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x109240, 0x0)
ioctl$KVM_GET_CPUID2(r1, 0xc008ae91, &(0x7f0000000040)={0x4, 0x0, [{}, {}, {}, {}]})

2018/02/28 09:17:43 executing program 7:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  138.002711] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  138.002735] binder: 19842:19855 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  138.012419] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.012429] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  138.012467] binder: 19841:19846 transaction failed 29201/-28, size 40-0 line 2963
[  138.012471] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.012478] binder_alloc: allocated: 8112 (num: 179 largest: 96), free: 80 (num: 6 largest: 32)
[  138.012506] binder: 19844:19850 transaction failed 29201/-28, size 40-0 line 2963
[  138.012929] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.012937] binder_alloc: allocated: 8120 (num: 180 largest: 96), free: 72 (num: 5 largest: 32)
2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  138.012956] binder: 19844:19850 transaction failed 29201/-28, size 40-0 line 2963
[  138.013689] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.013697] binder_alloc: allocated: 8120 (num: 180 largest: 96), free: 72 (num: 5 largest: 32)
[  138.013716] binder: 19841:19846 transaction failed 29201/-28, size 40-0 line 2963
[  138.013827] binder: undelivered TRANSACTION_ERROR: 29201
[  138.013916] binder: undelivered TRANSACTION_ERROR: 29201
[  138.027793] binder: undelivered TRANSACTION_ERROR: 29201
[  138.028131] binder: undelivered TRANSACTION_ERROR: 29201
[  138.028265] binder: undelivered TRANSACTION_ERROR: 29201
[  138.041111] binder: undelivered TRANSACTION_ERROR: 29201
[  138.041261] binder: undelivered TRANSACTION_ERROR: 29201
[  138.043463] binder: 19864:19867 transaction failed 29189/-22, size 40-0 line 2848
[  138.054809] binder: 19864:19867 transaction failed 29189/-22, size 40-0 line 2848
[  138.059333] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.059341] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.059363] binder: 19871:19873 transaction failed 29201/-28, size 40-0 line 2963
[  138.063340] binder: undelivered TRANSACTION_ERROR: 29201
[  138.104241] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.124439] binder: undelivered TRANSACTION_ERROR: 29189
[  138.126829] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.135716] binder: undelivered TRANSACTION_ERROR: 29189
[  138.143293] binder: 19879:19880 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf3280fe55746ae3f0c846f55e03ecdb4bdb4acba48845814900d24110bf1af83c5ca22ba959f33fcbe28a37957d45119d71c7c7a98a41d818e76be3c0349e05c0280694df5c0d7940e3d0150f8596faece7bf0d38803ac3f1fc06e12edd6c58281f", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x10000, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000080)={<r2=>0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e21, @broadcast=0xffffffff}]}, &(0x7f00000000c0)=0xc)
setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000100)={r2, 0x7}, 0x8)

2018/02/28 09:17:43 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}]})

2018/02/28 09:17:43 executing program 3:
r0 = socket$inet(0x2, 0x5, 0x5)
getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100), &(0x7f0000000140)=0x4)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x80001, 0x0)
ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000000))
ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000080)={[{0x5, 0x8, 0x9, 0x401, 0x3, 0x1, 0x80000001, 0x100000001, 0x7, 0x111e, 0x5, 0x8, 0x400}, {0xad, 0x1c5c80, 0x1, 0x62a176a7, 0x0, 0x9ed, 0x4, 0x4, 0x0, 0x1000006, 0x7, 0x3, 0x8}, {0x3, 0x3, 0x0, 0x7, 0x2, 0x8, 0x5, 0x8, 0x345e, 0x200008, 0x6, 0x0, 0x3}], 0x6})

2018/02/28 09:17:43 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:43 executing program 0:
syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3, 0xc00)
syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

2018/02/28 09:17:43 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x318, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  138.168330] kernel msg: ebtables bug: please report to author: Wrong len argument
[  138.170995] binder: undelivered TRANSACTION_ERROR: 29201
[  138.278231] binder: release 19843:19849 transaction 608 out, still active
[  138.285207] binder: undelivered TRANSACTION_COMPLETE
[  138.299282] binder: release 19843:19849 transaction 603 out, still active
[  138.301754] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:44 executing program 2:
getitimer(0x1, &(0x7f0000000040))
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000000)
r1 = request_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000100)='/dev/binder#\x00', 0xfffffffffffffffe)
r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x5, 0x44100)
getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000000c0)={<r3=>0x0, 0x5e800, 0x68cb, 0x8, 0xffffffffffff2d58, 0x7fff}, &(0x7f00000002c0)=0x14)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000300)={r3, 0x8, 0x30}, &(0x7f0000000340)=0xc)
r4 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff8)
keyctl$search(0xa, r1, &(0x7f0000000140)='blacklist\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x0}, r4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x7, 0x0)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000000100)={0x7, 0x200, 0xfffffffffffffffb, 0x3ff, 0x10001, 0x4, 0x4, 0x3, 0x7, 0xc489, 0xfffffffffffffffe, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000076000041e40000000000000000000000000000000094795deeecd243674d2840704bcb0a65faa8c2925aedb4bd4a12d07e8844fc8f7b421b9a8066af19ddef30099898726d585da89a82d58c1fecb7a179d8273176f0809b9238c131fa21042c58775d387767bc2a97372c1f0aa5223b3fa2bdb746c8cdf633ccd176286bf22441fe212e434a9e82139a51"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

[  138.306298] binder: undelivered TRANSACTION_COMPLETE
[  138.313909] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.313934] binder: 19886:19893 transaction failed 29201/-28, size 40-0 line 2963
[  138.341764] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.349607] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.357080] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:44 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:44 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634000000000000000000000000000000000000000000000000000000000000000002800000000009641feba00000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000000), 0x4)

[  138.358485] binder: 19901:19902 transaction failed 29201/-28, size 40-0 line 2963
[  138.371940] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.379637] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.385903] binder: 19909:19910 unknown command 4219648
[  138.388540] binder: 19885:19897 transaction failed 29201/-28, size 40-0 line 2963
[  138.394139] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000000100)=[], 0x4b6)
recvfrom$llc(r0, &(0x7f0000000000)=""/45, 0x2d, 0x40000000, &(0x7f0000000080)={0x1a, 0x1f, 0x2, 0x5, 0x6, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x10)

[  138.409231] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.418119] binder: 19903:19905 transaction failed 29201/-28, size 40-8 line 2963
[  138.418287] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.430419] binder: 19911:19918 unknown command 539410432
[  138.433545] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.439381] binder: 19909:19910 ioctl c0306201 20008000 returned -22
[  138.447859] binder: 19891:19898 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@vsock={0x0, 0x0, 0x0, @any}, &(0x7f0000000040)=0x10, 0x80800)
connect$unix(r1, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x82c92eb0f4c33de3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  138.454788] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.467272] binder: 19909:19917 unknown command 4219648
[  138.469794] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.479597] binder: 19909:19917 ioctl c0306201 20008000 returned -22
[  138.483953] binder: 19901:19912 transaction failed 29201/-28, size 40-0 line 2963
[  138.485733] binder: undelivered TRANSACTION_ERROR: 29201
[  138.491883] binder: 19911:19918 ioctl c0306201 20008000 returned -22
2018/02/28 09:17:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)

2018/02/28 09:17:44 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 5:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000100)={<r1=>0x0, 0xc0, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x400, @loopback={0x0, 0x1}, 0x9}, @in6={0xa, 0x4e23, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0x8001}, @in6={0xa, 0x4e20, 0x7, @empty, 0x9}, @in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @rand_addr}, @in6={0xa, 0x4e20, 0xff, @dev={0xfe, 0x80, [], 0x1a}, 0x5}, @in={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e20, @empty}, @in={0x2, 0x4e21, @rand_addr=0x401}]}, &(0x7f0000000140)=0xc)
setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000180)=r1, 0x4)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  138.507093] binder: undelivered TRANSACTION_ERROR: 29201
[  138.522168] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.524665] binder: undelivered TRANSACTION_ERROR: 29201
[  138.529881] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.544214] binder: 19930:19932 transaction failed 29201/-28, size 40-0 line 2963
[  138.554750] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  138.562429] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.571327] binder: 19929:19931 transaction failed 29201/-28, size 40-0 line 2963
[  138.571970] binder: undelivered TRANSACTION_ERROR: 29201
[  138.591972] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.599662] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/relabel\x00', 0x2, 0x0)
fstat(r0, &(0x7f0000000100))

2018/02/28 09:17:44 executing program 0:
r0 = socket$bt_hci(0x1f, 0x3, 0x1)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a6277000000002fa1e2b6e554d295f5ded40e7c6c04a176217c5ee26ce3c6d47a251b5da47e4752ced88dd41bd29d", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="e51c2f0786c244cf81ffffffffffffff022d3bb17133f373fe8a942cbe92520800f34d7fc52c812c010056dfa9080000000000000036e7c40c7e0062b93eddf70b8cdcd0279bc2bcbbd51eebb85c57bb1a1c3db4cf7957c6988ec458e5b200deefc640c62c8eec35acf088dadb220172acacb5ae6f038c74dd2ef3234d41818fe69a490847116636dfd18f7065df17a0b34122ec3c7ffd2938e17b7bfadeb63b317c7c7f7ae16ff8d29d596efc7a3427cbfa6d70b14da5b5badc3a698ee375d4b104a048ffe4db982615cf5291fa7ecee9739ed83ba7a8c620be5549"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0)

[  138.608550] binder: 19935:19941 transaction failed 29201/-28, size 40-0 line 2963
[  138.619065] binder: 19942:19944 unknown command 539410432
[  138.622481] binder: undelivered TRANSACTION_ERROR: 29201
[  138.631175] binder: 19942:19944 ioctl c0306201 20008000 returned -22
[  138.635262] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.645393] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.654370] binder: 19948:19951 transaction failed 29201/-28, size 40-0 line 2963
[  138.654507] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.667222] binder: undelivered TRANSACTION_ERROR: 29201
[  138.669694] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.676788] binder: undelivered TRANSACTION_ERROR: 29201
[  138.683991] binder: 19935:19952 transaction failed 29201/-28, size 40-0 line 2963
[  138.697359] binder: 19948:19955 ioctl b101 0 returned -22
[  138.703499] kernel msg: ebtables bug: please report to author: Wrong len argument
[  138.708106] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  138.718829] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.727707] binder: 19945:19949 transaction failed 29201/-28, size 40-8 line 2963
[  138.727780] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.737453] binder: undelivered TRANSACTION_ERROR: 29201
[  138.743038] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.743059] binder: 19948:19951 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:44 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e24, 0x40, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x70)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x800, 0x0)
dup2(r0, r0)
readv(r0, &(0x7f0000000000)=[], 0x0)
setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000040)={{0xa, 0x4e23, 0x100000001, @remote={0xfe, 0x80, [], 0xbb}, 0x2}, {0xa, 0x4e22, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0xfffffffffffff91c}, 0xf82, [0x6, 0x9, 0x3, 0x10001, 0x5, 0x5, 0x2df, 0x6]}, 0x5c)

2018/02/28 09:17:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000010c0)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01fffffe000000000000000084132b9a5374080f0000000065f0163f4e736d78f22d934ccd0c63"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x80800, 0x0)
ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000040)=""/4096)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x8, 0x10, r0, 0x46)
getpeername$packet(r1, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000001080)=0x14)

2018/02/28 09:17:44 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB, @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:44 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80000, 0x0)
pread64(r0, &(0x7f0000000040)=""/21, 0x15, 0x0)
r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x2, 0xc0000)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a45320, &(0x7f00000000c0)={{0x0, 0x6}, 'port1\x00', 0x2c, 0x800, 0x8, 0xfff, 0x18, 0x8, 0x1, 0x0, 0x2, 0x7})

2018/02/28 09:17:44 executing program 2:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x318, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:44 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0xfffffdc3, 0x0, &(0x7f0000009000)})

[  138.764994] binder: undelivered TRANSACTION_ERROR: 29201
[  138.770517] binder: undelivered TRANSACTION_ERROR: 29201
[  138.776000] binder: undelivered TRANSACTION_ERROR: 29201
[  138.781697] binder: undelivered TRANSACTION_ERROR: 29201
[  138.798687] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.806414] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7ff, 0x1)
ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffff9c, 0xc010640b, &(0x7f0000000040)={0x0, <r2=>0x0, 0x80000001})
r3 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x60, 0x800)
ioctl$KDSETMODE(r3, 0x4b3a, 0x9)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000000c0)={r2, 0x80000, r3})

[  138.807993] binder: 19962:19968 unknown command 539410432
[  138.815303] binder: 19959:19963 transaction failed 29201/-28, size 40-0 line 2963
[  138.827311] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.836148] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.845036] binder: 19974:19975 transaction failed 29201/-28, size 40-0 line 2963
[  138.845045] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  138.857649] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x804, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:44 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  138.860361] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.860392] binder: 19966:19971 transaction failed 29201/-28, size 40-8 line 2963
[  138.882592] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.890314] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.899178] binder: 19974:19975 transaction failed 29201/-28, size 40-0 line 2963
[  138.899188] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:44 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
lseek(r0, 0x0, 0x1)

2018/02/28 09:17:44 executing program 3:
r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x400040)
getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000080)={<r1=>0x0, 0x40000000000000}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000100)=@sack_info={r1, 0x6, 0x3ff}, &(0x7f0000000140)=0xc)
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r2, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  138.914608] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.923493] binder: 19960:19977 transaction failed 29201/-28, size 40-0 line 2963
[  138.923812] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  138.936198] binder: 19962:19968 ioctl c0306201 20008000 returned -22
[  138.938794] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.938824] binder: 19966:19985 transaction failed 29201/-28, size 40-8 line 2963
2018/02/28 09:17:44 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB, @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  138.948836] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.969493] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  138.978352] binder: 19960:19977 transaction failed 29201/-28, size 40-0 line 2963
[  138.978787] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  138.993677] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.002570] binder: 19980:19987 transaction failed 29201/-28, size 40-0 line 2963
[  139.002599] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.018037] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.022036] binder: undelivered TRANSACTION_ERROR: 29201
[  139.026912] binder: 19984:19988 transaction failed 29201/-28, size 40-0 line 2963
[  139.044340] binder: 19994:19995 unknown command 539410432
[  139.047139] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.050369] binder: 19994:19995 ioctl c0306201 20008000 returned -22
[  139.057539] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.057565] binder: 19984:19990 transaction failed 29201/-28, size 40-0 line 2963
[  139.080607] binder: undelivered TRANSACTION_ERROR: 29201
[  139.086517] binder: undelivered TRANSACTION_ERROR: 29201
[  139.092220] binder: undelivered TRANSACTION_ERROR: 29201
[  139.098182] binder: undelivered TRANSACTION_ERROR: 29201
[  139.103709] binder: undelivered TRANSACTION_ERROR: 29201
[  139.104962] kernel msg: ebtables bug: please report to author: Wrong len argument
[  139.109513] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:44 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b1, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 2:
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x400, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='*'], @ANYBLOB="010000009084c4000003008f1560419000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001440)=[{&(0x7f00000000c0)=""/19, 0x133}, {&(0x7f0000000100)=""/39}, {&(0x7f0000000140)=""/4096}, {&(0x7f0000001140)=""/36}, {&(0x7f0000001180)=""/174}, {&(0x7f0000001240)=""/192}, {&(0x7f0000001300), 0xfffffffffffffc83}, {&(0x7f0000001340)=""/74}], 0x1)

2018/02/28 09:17:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0180000000000000000ba111b31b1ca9f600523100000000c87e8dc4dac057af7fc12d1e9b4fb72eee8f49c5f6d7e67aaa36ef7564d0e18c988d4560fd61f225a04bec0b068dd1e79f8f"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = creat(&(0x7f0000000080)='./file0\x00', 0x90)
ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x5, &(0x7f00000000c0)=[{0x100000001, 0x42a8}, {0x4, 0x100000001}, {0x13a, 0xc865}, {0x2, 0x1}, {0x3, 0x5}]})

2018/02/28 09:17:44 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:44 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x71, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09b5507e7ecf32", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:44 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x0, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:44 executing program 5:
socket$inet6_dccp(0xa, 0x6, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x74, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x2, 0x4}, @request_death={0x400c630e, 0x2, 0x2}, @release={0x40046306, 0x3}, @transaction_sg={0x40486311, {{0xfff, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f0000000000)=[], &(0x7f0000000040)=[0x38, 0x0, 0x30]}, 0x10001}}], 0xd1, 0x0, &(0x7f0000000100)="dea3ee02fc7a479928646659421b659dde5be5fa709c9ca80fe8471fe86db2575abcb232e8033b860c7511a07ab6509c0b7e998842ae4a4f38b52b0f648ce0a852b23b7008d8514f7c9fa28a8e21cd942d59995b0605fa34a03f1317ede7a842d719b958791476f976092082dae593264d62a4cef419e945403b3c79c4f45a20488cf39c8aace5be5a91d0d484b3d6dee9aff34fe0bd932cea0b17a1989fe122f5819dfd0205f8be7f3260632372756f272099b0d64e5545223ce23e5e654555b1e93451212d0ade406888be221992e8b6"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  139.187102] binder: 20003:20006 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2
[  139.193347] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  139.203031] binder: 20003:20006 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2
[  139.203486] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.210615] binder: 20003:20006 Release 1 refcount change on invalid ref 3 ret -22
[  139.219440] binder: 20002:20010 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f00000002c0))
socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f0000000180)={0x6, 0xff, [{0x1, 0x0, 0x591b2c00}, {0x10000, 0x0, 0x4}, {0x0, 0x0, 0xfffffffffffffffc}, {0x6, 0x0, 0x1004000000}, {0x5000000000000, 0x0, 0x93}, {0x0, 0x0, 0x1}]})
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000000080)={0x9, 0x0, [{0x80000001, 0x2, 0x7c71, 0x8000000000006, 0x4}, {0x5, 0x5, 0x9, 0x7486c4da, 0x6}, {0x8000000f, 0x4, 0x4060, 0x2, 0xffffffff80000011}, {0x0, 0x1, 0x1f, 0x4b34, 0x5}, {0x1, 0x7fff, 0x5, 0x1, 0x100000006}, {0xc000000f, 0x2, 0x400, 0xc18, 0x2}, {0x40000007, 0x6, 0x18140, 0x8, 0x95a}, {0x80000000, 0x3, 0x0, 0x1, 0x8}, {0x80000007, 0xeaca, 0x5, 0x4000001, 0x4}]})

2018/02/28 09:17:44 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7, 0x40000)

[  139.227120] binder: 20003:20006 got transaction to invalid handle
[  139.237057] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  139.243165] binder: 20003:20006 transaction failed 29201/-22, size 0-24 line 2848
[  139.251572] binder: 20003:20015 transaction failed 29189/-22, size 40-0 line 2848
[  139.258522] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.258548] binder: 20001:20005 transaction failed 29201/-28, size 40-8 line 2963
[  139.284135] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.289668] binder: undelivered TRANSACTION_ERROR: 29201
[  139.291829] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.291862] binder: 20007:20012 transaction failed 29201/-28, size 40-0 line 2963
[  139.297359] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.321563] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:45 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x400000000800)
r1 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000000c0)="ade15ae92006158b6728f8bb76b48b5c0014cc95aa8e03eb1771e6b18e8fef30ce9240752956d88c0165819b7766c5cf50643c32d9f00f9a608d0378f00c977e527b", 0x42, 0x0)
keyctl$invalidate(0x15, r1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 0:
syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x802)

2018/02/28 09:17:45 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x11, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:45 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  139.330448] binder: 20004:20011 transaction failed 29201/-28, size 40-0 line 2963
[  139.332868] binder: 20009:20014 transaction failed 29189/-22, size 40-0 line 2848
[  139.343512] binder: undelivered TRANSACTION_ERROR: 29201
[  139.356132] binder: 20009:20033 transaction failed 29189/-22, size 40-0 line 2848
[  139.356732] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.371470] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.378316] binder: 20035:20036 unknown command 650117120
[  139.380355] binder: 20007:20012 transaction failed 29201/-28, size 40-0 line 2963
[  139.386313] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.401239] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.410106] binder: 20030:20034 transaction failed 29201/-28, size 40-0 line 2963
[  139.410117] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.419086] binder: 20035:20036 ioctl c0306201 20008000 returned -22
2018/02/28 09:17:45 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000000600)=[{&(0x7f0000000180)=""/42, 0x2a}, {&(0x7f00000001c0)=""/137, 0x89}, {&(0x7f0000000280)=""/236, 0x4a9}, {&(0x7f0000000640)=""/222, 0xde}, {&(0x7f0000000480)=""/187, 0xbb}, {&(0x7f0000000540)=""/81, 0x51}, {&(0x7f00000005c0)=""/19, 0x13}], 0x7)
sendto$inet(r0, &(0x7f0000000080)="df2914c6339fa0935cb7b9219996ac46708c9fdce2515f553e7bce71201e9d25d73580190360f09db16580ab88b55c85181f9036aa5d12cba22700bd8e3f2dcfddae408f63eeb822726ce84162753a5257e364b4d407e2da9d60173b7d1d32abefb221b8c8426dc626df0290384d1a40ec6c1985a95b1dead98d5e31a407826433ffd00106fd386f9eefbc15c2ff50be5a02f1a76cbd10849dca8ad7984f63b337b49df6c7de431a73229ab11890db95f0ba997b1e88748dc52b08ce7e284f1f089de1090f973c", 0xc7, 0x80, &(0x7f0000000000)={0x2, 0x4e21, @broadcast=0xffffffff}, 0x10)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000380)={<r1=>0x0, 0xb6, "6d8fc5547c2361aa959228526c434d88a3744f15577d6dd791904185d5bcec47480cde4a561cb549c22c767047be67fbfffa477a0e450176e0f35d7f0a4748eb36c3bd8be47b3058f3e6335fb75a41877aa6b6377ed9e7ad8326448f75a4c41a6d353222eb5a5eafd0180cfd69406b6319ee5ebb63c61087ceb66e200301d18abfc63e43368e50ba6b0f67d652bc44c27f799792e1f78f4d8f3d0e5ee319262294f11c1b5929cb713058cec9da34b995531a1b5df151"}, &(0x7f0000000440)=0xbe)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000740)={r1, @in={{0x2, 0x4e23, @loopback=0x7f000001}}, [0x0, 0x6, 0x9, 0x9, 0x4a14, 0x9, 0xe2b9, 0xfc000000000000, 0x1, 0x2, 0xff, 0x8, 0x6, 0x6, 0x7fffffff]}, &(0x7f0000000880)=0x108)

2018/02/28 09:17:45 executing program 0:
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB="06000000000000"]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="6d71cb83a6175f00"], @ANYBLOB="010000000000000000008a58d7acdd350cddf368b81048c095832e83c3464d5d4087000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='~'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, <r1=>0xffffffffffffff9c})
ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f0000000040)={0x0, 0x80000001})

2018/02/28 09:17:45 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = dup2(r0, r0)
getsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x4)
openat(r1, &(0x7f0000000000)='./file0\x00', 0x4000, 0x100)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x0, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:45 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x38)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  139.425398] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.425421] binder: 20037:20039 transaction failed 29201/-28, size 40-0 line 2963
[  139.428937] binder: undelivered TRANSACTION_ERROR: 29189
[  139.453955] binder: undelivered TRANSACTION_ERROR: 29189
[  139.459480] binder: undelivered TRANSACTION_ERROR: 29201
[  139.465453] binder: undelivered TRANSACTION_ERROR: 29201
[  139.470986] binder: undelivered TRANSACTION_ERROR: 29201
[  139.476538] binder: undelivered TRANSACTION_ERROR: 29201
[  139.499403] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  139.507088] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.515993] binder: 20045:20050 transaction failed 29201/-28, size 40-8 line 2963
[  139.516145] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.531323] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.540235] binder: 20044:20048 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:45 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  139.542502] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  139.555624] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.564498] binder: 20045:20062 transaction failed 29201/-28, size 40-8 line 2963
[  139.564567] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.579856] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.587165] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:45 executing program 0:
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x4000, 0x0)
ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000000040)={0x100000, 0x4002, 0x5, 0x99fb})
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', <r2=>0x0})
getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000100), &(0x7f0000000180)=0xffffffffffffffa6)
connect$packet(r0, &(0x7f00000000c0)={0x11, 0x0, r2, 0x1, 0xffffffffffffbd89, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14)
ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0)

2018/02/28 09:17:45 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x91a25f88cc796e53, 0x0)
ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  139.588740] binder: 20047:20054 transaction failed 29201/-28, size 40-0 line 2963
[  139.588896] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.594244] binder: undelivered TRANSACTION_ERROR: 29201
[  139.601859] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.601891] binder: 20049:20053 transaction failed 29201/-28, size 40-0 line 2963
[  139.630861] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  139.639109] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:45 executing program 3:
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000140)={0x3})
openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0)
r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xffffffff00000000, 0x2)
ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r1, 0x40a45321, &(0x7f0000000180)={{0x0, 0xffffffff00000000}, 'port0\x00', 0x4, 0x802, 0x4, 0x1, 0x9, 0x1, 0x81, 0x0, 0x1, 0x2})
socket$packet(0x11, 0x2, 0x300)
ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000080))
socket$netlink(0x10, 0x3, 0x17)
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000100)=@routing={0x0, 0x6, 0x3, 0x6, 0x0, [@ipv4={[], [0xff, 0xff], @rand_addr=0x4}, @remote={0xfe, 0x80, [], 0xbb}, @remote={0xfe, 0x80, [], 0xbb}]}, 0x38)
readv(r2, &(0x7f0000000240)=[{&(0x7f00000013c0)=""/31, 0xfe48}], 0x207f)

[  139.647974] binder: 20072:20074 transaction failed 29201/-28, size 40-8 line 2963
[  139.648831] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  139.664752] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.673645] binder: 20046:20051 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  139.675590] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.691576] binder: 20073:20075 transaction failed 29189/-22, size 40-0 line 2848
2018/02/28 09:17:45 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:45 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x0, 0x1, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:45 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
finit_module(r0, &(0x7f0000000000)='/dev/binder#\x00', 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  139.692195] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.708583] binder: 20052:20059 transaction failed 29201/-28, size 40-0 line 2963
[  139.716669] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.724329] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.733225] binder: 20047:20060 transaction failed 29201/-28, size 40-0 line 2963
[  139.733311] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.741133] binder: undelivered TRANSACTION_ERROR: 29189
[  139.748978] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.763057] binder: 20049:20076 transaction failed 29201/-28, size 40-0 line 2963
[  139.763063] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  139.763072] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.788654] binder: 20084:20089 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  139.788664] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  139.802739] binder: undelivered TRANSACTION_ERROR: 29201
[  139.807114] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.815982] binder: undelivered TRANSACTION_ERROR: 29201
[  139.821429] binder: 20072:20078 transaction failed 29201/-28, size 40-8 line 2963
[  139.826898] binder: undelivered TRANSACTION_ERROR: 29201
[  139.837218] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:45 executing program 4:
geteuid()
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:45 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a07476d08888ecfcca9a484938020c559092c7130273034767cc000000000000002000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  139.847769] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.856654] binder: 20087:20088 transaction failed 29201/-28, size 40-0 line 2963
[  139.856687] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.871956] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.878529] binder: undelivered TRANSACTION_ERROR: 29201
[  139.880838] binder: 20087:20091 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:45 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x38)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  139.881658] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.898735] binder: undelivered TRANSACTION_ERROR: 29201
[  139.901597] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.901633] binder: 20093:20094 transaction failed 29201/-28, size 40-0 line 2963
[  139.906223] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.931299] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.934076] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:45 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="007bee362e76ad0177b286e8c0e9930e95cf8daa7ec67260c66f2cb9de059fb6d333bcff0984e3eff874180a7270990d9ccba57a9dde3d66438c777bce5dbccc8fe461e8ac37b86930ad0fd8605e91ce9a63b0b700fee078047c05756b5430a6b7e108e044535f66b9cce3aed5ab088f5785ed42e468cdcbc8a7d8ff62379143f72d6cca5aac19c9ca334ff363e20d1cc8d40de417e32e6bdeaa1d05095af44c622de265cdabc939378cc3bf1642f536c24c4609566aa879314cbbef5deeb0c4f9aa17fdcbf642"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000000000)=[], 0xffffffffffffffd8, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="00f2d49392bf6497ec6dae0da84f04d71dbf0629c8fc30bd716987f992b62b104cc663ef6f395898181480d3979fd292dd4f31b259de3319aa12571e2a3ebc278f7369614af03e2d7cffca4e93b41997367b9157cb891548d5bc805e3526ad6a775057fd331c026fee5fff3f5e8215d3cc8f94d9228f678f1fe6020d24d4e80dbe7811e06dfa48a5630aaf0d602818089829d1afedd3df9ae001d0bc8f71c91001d4012b36c826e6d3c486a896a56892a414b799516d4c4940cdcd7eb47864645d409e6944da6c9e75d4a81c6c7861dd31f1c30e8d114b"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

