[ 37.717519][ T26] audit: type=1800 audit(1553659995.488:29): pid=7625 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.87' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 53.118555][ T7776] ------------[ cut here ]------------ [ 53.124040][ T7776] kernel BUG at drivers/android/binder_alloc.c:1141! [ 53.130835][ T7776] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 53.136951][ T7776] CPU: 1 PID: 7776 Comm: syz-executor471 Not tainted 5.1.0-rc2+ #38 [ 53.144935][ T7776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.154988][ T7776] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 53.161476][ T7776] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 ff f7 23 fc 4c 89 e6 4c 89 ef e8 14 f9 23 fc 4d 39 e5 76 07 e8 ea f7 23 fc <0f> 0b e8 e3 f7 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 f1 [ 53.181297][ T7776] RSP: 0018:ffff888086b976d8 EFLAGS: 00010293 [ 53.187464][ T7776] RAX: ffff8880a96ee280 RBX: 0000000020001000 RCX: ffffffff854c798c [ 53.195505][ T7776] RDX: 0000000000000000 RSI: ffffffff854c7996 RDI: 0000000000000006 [ 53.203458][ T7776] RBP: ffff888086b97758 R08: ffff8880a96ee280 R09: 0000000000000028 [ 53.211411][ T7776] R10: ffffed1010d72f32 R11: ffff888086b97997 R12: 0000000000000008 [ 53.219504][ T7776] R13: 0000000000000028 R14: ffff8880983d3410 R15: 0000000000000000 [ 53.227597][ T7776] FS: 0000000000000000(0000) GS:ffff8880ae900000(0063) knlGS:0000000009a58900 [ 53.236517][ T7776] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 53.243224][ T7776] CR2: 0000000000000000 CR3: 0000000093c38000 CR4: 00000000001406e0 [ 53.251423][ T7776] Call Trace: [ 53.254745][ T7776] ? memcpy+0x46/0x50 [ 53.258814][ T7776] binder_alloc_copy_from_buffer+0x37/0x42 [ 53.264678][ T7776] binder_get_object+0xc3/0x200 [ 53.269540][ T7776] binder_transaction+0x2b4a/0x6690 [ 53.274743][ T7776] ? binder_thread_read+0x3d50/0x3d50 [ 53.280107][ T7776] ? __lock_acquire+0x548/0x3fb0 [ 53.285035][ T7776] ? __might_fault+0x12b/0x1e0 [ 53.289855][ T7776] ? lock_downgrade+0x880/0x880 [ 53.294699][ T7776] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 53.301095][ T7776] ? _copy_from_user+0xdd/0x150 [ 53.305936][ T7776] binder_thread_write+0x64a/0x2820 [ 53.311119][ T7776] ? binder_transaction+0x6690/0x6690 [ 53.316649][ T7776] ? __might_fault+0x12b/0x1e0 [ 53.322410][ T7776] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 53.328855][ T7776] ? _copy_from_user+0xdd/0x150 [ 53.333797][ T7776] binder_ioctl+0x1033/0x183b [ 53.338521][ T7776] ? binder_thread_write+0x2820/0x2820 [ 53.343968][ T7776] ? vma_is_stack_for_current+0xd0/0xd0 [ 53.349503][ T7776] ? ksys_dup3+0x3e0/0x3e0 [ 53.353960][ T7776] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 53.360184][ T7776] ? fput_many+0x12c/0x1a0 [ 53.364751][ T7776] ? fput+0x1b/0x20 [ 53.368562][ T7776] ? tomoyo_file_ioctl+0x23/0x30 [ 53.373538][ T7776] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 53.379946][ T7776] ? security_file_ioctl+0x93/0xc0 [ 53.385045][ T7776] ? binder_thread_write+0x2820/0x2820 [ 53.390491][ T7776] __ia32_compat_sys_ioctl+0x197/0x620 [ 53.395938][ T7776] do_fast_syscall_32+0x281/0xc98 [ 53.400950][ T7776] entry_SYSENTER_compat+0x70/0x7f [ 53.406044][ T7776] RIP: 0023:0xf7f4e869 [ 53.410094][ T7776] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 53.430003][ T7776] RSP: 002b:00000000ff9f34ac EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 53.438441][ T7776] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0306201 [ 53.446403][ T7776] RDX: 0000000020000440 RSI: 0000000008048ce0 RDI: 0000000000000000 [ 53.454506][ T7776] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 53.462605][ T7776] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 53.470606][ T7776] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 53.478578][ T7776] Modules linked in: [ 53.483166][ T7776] ---[ end trace 5c50eb6871693f35 ]--- [ 53.488636][ T7776] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 53.