[  139.940173] binder: 20093:20102 transaction failed 29201/-28, size 40-0 line 2963
[  139.970692] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  139.979886] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  139.988785] binder: 20095:20097 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  139.996355] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  139.999646] binder: undelivered TRANSACTION_ERROR: 29201
[  140.007242] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.007277] binder: 20099:20104 transaction failed 29201/-28, size 40-0 line 2963
[  140.007464] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.012779] binder: undelivered TRANSACTION_ERROR: 29201
[  140.012850] binder: undelivered TRANSACTION_ERROR: 29201
[  140.021637] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.021667] binder: 20103:20105 transaction failed 29201/-28, size 40-0 line 2963
[  140.029306] binder: undelivered TRANSACTION_ERROR: 29201
[  140.037575] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.042588] binder: undelivered TRANSACTION_ERROR: 29201
[  140.047840] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.047865] binder: 20109:20110 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:45 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x803, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000080)=0xc)

2018/02/28 09:17:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0)
ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000040))

2018/02/28 09:17:45 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4f3eb17947920665)
accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x800)

2018/02/28 09:17:45 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:45 executing program 5:
clock_nanosleep(0x2, 0x1, &(0x7f0000b85000)={0x0, 0x1c9c380}, &(0x7f0000443000))
r0 = gettid()
timer_create(0x0, &(0x7f0000c00000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000))
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
tkill(r0, 0x1000000000016)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@decrefs={0x40046307, 0x1}], 0x2d0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:45 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x88f7, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:45 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x38)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  140.056894] binder: undelivered TRANSACTION_ERROR: 29201
[  140.104858] binder: undelivered TRANSACTION_ERROR: 29201
[  140.110360] binder: undelivered TRANSACTION_ERROR: 29201
[  140.117428] binder: undelivered TRANSACTION_ERROR: 29201
[  140.130695] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.138363] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:45 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x65, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:45 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
flistxattr(r0, &(0x7f0000000000)=""/35, 0x5)
readv(r0, &(0x7f0000000240)=[], 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000280)={{0x7, 0x80000000}, {0x8001, 0x3ff}, 0x7, 0x6, 0x9})
ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r0, 0x4010ae74, &(0x7f0000000080)={0xffffffffffffffc0, 0x6})
dup(r0)

[  140.147277] binder: 20121:20124 transaction failed 29201/-28, size 40-0 line 2963
[  140.147480] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.162593] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.169481] connsecmark_tg_check: 17 callbacks suppressed
[  140.169484] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  140.171486] binder: 20125:20129 transaction failed 29201/-28, size 40-0 line 2963
[  140.171570] binder: 20119:20123 transaction failed 29189/-22, size 40-0 line 2848
[  140.182833] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  140.194175] binder: undelivered TRANSACTION_ERROR: 29201
[  140.200353] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.200380] binder: 20120:20131 transaction failed 29201/-28, size 40-8 line 2963
[  140.204295] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.237805] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.244763] binder: undelivered TRANSACTION_ERROR: 29189
[  140.246684] binder: 20121:20124 transaction failed 29201/-28, size 40-0 line 2963
[  140.250843] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  140.261164] binder: undelivered TRANSACTION_ERROR: 29201
[  140.267563] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.267598] binder: 20120:20138 transaction failed 29201/-28, size 40-8 line 2963
[  140.273089] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  140.298839] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.307720] binder: 20139:20142 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  140.318084] binder: undelivered TRANSACTION_ERROR: 29201
[  140.323632] binder: undelivered TRANSACTION_ERROR: 29201
[  140.329248] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:46 executing program 5:
r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7fffffff, 0x0)
ioctl$TUNSETOFFLOAD(r0, 0x400454d0, &(0x7f0000000040)=0xfffffffffffffffd)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x0, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:46 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[], 0x0)

2018/02/28 09:17:46 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
epoll_create(0xfffffffffffff801)

2018/02/28 09:17:46 executing program 2:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000, 0x0)
ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a62770000f600", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040d3d2c838bbfc000000009e00e162253a0000000000001671a900000000000008000000000000280000000000000900", @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYBLOB="852a62770000000059b50ff9d232b684a160e4475e83a4c0ccf26d6266e406a5dc13c83e98c7c8a0f39e4f65cef4cf634706823f5a5d28517ffbc5604d6cd0b728c90f3ef503cbe45dfc4584e25da389911923ca2619b910169f6fd30e8d0e71be7962bfddbc282b0c8bce357e10a1a82cbf64a89f7edc5027d47dc351644c68cc131ff2776c854d068a94c2b4a9e9e67c2e78c5bf6761b3beebf7b2e9c150df784d7ac612e690f217", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="005db464890450d4a271be3f1605af6d52e7a7a6d8c2310d596aa0dfa00e054b28a2486794093bf2fcda7f546b3d568141e103789933212eb72171b8b13074b25b4ba2c5a506a63d03eff9fabb5cd6d6ad9887c2c95020012376e1fe815e0ae5bbbb627bf922430981d9b5e45502bb964d75797615dcc80fbd16bb2c97c7ad"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
fcntl$setlease(r0, 0x400, 0x3)
r1 = syz_open_dev$amidi(&(0x7f0000000240)='/dev/amidi#\x00', 0x0, 0x200000)
ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000280)={0x9})
ioctl(r0, 0x4, &(0x7f0000000180)="1b62005d9d826a25e9e2efd9f87bca09bce9d12c7ee8a56cdfedb529d3880fd33fb81c1ea71bc442197194659355e23e84757c5c64377368b907d013dbee246c8c4e498943b7f8")

2018/02/28 09:17:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x65, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:46 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  140.408831] binder: 20151:20156 got transaction to invalid handle
[  140.410373] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.415152] binder: 20151:20156 transaction failed 29201/-22, size 11258999068426240--9223362141250125824 line 2848
[  140.422761] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.422784] binder: 20149:20160 transaction failed 29201/-28, size 40-0 line 2963
[  140.449114] binder: 20151:20156 ioctl 4 20000180 returned -22
2018/02/28 09:17:46 executing program 5:
r0 = mq_open(&(0x7f0000000000)='/dev/binder#\x00', 0x80, 0x1, &(0x7f0000000040)={0x9, 0xffffffff, 0x2, 0x40, 0x4a3, 0xfffffffffffffffa, 0x4, 0xffff})
r1 = fcntl$dupfd(r0, 0x406, r0)
ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000080)={'dummy0\x00', @ifru_addrs={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x12}}})
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x13, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="1073abc740b2070000ad"], 0x100000087, 0x0, &(0x7f0000000080)})

[  140.452344] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.463425] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.468612] binder: 20151:20156 got transaction to invalid handle
[  140.472351] binder: 20154:20158 transaction failed 29201/-28, size 40-0 line 2963
[  140.474292] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.478609] binder: 20151:20156 transaction failed 29201/-22, size 11258999068426240--9223362141250125824 line 2848
2018/02/28 09:17:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x65, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  140.486229] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.486255] binder: 20150:20161 transaction failed 29201/-28, size 40-0 line 2963
[  140.494224] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  140.506613] binder: 20163:20165 unknown command -945065200
[  140.513325] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.513348] binder: 20153:20159 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
2018/02/28 09:17:46 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="8a46277dcdff0ae7906a3ff0c3f693a20dcd0ac98be70c2b338c36ec2c4927afad58e85ccf6edda754ee49018e6e83ea85cfe1ad42060bb2949a42b391200a2a1566917ab202c5b5ba679a546066ed45ef596ffffff6f2698550db5b586a9270680b9b8096d61e6471df1c468da080595e3932c867f496b0a81b"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x0, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc\x00', 0x20000, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x2000, 0x82)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  140.521819] binder: 20163:20165 ioctl c0306201 20008000 returned -22
[  140.546191] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  140.560618] binder: undelivered TRANSACTION_ERROR: 29201
[  140.560968] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.574220] binder: undelivered TRANSACTION_ERROR: 29201
[  140.575616] binder: 20173:20174 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  140.584676] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.607251] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.616134] binder: 20149:20167 transaction failed 29201/-28, size 40-0 line 2963
[  140.619858] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.627566] binder: 20163:20186 unknown command -945065200
[  140.631475] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.637488] binder: undelivered TRANSACTION_ERROR: 29201
[  140.645965] binder: 20180:20182 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:46 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/152, 0x98}, {&(0x7f00000000c0)=""/127, 0x7f}], 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$int_out(r0, 0x5462, &(0x7f0000000000))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x301001, 0x0)
ioctl$KVM_S390_VCPU_FAULT(r1, 0x4004ae52, &(0x7f0000000080)=0x100000000)

2018/02/28 09:17:46 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000f0ffffffffffffff00000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  140.651404] binder: 20163:20186 ioctl c0306201 20008000 returned -22
[  140.666185] binder: undelivered TRANSACTION_ERROR: 29201
[  140.670170] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.679305] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.686691] binder: undelivered TRANSACTION_ERROR: 29201
[  140.688177] binder: 20179:20184 transaction failed 29201/-28, size 40-0 line 2963
[  140.693949] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  140.709080] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.717955] binder: 20187:20188 transaction failed 29201/-28, size 40-8 line 2963
[  140.728343] binder: undelivered TRANSACTION_ERROR: 29201
[  140.734897] binder: undelivered TRANSACTION_ERROR: 29201
[  140.742068] binder: undelivered TRANSACTION_ERROR: 29201
[  140.749869] binder: 20191:20193 ioctl 5462 20000000 returned -22
[  140.749908] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  140.763776] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.769283] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  140.772649] binder: 20187:20190 transaction failed 29201/-28, size 40-8 line 2963
[  140.774323] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.795925] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.804778] binder: 20192:20196 transaction failed 29201/-28, size 40-0 line 2963
[  140.804786] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.820120] binder: 20191:20197 ioctl 5462 20000000 returned -22
[  140.826342] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.826581] binder: undelivered TRANSACTION_ERROR: 29201
[  140.835205] binder: 20191:20193 transaction failed 29201/-28, size 40-0 line 2963
[  140.848373] binder: undelivered TRANSACTION_ERROR: 29201
[  140.853865] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:46 executing program 2:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x400200, 0x0)
unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x202)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r2 = fcntl$dupfd(r1, 0x0, r1)
setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000000), 0x4)

2018/02/28 09:17:46 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x0, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x6b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:46 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}]})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x6940, 0x0)

2018/02/28 09:17:46 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x100, 0x0)

2018/02/28 09:17:46 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:46 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xfffffffffffffd27, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$bt_sco(0x1f, 0x5, 0x2)

2018/02/28 09:17:46 executing program 3:
r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x44)
accept4$packet(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x14, 0x80000)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f0000000000)={0x45, 0xff, 0x6})
readv(r1, &(0x7f0000000080)=[], 0x1)

[  140.861781] binder: undelivered TRANSACTION_ERROR: 29201
[  140.910321] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.918051] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.919595] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  140.926954] binder: 20203:20209 transaction failed 29201/-28, size 40-0 line 2963
[  140.935103] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  140.950161] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:46 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x5c, 0x0, &(0x7f00000000c0)=[@exit_looper={0x630d}, @enter_looper={0x630c}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000000)=[], &(0x7f0000000080)=[0x20, 0x28, 0x38, 0x30, 0x40]}, 0x400000}}, @release={0x40046306, 0x1}], 0x1, 0x0, &(0x7f0000000140)='D'})
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  140.959059] binder: 20204:20214 transaction failed 29201/-28, size 40-0 line 2963
[  140.959624] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  140.976041] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  140.984934] binder: 20202:20213 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  140.986403] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:46 executing program 4:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x802, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f0000000040)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x80, 0x0, &(0x7f0000000100)=[@increfs_done={0x40106308, r1, 0x1}, @reply_sg={0x40486312, {{0x1, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000080)=[], &(0x7f00000000c0)=[0x30]}, 0x3}}, @clear_death={0x400c630f, 0x2}, @increfs={0x40046304, 0x3}, @increfs={0x40046304, 0x3}], 0x14, 0x0, &(0x7f0000000180)="c4141ca81df14ee2b8ff12d5a65618d659afe3a4"})
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852aff0300000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  141.002373] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.011233] binder: 20204:20214 transaction failed 29201/-28, size 40-0 line 2963
[  141.011242] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  141.026510] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.035399] binder: 20206:20211 transaction failed 29201/-28, size 40-8 line 2963
[  141.035574] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  141.050707] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:46 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000000c0)=0x8, 0x4)
fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, <r1=>0x0})
r2 = getpgrp(r1)
fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, <r3=>0x0})
ioctl$LOOP_SET_FD(r0, 0x4c00, r0)
kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r0, &(0x7f0000000080)={r0, r0, 0x9})

2018/02/28 09:17:46 executing program 5:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80, 0x0)
ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="8505000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  141.059564] binder: 20206:20222 transaction failed 29201/-28, size 40-8 line 2963
[  141.059573] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.074931] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.083229] binder: undelivered TRANSACTION_ERROR: 29201
[  141.083813] binder: 20203:20209 transaction failed 29201/-28, size 40-0 line 2963
[  141.089625] binder: undelivered TRANSACTION_ERROR: 29201
[  141.097254] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x6b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083595784134e09", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  141.110171] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.115595] binder: 20231:20233 transaction failed 29189/-22, size 40-0 line 2848
[  141.119135] binder: 20201:20208 transaction failed 29201/-28, size 40-0 line 2963
[  141.123266] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.142098] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.150993] binder: 20227:20235 transaction failed 29201/-28, size 40-0 line 2963
[  141.153188] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  141.161852] binder: undelivered TRANSACTION_ERROR: 29189
[  141.167826] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.176336] binder: undelivered TRANSACTION_ERROR: 29201
[  141.182122] binder: 20236:20237 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  141.189224] binder: undelivered TRANSACTION_ERROR: 29201
[  141.202963] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:46 executing program 3:
readv(0xffffffffffffffff, &(0x7f0000001400)=[{&(0x7f0000000080)=""/31, 0xfffffffffffffe5d}], 0x1)
syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3ff, 0x840)

2018/02/28 09:17:46 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[]})
r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0xffffffffffff8f9b, @mcast2={0xff, 0x2, [], 0x1}, 0x30000000000000}], 0x1c)

2018/02/28 09:17:46 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0xfffffffffffffdc5})

2018/02/28 09:17:46 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0xff, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:46 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xcd5, 0x80000)
ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000040)={0x8000000000000000, 0x1000, 0x9, 0xa})
setsockopt$inet_int(r1, 0x0, 0x1f, &(0x7f0000000080)=0x1000, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x29f, 0x0, &(0x7f0000004fbc)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x65, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e5209176e152d84083", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:46 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x80000, 0x0)
r2 = request_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000100)='/dev/sequencer2\x00', 0xffffffffffffffff)
keyctl$read(0xb, r2, &(0x7f0000000140)=""/86, 0x56)
fcntl$dupfd(r0, 0x0, r1)
sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000040))

[  141.210643] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.219638] binder: 20227:20240 transaction failed 29201/-28, size 40-0 line 2963
[  141.227839] binder: undelivered TRANSACTION_ERROR: 29201
[  141.233338] binder: undelivered TRANSACTION_ERROR: 29201
[  141.239619] binder: undelivered TRANSACTION_ERROR: 29201
[  141.245165] binder: undelivered TRANSACTION_ERROR: 29201
[  141.250652] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:46 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000000)=0x6, 0x4)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r1, &(0x7f0000001400)=[], 0x6)

2018/02/28 09:17:47 executing program 5:
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x80681, 0x0)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000001300)={<r1=>0x0, @remote, @dev}, &(0x7f0000001340)=0xc)
r2 = getuid()
setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001380)={{{@in=@dev={0xac, 0x14, 0x14, 0x19}, @in=@multicast1=0xe0000001, 0x4e24, 0x2, 0x4e21, 0x1, 0x0, 0x20, 0xa0, 0x21, r1, r2}, {0x48f, 0x8f, 0x6, 0xffffffff, 0x7, 0xfd3, 0x2, 0xffffffffffffffff}, {0x8, 0xfffffffffffffffb, 0x7fff, 0x1f}, 0x6, 0x0, 0x0, 0x0, 0x1, 0x1}, {{@in6=@local={0xfe, 0x80, [], 0xaa}, 0x4d4, 0xff}, 0xa, @in=@loopback=0x7f000001, 0x3507, 0x6, 0x2, 0x7ff, 0x7, 0x909e, 0x100000001}}, 0xe8)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x3)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000057d9970cecbd1b8e000000000000000093d9bfb2fc777fb508d33f48e80166cd5a8435c3ca28f404c5ab5f9508e55502fa5c50dd2d5a3d0b144a01c8d609b2aefcd52a493974cd069a7e2508b8f15fa7654d923d45f9480eee8cd966f9fb14a91e93530c101a5c6e42bf0fd629752997a4ea27a65430ecfbe4b36f42762437e182d494c9c702fcafd4cb33fbfdea45fba1a178cb2bfff49b97568af43a34d7e4a2d164541c64588ee81f7a523d304a7e99a321ba59c493a559678f2cc7f49e081e60876cca6d3e74c3103b52292f467de4dba60125737b9060674bb42fb135b52093a0ce00", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x400, 0x0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000001c0)=<r1=>0x0)
capget(&(0x7f0000000140)={0x399f1736, r1}, &(0x7f0000000180)={0x72d, 0x1ff, 0x1, 0x8, 0xfff, 0x8})
readv(r0, &(0x7f0000000080)=[], 0x0)
getsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000000000)=0xffffffffffff0001, &(0x7f0000000200)=0x4)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000080)=""/182)

[  141.266106] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  141.273788] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.282983] binder: 20246:20250 transaction failed 29201/-28, size 40-8 line 2963
[  141.296657] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.304372] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:47 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x200)
pipe2(&(0x7f0000000080)={<r1=>0xffffffffffffffff}, 0x80000)
fstat(r0, &(0x7f0000000180))
r2 = getpgrp(0x0)
perf_event_open(&(0x7f0000000100)={0x7, 0x78, 0x1, 0x80, 0x81, 0x1, 0x0, 0x6, 0x0, 0x6, 0x1, 0x3f98, 0xffffffffffffffff, 0x4, 0x42, 0x6, 0x2, 0x80000000, 0x20, 0x100000000, 0x0, 0x0, 0xdd, 0xfd, 0x7, 0x9, 0x400, 0x6, 0x76, 0xffffffff00000000, 0x4, 0x81, 0x54885088, 0x2, 0x80, 0x4, 0x81, 0x8, 0x0, 0xd43e, 0x5, @perf_bp={&(0x7f00000000c0), 0xe}, 0x2, 0x2bf8, 0x86c, 0x6, 0x1, 0x80, 0x2}, r2, 0x4, r1, 0x2)

[  141.313274] binder: 20251:20259 transaction failed 29201/-28, size 40-0 line 2963
[  141.313379] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.328628] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.329413] binder: 20262:20267 transaction failed 29189/-22, size -8206757074431387305-0 line 2848
[  141.337511] binder: 20244:20247 transaction failed 29201/-28, size 40-0 line 2963
[  141.346830] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
2018/02/28 09:17:47 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x20000000000, 0x40000)
finit_module(r0, &(0x7f0000000000)='/dev/binder#\x00', 0x1)

2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000080)="c060eeb1fedc85ff0a2700e1504738cb848fd6e31dceb7e4da475ca15c7ef71f2e9d2b0d83b6f4f7f2d77325aad59a796b1d8057e7cc6baf512c6b43ef50d82696bf0718cdb732ca9042531adfb554b10d912957e84053f21e8f6950535f4c508898f6045957a7bbb7af8775b6b633daa907f0a9a4b3605eccde238df62c45849c55538a419a255828f488ed004cd007013c0be8fa04cef0851eb25c46a41030a3dca5c5c4ce8ead1813")
ioctl(r0, 0x6, &(0x7f0000000000)="af6e67d1ec2f0c28275082df151cff5cd4af36042e32c3d8d695373b")
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  141.363612] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.372503] binder: 20252:20260 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  141.380252] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  141.389924] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.391428] binder: undelivered TRANSACTION_ERROR: 29201
[  141.398810] binder: 20269:20271 transaction failed 29201/-28, size 40-8 line 2963
[  141.400110] binder: 20242:20248 unknown command 0
2018/02/28 09:17:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x5f, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e9c9eb0e52091", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:47 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x6}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffe)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  141.409478] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.420151] binder: 20242:20248 ioctl c0306201 20008000 returned -22
[  141.424448] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.424474] binder: 20251:20259 transaction failed 29201/-28, size 40-0 line 2963
[  141.446329] binder: undelivered TRANSACTION_ERROR: 29189
[  141.454544] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  141.463913] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.472818] binder: 20282:20283 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  141.473133] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  141.484641] binder: 20242:20284 unknown command 0
[  141.490212] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.490234] binder: 20269:20275 transaction failed 29201/-28, size 40-8 line 2963
[  141.498958] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.508915] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  141.511697] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.522970] binder: 20242:20284 ioctl c0306201 20008000 returned -22
[  141.527137] binder: 20286:20290 transaction failed 29201/-28, size 40-0 line 2963
[  141.535469] binder: undelivered TRANSACTION_ERROR: 29201
[  141.555872] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc\x00', 0x100ffe, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x59, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d123b94d4635b4e", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:47 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x2, 0x450040)
ioctl$LOOP_SET_CAPACITY(r1, 0x4c07)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000080ffff593331abe694615f3d41ce8c4c35cf419f0463cda93257d878bc8a354917fe49eb2df7680000008000000000176ad98f648be3fc3ef07011d1d748ed9e1b00fd1c8b886f337c7cdaf7be3d67af0c9cda3688344d4c070eb4c51e8af2508365af6275f48f2c732df8f2a306147a1d87b4b3"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="06c74be4c5cdeea595e55e8caaff1562aa8b356ec8d94e2d6a289c85483e3c39ca727be7a0269501c7495af9d6b738175625eaa55ea7ae2b910d92b874a8320c722b825ab5c62aaca9576dab8028e40188b9432753b814e1aa3ff9b0c6e55fa33e0872848770f27431e009cbf4d957b1f6746f216817e8f3"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x400, 0x101040)
syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socketpair$packet(0x11, 0x3, 0x300, &(0x7f0000000040))

2018/02/28 09:17:47 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:47 executing program 4:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x2, 0x40)
ioctl$KVM_SET_XCRS(r0, 0x4188aea7, &(0x7f0000000040)={0x5, 0x37, [{0x8, 0x0, 0x5}, {0x1, 0x0, 0xda6}, {0x2, 0x0, 0x90b8079}, {0x4, 0x0, 0xff}, {0xff, 0x0, 0x7}]})
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x100000002)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  141.565882] binder: undelivered TRANSACTION_ERROR: 29201
[  141.571400] binder: undelivered TRANSACTION_ERROR: 29201
[  141.576958] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:47 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0)
ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000080)={0x7, 0xcd1d, 0x9})
finit_module(r0, &(0x7f0000000000)='-wlan1em0\x00', 0x3)

2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x800, 0x0)
rt_sigaction(0x15, &(0x7f0000000000)={0x100, {0x7}, 0x80000000, 0x4}, &(0x7f0000000080), 0x8, &(0x7f00000000c0))
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0xfffffffffffff801, 0x4)

[  141.624867] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.632652] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.641542] binder: 20296:20300 transaction failed 29201/-28, size 40-0 line 2963
[  141.641570] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  141.658464] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:47 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x40, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000001240)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB="a37d0e57232ef1eb0dcf07ae213feb83a7b9d6b05426073ab8d0d51ff9e704ace56a36edfcc24214bd92e9b588fda34011435aadbbcfd62fdf9589babf472163a12ffae98682fa655c809507d8f52ed200c504e2bd", @ANYPTR, @ANYPTR, @ANYPTR, @ANYPTR64], @ANYRES32, @ANYRES32, @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="830cf883a1d04c8402b54c09ccc398d1e26bf17994456a6e92d358ef84b37ce017680262aff5dd74cf084f1c6bac633042059f1c8fafb71d9f9a1d6525dc587b44e7d0ed7b87c02e0b5b9b067851b6b20169d9acf3e30529305cca879cce9edf260bf82ee86978ea702bec2aa778255202a12ed0c081187c9c4d74658a0cc3c94f42bb63d38f1b2b9c08ff8410d3658b64c6525bce2c75205312dac78c5d015940f4f30dd93268c78a535a9f19be31f5d23a3b046ea3de3821b568eb1c5660edc76ddb9f03bfbb108c06d21cf1f7629b5b337ea8a5316e01d59f64e2b389ffcf82efae6afc3f52a409c15ac3a3c70fa7b6f3502719d80e957fd87ac0cf985c29c9e659e8547dbe2d1366b579ebb6271dce8155df91c412bad3b6f2a3cd4a56aaed075e922a9bfa9149231417eef281f4d394326acefa4f4d7554031a8d465b0cbf43eedd7b6c20498b42b9e3ec5957ae4498b42bbc1be4ef6b18eb4e452d2f2a3671deeb02a1fa13a03cf1b9f17b807dc88fdc0c8e8948d13c2a1f21813766959e61d129362ac741eb49bda91c24a72f4b0f2f9910e237de14b6fe839d98c222d148d0f912d700bcbe9eef92d73a482ace5900730359634ab64edf492602ef3ab782f075556eb85cc2bcb1e0cf36cc545b5effacd0ff960d44703e4ec3cba6acb4a4e1becdb7e1c2ba0ae1a112bcedc9daebcc030d794ea9c738b346d172cfbec8f6ded3ced2afbfeaa6dfb5799f6e7b23b0ea06cebfb4ab29d5a9c9377e9fdda6cb2496f1d51fc075a28c218362d411693429c2335995e317cc1d79736f8889ccc9c2046a93ff310a344dd6aec15a2d8c64ed32ec4280093cbb6d405617f3dbba3d1c56fc08a0e7a4b822b812defe119628eb73316c108ce7f92c756c6d5c98e5cbf18c016cfd18da8b478acee467a89b3e7e61d9ee4866db08aee28575a0ec171cfdaa20d110423aafbc77d4544ac48caaf4c3dc1700311989268c6076196e35c788e8dc7b43d475a37886c24c55f2dbe552b1f76eea54aa36223bec93ff1b9617c2d33cec2a331544f54f2228570a730700b0eb43d835d495d16dff14162ebdcdf8a5357641d8fc22d7cd040268a1f803fa4c77ac0ad1755291fc0cd98d35e9fe4feec589d040b1fcf29bc19a1afb102474cac85fd7f45fd98540ab82325600189f250185fe9fa57290c04182163e7c1df0dbdd79297f0985f41c6f0aeb2313e64c42b0aa6f9370f13558f67e34c15d101dad1a0ec3739d975bef036988eb19f4ba150e2bfd5aaffb101b68ee612f2c1836bf8651b9736cdda5d4d129f027eb891cfacdfa38d3a995ec9b3cdd23e584cc47bac505c07b5b25fe02a4047e81356a95f664d62ba16e0a431707e0f3e2fe12d31772244d80fe94c5f9bd28e2f353ad0f89dcbeafd69e68e03e6094c24a2bc5b1d3b573ca3fe913c793e7e44b285343001287eb0097d4c327a8a7473ee488be41fbfe99c0f827db6bfecff43c1f23e97850bb3009cd8d26336132d82ee894e9ab20ee5c9615b1f04ab5676746ce9ff2e24282a92192fe407a97fd994c0c42cd1bad9f4f2fc6d758b861321040df345af1bfae8c391325e93a6ebcde860ed3fdec1a01645699691aba6dd6955bdb8d81a70e8339cf38162ab8de52d77af22042b6ed6fa40f1526cc75848af0772ef9ef1ca1538682c3a7b9b454952b567c8cd9bc083c4d04748f16d542b22fb9de22a02243c266ec65347ede10e0a31515aa21ddc7637463129a9a7faf846379d9adef9ed583703d270b451f93de24d17d31d20ee97724258bdf4d4a66b30180d9672970d1a4c6b504eea68b9ce732a8d7d34707dd2a881c1920fa50881fc0b674ab10a61e77426d369ca0622e4a24e61805769a70bea585b304b06220f432f4c40057bce70c188fac59a73f6cdebe72b9d59fa2cd855adef627d0ad79ab13c709d93a725123e0282be8af25bd649bb139e22ea7696cb95dae66b7e646474914700d23ecb2a4d2a507955bb57b07f0906bff014c6f6e5a2e2e119b6a6361842e7b0abf68b8726e43b487b68cb707a12ef44be9cbf91a7d058c499cd6245e814f6962d81b6cb2abe07465c56fcbc0e7f116ef3f4e3c5286d98afc8f6de179698e2f096437ecf261ce120eabb5e79de693a5f1e4af25263ce3a905b11af0bcce4cbd074dccdbe3aff7ce20cbe88743d7e605a5aee336d76441112aeca92fa066b4de42693e6bb455298a236411576912a3b5877f271942c4c26ccb619a1f562d183ac51400762e6e7c231ce4eec3b4b77d208ab12a715bd65779bf203a275129e7c5fdd6b229b986f1b2b94f7954c1eaf850c71b3671eae4d84f0754adf4b1a0bad5235b7e62997686ebd59919181f7632a959b944da0e3ae857f8e0101de34ebf305ee244ce198fed2d6e8c3267fcae907048266c0708a1351b0d3f17bfc74881624e3da9798653902b76830a9202e58f23674ff31dd00845498e1f3246611cc27e98974dd27621beefb4b56ec0b8f45baf72c051a6900276f5df843040d815148c950e8502aba9008b62b906b01c124ad896c4560829e72486e5f50e9ab7fdb508a5c7f2a69cc4c9758f08fd8ad3b67b5eff2030a1e01768c424a31396bbe2ec51a52555ab897fecceb2ebf4784427ab490cd3fe789a53fa5b70674aa1c53590e44afb83ce3710da461f4bbd225afa01ba0d04b3dcb2d69f12ac09d79815785ea3616e39adb4581b74f06982f81997b9bf4bbdcc3d081e2a8a9b38b90e4a143b320015a150f39ee741fe384deedb560895d000b0c928f78514fd1c05dd7bc4b76aabbb7790e730cd1dca32fd7b5a79816491f6a61533e402f7e35cc952dc17559c46540197f07610dba5449b3a37f187c180e406bb2da44fd08a1f18d044e76f666eda79c415d4b6feab6b3b37e10609607660089f7fb136492738dd64316b7cadb1b23008b40a5c894b54c1cf81a913a548f404452c764ec605fce977f361e585c3360d2303af297670da8bb17c4e88dd35544b7ce76d29f180ccdcb04690e5b397d8afe12892211a2759ee8e78ac3a36932d315a3379210433c97a5d880fd844234c706732db61c376be6141abb82de62388877c7277c5e6d58a89d92631d17ed44c34faab8442466f8afc6ec5c735c5e42a86fc264b18a76239609f18c31c066c822a6a4f1aaa3f647671c7c773157f85e22d6275c080d5727827ae1c154ea5c010593f8bb9d0d891fc75e9c80fc0ae558b2e10d2d8cd08bbb5617f89f722e5a4c5b3204b1ad1be5cbd87157ed557b88cdbe181664aefc43ec32b037f6369589d1fda8ef310ddadcc32cbe049c08ee4fda4cf0111f954eba97e9b22eb4327ab3c95c67a66ea66037b74bda26b4f10574614dd9d2579a408fba01a63c791da1decba57f726e7f88baa867cf8c391697b77eee0d8c94c19071036f3a58b2eb4e0fe86d3ce1efdefb00d31534e14046ed86454ee517e9aa0866789551c239709d20b793311fc5e4577d2c903cd01d17bde52d3c4cf4da5e0b3adb92bc1a356ac7fc167f9be0c019137f21f5bba99197d290a1f5fdc40ef2c57493c0e863f261776edbe8fe1bb9035703ff4714045d6d59a638c4d625eb5446c104a0bbffd0342c0c3f6db22afb919cb4109a43dd5918df2e6558edb18d12fceda629a03da36400374046bc9b13468baf63b3f857c00c7fb4f43350d73f608c0099684a8f79f5dd538ff3cc07722d4f93045b9d2147205a8904351f31fb6bbf12394440189dbb67f32bfd9f372dc78507437d7fc6ad1f1517df45ad7a85c3020c488ebad633f3f1a2da7f694e226d5645bd105754e9fd4fcd402cb00446dc3f5adf6a847affa89310f7177f100a8111060f23bd16bab753f2757f51b7e254fc643ae7a495ee68413b601b5ec616fc0080c9b48a46dde8c3facf3c22c382e06c5016d7de4ca725da1767b8791b8a1b3a216ab7db93f6d0c3aff753b015980770afbc8ce97711755aae69786f9e7a0fbb3f60cb9d08732c926eb4af3026dc7607c05a1a8bd00f197f97510bfdef6c21093454b2a6276efb5c5e5a267e18a3209da321ee95c9bcaa5870ba983c0c743ce99bd7f7f4db7b74db36067100e98442b90af92c442ca3658aa6d43639d0df17517aeaba9c3d6e194435a14403f3d61a0b6139f3a565fd3298f7058834de8850afc539069356ef2233cbffda8088e36127fe3f7f4f0b8764a11929b7d32ebab713e696a981397c051cf46ec0f9c6ba5b10cb07a56026345c861f97e4e1b0276b1fa4dc0a63ddbc761fb0197da7e387b76d03eff41d4d322bf8ac580c1e12a27df13f654bb91e8384ac2f564cc062b58271a2c6bc7a051493f18b3338637609ff749d4fe96cf68ecf5a77daa67d49fc753a96d22cd5d2733b18a8ee409ff04ffff539c605b41d77e1ba219d4edffce221a5acf54d269898d66a38475842272bfa249cfa45e2f3270640813590be1760bafdee4c83e7d50fa7811aa3c89bfc8b2106c9a54cf99d457283ffffc1f7b6e3cc0507a49ae84fa16e40947c6ddf274a51c97f15225b65726ce79d3a565f643f0461393d73860d4ccc75c3bfbbd202b632f42c49cc90863be1fdb54e48e9de9a69c95d3ae6c22ef4d40848e1fdf8178e3f525448776c0d3549646565355f77832977582396d0a7c1ae28fa2f82cbda50edfd2a243749073a81f938d9081064fee1c8d0a9e9b6b8b716959336c55cdaf3c68880c673d324bc688666fa94e055caf653bf74e48f4b5ec00aca93297c9435fd05f44b6c73b3bb3735e7d5011412e0bc500c0194425b33420911ea166a5a181c430054c0d12d696c86519bf76dda2e9c99e119d3bd047871a4ba09a52f28272bfa6eb9d99c6af1920635b9d3ef787292e150d4211d08b6b509d50bedb153e7fcf059ba4ac2474afdccaabaea767247d804fb5daaec080fcadda2256662c3a128a03921224f018227f28c34b0a556557f3dfd488de933ebc688d1eb8829c8e5ebe4a407d72430383909a98ce5f1de3189908c57eded594fde3079ed9a13e7d822fea05eb6fdcfca057a28d4b01baf3b78dc3c997332d07beb9b22f0bc36cb1c02d86f7a3b2322cdd40b0464309c07260491902626aa078142881e5bec4507c0da9b3fb9d8b23bc17e8014383b1cf44ba300e5f868a9a5dfa3e38df3f313b680d1fbb547bab2d5efef716f5eaa791fdc89bf19bcdec5f5b16ae7c98a0f7d77c9a339e9ca76da4bd3d2e98f5076ef1bad51b2dc8b8fac0fa61a4af48649d42f7867cca766984e84fa70e6a723dbda93758da9f596e0e35b2da53613f2fd11926c7c74ff3140ae131e505c1332d38dd38eaf06ecbd19075ea913329644d0bd30875c38d33a421b2eb66fb678a3e33f0d84eae3893ee016c5ae78dd86176c0d4c3ffaf8a5bea3435fc6277b7ad04d0e42ec396c3c23e4c44a8c3fd939d4a6b2c1e23f9515f939f97ec26990d96bda8ac124e56003464c5a2806c61cfd025c581a367868da179233ef50f5a7ed53bb53d8313832cec69a8083e9fa78af96f4057de248dd352d416fd437c8ecbc960468029859a295af0e6369ec8572b834bb757ce6651a859d9003826e47c1e25e6a55386e1d52aece49c2391bde9d8cb8dd0b2518a3560e38ff436736dc022ff59a6cb4dbc873ce4bb8f381d6f392c0bd8e35f2bfc88dfeb6780e4cb7b3f6c21b60c7403f065d8ed2fe451684b30a65b861fbb4ff790db0c64983f8f0bf48fc7a24592fc368bd1d04475ad1e3b044b2566547170a8544add3f13761b37b1388609dde551434f65650aabb532a93d99", @ANYPTR, @ANYRES32, @ANYBLOB="e72f656627ecc1dfa8a0d0831103ced93e27dd5354b4b8c5185a370ad198967da6a7c8261007fa9e3043a89a3c704c0b7f4fb73cd917f958767932bfb3fe89175c45a4a9964134d6fa2a340e6be7566a86021dbbfc2fbdd78cccf841570c92cd0d231214df789d6e8c0b2ab7187f530bc379784c4e6662dcea3721612f95d1c87808593b79be2d5b7c5d156d819995e66d2a5131b1a59f6231950fd96d78dcb88fe8ee3614852f17b26ae028c7ed24add8c6dcfb7af7d80c188d880e368e02805ad3a28e97e426aec977da916b255994072492a134ba", @ANYPTR, @ANYRES64, @ANYBLOB=';U', @ANYPTR64, @ANYPTR64, @ANYRES32], @ANYRES32, @ANYBLOB="eb75c5506f98f168582204ac189342796febdc9a386a70c747f06af5e72792fb665c1af69951500eea7ba846479f3672fbf112444ebc3ff6f9093286b9092c857f1302b0b3e868705f0406a84ac7cb3640b44b1ab390c4fe285ba8f65576c0c864a0ed68a629df7e4126485808bd46ea0a1dee44540ac57b8038df46985741f792b0a37f76ae49c3330eaf923ea621cd2e026e88a7cd3b9d9227ba35e45c823a708147f8e204b89d9cd33b39fa55eb69fd6a6dcebf7d6fffa9", @ANYBLOB="7496d3cc9ec687b68e3f087acf093847796f46fdad10ecc178991dbfb26c136ae4617be71d7e655f786fafb37f7cc964c6cb08e9883d98ff6156ba969a3033f8a0b6e5becb8d4a348e5ab14f6c423b88522a33153ad0414190dbbaa774cc26f511f181715ec15428cbdec6f6e702406285c333f693a5ec26ea2818f2537d78dfd218707be7a9104e499ae2a54b6b7adbda03e76c98"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
fcntl$setsig(0xffffffffffffffff, 0xa, 0x3)
r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x7, 0x2000)
pwritev(r0, &(0x7f0000000040)=[{&(0x7f00000013c0)="f7c90715546708881f12aa5a5bd6968511e87043f90cd0ded5b743b0df2ed4e89e5bd6b486704d7906dca9eb028ab2a01ce53f479fa125b216c5e76e346e73de7f142bdd3a16dab2c8d1e2a62050bf726b1b2669fd7d54fccca1f416a10763e0f0b1da662f2bae9586f9c151c7cd7a0a76265d3b27da7608f6d4cd43ffb529f4ef76b9de1ea5cb2c1094e94afd5cb27513da6f4aa500b9eb2ca909a0707c6e75a6b9c35ebabd71", 0xa7}, {&(0x7f0000001480)="4d6b027677d70bdc16cbbc3968e8d334fddb5c831372dc450050eb0cf28c906ec193ab87df583a1b254720e1271c7cd88f96f2e1d454c5a7acfe3df4c023c6b5d735c52388bdd2e25e469ed25354c79452f06fde3a299cc1be901f60c813e5c89a2839884f79b20412bfa167a476f204c859f1fa92499276232cbfff3803c9e8083dfcba0cb453fba00c899defe0ac7d0d85f3b2cec1f25567fff2d7649f4e0dbebb3ce4f436d87f6d7dd20619951cd91029ea63673ac98f5a", 0xb9}], 0x2, 0x0)

2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', @ifru_flags})
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40047705, &(0x7f0000000000)={0x9, 0x7f})

2018/02/28 09:17:47 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  141.667371] binder: 20294:20302 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  141.672787] binder: undelivered TRANSACTION_ERROR: 29201
[  141.677218] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.690307] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.699202] binder: 20301:20304 transaction failed 29201/-28, size 40-0 line 2963
[  141.706887] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.714559] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
fstatfs(r0, &(0x7f0000000080)=""/191)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  141.723570] binder: 20297:20303 transaction failed 29201/-28, size 40-0 line 2963
[  141.726088] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.738943] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.747821] binder: 20309:20323 transaction failed 29201/-28, size 40-0 line 2963
[  141.747835] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  141.763107] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x53, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000000000000000000000000052da9d1d12", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:47 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0x10, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0xd8, 0x0, &(0x7f0000000180)=[@increfs_done={0x40106308, r1, 0x2}, @clear_death={0x400c630f, 0x4, 0x2}, @dead_binder_done={0x40086310, 0x1}, @exit_looper={0x630d}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x40, &(0x7f0000000000)=[], &(0x7f0000000040)=[0x78, 0x0, 0x78, 0x0, 0x38, 0x20, 0x78, 0x0]}, 0x5}}, @register_looper={0x630b}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x18, 0x50, &(0x7f00000000c0)=[@flat={0x77682a85, 0x10b, r2, 0x1}], &(0x7f0000000100)=[0x38, 0x78, 0x40, 0x18, 0x38, 0x18, 0x58, 0x0, 0x0, 0x28]}, 0x4}}, @release={0x40046306, 0x1}], 0x75, 0x0, &(0x7f0000000280)="60cce1109659685587e888ac3581a7cdde6063db32d3545053497af17c211e30956124ee836fa0a2cda69b591e39d1ae96e798480f8ff2000deb5fdce6decbf2df9ac4cce865d6bd5f7bac72082843654ffe716906466b5225fbb14aff52a98eca2ef4901bdf58fcca00546e4f330ec4fecd9689f2"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000028800000000200000800000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

[  141.772004] binder: 20295:20306 transaction failed 29201/-28, size 40-8 line 2963
[  141.772300] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.787338] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.791432] binder: undelivered TRANSACTION_ERROR: 29201
[  141.796209] binder: 20320:20322 transaction failed 29201/-28, size 40-0 line 2963
[  141.804837] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.816957] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:47 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  141.825861] binder: 20301:20331 transaction failed 29201/-28, size 40-0 line 2963
[  141.826240] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.835457] binder: undelivered TRANSACTION_ERROR: 29201
[  141.841223] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.855513] binder: 20309:20323 transaction failed 29201/-28, size 40-0 line 2963
[  141.855530] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
2018/02/28 09:17:47 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x38)

[  141.870066] binder: 20338:20339 BC_INCREFS_DONE u0000000000000000 no match
[  141.872370] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.872395] binder: 20334:20337 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  141.882283] binder: undelivered TRANSACTION_ERROR: 29201
[  141.888281] binder: 20338:20339 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4
[  141.888299] binder: 20338:20339 BC_DEAD_BINDER_DONE 0000000000000001 not found
[  141.918044] binder: 20338:20339 got transaction to invalid handle
[  141.924301] binder: 20338:20339 transaction failed 29201/-22, size 0-64 line 2848
[  141.929396] binder: undelivered TRANSACTION_ERROR: 29201
[  141.945063] binder_alloc: 6345: binder_alloc_buf size 2199023288368 failed, no address space
[  141.953700] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.957096] binder: undelivered TRANSACTION_ERROR: 29201
[  141.962575] binder: 20338:20341 transaction failed 29201/-28, size 2199023288360-8 line 2963
[  141.970531] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  141.984308] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  141.984964] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  141.993198] binder: 20343:20344 transaction failed 29201/-28, size 40-0 line 2963
[  141.993318] binder: undelivered TRANSACTION_ERROR: 29201
[  142.010236] binder: 20338:20339 BC_INCREFS_DONE u0000000000000000 no match
[  142.014280] binder: undelivered TRANSACTION_ERROR: 29201
[  142.014467] binder_alloc: 6345: binder_alloc_buf size 2199023288368 failed, no address space
[  142.021319] binder: 20338:20339 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4
[  142.021329] binder: 20338:20339 BC_DEAD_BINDER_DONE 0000000000000001 not found
[  142.021340] binder: 20338:20339 got transaction to invalid handle
[  142.026789] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.035366] binder: 20338:20339 transaction failed 29201/-22, size 0-64 line 2848
2018/02/28 09:17:47 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}]})

2018/02/28 09:17:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x4d, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000000000000000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:47 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a625701010000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\b'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 2:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x200001, 0x0)
setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f00000000c0)=0x74, 0x4)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$KIOCSOUND(r0, 0x4b2f, 0x6)
r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0)
setsockopt$inet6_dccp_buf(r2, 0x21, 0xc0, &(0x7f0000000040)="a4a8c91594088ce91eba3883c100c253e0055ffd5414d60b31038ab4dd91e589f1c0f837cdd002f46762d40f7a471b58373495", 0x33)
openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/access\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0xff, 0x8, 0x8})

2018/02/28 09:17:47 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}], 0x38)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:47 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:47 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x4010, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f00000000c0)=[@increfs_done={0x40106308, r1, 0x2}], 0xffffffffffffff0e, 0x0, &(0x7f0000000000)="b2003fe9c321b231e3"})

[  142.042291] binder: 20338:20341 transaction failed 29201/-28, size 2199023288360-8 line 2963
[  142.052904] binder: undelivered TRANSACTION_ERROR: 29201
[  142.086595] binder: undelivered TRANSACTION_ERROR: 29201
[  142.092103] binder: undelivered TRANSACTION_ERROR: 29201
[  142.133577] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.141401] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.149360] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  142.150286] binder: 20351:20357 transaction failed 29201/-28, size 40-0 line 2963
[  142.158387] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.173457] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:47 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000000080)=[], 0x0)

2018/02/28 09:17:47 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB="009a0c01f49488982d673f6cd30bc492f85f637a1a2e387bfbfa9e77ccdd9e7f99f70690bf16cbc427a2bdf3e994f4db04b0b8ef9dc2585bdcdb88c09d75a96dbeec1fe3205d86d77fd27a0728b69fe82f8750d9eabcadebc50443e35769d7de093419c087606292d0e51531d9a6eac4ca25b29163c8a28cef87dfd870d0cbd3dfcab17d2c1eb2fe854261c0de1b6ca330d3f450134cc8d0890c7f0a56fe717275f4abfeeb66e9ecfb722b0af4fee7f2"], @ANYBLOB="0100000000000000000000000000000000000000000000001bd54896a8a54e0430b793fb6f4fd337c0b05cc9a02529a4ff8605a03f3505"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0)
r2 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff8)
keyctl$describe(0x6, r2, &(0x7f0000000380)=""/100, 0x64)
mq_notify(r1, &(0x7f0000000100)={0x0, 0x12, 0x5, @thr={&(0x7f0000000040)="17edba73ecbbf3f092ff6138c3f21884b842f6d4737c6c78669b129ab3061b2276a0d766ec72e593b45b7f2f0becad6401", &(0x7f0000000080)="ce8dfd300f5647684f769f1ad70d4c70d3eeed339d3f68b270bf3872d69de38caa6d9896c7cbc7ca5b85395c2b80bb41d56f0a67a36a2f7d15679ad0a3e10ad51bc104276e2fef4aa076791cfea85937dffbc782f6d3f5f80e87"}})
getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000300), &(0x7f0000000340)=0x4)

[  142.182344] binder: 20352:20362 transaction failed 29201/-28, size 40-0 line 2963
[  142.185454] binder: undelivered TRANSACTION_ERROR: 29201
[  142.190104] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.203157] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.205534] binder: 20360:20371 BC_INCREFS_DONE u0000000000000000 no match
[  142.212038] binder: 20354:20359 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:47 executing program 3:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x80, 0x0)
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000001c0)=<r1=>0x0)
ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000200)=r1)
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r2, &(0x7f0000000140)=[{&(0x7f0000000000)=""/42, 0x2a}, {&(0x7f0000000080)=""/13, 0xd}, {&(0x7f00000000c0)=""/72, 0x48}], 0x3)

2018/02/28 09:17:47 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x141001, 0x0)
ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f0000000140))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[], 0x164, 0x0, &(0x7f0000000400)="ff4ccde3a0e9c5afe081a92ec7490d3b2d6f529dc337406df294e471bd74851cc9d8435543279a3f4768c0bdfffa897d6d27e8b78f5aaa5fc85bbca60b0c37255a778f9bbeb7ac0b8836a8c7921f41b2e08c97a50f9009f05f88ef579df7a3239fd67a8cfbc894ba4702605fac875d16e75cfd26befae709fcaefdbb460d58f138aaca7f97ca6f7ca82b0a6b0d313b87c1ffffffdd4e3562e41800a107000000da6f7542602ef0d3577ca3dfa4a3e83c5c573f763ccf82e9afec7e309c2ea18683d13a0ea1b52f836b85c0faec4cb2009d598744a2ce8c775cc7ba42ca9d526749b7c0b6acf9b316f6be4c6ee0d93f625f2fc67017cb16d23bf287ad02f34e8ab62dbb7bb4838e55f661339f1119d2e7fc6f59066f89005e30b5dd39c466367da8936662795ebc1f535b0569ab99a7c8256b2708a0bd745a8fc8acc370dfc09d928b0e8bd6ca743e04b3457c234c8a54033257ebdfdd2c721ac248da621b63cc56556f29ea8b2b815f6aa5f24578ec1e70c18291b6ceef66a9166d2dfcf3c52f3a434b94d5d05a7e0d6395d58fcf78bf2aea6681692174ae00e33dfd2477674768ed5d814977bb71586593734c7f42e6b2362f67fd9e772e30d5cb1162959ce6765db0f496c264e1d52c1256366f16584888b5909ea97be23d1750937e83a7bec65c0b460db18485f3175f3db4177e4b664238be9269b0c8e4a3956354da7d49d65ae3de4d430e655996630e423b92780bf16a0d7a712225b380d1243bc9eae2551a7f70da43eebae374b84cbbe0ef18ce66f306cf00425cbfe4b301ef841a"})
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x408403, 0x0)
epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000200)={0x60000000})

[  142.212447] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  142.234481] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.243368] binder: 20360:20364 transaction failed 29201/-28, size 40-8 line 2963
[  142.243494] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  142.255263] binder: undelivered TRANSACTION_ERROR: 29201
[  142.260274] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.272348] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:47 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0xff, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x4d, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000000000000000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:48 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}], 0x38)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  142.274575] binder: 20356:20361 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  142.277492] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.297422] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.297455] binder: 20358:20367 transaction failed 29201/-28, size 40-0 line 2963
[  142.308142] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.321594] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:48 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='D'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x200, 0x0)
getsockopt$inet_dccp_buf(r1, 0x21, 0x2, &(0x7f0000000080)=""/250, &(0x7f0000000180)=0xfa)

[  142.321615] binder: 20372:20382 transaction failed 29201/-28, size 40-0 line 2963
[  142.321622] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.321631] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.321663] binder: 20372:20375 transaction failed 29201/-28, size 40-0 line 2963
[  142.321690] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  142.321698] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0xb51ed93b3fedf97c)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  142.321718] binder: 20360:20369 transaction failed 29201/-28, size 40-8 line 2963
[  142.325690] binder: undelivered TRANSACTION_ERROR: 29201
[  142.339668] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  142.358428] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  142.407467] QAT: Invalid ioctl
[  142.410340] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.410378] binder: 20392:20393 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  142.416003] binder: undelivered TRANSACTION_ERROR: 29201
[  142.422474] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.433190] binder: undelivered TRANSACTION_ERROR: 29201
[  142.437604] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.437636] binder: 20391:20397 transaction failed 29201/-28, size 40-0 line 2963
[  142.448360] binder: undelivered TRANSACTION_ERROR: 29201
[  142.450734] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  142.459589] binder: undelivered TRANSACTION_ERROR: 29201
[  142.467165] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.467187] binder: 20396:20398 transaction failed 29201/-28, size 40-8 line 2963
[  142.475653] binder: 20384:20394 unknown command 0
[  142.483801] binder: undelivered TRANSACTION_ERROR: 29201
[  142.486286] binder: 20384:20394 ioctl c0306201 20008000 returned -22
[  142.495702] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  142.518564] QAT: Invalid ioctl
2018/02/28 09:17:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000800000005b7ebf7f49bc3e1b00000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)

2018/02/28 09:17:48 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0xfffffffffffffe3c}], 0x1)

2018/02/28 09:17:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000000)={0x8, [0x0, 0xd3, 0x1d, 0x1, 0x3, 0x0, 0x1f, 0x5]}, &(0x7f0000000040)=0x14)

2018/02/28 09:17:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x47, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:48 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}], 0x38)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0xff, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:48 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x404040, 0x8)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000080)={<r2=>0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}, 0x5}, &(0x7f0000000140)=0x98)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000001c0)={r2, @in6={{0xa, 0x4e23, 0x800, @dev={0xfe, 0x80, [], 0x19}, 0x8}}, 0x80000001, 0x86, 0x400, 0x4}, 0xa0)
setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_id=r2, 0x4)
r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x800, 0x480000)
ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xffffffffffffff66)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800)
sysfs$3(0x3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r0], 0x1cb, 0x0, &(0x7f00000000c0)="048c551832f25714885cb93d7bff6028dbf02e8dcc569af7590f65150feb26775bf2dfc3b7c2855f24a5a497ee58d9c793fa"})
socketpair(0x9, 0x800, 0x59, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000100)=0x80000001)
socket$inet6(0xa, 0xa, 0xffffffffa5bb7f41)

[  142.519266] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.519290] binder: 20396:20398 transaction failed 29201/-28, size 40-8 line 2963
[  142.528188] binder: 20384:20394 unknown command 0
[  142.533655] binder: undelivered TRANSACTION_ERROR: 29201
[  142.539220] binder: 20384:20394 ioctl c0306201 20008000 returned -22
[  142.546777] binder: undelivered TRANSACTION_ERROR: 29201
[  142.577619] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.585295] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.589822] binder: 20411:20414 unknown command 19
[  142.594182] binder: 20405:20407 transaction failed 29201/-28, size 40-0 line 2963
[  142.600881] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  142.608325] binder: 20411:20414 ioctl c0306201 20000040 returned -22
[  142.614417] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.614450] binder: 20410:20417 transaction failed 29201/-28, size 40-8 line 2963
[  142.615678] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  142.646645] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.655516] binder: 20409:20418 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  142.656126] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.670718] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:48 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc\x00', 0x680001, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000))

2018/02/28 09:17:48 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x0, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  142.672950] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.672981] binder: 20412:20413 transaction failed 29201/-28, size 40-0 line 2963
[  142.687096] binder: undelivered TRANSACTION_ERROR: 29201
[  142.690945] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.701369] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  142.707953] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.707986] binder: 20406:20415 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:48 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x406, r0)
ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000240))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0xfffffffffffffe1b, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000028000000000000000800000000000000f6bbe3a8b9fc5a08c5b3fcc55dd59da37e602c86934ecfe6c3cde45d9bf8a6eaf1e93cc900a6303583ba8c4c95ae3835232f6e142bf8dbacf865f1eb004a22f7e8ec913b49e180dddbc82692db48fc1919c395a63f09c387cd74572369c32b7b2ad5902f9e0aeefd3e0d9108f60553c9e9f43a10cb35ebdd4205", @ANYPTR, @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r2 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x3f, 0x204940)
ioctl$sock_ipx_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000200)={"135c73597652dd69b74c82fd4f1fe2e5", {0x4, 0x7fff, 0xd8, "7e36cc3ff332", 0x1f}})
getpeername$packet(r1, &(0x7f00000003c0)={0x0, 0x0, <r3=>0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000400)=0x14)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000440)={'vcan0\x00', r3})
io_setup(0x46, &(0x7f0000000000)=<r4=>0x0)
r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x400000, 0x0)
io_cancel(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)="441dba63e3fe3ce8dac212ed524d68287063b0c234dc9c7f472e19bba4a2130acd62f438765284275c77531016c73345bdad7f0bd770244a848ff1a8a64c1485a3d618e89d2bf8acc45b8eeaf3c4930620e1e6bbbc0e8811ae2e1a91f04b4ef991d5835896643508b286dd0817e26fcc6a5f7dba8578f5ef5c112e4d29e7589c900534", 0x83, 0x2, 0x0, 0x1, r5}, &(0x7f0000000180))

[  142.732657] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.740331] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.749213] binder: 20412:20420 transaction failed 29201/-28, size 40-0 line 2963
[  142.750752] binder: 20411:20419 unknown command 20
[  142.757453] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.769682] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.777829] binder: 20411:20419 ioctl c0306201 20000040 returned -22
[  142.778567] binder: 20428:20430 transaction failed 29201/-28, size 40-0 line 2963
[  142.785157] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  142.801792] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.803512] binder: undelivered TRANSACTION_ERROR: 29201
[  142.810669] binder: 20432:20435 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  142.816804] binder: undelivered TRANSACTION_ERROR: 29201
[  142.827783] binder: 20440:20441 ioctl 4b64 20000240 returned -22
[  142.839968] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.847686] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.850314] binder: 20440:20444 ioctl 4b64 20000240 returned -22
[  142.856569] binder: 20406:20421 transaction failed 29201/-28, size 40-0 line 2963
[  142.859580] binder: undelivered TRANSACTION_ERROR: 29201
[  142.879641] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:48 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
sigaltstack(&(0x7f0000ffb000/0x4000)=nil, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
r1 = getpid()
migrate_pages(r1, 0x10000, &(0x7f0000000100)=0xd3, &(0x7f0000000000)=0x7ff)

2018/02/28 09:17:48 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x0, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 2:
r0 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x9, 0x40001)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000200)=0x400)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x125200, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f00000000c0)={0x0, <r3=>0x0, 0x10001, 0xfffffffffffffffe})
modify_ldt$write(0x1, &(0x7f0000000180)={0x70b0, 0x100000, 0xcc55d3262735f1cb, 0x8, 0x6, 0x9, 0x3, 0x3ff, 0x1, 0xfffffffffffffffb}, 0x10)
ioctl$DRM_IOCTL_SG_FREE(r2, 0x40086439, &(0x7f0000000100)={0x3, r3})
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x3, 0x0)
setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x2)
eventfd(0x1)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000000007de98dc374016ca14a58b6d51398f5210b15793ec2acc7c10c15e8774078ad38272aa87d5ed124fe7d97342f5c645916f5b50dad161b72ece1a45b57ec49da38d82c537bab6fe2e6aa4fd115025e040e7d8a39d7d958e637853d056efa609714c98b93007f5cf73d1e9a3e4bf45019a62d903d1cc6832c02540dafa10947b10b01b8d348c15834322b06546d11227c82045d36b6ead39ea6c5cf5f6dd242787d1749215d329b3f787953cd5a9ffd2f91bc214e1b24d6bec7db75196e4af4a79a0f4af85eede6c8691ff6e56e47ef3b1f548423dbad21838077924d2d7cae69c62f6dd213f33c5a04c1b462667e4328caac8437c6657500a88bd6c75838a04e5a1a1658a0b5bcff8498f9dbd39b10722479687f1339473ca24aa89833a7a00b1ffcf93b051323bb93e8943d68b56f77df778fb9baf837aa6e515a5425512fc59d58f9f49ce967778cc381f860ec89777a7959f8c3f04b49967060d8000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
getpeername$packet(r0, &(0x7f0000000340)={0x0, 0x0, <r5=>0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000380)=0x14)
ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f00000003c0)={'vcan0\x00', r5})
creat(&(0x7f0000000140)='./file0\x00', 0x0)
personality(0x40000)

2018/02/28 09:17:48 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
dup3(r0, r0, 0x0)

2018/02/28 09:17:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x804)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:48 executing program 0:
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00635c494500ffa1c3e700000000000000000000000000000000000000000000000000133f0edc9151acf9000800000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0xff, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  142.885150] binder: undelivered TRANSACTION_ERROR: 29201
[  142.914363] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.920871] binder: 20450:20458 unknown command 1230791424
[  142.922100] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.928421] binder: 20450:20458 ioctl c0306201 20008000 returned -22
[  142.936587] binder: 20449:20452 transaction failed 29201/-28, size 40-0 line 2963
[  142.943209] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  142.957609] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  142.959836] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.959873] binder: 20451:20457 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  142.960216] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.975698] binder: undelivered TRANSACTION_ERROR: 29201
[  142.976673] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000000)={0x5, &(0x7f0000000080)=[{}, {}, {}, {}, {}]})
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)

[  142.976699] binder: 20446:20455 transaction failed 29201/-28, size 40-0 line 2963
[  142.976771] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  142.987931] binder: 20450:20465 unknown command 1230791424
[  142.995133] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  142.995167] binder: 20448:20453 transaction failed 29201/-28, size 40-0 line 2963
[  142.996789] binder_alloc: 6345: binder_alloc_buf size 274889691136 failed, no address space
[  143.042607] binder: 20450:20465 ioctl c0306201 20008000 returned -22
2018/02/28 09:17:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:48 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x0, 0x200, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 3:
readv(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/31, 0x1f}], 0x1)
socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000040))
pipe2(&(0x7f00000000c0), 0x800)

[  143.046875] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.046903] binder: 20447:20456 transaction failed 29201/-28, size 137439215616-137450475520 line 2963
[  143.059285] binder: undelivered TRANSACTION_ERROR: 29201
[  143.062748] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.094043] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.102943] binder: 20448:20460 transaction failed 29201/-28, size 40-0 line 2963
[  143.102970] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.118241] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.123259] binder: undelivered TRANSACTION_ERROR: 29201
[  143.127133] binder: 20468:20472 transaction failed 29201/-28, size 40-0 line 2963
[  143.133032] binder: undelivered TRANSACTION_ERROR: 29201
[  143.140198] binder_alloc: 6345: binder_alloc_buf size 274889691136 failed, no address space
[  143.154118] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:48 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x100000000000)
r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x301002)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000000c0)={<r2=>0x0, 0x2}, &(0x7f0000000100)=0x8)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000140)={<r3=>0x0, @in={{0x2, 0x4e24, @empty}}, 0x0, 0x8001}, &(0x7f0000000200)=0x98)
setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000380)={'filter\x00', 0x7, 0x4, 0x4c0, 0x110, 0x1f4, 0x0, 0x3dc, 0x3dc, 0x3dc, 0x4, &(0x7f0000000340), {[{{@arp={@multicast2=0xe0000002, @multicast2=0xe0000002, 0xffffff00, 0xffffff00, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0xff, 0xff]}, @mac=@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xf}, {[0xff, 0x4f50ac2a2f43d17f, 0xff]}, 0x1, 0xffffffffffff1f0f, 0xfffffffffffffffd, 0x7fffffff, 0x80000001, 0xfffffffffffffffd, 'bcsf0\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x200}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @remote={0xac, 0x14, 0x14, 0xbb}, 0x2}}}, {{@uncond, 0xc0, 0xe4}, @unspec=@CONNSECMARK={0x24, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@arp={@rand_addr=0xc5, @remote={0xac, 0x14, 0x14, 0xbb}, 0xffffff00, 0x0, @empty, {[0xff, 0xff, 0xff]}, @mac=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, {[0x0, 0xff, 0x0, 0xff, 0x0, 0xff]}, 0x3, 0x6, 0x7, 0x3, 0x40, 0x1f, 'bpq0\x00', 'syzkaller1\x00', {0xff}, {0xff}, 0x0, 0x2a4}, 0xc0, 0x1e8}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x6, 'system_u:object_r:gpg_agent_exec_t:s0\x00'}}}], {{[], 0xc0, 0xe4}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x50c)
ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0e05403, &(0x7f00000008c0)={{0x2, 0x3, 0x9c82, 0x1, 0x401}, 0x2, 0x3dc00000000, 'id1\x00', 'timer1\x00', 0x0, 0x5, 0x356, 0x1, 0x40})
getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000240)={r2, 0x3, 0x100, 0xdf3, 0x7, 0x5, 0x0, 0xfffffffffffffff9, {r3, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xd}}}, 0x7fff, 0x3f, 0x8, 0x7ff, 0xccc7}}, &(0x7f0000000300)=0xb8)
getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$TIOCEXCL(r0, 0x540c)

[  143.163055] binder: 20447:20471 transaction failed 29201/-28, size 137439215616-137450475520 line 2963
[  143.163149] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  143.181820] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.187448] binder: undelivered TRANSACTION_ERROR: 29201
[  143.190721] binder: 20473:20477 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  143.196526] binder: undelivered TRANSACTION_ERROR: 29201
[  143.213785] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  143.221507] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.225185] binder: undelivered TRANSACTION_ERROR: 29201
[  143.230495] binder: 20479:20482 transaction failed 29201/-28, size 40-8 line 2963
[  143.236000] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.251162] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.260068] binder: 20485:20486 transaction failed 29201/-28, size 40-0 line 2963
[  143.268814] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.276489] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.282467] binder: 20488:20492 ioctl 540c 0 returned -22
[  143.285442] binder: 20488:20489 transaction failed 29201/-28, size 40-0 line 2963
[  143.292432] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.298796] binder: undelivered TRANSACTION_ERROR: 29201
[  143.306264] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.306286] binder: 20480:20483 transaction failed 29201/-28, size 40-0 line 2963
[  143.314263] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.324946] binder: undelivered TRANSACTION_ERROR: 29201
[  143.328204] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.328225] binder: 20485:20490 transaction failed 29201/-28, size 40-0 line 2963
[  143.336565] binder: 20488:20492 ioctl 540c 0 returned -22
2018/02/28 09:17:49 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000080)})
openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0)

2018/02/28 09:17:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="009be7cd3aee9c60d9eed1694ef0853fb8645c0338ee"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:49 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x101)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x10010, r0, 0x0)
ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000080)={[], 0x8, 0xfffffffffffffffa, 0x8, 0x0, 0xa34, 0xf000, 0x10f002, [], 0x3e})
readv(r0, &(0x7f0000000240)=[{&(0x7f0000000280)=""/31, 0x1f}], 0x1)

2018/02/28 09:17:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:49 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0xfff}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socketpair$inet(0x2, 0x80004, 0x1, &(0x7f00000014c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000001500)={0xb025, 0x4, 0xff, 0x8001, <r2=>0x0}, &(0x7f0000001540)=0x10)
setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000001580)={r2, 0x8000}, 0x8)

2018/02/28 09:17:49 executing program 4:
r0 = socket$kcm(0x29, 0x2, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x20010, r0, 0x0)
fcntl$dupfd(r0, 0x0, r0)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2)
fcntl$dupfd(r0, 0x0, r1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0xfe34, 0x0, &(0x7f0000000080)="f2af1a00c8eea30880d99a942e0065f2775e889b932b0884d4813e861f024520621797ccecae77"})
syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x2)

[  143.341495] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.354146] binder: undelivered TRANSACTION_ERROR: 29201
[  143.357933] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.357954] binder: 20488:20489 transaction failed 29201/-28, size 40-0 line 2963
[  143.363671] binder: undelivered TRANSACTION_ERROR: 29201
[  143.404603] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.406741] audit: type=1400 audit(1519809469.108:111): avc:  denied  { map } for  pid=20495 comm="syz-executor3" path="/dev/rtc0" dev="devtmpfs" ino=9477 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:clock_device_t:s0 tclass=chr_file permissive=1
[  143.412269] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.412294] binder: 20498:20500 transaction failed 29201/-28, size 40-0 line 2963
[  143.437821] binder: undelivered TRANSACTION_ERROR: 29201
[  143.449467] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  143.459431] binder: undelivered TRANSACTION_ERROR: 29201
[  143.474136] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.483058] binder: 20496:20501 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  143.483117] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.492848] binder: 20494:20505 transaction failed 29189/-22, size 40-0 line 2848
[  143.500419] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:49 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0)
ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f00000001c0)={'bpq0\x00', @ifru_flags=0x8002})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000001000000000000000000000000000000000000000000000002800000000000000080000000000000028347ce8e80477557c201b7fc40111477d0474525d21197e00965c08536c460e62e76c62256cdd127fb3ceba6bf141bb1a09003eee3f1858d310115a14780b5bfbde60f3742f7d68ab27e72bfd83f1b9c893fe00924fcc22dadb8dd8360fc0f86bfcff0772bf6d622fc62c8a6edfcb894161790ff372e675dc000000000000000000000000000000d60bd3666508cf2d40597178ea316626039cef79fdb94261932f6e4b2f5eef85ac0733a2b86032b241931ed56abdcdd5c59761a5d9572cbf60735becf1994c792205f4684ddf4e130df0a039c1fef9965c76e358ec129435fd144dea86796a0a8081abcfbd51bcc4d779703b62aaa6d0e32787f01e1a111da31b1179e6d2a2124e551acc97d4e259000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  143.500442] binder: 20499:20504 transaction failed 29201/-28, size 40-0 line 2963
[  143.522298] binder: undelivered TRANSACTION_ERROR: 29201
[  143.528033] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.537719] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.546627] binder: 20497:20502 transaction failed 29201/-28, size 40-0 line 2963
[  143.546825] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xfffffffffffffef8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="bbd9fe8194c03c69ec98a86c813a57dc29e1d76df332ed3b58bdd47e8c3dcce9c4dee3032993f51d8b1cfc94842284aedc0668340d"], 0x78, 0x0, &(0x7f00000000c0)="4f1edeeb341ed2fd7c6a3a03c3c5f1e29cc535e2f9a67c099ce97daf71e2a6d2ba72eae92dba984486fe0463f77b08517f2790092d47fbd9c17a566f463e126393a223c5df6bd5f46c32393b73063f605d08000000000800000000000000d5345afc1849523ff171879c71c7a5935f52e57c39e96346c7b7"})
r1 = creat(&(0x7f0000000040)='./file0\x00', 0xa9)
ioctl$TIOCGETD(r1, 0x5424, &(0x7f00000001c0))
ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc004240a, &(0x7f0000000180)={0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000140)={0x9, 0x3, 0x6, 0x200, 0x100000001, 0x10001})

2018/02/28 09:17:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:49 executing program 2:
r0 = dup(0xffffffffffffffff)
getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000240)={0x0, 0x2, 0xfa77, 0x1, 0xddb6, 0x6, 0x1, 0x7, {<r1=>0x0, @in={{0x2, 0x4e21, @empty}}, 0x8, 0x791, 0x9, 0x4, 0x1}}, &(0x7f0000000180)=0xb8)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000000)={<r2=>r1, @in={{0x2, 0x4e23, @multicast2=0xe0000002}}, 0x6}, &(0x7f00000000c0)=0x98)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000300)=ANY=[@ANYRES32=r2, @ANYBLOB="de0000009254bf4cb68004645610287e78545abb2fc8bddc3a0aadae2a1c6df5083333c02d61d61aed82f89ef0b83c06bf85fc61310db0d8861f88db51029e36518df071c7659e1516367eea68643a20d72f3ef4602b7035b5698a49b81eb7412afaef3402bcfdf333fe5d88735056ca0d6e3ef836640e9a3a8d91d1087050f0509612deff7752f74bdac58e63505aece03d2840397a2403000000ad96fc3cf4ea9c08b641afa75ca4e4c1810fea3af46794d8dcdff5e76628d643e651d7f0061aff2014602d06a877fad87188485592fcd673d3a786ff72f8bfd78a983b07660631a1e733d51004a8ddb8af92f5ba3e90de4ab0e88dd78df3dafce692f621f67c8864c8c583bc22b107b7ccb90935712c60a771076fcb754dfb28470ac9415879923e85d48d08b2590c21d90505ce54858d16f579221f3358819d904eb551c1657b06e343acba492b92727bf783b45de0bc76d701cc4819ba59b7d468963df5fbeb3716116d9dde63292a4820b03472807f357db267b59d492f42fcc42555553ba1a436b968445039cfcdb0b0d5de983ca21e39fe81b88163f4ed3f8b58072a8f13a76efa3bba8cb862fb06db43ae56da01deccd5370af87cf11b9ddf8adcafc78a8e509a8ad1b1bf1b68627e3f4f26584a4b3c"], &(0x7f0000000200)=0xe6)
getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000100)={r2, 0x1ff, 0x7ff, 0x3}, &(0x7f0000000140)=0x10)
fcntl$setpipe(r0, 0x407, 0xffffffffffffffe0)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000005c0)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000006c0)=0xe8)
bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0xe, 0x9, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2e5}, [@ldst={0x3, 0x3, 0x0, 0xf, 0x0, 0x44, 0x1}, @map={0x18, 0x7, 0x1, 0x0, r0}, @ldst={0x1, 0x3, 0x3, 0x7, 0x0, 0xfffffffe, 0xc}], {0x95}}, &(0x7f00000001c0)='syzkaller\x00', 0x80, 0x30, &(0x7f0000000580)=""/48, 0x41100, 0x1, [], r4}, 0x48)

2018/02/28 09:17:49 executing program 3:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x800, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)=""/31, 0x1f}], 0x1)
r1 = accept4$inet6(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, @dev}, &(0x7f00000000c0)=0x1c, 0x80800)
fcntl$getownex(r0, 0x10, &(0x7f0000000000))
ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000100)={0x5, 0x800, 0x8, 0x2800000, 0x1ff})

[  143.561930] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.569325] binder: undelivered TRANSACTION_ERROR: 29189
[  143.570817] binder: 20517:20518 transaction failed 29201/-28, size 40-8 line 2963
[  143.580655] binder: undelivered TRANSACTION_ERROR: 29201
[  143.591575] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  143.602160] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:49 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}]})

[  143.609924] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.618840] binder: 20522:20523 transaction failed 29201/-28, size 40-0 line 2963
[  143.621283] binder: undelivered TRANSACTION_ERROR: 29201
[  143.626528] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.639584] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.648474] binder: 20497:20514 transaction failed 29201/-28, size 40-0 line 2963
[  143.648509] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:49 executing program 4:
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0186404, &(0x7f00000000c0)={&(0x7f0000ffe000/0x1000)=nil, 0x7, 0x2, 0x80, &(0x7f0000ffd000/0x3000)=nil, 0x9})
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000004fbc)=[@reply={0x40406301, {0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, &(0x7f0000000000)=[], &(0x7f0000000040)=[0x18, 0x38, 0x38]}}], 0x0, 0x0, &(0x7f0000009000)})
openat(r0, &(0x7f0000000100)='./file0\x00', 0x10000, 0xa0)

2018/02/28 09:17:49 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$TIOCEXCL(r0, 0x540c)

[  143.663818] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.672710] binder: 20526:20527 transaction failed 29201/-28, size 40-0 line 2963
[  143.681978] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  143.691318] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.695700] binder: undelivered TRANSACTION_ERROR: 29201
[  143.700204] binder: 20532:20534 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
2018/02/28 09:17:49 executing program 5:
r0 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x800, 0x40000080000)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
setsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000000)=0x2, 0x4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000200)=""/210)
ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, &(0x7f00000001c0)={0x0, 0xfffffffffffffffb, 0x8, &(0x7f0000000140)})

2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  143.703472] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  143.723271] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.732161] binder: 20540:20542 transaction failed 29201/-28, size 40-8 line 2963
[  143.732664] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.745064] binder: 20543:20547 ioctl 540c 0 returned -22
[  143.747539] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:49 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
recvfrom$llc(r1, &(0x7f0000000040)=""/218, 0xda, 0x0, &(0x7f0000000140)={0x1a, 0x7, 0x1, 0x81, 0xe7, 0x10001, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x13}}, 0x10)

2018/02/28 09:17:49 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  143.760623] binder: 20541:20550 got reply transaction with no transaction stack
[  143.762055] binder: 20526:20530 transaction failed 29201/-28, size 40-0 line 2963
[  143.769442] binder: 20541:20550 transaction failed 29201/-71, size 0-24 line 2763
[  143.777152] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.789517] binder: undelivered TRANSACTION_ERROR: 29201
[  143.792315] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.792340] binder: 20543:20544 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  143.795597] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.822091] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.823666] binder: 20541:20550 got reply transaction with no transaction stack
[  143.830975] binder: 20552:20554 transaction failed 29201/-28, size 40-0 line 2963
[  143.839567] binder: undelivered TRANSACTION_ERROR: 29201
[  143.846098] binder: 20541:20550 transaction failed 29201/-71, size 0-24 line 2763
[  143.846504] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:49 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$TIOCEXCL(r0, 0x540c)

2018/02/28 09:17:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x8, 0x0, &(0x7f0000000000)=[@release={0x40046306}], 0xffffffffffffffad, 0x0, &(0x7f0000000040)="58887a991a56eabc479119fc9d1495a8ddd3be1996248244da17b91fef2cd4e868aec64ac5cbb7a6b8986f3ba0b26a7f95e44ebf637181f25d0b250000000000000000e93576a2f5de1efe39"})

[  143.854822] binder: undelivered TRANSACTION_ERROR: 29201
[  143.859283] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.859304] binder: 20555:20556 transaction failed 29201/-28, size 40-8 line 2963
[  143.873810] binder: undelivered TRANSACTION_ERROR: 29201
[  143.900984] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  143.908647] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.913986] binder: 20560:20561 Release 1 refcount change on invalid ref 0 ret -22
[  143.917526] binder: 20555:20556 transaction failed 29201/-28, size 40-8 line 2963
[  143.925603] binder: undelivered TRANSACTION_ERROR: 29201
[  143.938322] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  143.938346] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.938369] binder: 20558:20563 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  143.971697] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  143.974660] binder: undelivered TRANSACTION_ERROR: 29201
[  143.979492] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  143.984858] binder: undelivered TRANSACTION_ERROR: 29201
[  143.993664] binder: 20566:20567 transaction failed 29201/-28, size 40-0 line 2963
[  143.999155] binder: undelivered TRANSACTION_ERROR: 29201
[  144.012317] binder: 20566:20569 ioctl 540c 0 returned -22
2018/02/28 09:17:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000008000000000000000000000000000000000000592e9653df55691ef48dc780e529169d8bebeb37"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000280)={<r2=>0x0, <r3=>0x0})
mq_timedreceive(r1, &(0x7f0000000180)=""/233, 0xe9, 0x100000000, &(0x7f00000002c0)={r2, r3+30000000})
r4 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x9f7, 0x2000)
ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000000100)={0x0, 0x5, 0x100000000, &(0x7f00000000c0)})

2018/02/28 09:17:49 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802)

2018/02/28 09:17:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:49 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3ff, 0x200282)
r2 = fcntl$getown(r0, 0x9)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000080)={{0x8, 0x4, 0x84bb, 0x6cda, "688e95a337e0381fd949e3eb00260c8b3b4444fa17df0c8d4fc36538ceea9a1ac9d486e9785a84c81b4ecc98", 0x12000000000000}, 0x0, 0x0, 0x8000, r2, 0x5, 0xffffffffffff7fff, "9235d49a6088cc17e1facd9ba43d9927b51fdddd5cad8d7552543cca8963abd2524b6b174945c868fa22ac923a88ab100af95bae01158dfa85c46f84f195f32c", &(0x7f0000000040)='/dev/binder#\x00', 0xd, [], [0x7, 0x4, 0x68000000000, 0x9]})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:49 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$TIOCEXCL(r0, 0x540c)

2018/02/28 09:17:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8, 0x20003)
r2 = getpgrp(0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000080)={{0x7, 0x3, 0x4, 0x7, "c5de9f11b081414c2494ec51d19dc4baa906cfba57b7bf8726eda3197d79554b0469c967423b11dfb6f8f002", 0x401}, 0x0, 0x0, 0x80000001, r2, 0xfffffffffffffffb, 0x3, "d0c0def5ccf140ecad71e848c0a6dee1b4ffc696fb8aeb795de39e9edf5b435bacb2e0230b88d5416aa305a274a6a2259aea86aa986986ec0cd2b03884415484", &(0x7f0000000040)='posix_acl_access&cpuset\x00', 0x18, [], [0x6527, 0x2b6f, 0x8041, 0x9]})
ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f00000003c0))
ioctl$DRM_IOCTL_AGP_ENABLE(r1, 0x40046432, &(0x7f00000001c0)=0x5)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x48, 0x0, &(0x7f0000000280)=[@exit_looper={0x630d}, @transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x20, 0x20, &(0x7f0000000200)=[@fda={0x66646185, 0x7, 0x2, 0x24}], &(0x7f0000000240)=[0x78, 0x38, 0x68, 0x38]}}], 0x4e, 0x0, &(0x7f0000000300)="2407f8e46f54ab54943c34e69ebcbb64c52e58703090483399401ac85ec48dafa5c9a581a30af4b258dbcef5577c9c0cd8360bc53a20a26877784ddda2439add85d2d34614a3faa13b4c57cff19d"})

2018/02/28 09:17:49 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  144.016064] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.018351] binder: undelivered TRANSACTION_ERROR: 29201
[  144.025524] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.025549] binder: 20568:20571 transaction failed 29201/-28, size 40-0 line 2963
[  144.050116] binder: undelivered TRANSACTION_ERROR: 29201
[  144.059312] binder: undelivered TRANSACTION_ERROR: 29201
[  144.074424] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.082209] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.091102] binder: 20573:20576 transaction failed 29201/-28, size 40-0 line 2963
[  144.091208] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  144.107926] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})

[  144.116811] binder: 20579:20582 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  144.118311] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.135293] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.144172] binder: 20575:20578 transaction failed 29201/-28, size 40-0 line 2963
[  144.145212] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  144.159465] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.160902] binder: 20575:20578 ioctl 540c 0 returned -22
[  144.168351] binder: 20574:20583 transaction failed 29201/-28, size 40-8 line 2963
[  144.168631] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.188602] binder: undelivered TRANSACTION_ERROR: 29201
[  144.189236] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.189268] binder: 20577:20584 transaction failed 29201/-28, size 40-0 line 2963
[  144.195261] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:49 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  144.219010] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.228511] binder: 20580:20588 transaction failed 29201/-28, size 40-0 line 2963
[  144.228778] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.243808] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.252791] binder: 20573:20576 transaction failed 29201/-28, size 40-0 line 2963
[  144.257952] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x0, 0x0, &(0x7f0000009000)})

[  144.268143] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.277035] binder: 20605:20606 transaction failed 29201/-28, size 40-0 line 2963
[  144.277053] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  144.290898] binder: undelivered TRANSACTION_ERROR: 29201
[  144.292303] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.292338] binder: 20574:20596 transaction failed 29201/-28, size 40-8 line 2963
[  144.293661] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:50 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063404010000006000000000000000000280000000000000000000000000000007879161f6a76c755521a5343edfbd8cec135edc316036a3252b725b8612376d70d7c54395429741807091cc200000000000000000000000000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000cd89d4c6d860107200000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0xa0000, 0x0)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000100)={<r2=>0x0, @in={{0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1, 0x7, 0xffffffffffffa28e, 0x8, 0x8}, &(0x7f00000001c0)=0xa0)
setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000200)=r2, 0x4)

2018/02/28 09:17:50 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000026c000)=[], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  144.302242] binder: undelivered TRANSACTION_ERROR: 29201
[  144.306814] binder_alloc: allocated: 8128 (num: 181 largest: 96), free: 64 (num: 4 largest: 32)
[  144.323603] binder: undelivered TRANSACTION_ERROR: 29201
[  144.327476] binder: 20580:20595 transaction failed 29201/-28, size 40-0 line 2963
[  144.349550] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.357427] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.366314] binder: 20577:20584 transaction failed 29201/-28, size 40-0 line 2963
[  144.372047] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  144.381046] binder: undelivered TRANSACTION_ERROR: 29201
[  144.383119] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.390960] binder: undelivered TRANSACTION_ERROR: 29201
[  144.397415] binder: 20599:20604 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  144.402858] binder: undelivered TRANSACTION_ERROR: 29201
[  144.419059] binder: undelivered TRANSACTION_ERROR: 29201
[  144.424570] binder: release 20611:20612 transaction 794 out, still active
[  144.431535] binder: undelivered TRANSACTION_COMPLETE
[  144.437468] binder: undelivered TRANSACTION_ERROR: 29201
[  144.443007] binder: 20614:20615 got transaction to invalid handle
[  144.449291] binder: 20614:20615 transaction failed 29201/-22, size 5988189182914619935--1353963018807153341 line 2848
[  144.460127] binder: undelivered TRANSACTION_ERROR: 29201
[  144.462942] binder: 20614:20615 got transaction to invalid handle
2018/02/28 09:17:50 executing program 4:
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x8800, 0x0)
ioctl$int_in(r0, 0x5421, &(0x7f0000000040)=0x20000)
write$selinux_validatetrans(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="73797374656d5f753adac06a6563745f723a646d696465636f64655f657865635f743a73302073797374656d5f753a6f626a6563745f723a73797374656d645f6c6f67696e645f657865635f743a7330203938202f7573722f7362696e2f637570732d62726f7773656400"], 0x6b)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000002866c54b7d0000000000000000000000", @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000001ab3d8eacd5986451000000000000001f7a00005a9dbd4a9ec90e6647815504175a9f766734ba9fb0d58556ce566dfaed928665101f98623cd1291def812f4aee60340c035d263fcdea5159a85bc91bc47cf6e290db53b9e46aa84b594b03743bd0337554e61c99b8d61b46b97921ffffff7fa36188016efcd4d2e6ade91b534d36cb1703b671ef9b434ae3b517ed84715aa6479f016b6e9c208a57d9b5df09fc84c5f0a8d7cd0db5c5787b53cdf2a00fa6aac1c7664a6f1da061253311bd3c42b7"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000080))

2018/02/28 09:17:50 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$bt_hidp(0x1f, 0x3, 0x6)

2018/02/28 09:17:50 executing program 2:
r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xb16, 0x2)
ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000340)={<r1=>0x0, 0x1a, "ca2bd4781913eef1e463370172e18feae43049015471c1bbdd1e"}, &(0x7f0000000380)=0x22)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e20, 0x1c0000000000000, @local={0xfe, 0x80, [], 0xaa}, 0x5}}, 0x45e39e20, 0xffff, 0x3, 0xb272, 0x10}, 0xa0)
ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {<r2=>0x0}]})
ioctl$DRM_IOCTL_DMA(r0, 0xc0286429, &(0x7f0000000300)={r2, 0x3, &(0x7f00000000c0)=[0x2, 0xc1, 0x4], &(0x7f0000000100)=[0x0, 0x3, 0x1], 0x0, 0x2, 0x5, &(0x7f0000000280)=[0x7, 0x200], &(0x7f00000002c0)=[0xffffffffffffffc1, 0x5, 0x2, 0x2]})
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627700020000c379020e1330dbeeb4bcd353ca342b0ca9123fca03884a622003c7fec4b32371e95653099c162262fdfa8d2da0f67c144bd9c0f4e3c10120e00f6a18725879f6bf86c6a82e080ebbd501bda4fb53210ba9ce0d712c5ed26e061fa77555b9e190ee2eef38f61d7b298f344d1362abb3a0ba78661d41a9d2ce6d1a77a1f67a6d594e029490f18d9227b88b1a77827ff0bdd7972953cadcdf7e38bf18dee2eb6a2af3b744e4ed95c7b3d02817b594d93bf8dc4890fb2e65a04b5c4684bcd318a42facb3a5ee2576bce8addb2dcd13abb15a22521b9159b931a6a5f442e1b9f3eef4a99dc9ecd652dd8f80efce3f8a208be2", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000094c34e6077f0da97e98953d05062b37000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r4 = geteuid()
r5 = getegid()
lchown(&(0x7f0000000480)='./file0\x00', r4, r5)

2018/02/28 09:17:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = dup(r0)
ioctl$VT_RELDISP(r1, 0x5605)

2018/02/28 09:17:50 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000026c000)=[], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x41, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca00280000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:50 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  144.471972] binder: 20614:20615 transaction failed 29201/-22, size 5988189182914619935--1353963018807153341 line 2848
[  144.485550] binder: undelivered TRANSACTION_ERROR: 29201
[  144.501002] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  144.501533] binder: undelivered TRANSACTION_ERROR: 29201
[  144.508693] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
2018/02/28 09:17:50 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000004fbc)=ANY=[@ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  144.508719] binder: 20619:20622 transaction failed 29201/-28, size 40-8 line 2963
[  144.512599] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.538416] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.541671] binder: 20635:20637 unknown command 539410432
[  144.547302] binder: 20623:20626 transaction failed 29201/-28, size 40-0 line 2963
[  144.549757] binder_alloc: 6345: binder_alloc_buf size -286466233676689792 failed, no address space
[  144.555306] QAT: Invalid ioctl
2018/02/28 09:17:50 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x43, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  144.560569] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.560612] binder: 20628:20631 transaction failed 29201/-28, size -3078698002649018962-2792231768972329162 line 2963
[  144.569801] binder_alloc: 6345: binder_alloc_buf size 538142139944 failed, no address space
[  144.579422] binder: 20621:20639 ioctl 5605 0 returned -22
[  144.581871] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.615420] binder: 20620:20632 transaction failed 29201/-28, size 538142139944-0 line 2963
[  144.615430] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.631631] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.640485] binder: 20621:20639 transaction failed 29201/-28, size 40-0 line 2963
[  144.640499] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.651793] binder: 20635:20637 ioctl c0306201 20008000 returned -22
[  144.655776] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
2018/02/28 09:17:50 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000004fbc)=ANY=[@ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  144.655811] binder: 20621:20624 transaction failed 29201/-28, size 40-0 line 2963
[  144.658484] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  144.688038] binder_alloc: allocated: 8136 (num: 182 largest: 96), free: 56 (num: 3 largest: 32)
[  144.696917] binder: 20646:20647 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  144.697438] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.714334] binder_alloc: allocated: 8144 (num: 183 largest: 96), free: 48 (num: 2 largest: 32)
[  144.716539] binder: 20650:20651 unknown command 539410432
[  144.723217] binder: 20623:20626 transaction failed 29201/-28, size 40-0 line 2963
[  144.728822] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  144.743847] binder: release 20627:20630 transaction 802 out, still active
[  144.744134] binder_alloc: allocated: 8144 (num: 183 largest: 96), free: 48 (num: 2 largest: 32)
[  144.751004] binder: undelivered TRANSACTION_COMPLETE
[  144.759805] binder: 20619:20622 transaction failed 29201/-28, size 40-8 line 2963
2018/02/28 09:17:50 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000026c000)=[], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  144.772997] binder_alloc: 6345: binder_alloc_buf size 538142139944 failed, no address space
[  144.781565] binder_alloc: allocated: 8144 (num: 183 largest: 96), free: 48 (num: 2 largest: 32)
[  144.784050] binder: undelivered TRANSACTION_ERROR: 29201
[  144.790578] binder: 20620:20644 transaction failed 29201/-28, size 538142139944-0 line 2963
[  144.800052] binder: release 20652:20653 transaction 808 out, still active
[  144.804894] binder: 20650:20651 ioctl c0306201 20008000 returned -22
[  144.811407] binder: undelivered TRANSACTION_COMPLETE
2018/02/28 09:17:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r0, 0x9, 0x1, 0x9, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x2e2)
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000140))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000002800000000000000000000000000000035225c7d4a9d1fb14af212776346cc6f859727078dc944ce53719666a8df071e6dddce1b6150c9009e6813fc3ea76f77e8202f94179d3ab1dc3c9558b6c7cc7ef3de5abd07fdd71c10afae950fec178080684e1f40e635ec738e9d6bd30f1334eabadd3be999ad73b0c4f31a2bff6828dc1be25c44f7a979b1700d", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/policy\x00', 0x0, 0x0)
write$vnet(r1, &(0x7f0000000240)={0x1, {&(0x7f00000001c0)=""/10, 0xa, &(0x7f0000000200)=""/60, 0x1, 0x3}}, 0x68)
setsockopt$netrom_NETROM_T2(r1, 0x103, 0x2, &(0x7f00000002c0)=0x4437, 0x4)

2018/02/28 09:17:50 executing program 6:
r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xb16, 0x2)
ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000340)={<r1=>0x0, 0x1a, "ca2bd4781913eef1e463370172e18feae43049015471c1bbdd1e"}, &(0x7f0000000380)=0x22)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e20, 0x1c0000000000000, @local={0xfe, 0x80, [], 0xaa}, 0x5}}, 0x45e39e20, 0xffff, 0x3, 0xb272, 0x10}, 0xa0)
ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {<r2=>0x0}]})
ioctl$DRM_IOCTL_DMA(r0, 0xc0286429, &(0x7f0000000300)={r2, 0x3, &(0x7f00000000c0)=[0x2, 0xc1, 0x4], &(0x7f0000000100)=[0x0, 0x3, 0x1], 0x0, 0x2, 0x5, &(0x7f0000000280)=[0x7, 0x200], &(0x7f00000002c0)=[0xffffffffffffffc1, 0x5, 0x2, 0x2]})
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627700020000c379020e1330dbeeb4bcd353ca342b0ca9123fca03884a622003c7fec4b32371e95653099c162262fdfa8d2da0f67c144bd9c0f4e3c10120e00f6a18725879f6bf86c6a82e080ebbd501bda4fb53210ba9ce0d712c5ed26e061fa77555b9e190ee2eef38f61d7b298f344d1362abb3a0ba78661d41a9d2ce6d1a77a1f67a6d594e029490f18d9227b88b1a77827ff0bdd7972953cadcdf7e38bf18dee2eb6a2af3b744e4ed95c7b3d02817b594d93bf8dc4890fb2e65a04b5c4684bcd318a42facb3a5ee2576bce8addb2dcd13abb15a22521b9159b931a6a5f442e1b9f3eef4a99dc9ecd652dd8f80efce3f8a208be2", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000094c34e6077f0da97e98953d05062b37000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r4 = geteuid()
r5 = getegid()
lchown(&(0x7f0000000480)='./file0\x00', r4, r5)

2018/02/28 09:17:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01c91a7556622fe59e000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
open_by_handle_at(r0, &(0x7f0000000000)={0x9, 0x3f, 'I'}, 0x22000)
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/if_inet6\x00')
ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f00000000c0)={&(0x7f0000000080)=[0x4, 0xffffffffffff8935, 0x101, 0x3ff, 0xf7e, 0x1, 0x2], 0x7, 0x3, 0xeef8, 0x4, 0x1, 0x364, {0xfffffffffffffffb, 0x7fff, 0x400, 0x3, 0x0, 0x3, 0x4, 0xf896, 0xf800000000000000, 0x2, 0x6, 0x0, 0x8, 0x800, "0d032f858a3d063cf3d062e2ee1ab08d2dc5164f02f5640dccdbd24d92133f60"}})

2018/02/28 09:17:50 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="08000000f8000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="00813123c55d83fc80ad213c5a62e579231d908dc8040631df7ec3a91ca20af0ccd79e0f7028dec924b21d408cb83b96daee0b"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x6, 0x2001)
ioctl$KVM_KVMCLOCK_CTRL(r1, 0xaead)
r2 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c, 0x80000)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@local}, 0x0, @in6=@empty}}, &(0x7f00000001c0)=0xe8)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800)
ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000200)={@mcast1={0xff, 0x1, [], 0x1}, @ipv4={[], [0xff, 0xff], @rand_addr=0x5}, @mcast1={0xff, 0x1, [], 0x1}, 0x9, 0x8, 0xec28, 0x100, 0x2, 0x8, r3})

2018/02/28 09:17:50 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000004fbc)=ANY=[@ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x43, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:50 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x408, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0xc8, 0xc8, 0xf0, [@arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

[  144.821148] binder: undelivered TRANSACTION_ERROR: 29201
[  144.845408] binder: undelivered TRANSACTION_ERROR: 29201
[  144.864092] binder: undelivered TRANSACTION_ERROR: 29201
[  144.875118] binder: undelivered TRANSACTION_ERROR: 29201
[  144.877339] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.880666] binder: undelivered TRANSACTION_ERROR: 29201
[  144.888272] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  144.888297] binder: 20655:20663 transaction failed 29201/-28, size 40-0 line 2963
[  144.893982] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.917882] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:50 executing program 6:
r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xb16, 0x2)
ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000340)={<r1=>0x0, 0x1a, "ca2bd4781913eef1e463370172e18feae43049015471c1bbdd1e"}, &(0x7f0000000380)=0x22)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e20, 0x1c0000000000000, @local={0xfe, 0x80, [], 0xaa}, 0x5}}, 0x45e39e20, 0xffff, 0x3, 0xb272, 0x10}, 0xa0)
ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {<r2=>0x0}]})
ioctl$DRM_IOCTL_DMA(r0, 0xc0286429, &(0x7f0000000300)={r2, 0x3, &(0x7f00000000c0)=[0x2, 0xc1, 0x4], &(0x7f0000000100)=[0x0, 0x3, 0x1], 0x0, 0x2, 0x5, &(0x7f0000000280)=[0x7, 0x200], &(0x7f00000002c0)=[0xffffffffffffffc1, 0x5, 0x2, 0x2]})
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627700020000c379020e1330dbeeb4bcd353ca342b0ca9123fca03884a622003c7fec4b32371e95653099c162262fdfa8d2da0f67c144bd9c0f4e3c10120e00f6a18725879f6bf86c6a82e080ebbd501bda4fb53210ba9ce0d712c5ed26e061fa77555b9e190ee2eef38f61d7b298f344d1362abb3a0ba78661d41a9d2ce6d1a77a1f67a6d594e029490f18d9227b88b1a77827ff0bdd7972953cadcdf7e38bf18dee2eb6a2af3b744e4ed95c7b3d02817b594d93bf8dc4890fb2e65a04b5c4684bcd318a42facb3a5ee2576bce8addb2dcd13abb15a22521b9159b931a6a5f442e1b9f3eef4a99dc9ecd652dd8f80efce3f8a208be2", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000094c34e6077f0da97e98953d05062b37000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r4 = geteuid()
r5 = getegid()
lchown(&(0x7f0000000480)='./file0\x00', r4, r5)

[  144.926772] binder: 20658:20661 transaction failed 29201/-28, size 40-0 line 2963
[  144.926831] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  144.942128] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  144.946266] binder: undelivered TRANSACTION_ERROR: 29201
[  144.951041] binder: 20657:20664 transaction failed 29201/-28, size 40-0 line 2963
[  144.956612] binder: undelivered TRANSACTION_ERROR: 29201
[  144.965259] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  144.973881] binder: undelivered TRANSACTION_ERROR: 29201
[  144.977229] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  144.977256] binder: 20659:20665 transaction failed 29201/-28, size 40-8 line 2963
[  144.992308] binder: 20679:20680 ioctl 80284504 20000000 returned -22
[  144.999607] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  145.006268] binder: undelivered TRANSACTION_ERROR: 29201
[  145.014976] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.015008] binder: 20660:20667 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  145.020904] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.046820] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.054084] binder: 20684:20686 unknown command 539410432
[  145.055703] binder: 20654:20662 transaction failed 29201/-28, size 40-0 line 2963
[  145.062458] binder: 20684:20686 ioctl c0306201 20008000 returned -22
2018/02/28 09:17:50 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = dup(r0)
ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000000)=""/117)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB, @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:50 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x43, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  145.070052] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.083997] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.092899] binder: 20674:20675 transaction failed 29201/-28, size 40-0 line 2963
[  145.092925] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.106848] binder: undelivered TRANSACTION_ERROR: 29201
[  145.108303] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:50 executing program 6:
r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xb16, 0x2)
ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000340)={<r1=>0x0, 0x1a, "ca2bd4781913eef1e463370172e18feae43049015471c1bbdd1e"}, &(0x7f0000000380)=0x22)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e20, 0x1c0000000000000, @local={0xfe, 0x80, [], 0xaa}, 0x5}}, 0x45e39e20, 0xffff, 0x3, 0xb272, 0x10}, 0xa0)
ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {<r2=>0x0}]})
ioctl$DRM_IOCTL_DMA(r0, 0xc0286429, &(0x7f0000000300)={r2, 0x3, &(0x7f00000000c0)=[0x2, 0xc1, 0x4], &(0x7f0000000100)=[0x0, 0x3, 0x1], 0x0, 0x2, 0x5, &(0x7f0000000280)=[0x7, 0x200], &(0x7f00000002c0)=[0xffffffffffffffc1, 0x5, 0x2, 0x2]})
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="852a627700020000c379020e1330dbeeb4bcd353ca342b0ca9123fca03884a622003c7fec4b32371e95653099c162262fdfa8d2da0f67c144bd9c0f4e3c10120e00f6a18725879f6bf86c6a82e080ebbd501bda4fb53210ba9ce0d712c5ed26e061fa77555b9e190ee2eef38f61d7b298f344d1362abb3a0ba78661d41a9d2ce6d1a77a1f67a6d594e029490f18d9227b88b1a77827ff0bdd7972953cadcdf7e38bf18dee2eb6a2af3b744e4ed95c7b3d02817b594d93bf8dc4890fb2e65a04b5c4684bcd318a42facb3a5ee2576bce8addb2dcd13abb15a22521b9159b931a6a5f442e1b9f3eef4a99dc9ecd652dd8f80efce3f8a208be2", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000094c34e6077f0da97e98953d05062b37000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r4 = geteuid()
r5 = getegid()
lchown(&(0x7f0000000480)='./file0\x00', r4, r5)

2018/02/28 09:17:50 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2a, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  145.122616] binder: 20657:20669 transaction failed 29201/-28, size 40-0 line 2963
[  145.123049] binder_alloc: 6345: binder_alloc_buf size -3078698002646397312 failed, no address space
[  145.139551] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.148412] binder: 20687:20690 transaction failed 29201/-28, size -3078698002649018962-2621642 line 2963
[  145.148428] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.165819] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:50 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x42, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca0028000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  145.174708] binder: 20654:20668 transaction failed 29201/-28, size 40-0 line 2963
[  145.174732] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.184766] binder: 20679:20694 ioctl 80284504 20000000 returned -22
[  145.190055] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.202403] binder: undelivered TRANSACTION_ERROR: 29201
[  145.205407] binder: 20679:20688 transaction failed 29201/-28, size 40-0 line 2963
[  145.205599] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
2018/02/28 09:17:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0x7, 0x8000)
getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f00000001c0)=0x7be, &(0x7f0000000200)=0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="850762770000000040be04b850f43e58cd58cde56ebd0bbd2a5fbdfc7be0c2749cd28f5e127c8a95d5373d384bf787d4fedea3d49f2f2b6294118b19c81d5395c5a1015a8722b02f8afe18e91e09401c2588d8e5cc80c0411613457ef79780cf51d6e07762ac41559b71de611615a5b06f13b5877b34442f842b81f8b6195b09e5fe0500000000000000ce2c5289f3513f007d3023af582ddb9c73982c6f1dfe281465c3", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc)

2018/02/28 09:17:50 executing program 2:
syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

[  145.212299] binder: undelivered TRANSACTION_ERROR: 29201
[  145.218633] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.230246] binder: undelivered TRANSACTION_ERROR: 29201
[  145.231658] binder: 20659:20676 transaction failed 29201/-28, size 40-8 line 2963
[  145.243201] binder_alloc: 6345: binder_alloc_buf size 8192 failed, no address space
[  145.261505] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.268067] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:51 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$bt_hidp(0x1f, 0x3, 0x6)

[  145.270369] binder: 20691:20695 transaction failed 29201/-28, size 8192-0 line 2963
[  145.284858] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.292543] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.301425] binder: 20692:20698 transaction failed 29201/-28, size 40-0 line 2963
[  145.311085] binder: undelivered TRANSACTION_ERROR: 29201
[  145.318231] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:51 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = memfd_create(&(0x7f0000000040)='/dev/binder#\x00', 0x430dbfc5847321f0)
setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000080)={{{{0x2, 0x4e22, @multicast1=0xe0000001}}, {{0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x2}}}, 0x9, 0xffffffff, 0x1, "69dd4a6c6b54700bd930cd98a5cd2b07e775eaf15123b171a5678a0f057a95b9ea74120b19a2db0387db8cf9ffc5bacd9113f797d42dee3332709dcdf9c4996f620f9dedf2338f2447e7eadcecdf2836"}, 0x160)
pipe(&(0x7f0000000000))

2018/02/28 09:17:51 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2a, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:51 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7ff, 0x1)
ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffff9c, 0xc010640b, &(0x7f0000000040)={0x0, <r2=>0x0, 0x80000001})
r3 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x60, 0x800)
ioctl$KDSETMODE(r3, 0x4b3a, 0x9)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f00000000c0)={r2, 0x80000, r3})

[  145.326142] binder: undelivered TRANSACTION_ERROR: 29201
[  145.345070] binder: undelivered TRANSACTION_ERROR: 29201
[  145.351671] binder: undelivered TRANSACTION_ERROR: 29201
[  145.359959] kernel msg: ebtables bug: please report to author: Wrong len argument
2018/02/28 09:17:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  145.397989] binder: 20706:20710 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  145.404618] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.416532] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.425418] binder: 20709:20715 transaction failed 29201/-28, size 40-0 line 2963
[  145.425980] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.440775] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.449666] binder: 20708:20711 transaction failed 29201/-28, size 40-0 line 2963
[  145.454646] binder: undelivered TRANSACTION_ERROR: 29201
[  145.457525] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.470495] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.479382] binder: 20705:20712 transaction failed 29201/-28, size 40-0 line 2963
[  145.484583] binder_alloc: 6345: binder_alloc_buf size 8192 failed, no address space
[  145.495033] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.503922] binder: 20714:20718 transaction failed 29201/-28, size 8192-0 line 2963
[  145.506205] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  145.515370] binder: undelivered TRANSACTION_ERROR: 29201
[  145.519418] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.533710] binder: 20707:20716 transaction failed 29201/-28, size 40-8 line 2963
[  145.533735] binder: 20720:20722 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  145.541382] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.559906] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.566395] binder: undelivered TRANSACTION_ERROR: 29201
[  145.568837] binder: 20705:20712 transaction failed 29201/-28, size 40-0 line 2963
[  145.574740] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.585198] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:51 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x408, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0xc8, 0xc8, 0xf0, [@arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:51 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2a, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x5c, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec680aeebea5c84f608c3930c3"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:51 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$bt_hidp(0x1f, 0x3, 0x6)

2018/02/28 09:17:51 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x37, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="780882c81972728ad2a8c871cfb7a82eefe59a79680ab27238f238584bd5aad79343ba365f325ccb049edfd08a990edd4871e42ce1a81c08bb9fe0265e254e13b27f48d7764710906c4c2cf84e5dfd08702cc48240437ef35e93b5c909c232303d63bb2fcbf90c6e70df1e49b7bc5442e73c8f9fa6c50490f652aa4edba366dd461d60ab7d1e4546575f83dcd56d38ab903d52aa"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000000)={0x0, <r1=>r0})
ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000040)=0x2)

[  145.589520] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.595162] binder: undelivered TRANSACTION_ERROR: 29201
[  145.603811] binder: 20708:20711 transaction failed 29201/-28, size 40-0 line 2963
[  145.620308] binder: undelivered TRANSACTION_ERROR: 29201
[  145.625804] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852ab9c4e53c3e08", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x2400, 0x44)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, 0x4000})

[  145.643942] binder: 20728:20736 transaction failed 29189/-22, size 40-0 line 2848
[  145.644832] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  145.659311] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.659764] binder: undelivered TRANSACTION_ERROR: 29189
[  145.668214] binder: 20730:20735 transaction failed 29201/-28, size 40-8 line 2963
[  145.673843] binder_alloc: 6345: binder_alloc_buf size 8192 failed, no address space
[  145.689097] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:51 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)})
socket$bt_hidp(0x1f, 0x3, 0x6)

[  145.698006] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.698034] binder: 20731:20737 transaction failed 29201/-28, size 8192-0 line 2963
[  145.713542] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.721802] binder: undelivered TRANSACTION_ERROR: 29201
[  145.722421] binder: 20744:20746 transaction failed 29201/-28, size 40-0 line 2963
[  145.728231] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:51 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x37, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  145.743111] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.744127] binder: 20729:20749 ioctl c00caee0 20000000 returned -22
[  145.751999] binder: 20732:20740 transaction failed 29201/-28, size 40-0 line 2963
[  145.756046] binder: undelivered TRANSACTION_ERROR: 29201
[  145.762059] binder: 20733:20739 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  145.768167] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.790376] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:51 executing program 4:
syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0xc1)
socket$alg(0x26, 0x5, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f00000004c0)=""/186)
setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000300)={0x80, {{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1a}}}, 0x1, 0x2, [{{0x2, 0x4e23, @rand_addr=0x1}}, {{0x2, 0x4e21, @empty}}]}, 0x1a8)
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x7, <r2=>r0})
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000100)={{{@in=@broadcast, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@rand_addr}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8)
ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000280)={{0x1, 0x5000000000}, {0x8, 0x7}, 0x40, 0x1, 0x1})
recvfrom$packet(r2, &(0x7f0000000040)=""/18, 0x12, 0x40, &(0x7f0000000240)={0x11, 0x15, r3, 0x1, 0x40, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x15}}, 0x14)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000c9b67a9588d60000000000000000000000000000b48bbc480000ff4b6d077a3c44a26824a6ac9e0000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f00000000c0))

[  145.799240] binder: 20744:20748 transaction failed 29201/-28, size 40-0 line 2963
[  145.799263] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.814576] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.817212] binder: undelivered TRANSACTION_ERROR: 29201
[  145.823489] binder: 20734:20741 transaction failed 29201/-28, size 40-0 line 2963
[  145.829128] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]]})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  145.844302] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.853215] binder: 20729:20738 transaction failed 29201/-28, size 40-0 line 2963
[  145.861106] binder_alloc: 6345: binder_alloc_buf size 48 failed, no address space
[  145.868820] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.877710] binder: 20750:20754 transaction failed 29201/-28, size 40-8 line 2963
[  145.877789] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.885577] binder: undelivered TRANSACTION_ERROR: 29201
[  145.893055] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.893084] binder: 20759:20761 transaction failed 29201/-28, size 40-0 line 2963
[  145.893289] binder_alloc: 6345: binder_alloc_buf size 4917113529857763240 failed, no address space
[  145.907442] binder: undelivered TRANSACTION_ERROR: 29201
[  145.907723] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.915463] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000000)={0x0, <r1=>r0})
ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000040)=0x2)

[  145.924440] binder: 20758:20762 transaction failed 29201/-28, size 4916939065498795776-174464358967458 line 2963
[  145.933279] binder: undelivered TRANSACTION_ERROR: 29201
[  145.938772] binder: 20760:20763 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  145.944285] binder: undelivered TRANSACTION_ERROR: 29201
[  145.975288] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  145.984077] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  145.986179] kernel msg: ebtables bug: please report to author: Wrong len argument
[  145.992953] binder: 20768:20769 transaction failed 29201/-28, size 40-0 line 2963
[  146.002933] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  146.015941] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.018602] binder: undelivered TRANSACTION_ERROR: 29201
[  146.024857] binder: 20767:20770 transaction failed 29201/-28, size 40-0 line 2963
[  146.025068] binder: 20767:20771 ioctl c00caee0 20000000 returned -22
2018/02/28 09:17:51 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x408, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0xc8, 0xc8, 0xf0, [@arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:51 executing program 0 (fault-call:2 fault-nth:0):
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3e, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]]})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:51 executing program 6 (fault-call:2 fault-nth:0):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:51 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x40000, 0x0)
connect$netlink(r0, &(0x7f0000000180)=@kern={0x10, 0x0, 0x0, 0x20}, 0xc)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000001c0)={{{{0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}}, {{0xa, 0x4e22, 0xbaa1, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x8}}}, 0x100000001, 0x7fffffff, 0x5, "ff08c3d003c9e63f74bf626a28b77007438660a9bae0781434689ec12820a990b750dbebf0fa2ebed592f0b5d4379d5979078d7a737d8abe97e19fed5a963fad70d5283929015ea3dd9d1d314eda468d"}, 0x160)

2018/02/28 09:17:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x13)
accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x0, @reserved=0x1}, 0x10, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x200, 0x40800)
ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000040)=""/145)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  146.031353] binder_alloc: 6345: binder_alloc_buf size 4917113529857763240 failed, no address space
[  146.053779] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.062665] binder: 20758:20766 transaction failed 29201/-28, size 4916939065498795776-174464358967458 line 2963
[  146.073167] binder: undelivered TRANSACTION_ERROR: 29201
[  146.078699] binder: undelivered TRANSACTION_ERROR: 29201
[  146.084211] binder: undelivered TRANSACTION_ERROR: 29201
[  146.089707] binder: undelivered TRANSACTION_ERROR: 29201
[  146.101662] binder_alloc: 6345: binder_alloc_buf size 35350802071592 failed, no address space
[  146.106724] FAULT_INJECTION: forcing a failure.
[  146.106724] name failslab, interval 1, probability 0, space 0, times 0
[  146.110375] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.110405] binder: 20775:20777 transaction failed 29201/-28, size 40-35350802071552 line 2963
[  146.110462] binder: undelivered TRANSACTION_ERROR: 29201
[  146.121609] CPU: 0 PID: 20779 Comm: syz-executor0 Not tainted 4.16.0-rc3+ #242
[  146.121614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  146.121618] Call Trace:
[  146.121631]  dump_stack+0x194/0x24d
[  146.121647]  ? arch_local_irq_restore+0x53/0x53
[  146.136913] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  146.139188]  ? __lock_acquire+0x664/0x3e00
[  146.139210]  should_fail+0x8c0/0xa40
[  146.144704] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.151980]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  146.151997]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[  146.152010]  ? print_irqtrace_events+0x270/0x270
[  146.161398] binder: 20783:20786 transaction failed 29201/-28, size 40-0 line 2963
[  146.163901]  ? trace_hardirqs_off+0x10/0x10
[  146.163909]  ? trace_hardirqs_off+0x10/0x10
[  146.163928]  ? find_held_lock+0x35/0x1d0
[  146.168257] binder: 20776:20781 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  146.172201]  ? check_same_owner+0x320/0x320
[  146.172211]  ? lock_downgrade+0x980/0x980
[  146.172218]  ? lock_downgrade+0x980/0x980
[  146.172231]  ? rcu_note_context_switch+0x710/0x710
[  146.181218] FAULT_INJECTION: forcing a failure.
[  146.181218] name failslab, interval 1, probability 0, space 0, times 0
[  146.184039]  ? lock_release+0xa40/0xa40
[  146.184047]  ? lock_release+0xa40/0xa40
[  146.184068]  should_failslab+0xec/0x120
[  146.184081]  kmem_cache_alloc_trace+0x4b/0x740
[  146.287940]  binder_get_thread+0x1cf/0x870
[  146.292159]  ? binder_inc_ref_for_node+0xbc0/0xbc0
[  146.297076]  ? check_same_owner+0x320/0x320
[  146.301385]  ? rcu_note_context_switch+0x710/0x710
[  146.306301]  ? __might_sleep+0x95/0x190
[  146.310264]  binder_ioctl+0x20c/0x1417
[  146.314144]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[  146.319756]  ? check_same_owner+0x320/0x320
[  146.324062]  ? rcu_note_context_switch+0x710/0x710
[  146.328981]  ? __might_sleep+0x95/0x190
[  146.332946]  ? _cond_resched+0x14/0x30
[  146.336820]  ? selinux_file_ioctl+0x444/0x690
[  146.341300]  ? __fget_light+0x2b2/0x3c0
[  146.345263]  ? selinux_capable+0x40/0x40
[  146.349316]  ? __sb_end_write+0xa0/0xd0
[  146.353281]  ? security_file_ioctl+0x7d/0xb0
[  146.357668]  ? security_file_ioctl+0x89/0xb0
[  146.362069]  compat_SyS_ioctl+0x151/0x2a30
[  146.366286]  ? do_fast_syscall_32+0x156/0xf9f
[  146.370762]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[  146.376372]  ? do_ioctl+0x60/0x60
[  146.379810]  do_fast_syscall_32+0x3ec/0xf9f
[  146.384123]  ? do_int80_syscall_32+0x9c0/0x9c0
[  146.388684]  ? _raw_spin_unlock_irq+0x27/0x70
[  146.393158]  ? finish_task_switch+0x1c1/0x7e0
[  146.397642]  ? syscall_return_slowpath+0x2ac/0x550
[  146.402555]  ? prepare_exit_to_usermode+0x350/0x350
[  146.407553]  ? sysret32_from_system_call+0x5/0x3c
[  146.412382]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  146.417218]  entry_SYSENTER_compat+0x70/0x7f
[  146.421603] RIP: 0023:0xf7fbbc99
[  146.424961] RSP: 002b:00000000f77b709c EFLAGS: 00000286 ORIG_RAX: 0000000000000036
[  146.432652] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000c0306201
[  146.439899] RDX: 0000000020008000 RSI: 0000000000000000 RDI: 0000000000000000
[  146.447148] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  146.454394] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  146.461641] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  146.468926] CPU: 1 PID: 20782 Comm: syz-executor6 Not tainted 4.16.0-rc3+ #242
[  146.476279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  146.485619] Call Trace:
[  146.486750] binder_alloc: 6345: binder_alloc_buf size 35350802071592 failed, no address space
[  146.488189]  dump_stack+0x194/0x24d
[  146.488206]  ? arch_local_irq_restore+0x53/0x53
[  146.488218]  ? reacquire_held_locks+0x1f9/0x3e0
[  146.488227]  ? reacquire_held_locks+0x1f9/0x3e0
[  146.488251]  should_fail+0x8c0/0xa40
[  146.488265]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  146.496920] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.500503]  ? trace_hardirqs_off+0x10/0x10
[  146.500511]  ? lock_downgrade+0x980/0x980
[  146.500521]  ? lock_downgrade+0x980/0x980
[  146.505188] binder: 20789:20790 transaction failed 29201/-28, size 40-35350802071552 line 2963
[  146.509804]  ? trace_hardirqs_off+0x10/0x10
[  146.509815]  ? lock_acquire+0x1d5/0x580
[  146.509825]  ? lock_acquire+0x1d5/0x580
[  146.518516] binder: 20774:20779 ioctl c0306201 20008000 returned -12
[  146.523241]  ? find_held_lock+0x35/0x1d0
[  146.523297]  ? check_same_owner+0x320/0x320
[  146.523312]  ? rcu_note_context_switch+0x710/0x710
[  146.557676] binder_alloc: 6345: binder_alloc_buf size 4622786481662984232 failed, no address space
[  146.557698]  ? check_same_owner+0x320/0x320
[  146.561699] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.565607]  should_failslab+0xec/0x120
[  146.565621]  kmem_cache_alloc_node_trace+0x5a/0x760
[  146.572111] binder: 20792:20794 transaction failed 29201/-28, size 2316750164561231912-2306036317101752320 line 2963
[  146.576139]  __get_vm_area_node+0xae/0x340
[  146.583437] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  146.585343]  __vmalloc_node_range+0xa3/0x650
[  146.585357]  ? compat_do_replace+0x19f/0x7c0
[  146.585386]  vmalloc+0x45/0x50
2018/02/28 09:17:52 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3e, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:52 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x38, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:52 executing program 0:
r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x0)
setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f00000000c0)={0x3, 0x4, 0x1ff, 0xd6}, 0x10)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80800)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f00000002c0)=[@in={0x2, 0x4e24, @multicast1=0xe0000001}, @in={0x2, 0x4e20, @loopback=0x7f000001}, @in={0x2, 0x4e23, @broadcast=0xffffffff}, @in={0x2, 0x4e20, @multicast2=0xe0000002}], 0x156)
r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
setsockopt$netrom_NETROM_IDLE(r3, 0x103, 0x7, &(0x7f0000000040)=0x400, 0x4)
syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x7, 0x2000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="852a627700000080fe44eb0fd8e5e4fdeead1fa58b4b887980b31236633bf3dc3491ae3480271cf3f55b3d6f294d9c46bff9a812279da31b1b0659e691b9697614baa99e3e4cae2e4e38a44bf39f5e3392a968e18b", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:52 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x32, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  146.585396]  ? compat_do_replace+0x19f/0x7c0
[  146.585409]  compat_do_replace+0x19f/0x7c0
[  146.594499] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.598783]  ? do_ebt_set_ctl+0x110/0x110
[  146.598826]  ? ns_capable_common+0xcf/0x160
[  146.607634] binder: 20793:20795 transaction failed 29201/-28, size 40-0 line 2963
[  146.611555]  compat_do_ebt_set_ctl+0x22a/0x2d0
[  146.611570]  ? compat_do_replace+0x7c0/0x7c0
[  146.630226] kernel msg: ebtables bug: please report to author: Wrong len argument
2018/02/28 09:17:52 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2c, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:52 executing program 4:
pipe2(&(0x7f0000000000)={<r0=>0xffffffffffffffff}, 0x800)
socket$bt_hci(0x1f, 0x3, 0x1)
r1 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8, 0x48810, 0xffffffffffffff9c, 0x3a)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000011c0)={0x54, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)=[@ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x3, 0x12}, @flat={0x73682a85, 0xa, r1, 0x3}, @fda={0x66646185, 0x4, 0x0, 0x16}], &(0x7f0000000100)=[0x20, 0x78, 0x40]}, 0x20000000000}}, @decrefs={0x40046307, 0x2}], 0x1000, 0x0, &(0x7f00000001c0)="343287c11dc7fa96212b620f472be707d86cd94fdb60a544a4ad9d42df5c2a70d0ea1c192a2db5c3e0abbbaa1fc474690ac411d14ba3ffa0a0e529302835d1fbe559604825c9ef4b509df9387d111f314a073eaf04cb08791f390e041cd4c45d0f528139c6cfb01ef4bb2086a1c67f118ad4f8597da42391c3e419da167b8e7a3b867902fcf55f65a85adb7fb465c9834a5c208fd38ba05e093c65a76c44436744eaf917fe9b4c1bbfd94001a950c27acc5fb40076550f13b91482fe3315d14ce241a7cf88240b5029e0f3e49661564a59167ce95ea9403bc76a9d5eb664a9ad9afb34be7f5810946f48f7ce472dce7882b5a2a9a4e42426cc49f1926df53d463f7408d2d1ff117bfe49e55077896a7cbad65d8c2703b8adad7f7ea88d9d824e1b1eff3e9366ac0a32f3d1a85591817dd7f5f327c4c642b0f7265e2b7e62d801b8d529787ff8a88cec4cfc4b33363c165073068a75c226813efdd5873292b5fbe652fbb3785c908de0214ef2c642d4f3a54af89dabc75845ae167a8586a98a4f1554ba37ce3c068eba7a55201e9cdc37341cff8e376594218dc9036b370541b574448ade65657c563341d9bf2074d2bedac274b8afdf3b39765618ee727e78fba4cdbe57de13734162935b0f430491778f8fe0df5d2ce56c246e9220a7f16be90ec036d1e91de2fa056f633091be9f364be1c352c930b33aad95614aa05bfcb5760669b4fdbaf45743de49711ac6e8fe7ed472326be914eb11354db273f9bb9ca06d060c7a5e7d167dfd46ae38775e2f253c3dc2716f96c59a27296c9d5a93c880aec064bd7d67d240e55785ad5dbe8e6a0b296b6d26a572d3068a2764cd197149d83524526f5948aca10d1db21a9a8e67bfa2d7141ea0353b7d642e4ff1b3a5ddc16422ca618a39f16ac19a4afb139414262506dbcddca673e3ab7e56f098c1919565245726b0e4be8701817c56368cbcb2f38eaa6ddf9b904145f594e5d1e2115cfb3a8760fe2ff496ddb9b5f19003d09c273bfc01a536267c6e718bd17fcdfd0991dcd5bd928dc600ed47867075b5452e50095c8a7cec366b17d075d525e32044f9c1ee154c7314ee960a9a62d6c9152a07df0a0dcdad6cc6dd7d87eb13ca4026a3fa5776393ecc0419e314c94314b21c5664b6bb9a44811a5bfd13e124f82a5afabd1b8203060d91f671996cd2167e23586549e1a4331c3278c47aeaa3fd0373defa6a7fa1a3bcb85602b0cf49d347a6645c280a1c07c72a4a9bba3568b6ac67fe353ec028d3290d26b9bfd06e8b9bd1e828e90d11825f4f9540fc22fdcb6a3e9fa4fe835ac8f2702edeb49206e9359820dae77ea7efe2930e341332511cdfb8666cea3bfbbfbddf330c3868d8772c0af9a701e0a6ad466f1b63633f41a6588bd3f57702905fb17c9c8c0e6709b4e9fd97c84269de2057ca6b244cc825e9f9cf0db56fd9e0af2e0f2a3744479300a595fca9a1294ec2c92cdd0888135e7a97d482e5f27d4f2f41c7d620811963a25a200601273ce25eac5e25c0d57fb352d5e8ed408199b59fb4e54becbbb2186fdaedacc3eecebdb19b6fdc96cc9622481de8d8551f3d39e71266a3928b63e822d275a549e37f6ab2d9096bcafb6c6be9414db3dfbba6219a040ed9821218648df2ea296fa5d585c2fb5279c3135399ef3a5b35a5a550e05168b7d5439dbbb167d793a90ccaa3f52dce7d9793abce044fc16abd724a41c65391efb0c04eaec0b9dc818f7a8b8b70363d220e83fdec0eb538912dc4088c199717080a665f77d456cc7e91afc354a803435cfaf27ca6299b494f22efeef34e9ca7594ce87b8354e29bed5db8234e7571f07305be1c1629a45ca1cf84099f594358a6e692fa19172f17be0f7ee797b376abaf3961f101e661acecfddcbeb9caa95e9aa6ac314a34f88025f24acbfe85ec0acbb5c0c2e19539b4d3af9ad83a41d19f317976f9a360387224c7e263eceba5aeefe32b7d9e2e28497570fcbf1dbe37b7f2ed80933f801e0697b26a9a55eaa3b55f0bec6437118ee7eca844f2a8db9354f1c41230e569171292c07e864a84fd83e07c502e41b9b5dab58e148b6c47b1e6257f4863f5a24bf626c7e67d67498e7edb8b6af6b7646c20dab6cd3ab45e994364dbce536b77a98621b916d11a0e79e7ad4806895c423e946c2290321d1d9b74723aaf8583905e3369290a6d96e2302fb68d601acda0339a025a48f31f0e335024803e27f58d56af5548d164b04d9fb3740a4ad23cbf6fbaebb3878077f765f3483c47c9fbb5d05e43b43f469cd92174cabff27457342dc88edb6124acadb3fc3503f90855e13bceb17d51c427fc0bfd7c3a028a571ef70cf50aba60b31c2c6d84106545e04188494f769739a27c6b96ddb3c2ff47915606f4d8340350f59f88014cc79f7da7eb7c94b09613af5a7602308791a9522e86ffebe8dfbcbf329663277207b317648b2a80fe7294f61f20bb52ef7ab4cfdfe399a905828c9f014d9c585e9e835a4456574a4a5ca2c07759ecbc28ef21ec5bb104bcc75f66b26b7730bcf1e6c23bc31ad23d79ed34284aec180b06e67e89d251c9f1db744b33ea7420e077dc0edb867cb5297ce5d364554c555ea77d2b36aac6e7dc1a515d7d4764a8bdda69c1a6928ced4b9a76dc297b3ac1ed3bb9eef296ff1f8033a3329438817bc1b23a76c839d01a2647feaf991d9d2702f41f0f32fa3ddc9e3587f11d6b55b2e40f351ca18635b61c73f2521429c8dca6e601662c41ed74462c3550044cdb063c8ae40d333f127bf93fa332883dff6a3ec10ea834b75cbf2b2f89d15481f9a77ca78034098aa1abc7ce4bcca865e0864753f0a6e13fad019b7cbe90522ed713a8d283b935ede57b4c149fd87742b7ada844c3d695e82c43ff8f3c047e53cb4bb1cf58d58b046e43c53b4ea9ebafef57ac0c1f277cf09ecf6052055a7bda3111985469db20d5c87790d759db94c1684fab4b6d937247a7576cf7b79931fe99b0312cfae9a2df31e8a0f2ec6b6cf62e12f1c464c604e526f810dccc94f9c5efacfc9dc13c7e51ca68498aa13a15c468370821cd0716fcd3d2746e3a1dbecc6ec1a7401b159d88a99325709a373ebd1fc9bc2fe271db1041206aa3f46949791c1119eeaffd1cfca031298572d12926c1a6c52ffe3c416107a0565a634fdf3c39346d38ca648970860d3d7cf3b1ce5f7f76e27f31d853019796b5812efee9d4d36596ac98d0e86989fd7832b6610cbec4b5c66bd1ca4a8bf3da538117f0cd16cbb8f96fe4417d8064c1f496a2ec5ef456fcd34279ab031103592ca5f80edb821317cab4bf368c071b1ecdd3e6fb7a9c968301120838bb036f727d1363f8dde25ec1ae49cec7d8c89ff1a1c89a77118beb56d8204ee74454e4eeaf00599ed7e327eb03d7879f8a1eb86472fd10f5dfe5defbb2e31b4b0ecf1abb44bdd6d42489e448aee52fa88e92b1fd4e5a429f730a21cc68256b52bf647085ad77ce187ea365dda426f0880468fe8dbae1801ee5843b0a4cd2dca2931b1c2065cdb80609aaa18259ffa5c775117c2ee7550afc6c7d643b298d47fc5ec74d2543c46d111d24116386179cd35f88b7b30aa7d34227b1b17a4b9813c412d6decf29ad82baade8c4013fab79050a5c07ed19f6b3a02dcd81097a081819f8d94090f07d68f66d589cd3a454768335a4bdcb277771a073bc095b6aba5aa1763909b69b8b63382a52b03e5585cc3e25a17ebb861debda3b94900706721f63b0050c9f80decd18caddd69c2630f5d9ebb398a929fda9444ec73bd3f722ff038f28ed19b677588ccf10f6764f1cbf3c21d747aa929e996b968cd98f931b79a2f036e91df505f4739e0dba53f9630f0e31f14c10789ae33a0fadb557a208ecf46e2b600e69877579e3d43138a70d0e5af35d8466ab0607cdca71e2a9a42607bbc449e4f09c2273c8c9da3f0c7c45a2e584085b7395defbabce3cedce92688977e4a0a92257ff111dbb44c2ca68fa9530c1b20707559b7eace06f8e89303ee8bb6612fd5d477c4693dd6602ee41446ca1897ee77d0ce32f3756eccf7e53d52cca84cc3b724c55765a7547219f07028b430bff3781e851ec70f7ee0777aa274f17ca197bd23c9e0db8f0064d8977eab39de415c6003523cb2c0d21d9aade9fdbf8ebef0cc44e210c85c762de0588b7588b0baa47bbec9c72d2286593f88958547a3f9049c4bef596764ef54e87d962e3516b8f278be6907d05ff89649273484b536315dffc11d138ba1e3698b82e29a77613268fd30c797d545ec1d0e31bc3591d2a0d18c92381db2b57aeba908fd3ce964e7646334bdfc2e6d2eba7a831e7976249f58e09ea64f67a4e341992f583f18ddfe22d6403d71df6a2f74e0f9c449c294bded36dd40ea1885681f1e789d6055dcce240e5b25179b31141a22b7c8941cb69d6a42b417af54c5b68505595efa98b533c80451a20989e0c26c26c381bc79e19e9ce602f6b0b9a59bbf04722242c5a74d10694c9f03e3b867110c7928f03ab7725a5b67e9d1a3984a9f47dfe5523119da8ba343cc0c27f42d0bd49bfe259cec51461e24750d59c25d9a4e97d55967a1bbe4cd0e1a9d0d10bdefc54f9f9c59356772ea869b3a847e2d6258ac368213706fbbf09f9ba168682590a90db2e2d379f0040464a65064c6555381f00dbff7af471b8ab67bded72b8303e4dac0875bfcc38943b393f5260f48c3ea10b40f6c853960606a3cd9e0628048bbb9ae1775fb840f196ec785000cbd32ff61dab9f9086d0447e73dcdb6bfa382b950e9191caa6b1d3dd08251a428d504e1e701f6fc6d3c44939093d26c3894837e3bd1f678e2bfc5ed7442c3e54e2cff02a67cd4b885021f124fbad17ec09e84520850bdf936c722e4e110f841ca18860520cff318c2a5ea3b29aadd57126542748532a1fa7ded81b078ab21b37c76370c54c4b2564cdfc96493434c0cc8b2c504f11cd6d60939791896fef62c1d85868733ead96aaa81d7864cc35dfb669bc80042a9f610d2613c00e2b0640dee9615f924833ba38e2e6bc2ce2bc372fb2f84dc17854553f0a3e3676a0fd333b6706b818af8f5ae14ff4c37acbb64452e9581fb1e9579459de339217d8db88bd3cc1bdbae541588b864813fd1069cdafc29cb74aba76c9c99d9f9968004f07331ab5c9ba69dd27e040ede41ebcca0cec2e35f880060781b9bb61cd349d00b775f8a3da2c66aeac4770586162ae6122e04b31de8d6f04f79766248ec5329d366e6dfbcfcff68a68ac76ad57e1a08bc2965d44b3dddc4dca9a63ce8ae52c8ffa30d976a9bd37fdb673e45e1d36282251275d89d0a8e013e93f4e9c5dc5b53fce19887b7373733e27e2319a2c5a7aae2ae832e81ffa0341580dcf4dd3f602e66e645f5e3a7e5a4db1feb6e147fcceed8682aea6aa1f75a102804c43c8037cb8595d0857e2cb170ecf71fe570f182071cf3e19635ab2117522b0587d9c2d2d74fe27280fe3e31a0b8e9b559e3c8cd1ef620a17475198e91278f78bc68e5e6216b63204fabbb726baf0be3b564a0125edc1bf63590275c3df9cf318d4281d5e0f2a01796cd704c0fcd0d54fc16870013c06df79835f750ede0e648762ef4edbff62eeb37a27fb390e947e67aba202a20e0931a69891de6088550f5d4a8b6007bace50e6ac6223fc4b139e5fad08932253538478115a67dc9e8be17043366262667633f64eb438762c9c3a603fc15973cc2cd801cd9cf97e52d1945460e83d69fecacc70933b2cf934ce836c72ff6da4d75794b887a68da979f590d7d1e9"})
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="851a62770000d3b6", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  146.631419]  ? mutex_unlock+0xd/0x10
[  146.631433]  ? nf_sockopt_find.constprop.0+0x1a7/0x220
[  146.631449]  compat_nf_setsockopt+0x88/0x130
[  146.631461]  ? compat_do_replace+0x7c0/0x7c0
[  146.640615] binder_alloc: 6345: binder_alloc_buf size -5778118321916329944 failed, no address space
[  146.643448]  compat_ip_setsockopt+0x8b/0xd0
[  146.643466]  inet_csk_compat_setsockopt+0x95/0x120
[  146.643473]  ? ip_setsockopt+0xa0/0xa0
[  146.643491]  compat_tcp_setsockopt+0x3d/0x70
[  146.643508]  compat_sock_common_setsockopt+0xb2/0x140
[  146.643517]  ? tcp_setsockopt+0xd0/0xd0
2018/02/28 09:17:52 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000028000004000000000000000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000002809000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  146.647918] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.651075]  compat_SyS_setsockopt+0x17c/0x410
[  146.651083]  ? sock_common_setsockopt+0xd0/0xd0
[  146.651100]  ? scm_detach_fds_compat+0x3c0/0x3c0
[  146.655502] binder: 20797:20799 transaction failed 29201/-28, size -5778118321916338138-8192 line 2963
[  146.659683]  ? do_fast_syscall_32+0x156/0xf9f
[  146.659700]  ? scm_detach_fds_compat+0x3c0/0x3c0
[  146.670194] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  146.672625]  do_fast_syscall_32+0x3ec/0xf9f
[  146.672649]  ? do_int80_syscall_32+0x9c0/0x9c0
[  146.672658]  ? _raw_spin_unlock_irq+0x27/0x70
[  146.672670]  ? finish_task_switch+0x1c1/0x7e0
[  146.672686]  ? syscall_return_slowpath+0x2ac/0x550
[  146.672699]  ? prepare_exit_to_usermode+0x350/0x350
[  146.677023] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.684606]  ? sysret32_from_system_call+0x5/0x3c
[  146.684624]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  146.684645]  entry_SYSENTER_compat+0x70/0x7f
[  146.689214] binder: 20793:20798 transaction failed 29201/-28, size 40-0 line 2963
[  146.693564] RIP: 0023:0xf7f49c99
[  146.693570] RSP: 002b:00000000f774509c EFLAGS: 00000286 ORIG_RAX: 000000000000016e
[  146.693580] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000000000
[  146.693585] RDX: 0000000000000080 RSI: 0000000020000580 RDI: 0000000000000490
[  146.693591] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  146.736812] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  146.737249] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  146.737255] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  146.737341] syz-executor6: vmalloc: allocation failure: 256 bytes, mode:0x14000c0(GFP_KERNEL), nodemask=(null)
[  146.741368] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.745557] syz-executor6 cpuset=/
[  146.750752] binder: 20803:20805 transaction failed 29201/-28, size 40-0 line 2963
[  146.754689]  mems_allowed=0
[  146.754698] CPU: 1 PID: 20782 Comm: syz-executor6 Not tainted 4.16.0-rc3+ #242
[  146.798753] binder_alloc: 6345: binder_alloc_buf size 67108904 failed, no address space
[  146.803659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  146.803663] Call Trace:
[  146.803677]  dump_stack+0x194/0x24d
[  146.803693]  ? arch_local_irq_restore+0x53/0x53
[  146.803702]  ? idr_get_free+0xfd0/0xfd0
[  146.803713]  ? rcu_pm_notify+0xc0/0xc0
[  146.803735]  warn_alloc+0x19a/0x2b0
[  146.808035] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.812583]  ? zone_watermark_ok_safe+0x400/0x400
[  146.812593]  ? kmem_cache_alloc_node_trace+0x36f/0x760
[  146.812624]  ? __get_vm_area_node+0x234/0x340
[  146.817097] binder: 20807:20809 transaction failed 29201/-28, size 67108904-0 line 2963
[  146.821550]  __vmalloc_node_range+0x4f0/0x650
[  146.821577]  vmalloc+0x45/0x50
[  146.841106] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  146.845114]  ? compat_do_replace+0x19f/0x7c0
[  146.845126]  compat_do_replace+0x19f/0x7c0
[  146.845145]  ? do_ebt_set_ctl+0x110/0x110
[  146.845186]  ? ns_capable_common+0xcf/0x160
[  146.849998] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.854378]  compat_do_ebt_set_ctl+0x22a/0x2d0
[  146.854393]  ? compat_do_replace+0x7c0/0x7c0
[  146.862050] binder: 20800:20810 transaction failed 29201/-28, size 40-0 line 2963
[  146.865338]  ? mutex_unlock+0xd/0x10
[  146.873194] binder_alloc: 6345: binder_alloc_buf size 536915920 failed, no address space
[  146.880258]  ? nf_sockopt_find.constprop.0+0x1a7/0x220
[  146.880278]  compat_nf_setsockopt+0x88/0x130
[  146.880287]  ? compat_do_replace+0x7c0/0x7c0
[  146.880303]  compat_ip_setsockopt+0x8b/0xd0
[  146.887584] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  146.894797]  inet_csk_compat_setsockopt+0x95/0x120
[  146.894805]  ? ip_setsockopt+0xa0/0xa0
[  146.902419] binder: 20801:20811 transaction failed 29201/-28, size 536915920-0 line 2963
[  146.909645]  compat_tcp_setsockopt+0x3d/0x70
[  146.909663]  compat_sock_common_setsockopt+0xb2/0x140
[  147.151327]  ? tcp_setsockopt+0xd0/0xd0
[  147.155282]  compat_SyS_setsockopt+0x17c/0x410
[  147.159834]  ? sock_common_setsockopt+0xd0/0xd0
[  147.164476]  ? scm_detach_fds_compat+0x3c0/0x3c0
[  147.169206]  ? do_fast_syscall_32+0x156/0xf9f
[  147.173678]  ? scm_detach_fds_compat+0x3c0/0x3c0
[  147.178406]  do_fast_syscall_32+0x3ec/0xf9f
[  147.182705]  ? do_int80_syscall_32+0x9c0/0x9c0
[  147.187258]  ? _raw_spin_unlock_irq+0x27/0x70
[  147.191727]  ? finish_task_switch+0x1c1/0x7e0
[  147.196196]  ? syscall_return_slowpath+0x2ac/0x550
[  147.201096]  ? prepare_exit_to_usermode+0x350/0x350
[  147.206083]  ? sysret32_from_system_call+0x5/0x3c
[  147.210901]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  147.215718]  entry_SYSENTER_compat+0x70/0x7f
[  147.220099] RIP: 0023:0xf7f49c99
[  147.223434] RSP: 002b:00000000f774509c EFLAGS: 00000286 ORIG_RAX: 000000000000016e
[  147.231113] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000000000
[  147.238356] RDX: 0000000000000080 RSI: 0000000020000580 RDI: 0000000000000490
[  147.245598] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  147.252840] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  147.260081] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  147.267402] warn_alloc_show_mem: 1 callbacks suppressed
[  147.267404] Mem-Info:
[  147.275174] active_anon:82991 inactive_anon:61 isolated_anon:0
[  147.275174]  active_file:3651 inactive_file:8910 isolated_file:0
[  147.275174]  unevictable:0 dirty:193 writeback:0 unstable:0
[  147.275174]  slab_reclaimable:10963 slab_unreclaimable:79243
[  147.275174]  mapped:23919 shmem:68 pagetables:682 bounce:0
[  147.275174]  free:1413976 free_pcp:418 free_cma:0
[  147.308504] Node 0 active_anon:331964kB inactive_anon:244kB active_file:14604kB inactive_file:35640kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:95676kB dirty:772kB writeback:0kB shmem:272kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 178176kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no
[  147.336532] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  147.362648] lowmem_reserve[]: 0 2864 6373 6373
[  147.367249] Node 0 DMA32 free:2934572kB min:30292kB low:37864kB high:45436kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129292kB managed:2935320kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:748kB local_pcp:700kB free_cma:0kB
[  147.394933] lowmem_reserve[]: 0 0 3509 3509
[  147.399273] Node 0 Normal free:2705424kB min:37120kB low:46400kB high:55680kB active_anon:331964kB inactive_anon:244kB active_file:14604kB inactive_file:35640kB unevictable:0kB writepending:772kB present:4718592kB managed:3593748kB mlocked:0kB kernel_stack:4384kB pagetables:2728kB bounce:0kB free_pcp:1032kB local_pcp:280kB free_cma:0kB
[  147.429124] lowmem_reserve[]: 0 0 0 0
[  147.432942] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB
[  147.446522] Node 0 DMA32: 3*4kB (M) 2*8kB (M) 1*16kB (M) 2*32kB (M) 1*64kB (M) 1*128kB (M) 2*256kB (M) 2*512kB (M) 2*1024kB (M) 1*2048kB (M) 715*4096kB (M) = 2934572kB
[  147.461706] Node 0 Normal: 376*4kB (UME) 731*8kB (UME) 800*16kB (UM) 1008*32kB (UM) 474*64kB (UM) 137*128kB (UME) 70*256kB (UME) 45*512kB (UME) 38*1024kB (UM) 23*2048kB (UM) 605*4096kB (UM) = 2705336kB
[  147.479808] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
[  147.488382] 12628 total pagecache pages
[  147.492357] 0 pages in swap cache
[  147.495816] Swap cache stats: add 0, delete 0, find 0/0
[  147.501179] Free swap  = 0kB
[  147.504191] Total swap = 0kB
2018/02/28 09:17:53 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x0, 0x5, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a6277000000004edbb0893c3e78c1600d5439575d9baffa57687dc49b00f3fd11386ab6bd0206503bc652bd9e8cd123eca0df3948a1a578539510e6a3860d75f960292bebfa7c9992e7b2f0e15684cfd4e6d760b03bc37479351297567cb51917ed428360efdb9f88338b6475", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="102356b8cee1d0b22c4070ab27c7db967abc95e8584e7d5dd25603054679552d628c6d84976ec28128dc87a29055b647682a6ade8ede8b3a45dcb427524a83ff63e63b257e5037"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x401, 0x400)
sendto$unix(r1, &(0x7f00000000c0)="144d83c9b0a361c6a2b7939b5cea929c4385223f769d686fa73eed22523205acbb61db1341930d18474599ae23efbdb734555d9a95bebacdf89485b1bdbcb92a4a13a170609dd2c7151e78d79c93a0ae72ed651e94a7015bf26b190ab96a3799ae78de0817cb9cad860096016020ebde150c7354bb2e8a31bbf44184949adafc22801e5fb5bcf6f55e2b8f857c6c3156e91e01e004b88e537a0dcff63b2f9193a29e9725abc9df4210435612cda447e78b3dd1b16fe4ede321b7343dd3aa7fd8eb0ed40e58559edf341d5e516663918fbd3bec421da901fb", 0xd8, 0x40000, 0x0, 0x0)

2018/02/28 09:17:53 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2c, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004fbc)=[], 0x19, 0x0, &(0x7f0000000080)="44719b42d3376df48c244d07bd97ba564f36d69ea3d243c137"})
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000180)={&(0x7f0000000040)=[0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1, 0x4, 0x8, 0x7})

2018/02/28 09:17:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]]})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:53 executing program 0:
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000400600000000000000000000000000000000000008000800000000002800000000991ec05b55000000000000", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000040)={@rand_addr, @loopback}, &(0x7f0000000080)=0xc)

2018/02/28 09:17:53 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x10000, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000200)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x2, 0x9, 0x5})
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

[  147.507205] 1965969 pages RAM
[  147.510321] 0 pages HighMem/MovableOnly
[  147.514293] 329725 pages reserved
[  147.517906] binder: undelivered TRANSACTION_ERROR: 29201
[  147.523435] binder: undelivered TRANSACTION_ERROR: 29201
[  147.528932] binder: undelivered TRANSACTION_ERROR: 29201
[  147.537115] binder: undelivered TRANSACTION_ERROR: 29201
[  147.546511] binder: 20817:20822 ioctl c04064a0 20000180 returned -22
[  147.549629] binder: 20818:20826 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  147.556085] binder: undelivered TRANSACTION_ERROR: 29201
[  147.564855] binder_alloc: 6345: binder_alloc_buf size 536915920 failed, no address space
[  147.574529] connsecmark_tg_check: 3 callbacks suppressed
[  147.574533] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  147.577732] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.584728] binder: 20817:20829 ioctl c04064a0 20000180 returned -22
2018/02/28 09:17:53 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x261, @empty, 0x5}], 0x1c)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2c, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x2e, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123d"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  147.591087] binder: 20816:20820 transaction failed 29201/-28, size 536915920-0 line 2963
[  147.600372] binder: undelivered TRANSACTION_ERROR: 29201
[  147.613638] binder: 20821:20825 transaction failed 29189/-22, size -4603073543847018456-21851 line 2848
[  147.616323] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  147.639437] binder: 20821:20825 transaction failed 29189/-22, size -4603073543847018456-21851 line 2848
[  147.640734] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000000))

2018/02/28 09:17:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = getpid()
move_pages(r1, 0x2, &(0x7f0000000000)=[&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil], 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2)
move_pages(r1, 0x5, &(0x7f0000000100)=[&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil], 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x2)
sched_getparam(r1, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000280000000000000000000000000000009bccbb5cfb80921a2c", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x10000, 0x0)
ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r2, 0x81785501, &(0x7f0000000200)=""/2)

[  147.656689] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.665590] binder: 20832:20836 transaction failed 29201/-28, size 40-0 line 2963
[  147.665715] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  147.677748] binder: undelivered TRANSACTION_ERROR: 29189
[  147.680919] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.680941] binder: 20815:20827 transaction failed 29201/-28, size 40-0 line 2963
[  147.687563] binder: 20838:20841 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  147.714568] binder_alloc: 6345: binder_alloc_buf size 536915920 failed, no address space
[  147.716561] binder: undelivered TRANSACTION_ERROR: 29189
[  147.723030] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.732082] binder: undelivered TRANSACTION_ERROR: 29201
[  147.737148] binder: 20839:20845 transaction failed 29201/-28, size 536915920-0 line 2963
[  147.742672] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:53 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000001a00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000110000000000000000006c6f000000000000000000000000000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000700000007000000098000000434f4e4e5345434d1041524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e0000000000000000006263736830000000000000000000000062637366300000000000000000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c90000000000000000000061727000000000000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c415353494659000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff010000001900000040000000000762707130000000000000000000000000696662300000000000000000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000000f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000000736974300000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b00000000000000000000000000000000000000000000000000000000080000000000000000000000"]}, 0x491)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000140)=@nat={'nat\x00', 0x19, 0x5, 0xf84, [0x20000a40, 0x0, 0x0, 0x20001590, 0x200016cc], 0x0, &(0x7f0000000080), &(0x7f0000000a40)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x0, 0x4f, 0x6000, 'vlan0\x00', 'bridge0\x00', 'tunl0\x00', 'vlan0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0x0, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], 0xf8, 0x158, 0x188, [@ipvs={'ipvs\x00', 0x28, {{@ipv6=@mcast1={0xff, 0x1, [], 0x1}, [0x0, 0xff, 0xffffffff], 0x4e22, 0x3b, 0x1, 0x4e20, 0x2c, 0x8}}}, @quota={'quota\x00', 0x18, {{0x0, 0x0, 0x6}}}]}, [@snat={'snat\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, 0xfffffffffffffffc}}}, @arpreply={'arpreply\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xfffffffffffffffe}}}]}, @arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}, {{{0x5, 0x0, 0x4305, 'ip6_vti0\x00', 'ip6gre0\x00', 'bcsf0\x00', 'bpq0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x0, 0x0, 0x0, 0xff], @empty, [0x0, 0xff, 0x0, 0xff], 0x938, 0x968, 0x998, [@among={'among\x00', 0x87c, {{0x8001, 0x5, 0x8, {[0x8, 0x0, 0xdcf, 0x4, 0x5, 0x61, 0x1, 0x5287, 0x3, 0x0, 0x0, 0x200, 0xfffffffffffffffb, 0x6, 0x2ed, 0xf8d8, 0x8000, 0x5, 0x6, 0xfffffffffffffff7, 0x401, 0xffffffffffffffff, 0xffffffffffff2659, 0x5, 0x800, 0x7, 0xf3d6, 0x7f, 0x4, 0x3, 0x200, 0x1ff, 0xc94, 0x7, 0xa835, 0x2, 0x0, 0x2, 0x7, 0xfff, 0x0, 0x48e, 0x9, 0xa0e7, 0x6, 0x34e, 0xfffffffffffffffc, 0x56, 0x1ff, 0x2, 0x46c, 0x200, 0x1, 0x3f, 0x5, 0x0, 0x0, 0xcc9, 0x2, 0x7, 0x4, 0x1, 0x32d3, 0x4, 0xef71, 0x100000001, 0x80000001, 0x3, 0x1000, 0x7, 0x5, 0x80000001, 0x56, 0xffffffffffffff24, 0x12, 0xfffffffffffffff9, 0x2, 0x8, 0x1000000000, 0x9, 0xdb3, 0x400, 0x5, 0x4e, 0x20, 0x4, 0x8000, 0x0, 0x401, 0x3, 0x3f, 0x7, 0x3ff, 0x3, 0x0, 0x9, 0x0, 0x5, 0x0, 0x9, 0xae7, 0x3f, 0x80, 0x400000000000000, 0x2, 0xe3, 0xfff, 0x5, 0x3ff, 0x5, 0x2bc, 0xc000, 0x10001, 0x5, 0xfff, 0x80000, 0x100000001, 0x3f, 0x3, 0xfffffffffffff888, 0x3, 0x42, 0x7fff, 0x3ff, 0x3, 0x5a, 0x4, 0x0, 0x0, 0x3, 0x5, 0x6000000000000000, 0x3, 0x3, 0x10000, 0x1, 0x80000001, 0xfff, 0x6, 0x6, 0x4, 0x3f, 0x4, 0x1, 0x6, 0x4, 0x3, 0xfff, 0x2, 0x6, 0x4, 0x216, 0x7ff, 0x7fffffff, 0xfffffffffffffff8, 0x10000, 0x7f, 0x7fffffff, 0x400, 0x7, 0x9, 0x40, 0x9, 0xc2, 0x9, 0x81, 0x7, 0x3, 0x1, 0x23, 0x7, 0x5, 0x0, 0x1, 0x4, 0x1, 0x100, 0x528, 0xffff, 0x6, 0x5, 0x8, 0x7, 0x4, 0x4, 0x7dd, 0x4, 0x9, 0x8, 0x4, 0x7, 0x400, 0x5, 0x0, 0x200, 0x1, 0x40, 0x7, 0x401, 0x0, 0x0, 0x5d4, 0x8, 0x9, 0x6, 0x4, 0x252, 0x3, 0x3, 0xffffffffffff8000, 0x1f, 0x2, 0x800, 0x7f, 0x4, 0xa5, 0x8, 0xfffffffffffffff8, 0x3ff, 0x7, 0x80, 0x821, 0xfffffffffffffff9, 0x1000, 0x8, 0x7, 0x80000001, 0x4, 0x8, 0x7fff, 0x2, 0x428, 0x9, 0x7, 0x3, 0xffffffffffffff31, 0x6, 0x9, 0xfffffffffffffff7, 0x8000, 0x4, 0x7, 0x9f, 0x8, 0xa48, 0x800, 0xfffffffffffffff9, 0x1, 0x4, 0x1, 0x10000, 0x1, 0x80, 0x8, 0x100000000, 0x7, 0x1f], 0x2, [{[0x200, 0x3], @remote={0xac, 0x14, 0x14, 0xbb}}, {[0x3ff, 0x7], @rand_addr=0x6}]}, {[0x0, 0x1, 0xfffffffffffffffa, 0x81, 0x1, 0x7f, 0x7fff, 0x60e, 0x140000000000000, 0x100000000000, 0xd5, 0x2, 0xa602, 0xf15, 0x5, 0x4, 0x56, 0x6, 0x3, 0xb5, 0x3f, 0x10000, 0x34d2, 0x3, 0x6, 0x5, 0x40, 0xe943, 0x5, 0x0, 0x8, 0x5, 0xffffffffffff8001, 0xfffffffffffffffd, 0x9, 0x101, 0x8, 0x100000001, 0x65470cd4, 0xf2df, 0x9f8, 0x80000001, 0xfffffffffffffff7, 0xf60, 0xfcdc, 0x6f21, 0x9, 0x4, 0xffff, 0x3, 0xe9, 0x5, 0xfffffffffffffff9, 0xfffffffffffffff7, 0x0, 0x3, 0x9, 0x2, 0x5, 0x4, 0x1ff, 0x800, 0x5, 0x0, 0x7f, 0x4a55, 0x7, 0x1f92, 0x3, 0x1ff, 0x51e, 0x4db, 0x401, 0x4, 0x8, 0x1f, 0xff5, 0x1, 0x1, 0x4, 0x0, 0x9, 0x6, 0x1, 0x8, 0x6fd, 0xb4, 0x7, 0x0, 0x6, 0x1ff, 0x40000000000000, 0x800, 0x3ff, 0x20, 0xa8, 0x9, 0x4d8000000000000, 0x7, 0xfff, 0x5, 0x4, 0x2, 0x8001, 0x7, 0x7, 0x2, 0x77, 0x7, 0x56a, 0x3, 0x9, 0x5, 0x5, 0x8e, 0x40, 0xd, 0x80000001, 0x7988, 0x1, 0x7fffffff, 0x401, 0x7fffffff, 0x8, 0x2, 0x100000000, 0x5, 0x1f, 0x24, 0x6, 0x0, 0x3ff, 0x100000001, 0x100000001, 0x664, 0xffffffff, 0x7, 0x8000000000000, 0x101, 0x401, 0x8, 0x9, 0x9, 0x11bd, 0x401000000, 0x7d7, 0xc65, 0x2, 0x0, 0x0, 0x5, 0x8, 0x9697, 0x4, 0x3, 0xc704, 0x8, 0x400, 0x1f, 0x3, 0x6, 0x4, 0x2e1, 0x7, 0x1f, 0x8, 0xffffffffffffffff, 0x1, 0x40, 0xe602, 0x2, 0x20, 0x2b, 0x20000000000000, 0x10f43c45, 0xfffffffffffffff8, 0x3, 0x2f5176c4, 0x1, 0x401, 0x4, 0x100, 0x1000, 0x9, 0x8000, 0x1, 0x3, 0x9, 0x4, 0x10000000000000, 0x9, 0xd8, 0xffffffff, 0x77, 0x6, 0x0, 0xfffffffffffffeff, 0x1, 0x6, 0x0, 0x5, 0x3, 0x2, 0x80000000, 0x2, 0xffffffff00000001, 0x0, 0x0, 0x2, 0x2ceb, 0x3, 0x20, 0x1, 0x7, 0x4, 0x100, 0x1, 0x8, 0x5, 0x5, 0x9, 0x8, 0xffffffff00000000, 0x8, 0x3, 0x40, 0x400, 0x200, 0x7, 0x3, 0x48a4, 0x9, 0x9, 0x0, 0x5, 0x401, 0x9, 0x8, 0x2f, 0x1ff, 0x8d, 0xf5, 0x3, 0xfffffffffffffffe, 0x20, 0x3a69, 0x400, 0x2, 0x4, 0x9, 0x0, 0x3, 0x6, 0x7f, 0x7, 0xe4], 0x6, [{[0x8b], @empty}, {[0x6, 0x2], @rand_addr=0x4}, {[0x6, 0x4f7], @rand_addr=0x6}, {[0x10000, 0x19b], @dev={0xac, 0x14, 0x14, 0x10}}, {[0x1, 0x18000000000], @broadcast=0xffffffff}, {[0x0, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}]}}}}, @connlabel={'connlabel\x00', 0x4, {{0x8}}}]}, [@snat={'snat\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc83003aa95b69dad}, 0xfffffffffffffffe}}}]}, @snat={'snat\x00', 0xc, {{@link_local={0x1, 0x80, 0xc2}, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0x0, 0x1, [{{{0x5, 0x4, 0x88fc, 'ip_vti0\x00', 'irlan0\x00', 'bpq0\x00', 'bridge0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0xff, 0xff, 0x0, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], 0x70, 0xdc, 0x10c, []}, [@arpreply={'arpreply\x00', 0xc, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 0xffffffffffffffff}}}, @common=@RATEEST={'RATEEST\x00', 0x18, {{'syz1\x00', 0xffff, 0x81, 0xa18}}}]}, @arpreply={'arpreply\x00', 0xc, {{@empty, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x2, [{{{0x1b, 0x1d, 0x88ff, 'bcsh0\x00', 'ifb0\x00', 'yam0\x00', 'gre0\x00', @empty, [0xff, 0x0, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], 0xe4, 0x114, 0x144, [@helper={'helper\x00', 0x24, {{0x1, 'H.245\x00'}}}, @cpu={'cpu\x00', 0x8, {{0x9, 0x1}}}]}, [@arpreply={'arpreply\x00', 0xc, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, 0xfffffffffffffffe}}}]}, @common=@dnat={'dnat\x00', 0xc, {{@random="f086cb694cd9", 0xfffffffffffffffc}}}}, {{{0x19, 0x9, 0x0, 'ipddp0\x00', 'tunl0\x00', 'ip6tnl0\x00', 'nr0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], @random="cf057b26e95f", [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0xec, 0x15c, 0x184, [@cluster={'cluster\x00', 0x10, {{0x7, 0x6, 0xa787}}}, @nfacct={'nfacct\x00', 0x24, {{'syz0\x00', 0x6}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x24, {{0x80000001, 'syz1\x00', 0x909d}}}, @common=@STANDARD={'\x00', 0x4, {0xfffffffffffffffb}}]}, @common=@AUDIT={'AUDIT\x00', 0x4, {{0x3}}}}]}]}, 0xfd4)

[  147.758546] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.767428] binder: 20843:20849 transaction failed 29201/-28, size 40-0 line 2963
[  147.775587] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  147.779874] binder: undelivered TRANSACTION_ERROR: 29201
[  147.783309] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.788709] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x2e, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123d"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:53 executing program 2:
r0 = open(&(0x7f0000000180)='./file0\x00', 0x80000, 0x42)
recvmsg$kcm(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f00000001c0)=""/251, 0xfb}, {&(0x7f00000002c0)=""/208, 0xd0}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/15, 0xf}], 0x4, &(0x7f0000001440)=""/34, 0x22, 0x40}, 0x2000)
r1 = syz_open_dev$binder(&(0x7f00000014c0)='/dev/binder#\x00', 0x0, 0x2)
r2 = accept4$ax25(0xffffffffffffff9c, &(0x7f0000000040), &(0x7f0000000080)=0x10, 0x80000)
accept4(r2, &(0x7f00000000c0)=@pptp={0x0, 0x0, {0x0, @remote}}, &(0x7f0000000100)=0x20, 0x80800)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB='w\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  147.797532] binder: 20832:20847 transaction failed 29201/-28, size 40-0 line 2963
[  147.801147] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  147.803136] binder: undelivered TRANSACTION_ERROR: 29201
[  147.810745] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.819170] binder: undelivered TRANSACTION_ERROR: 29201
[  147.823781] binder: 20844:20846 transaction failed 29201/-28, size 40-0 line 2963
[  147.832897] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  147.853467] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.862348] binder: 20843:20849 transaction failed 29201/-28, size 40-0 line 2963
[  147.868965] binder: 20856:20858 transaction failed 29189/-22, size 40-0 line 2848
[  147.873648] binder: 20854:20859 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  147.879830] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  147.889829] kernel msg: ebtables bug: please report to author: Wrong len argument
[  147.898959] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  147.904263] binder: undelivered TRANSACTION_ERROR: 29201
[  147.911797] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  147.911819] binder: 20844:20846 transaction failed 29201/-28, size 40-0 line 2963
[  147.936108] kernel msg: ebtables bug: please report to author: Wrong len argument
[  147.943829] binder: undelivered TRANSACTION_ERROR: 29201
[  147.949383] binder: undelivered TRANSACTION_ERROR: 29201
[  147.954880] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:53 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x0, 0x0, 0xc936, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:53 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x3ffffffffffffe)
r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000040)=0x257, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x8, &(0x7f0000000140)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x4}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @fd={0x66642a85, 0x0, r1, 0x0, 0x2}], &(0x7f00000001c0)=[0x30]}, 0xdfcd}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x3, 0x400)
getsockopt$inet_int(r1, 0x0, 0x16, &(0x7f0000000100), &(0x7f0000000140)=0x4)
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x84000)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000280000000000000000000000000000009f24d91400317997eea88a43b08ff58fd76a66f60c9bd40e2a10c157920f7f0daf064f17719416ddbe287073ed36be", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2f, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x6)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x2e, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123d"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:53 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000b00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0200000011000000a5da1fdc0ac613bd000000000000000000000000000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000700000007000000098000000434f4e4e5345434d41524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e0000000000000000006263736830000000000000000000000062637366300000000000000000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c90000000000000000000061727000000000000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c415353494659000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff010000001900000040000000000762707130000000000000000000000000696662300000000000000000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000000f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000000736974300000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b00000000000000000000000000000000000000000000000000000000080000000000000000000000c1de7ae8b1aa70c0c58dd018455939b51221ce0bfac2fa1204ee9dea03f996a9f44b5e4df331a71f677598f3d02efd5f560a761c28c8c8c81b168644c24024675e0b198094ffcd1e47ab1ff38a3bf31bb8f9552d2df6846163d9ad4a9c4f58785307ea1a1593a411b869986b1b8042d61dd37cd630317d5464e69c1a32831fcdd01cffa1aa084cc7b92f3806dee8568f9243f5aeabd5750bd62fc79cb0b22500ecb0a10970750cf8a66e266bee46cc2fa8b91c58af"]}, 0x545)
socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0)

2018/02/28 09:17:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="01000000000000000000000000000000000000000008000095fc4168482a14a7fc86df2c692b7d05cf002de1a694dac84b27533ec01589e5fc3ad1a5e5c48547c264d5dc233c6dc3035eee05f4e9a93a99d4d19c9384e7fe4842ab4288c92b9428102470177ac4cf3152f6582cfd9f07310b6144de8b5fedd9eef40711f4001281d7b7c64b0a53da546ddaa7423c06570d61fdcb1a31c066a1fd34e95a2d326b6590b77cdadab8b6ef19a1c7e44fd1718ac51e276e5b337acf96f7117b5418947cf216954f3bce24979ea64c6f2974f84dbf0e1dd342dbedf8520c8aed5cce97418c20ce832827ce1969840a7b69d1ca8b233c7c38cce9f1ab4c456daa30af95118af2cf27572f4621eb9c63c013886803388f1369a57de9e516da587b8269255fc657551521685de3ec00000000c84c9f24ee6d5e2a1f80e42673fb3d8cd11532d1eb2baf00f1a703ffdbe13266b0fd1cd9f65c92cd0c4943977c7bd473476c638e632edf5b8a"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
mlock2(&(0x7f0000ff3000/0xc000)=nil, 0xc000, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={r0, 0x3, 0x1, 0x7, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}, 0x20)
bpf$BPF_PROG_QUERY(0x10, &(0x7f00000000c0)={r0, 0x3, 0x1, 0x1, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], 0x4}, 0x20)

[  147.960380] binder: undelivered TRANSACTION_ERROR: 29201
[  147.965873] binder: undelivered TRANSACTION_ERROR: 29201
[  147.971376] binder: undelivered TRANSACTION_ERROR: 29201
[  147.976861] binder: undelivered TRANSACTION_ERROR: 29189
[  147.982352] binder: undelivered TRANSACTION_ERROR: 29201
[  147.987830] binder: undelivered TRANSACTION_ERROR: 29201
[  147.993378] binder: undelivered TRANSACTION_ERROR: 29201
[  147.998857] binder: undelivered TRANSACTION_ERROR: 29201
[  148.004403] binder: undelivered TRANSACTION_ERROR: 29201
[  148.011242] binder: undelivered TRANSACTION_ERROR: 29201
[  148.022699] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.030379] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.036457] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.039268] binder: 20865:20867 transaction failed 29201/-28, size 40-0 line 2963
[  148.042153] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.062211] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.063674] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.071083] binder: 20872:20878 transaction failed 29201/-28, size 40-0 line 2963
[  148.072519] binder: 20869:20876 transaction failed 29189/-22, size 40-0 line 2848
[  148.079808] binder_alloc: 6345: binder_alloc_buf size 9007954363678720 failed, no address space
[  148.091692] binder: undelivered TRANSACTION_ERROR: 29189
2018/02/28 09:17:53 executing program 5:
r0 = syz_fuse_mount(&(0x7f00000000c0)='./file0\x00', 0x2, 0xffffffffffffffff, 0x0, 0x800, 0x340001)
fcntl$setstatus(r0, 0x4, 0x800)
r1 = socket$pptp(0x18, 0x1, 0x2)
ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000000080)=0x400)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000075ffffffffffffff00002800000000000000000000000000000002e2b186be78abac348eee", @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="852a627700000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/user\x00', 0x2, 0x0)

2018/02/28 09:17:53 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x200)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000140))
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x18, 0x0, &(0x7f0000004fbc)=ANY=[@ANYRES64=r0, @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="852a6877a8e046d2", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0000bf7f2f00000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
r2 = mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4, 0x4010, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r2})

[  148.094101] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.117246] binder: 20868:20874 transaction failed 29201/-28, size 9007954363678720-0 line 2963
[  148.121587] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  148.130391] binder: 20870:20875 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  148.135495] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.152526] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:53 executing program 2:
creat(&(0x7f0000000000)='./file0\x00', 0x18)
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={<r1=>0x0}, &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000180)={r1, @in={{0x2, 0x4e22, @multicast1=0xe0000001}}}, &(0x7f0000000240)=0x8c)

[  148.156091] binder: undelivered TRANSACTION_ERROR: 29201
[  148.161401] binder: 20872:20881 transaction failed 29201/-28, size 40-0 line 2963
[  148.167909] binder: 20888:20892 unknown command 19
[  148.182892] binder: 20888:20892 ioctl c0306201 20008000 returned -22
[  148.191391] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.196788] binder: undelivered TRANSACTION_ERROR: 29201
[  148.199050] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.199076] binder: 20889:20890 transaction failed 29201/-28, size 40-0 line 2963
[  148.202216] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  148.204803] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.216375] binder: 20888:20897 unknown command 20
[  148.221439] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.230373] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
2018/02/28 09:17:53 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2f, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80000, 0x0)
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000040)=0x6570, 0x4)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x1, 0x3, 0x80000000, 0x2, 0xdb7f})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000080)={0x4, r0})

2018/02/28 09:17:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x45, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e88599"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  148.237226] binder: 20895:20896 transaction failed 29201/-28, size 40-0 line 2963
[  148.242236] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.251237] binder: 20888:20897 ioctl c0306201 20008000 returned -22
[  148.258892] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.258915] binder: 20889:20890 transaction failed 29201/-28, size 40-0 line 2963
[  148.263332] binder: undelivered TRANSACTION_ERROR: 29201
[  148.298974] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:54 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000b80)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000110000000000000000006c6f0000000013f7eb5a0c747b23000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaac5caa8ed5272d7e21e6a4aa00000000000000000070000000d720a5f2899333dcc7649480f028757000000098000000434f4e4e5345434d41524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e0000000000000000006263736830000000000000000000000062637366300000000000000000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c90000000000000000000061727000000000000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c415353494659000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff010000001900000040000000000762707130000000000000000000000000696662300000000000000000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000200f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffbfff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000000736974300000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b00000000000000000000000000000000000000000000020000000000080000000000000000000000bbd1cb617173b60aa85b7742ee751aeb8527ee4c7c0add389034a5027b17391a0b7d6eb9afa3f669e8af5a3e7cd3b025df5f0cb319f6d2e85d8fd921927cea088276c7f8edb5b0062e1cb83d6c56b013ec67d9ece6d610e3f9f8b694a5b4e491a9293eac1483ad1b4171ca5927290e08d98c270cc508be05fcc2e77dc7c1b541e31a9ecb16a08f705e4f6042c130992d6bb25ceedccf3ed1f015d74d853f89cee977937ebed97ede054fab5a3873d096cc75e4f756459f3e0963493d2df095909ecaae6c8557f246ffc42e4550f96aac7adb160e6fa258df4bb0838a87b70471725c881ab563d717b850c7c61f8e60d3dd"]}, 0x59b)
pipe2(&(0x7f00000000c0), 0x80000)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x201, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x100000000000, 0x0, 0x0, 0xfffffffffffffffe}, &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

[  148.310477] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.315591] binder: undelivered TRANSACTION_ERROR: 29201
[  148.319360] binder: 20895:20902 transaction failed 29201/-28, size 40-0 line 2963
[  148.324847] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.340131] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.349043] binder: 20904:20907 transaction failed 29201/-28, size 40-0 line 2963
[  148.354835] binder: 20905:20908 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  148.356716] binder_alloc: 6345: binder_alloc_buf size 9007954363678720 failed, no address space
[  148.372717] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.376455] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.385989] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.392913] binder: 20903:20906 transaction failed 29201/-28, size 9007954363678720-0 line 2963
[  148.392953] binder: undelivered TRANSACTION_ERROR: 29201
[  148.392963] binder: undelivered TRANSACTION_ERROR: 29201
[  148.393054] binder: undelivered TRANSACTION_ERROR: 29201
[  148.400679] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.409861] binder: undelivered TRANSACTION_ERROR: 29201
[  148.414921] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.414944] binder: 20904:20913 transaction failed 29201/-28, size 40-0 line 2963
[  148.420434] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:54 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:54 executing program 0:
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x178)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000180)=ANY=[@ANYRES64, @ANYBLOB="005e448b30b9581de8141aa190b9c8683d20f5cf230f70190536de9e3240c0934558d8011ea8f9882d36988fb97422a35e165b54ffc5808e70abb40df59f9027fc7f3a74079242dfe3071b1c10a9406fc29d1ab3da83fa3d5218b8bdd3c00ef1953843698ac7666f49f85ec523056ff5e26aac46fc6457adaf81b6025913e180c6e101ac70fc0abc5b0d0f0c20ae4ab20ab89e95ce2ba181", @ANYRES32], 0x3d, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:54 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x45, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e88599"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:54 executing program 5:
r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write(r1, &(0x7f0000000040), 0x0)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0xb71)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000040)={0x8000, 0x3, 0x3})
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:54 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2f, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x4000, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000040)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x2c)

2018/02/28 09:17:54 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000140)={{{{0x2, 0x4e21, @empty}}, {{0xa, 0x4e21, 0x200, @dev={0xfe, 0x80, [], 0x15}, 0xffff}}}, 0x546, 0x4, 0x1000, "4797f5fc26a74244c06448462d030d1937ced11168687c85d2f46c29ad2eb675cee7c5230848774544702f33507d384013756274f0c738119206f51c975148f27193523ccc8b71aab64e7d3ba17b21ff"}, 0x160)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x1, 0x5, 0xc936}}}, @arp={'arp\x00', 0x34, {{0x0, 0x0, 0x0, @loopback=0x7f000001, 0x0, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00'}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x0, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8}}]}]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:54 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x80)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000040)={<r2=>0x0, 0xffffffff, 0x9}, &(0x7f0000000080)=0x8)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000000c0)={<r3=>r2, 0x69, "ba696fba871e3e42bca95b3669a9ea6eddde5a790dcb7fb308b99b09be29d728924cfe65036e43180a03092cc2a342504523c15186616b85866ef29dfb16365eea93025a00dc72ea685d635bc1011f54489b4ad38026deaa62127c2fc20a1beebf2d98deacae2caa3b"}, &(0x7f0000000140)=0x71)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000180)={r3, 0x6, 0x6f, "3b7fee1f0e0069e35d3adeda8e19ba450c0ac3d8718b564a3730d52ab246a890bdc177fb3c3261a91853c4960c7b226ee08a04bbbc7f72813377bf533b2a718db8c4dcf406e53f3e93e5e2370b3db02f3c3ef91efecd5ca5a5332eb43598d37401185179ec171eb3c86af03929e389"}, 0x77)

[  148.461149] binder: undelivered TRANSACTION_ERROR: 29201
[  148.466657] binder: undelivered TRANSACTION_ERROR: 29201
[  148.472156] binder: undelivered TRANSACTION_ERROR: 29201
[  148.477648] binder: undelivered TRANSACTION_ERROR: 29201
[  148.490896] binder_alloc: 6345: binder_alloc_buf size 9007954363678720 failed, no address space
[  148.493996] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
2018/02/28 09:17:54 executing program 6:
r0 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x7, 0x101000)
ioctl$KVM_PPC_GET_PVINFO(r0, 0x4080aea1, &(0x7f0000000140)=""/124)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000b00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000110000000000000000006c6f000000000000000000000000000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000700000007000000098000000434f4e4e5345434d41524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e00000000000000000062637368300000000000000000000000626373663000000000f6ff0000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c9000000000000000000006172700000ed00000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c415353494659000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000d249bdf0010000001900000040000000000762707130000000000000000000000000696662300000000000000000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000000f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000007000000000000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b000000000000000000000000000000000000000000000000000000000800000000000000000000009c921d4a34a8ffe78a0d6e87b70c37b7c39751d85cd49fc9bfffd863840bdf4c6cb7d1a029b6ac5907695279d0e3e437e549a8c471382f02f90a5a75da800dabe90e0c7b9414b71b15687e1e53dd6e0d44f33e1a92cf8d30c43766907a58df454509944f5c349e35aba2aea278e362bf6b0e20e7216f6bf12ee7293cc0fbb6e5e852b770dfbc53e35333b6246430050c3bd8b84bb859d8f72f7f5d"]}, 0x52b)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

[  148.499782] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.499809] binder: 20918:20925 transaction failed 29201/-28, size 9007954363678720-0 line 2963
[  148.509242] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.522834] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  148.525475] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.525509] binder: 20921:20926 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:54 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x45, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e88599"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  148.534590] binder: 20927:20930 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  148.541074] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.541083] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.541108] binder: 20919:20928 transaction failed 29201/-28, size 40-0 line 2963
[  148.566898] binder: undelivered TRANSACTION_ERROR: 29201
[  148.590878] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:54 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2c, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

[  148.605788] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.613026] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.614688] binder: 20917:20932 transaction failed 29201/-28, size 40-0 line 2963
[  148.623955] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.637635] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.646536] binder: 20919:20931 transaction failed 29201/-28, size 40-0 line 2963
[  148.646561] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:54 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
r1 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x1, 0x410000)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000280)={<r2=>0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xf}}}, 0x3f, 0x20, 0x80000000, 0x7fff, 0x9}, &(0x7f0000000340)=0xa0)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000380)={r2, @in6={{0xa, 0x4e22, 0x1ff, @mcast1={0xff, 0x1, [], 0x1}, 0x6}}}, 0x8c)
getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000040), &(0x7f0000000200)=0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@mcast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000000)=0xe8)
setuid(r3)

[  148.661787] binder: undelivered TRANSACTION_ERROR: 29201
[  148.661862] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.672089] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  148.676174] binder: 20921:20933 transaction failed 29201/-28, size 40-0 line 2963
[  148.679285] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.699464] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x4)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x20000, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="d2ff", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYBLOB="b644a44e6291a373d98b9c3eef3cf46bde57e02714b12ba3c93bfa34475248"], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:54 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000110000000000000000006c6f000000000000000000000000000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000700000007000000098000000434f4e4e5345434d41524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e0000000000000000006263736830000000000000000000000062637366300000000000000000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c90000000000000000000061727000000000000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c415353494659000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff010000001900000040000000000762707130000000000000000000000000696662300000000000080000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000000f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000000736974300000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b00000000000000000000000000000000000000000000000000000000080000000000000000000000"]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

[  148.704355] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.708347] binder: 20917:20943 transaction failed 29201/-28, size 40-0 line 2963
[  148.710935] binder: undelivered TRANSACTION_ERROR: 29201
[  148.716736] binder: 20940:20942 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  148.723768] binder: undelivered TRANSACTION_ERROR: 29201
[  148.726853] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.753305] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
2018/02/28 09:17:54 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x51, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec68"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

[  148.762184] binder: 20948:20951 transaction failed 29201/-28, size 40-0 line 2963
[  148.768497] binder_alloc: 6345: binder_alloc_buf size 536915920 failed, no address space
[  148.772785] binder: 20953:20957 transaction failed 29189/-22, size 40-0 line 2848
[  148.778239] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.790937] binder: undelivered TRANSACTION_ERROR: 29201
[  148.794710] binder: 20936:20938 transaction failed 29201/-28, size 536915920-0 line 2963
[  148.800159] binder: undelivered TRANSACTION_ERROR: 29201
2018/02/28 09:17:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x400000802)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  148.814265] binder: 20953:20959 transaction failed 29189/-22, size 40-0 line 2848
[  148.822212] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.827135] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'broute'
[  148.829892] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.829918] binder: 20948:20958 transaction failed 29201/-28, size 40-0 line 2963
[  148.835648] binder: 20960:20962 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  148.865540] binder: undelivered TRANSACTION_ERROR: 29201
[  148.873288] binder: 20963:20965 transaction failed 29189/-22, size 40-0 line 2848
[  148.881180] binder: undelivered TRANSACTION_ERROR: 29201
[  148.886852] binder: undelivered TRANSACTION_ERROR: 29201
[  148.892383] binder: undelivered TRANSACTION_ERROR: 29201
[  148.897874] binder: undelivered TRANSACTION_ERROR: 29201
[  148.903420] binder: undelivered TRANSACTION_ERROR: 29189
[  148.908979] binder: undelivered TRANSACTION_ERROR: 29189
2018/02/28 09:17:54 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x11, 0x0, 0x0, 'lo\x00', 'dummy0\x00', 'rose0\x00', 'gretap0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x70, 0x70, 0x98, []}, []}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x4, {{0x1}}}}, {{{0x3, 0x0, 0x0, 'syz_tun\x00', 'bcsh0\x00', 'bcsf0\x00', "650101000000000000eba741298c0100", @link_local={0x1, 0x80, 0xc2}, [], @random="c58a89cd4535", [0x0, 0x0, 0x0, 0x0, 0xff], 0x100, 0x100, 0x128, [@statistic={'statistic\x00', 0x14, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}}}, @arp={'arp\x00', 0x34, {{0x5, 0x800, 0x1, @loopback=0x7f000001, 0xff0000ff, @local={0xac, 0x14, 0x14, 0xaa}, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, [0x0, 0x0, 0xf76a9871f77b5945, 0x0, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xa}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x2, 0x38}}}]}, []}, @common=@CLASSIFY={'CLASSIFY\x00', 0x4, {{0x3}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x19, 0x40, 0x7, 'bpq0\x00', 'ifb0\x00', 'bpq0\x00', 'ifb0\x00', @empty, [0xff, 0xff, 0x0, 0x103, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0xac, 0xf4, []}, [@common=@RATEEST={'RATEEST\x00', 0x18, {{'syz0\x00', 0x9, 0x6, 0x4}}}]}, @common=@LED={'LED\x00', 0x24, {{'syz1\x00', 0x0, 0x6, 0x81}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe, 0x0, []}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x1, [{{{0x5, 0x19, 0x88ae, 'syz_tun\x00', 'syz_tun\x00', 'ipddp0\x00', 'sit0\x00', @link_local={0x1, 0x80, 0xc2}, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xcc, []}, [@common=@dnat={'dnat\x00', 0xc, {{@empty}}}]}, @common=@mark={'mark\x00', 0x8, {{0xfffffff0, 0xfffffffffffffffd}}}}]}]}, 0x490)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa})
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000018000)=0x3f, 0x4)
bind$inet(r1, &(0x7f0000015000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10)

2018/02/28 09:17:54 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x51, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec68"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x40003, 0x0)
ioctl$VHOST_GET_VRING_BASE(r1, 0xc008af12, &(0x7f0000000080))
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000040)=0x7fffffff, 0x4)

2018/02/28 09:17:54 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0xc0, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000ac0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000110000000000000000006c6f000000000000000000000000000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000700000007000000098000000434f4e4e5345434d41524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e0000000000000000006263736830000000000000000000000062637366300000000000000000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c90000000000000000000061727000000000000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c415353494659000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff010000001900000040000000000762707130000000000000000000000000696662300000000000000000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000000f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000000736974300000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b00000000000000000000000000000000000000000000000000000000080000000000000000000000661ac14fad7e866ab2f1e95796a4630138a3a3042e42d098d93cc52768e115a6767f0421458cf8df41a2143b9b9ee0e00143655b09f0e03b8a59ff8d9214b9d893c497a9e8bca91ceee7193a8525c7518314bf6500a88d515a4c1ca673ad795d45fde84bd3e6a831ed"]}, 0x4f9)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

2018/02/28 09:17:54 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
ioctl$EVIOCSFF(r0, 0x402c4580, &(0x7f0000000000)={0x0, 0xffff, 0x10000, {0x8, 0x4}, {0x1fd, 0xfa}, @period={0x5f, 0x3, 0x2, 0x6, 0x6, {0x100000001, 0x7, 0x81, 0x5}, 0x8, [0x60000000000, 0xfff, 0x68c, 0x8, 0x1, 0xffffffffffffff7f, 0x1, 0x2]}})

2018/02/28 09:17:54 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x2c, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="a201000000000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})

2018/02/28 09:17:54 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@remote, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@dev}, 0x0, @in=@rand_addr}}, &(0x7f0000000000)=0xe8)
r2 = getgid()
fchown(r0, r1, r2)

2018/02/28 09:17:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40402, 0x80)
fcntl$setpipe(r1, 0x407, 0x8)
renameat2(r1, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000080)='./file0\x00', 0x5)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x35f, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000010000000000000002800000000000000000000000000000069aa799f9b67d23b7e5d190c19e58ba5d6b8a874b1ffb658f789c0ac3d9aa9a1afad779b92e558dcf3b9d02c034d8c76c399dd478ae59ccc51e8978b33a2d9aa259b10b5ea851c6e992ce2db5a256e71953c409e0b92bfea66c4e542fda52d3b39f33835dc4327e04b2e5df9201202c3956adf1b701e34f307e46d3386b2af7813", @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB="81b6c30985a310a22a46704c094d578730529df9d2b0e68b9bcf75ed0642b31cd25e332ded0217ceb6ff252d0b65b41996f16e6707509c26856e989e9c3d1952e8520bff4d30565a42b5d896adfaa07074bb3935b64a0c10bf0ff195a0d11833122c898d7a9e417afb62c27cebc15bce53591c943419e71edcc0dfc827d9e9fb4e56709f4139b061146a9c58b109922a431ed08bed80809a14164ab732ddf799006d871d7787e2000000000000000000000000000000965c64158c6af57d9b9c1b80a8bd9c5b446be384672dc23a59c79e054f35ccb3df0c59e81dee54cda3011eac3e8ead54b9333d815ddca92568b2247eaa92f3a7e4f3faf0246cdecaf0961ef06222419fe25f8ce2ffe9a3d1cc7ec4103e74bae97fb0bb1ff7be25da8e7ca2e8964f070733df8f4a4935266e2aa800b8321413eef328dbaeb34b0d2b3f45e7f3b69516c4fa921befd89f6192341da665c62382ded7add3e707a7798994a9e2fecc412444e326c19a70a36565b05a2d87cecd1652c26a7fceedc00100000000000000e9018e469e40d3861e893cf267b5387c358d2d37485d34b8805c457e015fb70613c4e118f43527c0318d048d108bdc08923f9bb52f7c1f35", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x0, 0x0, &(0x7f0000009000)})
rt_sigpending(&(0x7f0000000100), 0x8)
openat(r1, &(0x7f00000000c0)='./file0\x00', 0x40, 0x20)

[  148.914481] binder: undelivered TRANSACTION_ERROR: 29189
[  148.921305] binder: undelivered TRANSACTION_ERROR: 29201
[  148.930364] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.938085] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.946950] binder: 20967:20970 transaction failed 29201/-28, size 40-0 line 2963
[  148.946969] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.962259] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.971158] binder: 20972:20979 transaction failed 29201/-28, size 40-0 line 2963
[  148.971230] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  148.979691] kernel msg: ebtables bug: please report to author: Wrong len argument
[  148.986531] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  148.997604] kernel msg: ebtables bug: please report to author: Wrong len argument
[  149.003036] binder: 20969:20976 transaction failed 29201/-28, size 40-0 line 2963
[  149.003732] binder: 20975:20980 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
[  149.011672] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  149.025071] binder: 20969:20987 ioctl 402c4580 20000000 returned -22
[  149.029305] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.052270] binder: 20972:20985 transaction failed 29201/-28, size 40-0 line 2963
2018/02/28 09:17:54 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x3b, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000cfae8d666d7a4446d5ca002800000000", @ANYPTR64=&(0x7f000000afd0)=ANY=[]], 0x51, 0x0, &(0x7f0000000000)="d78568878daeeefb8476ac7a43265c8f2dddc2d316c75b572618dc279ccd7e6c040853728f0bc3602165d76a123da53408a19283edce0db4083f53f3e6795808b661e885991c259648946a3920d24dec68"})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x1, 0x0)

2018/02/28 09:17:54 executing program 6:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x0, 0x0)
ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f00000000c0))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@broute={'broute\x00', 0x20, 0x4, 0x440, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000600], 0x0, &(0x7f0000000100), &(0x7f0000000600)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000110000000000000000006c6f000000000000000000000000000064756d6d793000000000000000000000726f736530000000000000000000000067726574617030000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000700000007000000098000000434f4e4e5345434d41524b00000000000000000000000000000000000000000004000000000000000300000000000000000073797a5f74756e0000000000000000006263736830000000000000000000000062637366300000000000000000000000650101000000000000eba741298c01000180c2000000000000000000c58a89cd45350000000000000000000100000001000028010000737461746973746963000000000000000000000000000000000000000000000014000000000001000500000036c90000000000000000000061727000000000000000000000000000000000000000000000000000000000003400000000000000000000007f00000100000000ac1414aa00000000aaaaaaaaaa00000000000000aaaaaaaaaa0000000000000000000000434c41535349465900000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff010000001900000040000000000762707130000000000000000000000000696662300000000000000000000000006270713000000000000000000000000069666230000000000000000000000000000000000000ff00000000000180c2000000000000000000000070000000ac000000f400000052415445455354000000000000000000000000000000000000000000000000001800000073797a3000000000000000000000000000000000000000004c454400000000000000000000000000000000000000000000000000000000002400000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff010000000500000019000000000073797a5f74756e00000000000000000073797a5f74756e00000000000000000069706464703000000000000000000000736974300000000000000000000000000180c2000000000000000000000000000000000000000000000070000000a0000000cc000000646e6174000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000006d61726b000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000"]}, 0x490)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000), &(0x7f0000000040)=0x18)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)

[  149.054093] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  149.067975] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.076851] binder: 20967:20970 transaction failed 29201/-28, size 40-0 line 2963
[  149.076883] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  149.092193] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.097223] binder: 20969:20997 ioctl 402c4580 20000000 returned -22
[  149.101054] binder: 20973:20977 transaction failed 29201/-28, size 40-0 line 2963
[  149.107620] binder: undelivered TRANSACTION_ERROR: 29201
[  149.115349] binder_alloc: 6345: binder_alloc_buf size 536915920 failed, no address space
[  149.120925] binder: undelivered TRANSACTION_ERROR: 29201
[  149.128902] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.128933] binder: 20971:20978 transaction failed 29201/-28, size 536915920-0 line 2963
[  149.134587] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
2018/02/28 09:17:54 executing program 0:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x154}, @in6={0xa, 0x4e24, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, @in6={0xa, 0x4e22, 0x0, @remote={0xfe, 0x80, [], 0xbb}}], 0x54)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000100)=""/136)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x77622a85, 0x0, &(0x7f0000007f72), 0x1}], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)})

[  149.159090] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.159183] binder: 21001:21002 ioctl 80404508 20000100 returned -22
[  149.167964] binder: 20969:20995 transaction failed 29201/-28, size 40-0 line 2963
[  149.168193] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  149.176708] WARNING: CPU: 1 PID: 21003 at net/bridge/netfilter/ebtables.c:2056 compat_copy_entries+0xcfa/0x1050
[  149.182251] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.189892] Kernel panic - not syncing: panic_on_warn set ...
[  149.189892] 
[  149.189901] CPU: 1 PID: 21003 Comm: syz-executor6 Not tainted 4.16.0-rc3+ #242
[  149.189906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  149.189909] Call Trace:
[  149.189923]  dump_stack+0x194/0x24d
[  149.200153] binder: 20973:20990 transaction failed 29201/-28, size 40-0 line 2963
[  149.208930]  ? arch_local_irq_restore+0x53/0x53
[  149.208948]  ? vsnprintf+0x1ed/0x1900
[  149.216682] binder: 20994:20996 transaction failed 29201/-22, size -3078698002649018962--3458764513817919286 line 2963
2018/02/28 09:17:54 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f000026c000)=ANY=[@ANYBLOB="85000000", @ANYPTR64=&(0x7f0000007f72)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000000000000000000"], @ANYPTR64=&(0x7f000000afd0)=ANY=[]]})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xe, 0x8, 0x80, 0x4, 0x6, r1, 0x388}, 0x2c)

[  149.223621]  panic+0x1e4/0x41c
[  149.223631]  ? refcount_error_report+0x214/0x214
[  149.223639]  ? show_regs_print_info+0x18/0x18
[  149.223654]  ? compat_sock_common_setsockopt+0xb2/0x140
[  149.223668]  ? __warn+0x1c1/0x200
[  149.237891] binder: undelivered TRANSACTION_ERROR: 29201
[  149.239197]  ? compat_copy_entries+0xcfa/0x1050
[  149.239207]  __warn+0x1dc/0x200
[  149.239218]  ? compat_copy_entries+0xcfa/0x1050
[  149.251939] binder: undelivered TRANSACTION_ERROR: 29201
[  149.255244]  report_bug+0x211/0x2d0
[  149.255263]  fixup_bug.part.11+0x37/0x80
[  149.255274]  do_error_trap+0x2d7/0x3e0
[  149.269363] binder: undelivered TRANSACTION_ERROR: 29201
[  149.273973]  ? module_unload_free+0x5b0/0x5b0
[  149.273991]  ? math_error+0x400/0x400
[  149.274003]  ? module_unload_free+0x5b0/0x5b0
[  149.283261] binder: undelivered TRANSACTION_ERROR: 29201
[  149.283826]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  149.283846]  do_invalid_op+0x1b/0x20
[  149.283855]  invalid_op+0x1b/0x40
[  149.283865] RIP: 0010:compat_copy_entries+0xcfa/0x1050
[  149.283869] RSP: 0018:ffff8801c34577e8 EFLAGS: 00010216
[  149.283877] RAX: 0000000000010000 RBX: 0000000000000000 RCX: ffffffff851aa9ba
[  149.283882] RDX: 0000000000000789 RSI: ffffc90003f82000 RDI: 0000000000000000
[  149.283887] RBP: ffff8801c3457968 R08: 0000000000000000 R09: 0000000000000000
[  149.283894] R10: ffffffff88613300 R11: 0000000000000004 R12: 0000000000000004
[  149.290629] binder: undelivered TRANSACTION_ERROR: 29201
[  149.292745] R13: dffffc0000000000 R14: ffff8801c34579c8 R15: ffffc900076511ec
[  149.292772]  ? compat_copy_entries+0xcfa/0x1050
[  149.298563] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  149.300675]  ? compat_copy_entries+0xcfa/0x1050
[  149.300712]  ? compat_table_info+0x590/0x590
[  149.305366] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.310784]  ? __might_sleep+0x95/0x190
[  149.310817]  compat_do_replace+0x398/0x7c0
[  149.314428] binder: 21001:21002 transaction failed 29201/-28, size 40-0 line 2963
[  149.318443]  ? do_ebt_set_ctl+0x110/0x110
[  149.318484]  ? ns_capable_common+0xcf/0x160
[  149.326823] binder: undelivered TRANSACTION_ERROR: 29201
[  149.327748]  compat_do_ebt_set_ctl+0x22a/0x2d0
[  149.327766]  ? compat_do_replace+0x7c0/0x7c0
[  149.332421] binder: undelivered TRANSACTION_ERROR: 29201
[  149.336026]  ? mutex_unlock+0xd/0x10
[  149.336039]  ? nf_sockopt_find.constprop.0+0x1a7/0x220
[  149.345343] binder: 21001:21002 ioctl 80404508 20000100 returned -22
[  149.345935]  compat_nf_setsockopt+0x88/0x130
[  149.350925] binder_alloc: 6345: binder_alloc_buf size 40 failed, no address space
[  149.354430]  ? compat_do_replace+0x7c0/0x7c0
[  149.354448]  compat_ip_setsockopt+0x8b/0xd0
[  149.354464]  inet_csk_compat_setsockopt+0x95/0x120
[  149.357901] binder_alloc: allocated: 8152 (num: 184 largest: 96), free: 40 (num: 2 largest: 32)
[  149.363136]  ? ip_setsockopt+0xa0/0xa0
[  149.363159]  compat_tcp_setsockopt+0x3d/0x70
[  149.368520] binder: 21001:21006 transaction failed 29201/-28, size 40-0 line 2963
[  149.375736]  compat_sock_common_setsockopt+0xb2/0x140
[  149.375745]  ? tcp_setsockopt+0xd0/0xd0
[  149.558560]  compat_SyS_setsockopt+0x17c/0x410
[  149.563117]  ? sock_common_setsockopt+0xd0/0xd0
[  149.567762]  ? scm_detach_fds_compat+0x3c0/0x3c0
[  149.572493]  ? do_fast_syscall_32+0x156/0xf9f
[  149.576963]  ? scm_detach_fds_compat+0x3c0/0x3c0
[  149.581689]  do_fast_syscall_32+0x3ec/0xf9f
[  149.585984]  ? _raw_spin_unlock_irq+0x27/0x70
[  149.590457]  ? do_int80_syscall_32+0x9c0/0x9c0
[  149.595014]  ? _raw_spin_unlock_irq+0x27/0x70
[  149.599490]  ? finish_task_switch+0x1c1/0x7e0
[  149.603966]  ? syscall_return_slowpath+0x2ac/0x550
[  149.608871]  ? prepare_exit_to_usermode+0x350/0x350
[  149.613860]  ? sysret32_from_system_call+0x5/0x3c
[  149.618680]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  149.623502]  entry_SYSENTER_compat+0x70/0x7f
[  149.627880] RIP: 0023:0xf7f49c99
[  149.631213] RSP: 002b:00000000f774509c EFLAGS: 00000286 ORIG_RAX: 000000000000016e
[  149.638890] RAX: ffffffffffffffda RBX: 0000000000000014 RCX: 0000000000000000
[  149.646140] RDX: 0000000000000080 RSI: 0000000020000580 RDI: 0000000000000490
[  149.653381] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  149.660622] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  149.667860] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  149.675886] Dumping ftrace buffer:
[  149.679613]    (ftrace buffer empty)
[  149.683298] Kernel Offset: disabled
[  149.686899] Rebooting in 86400 seconds..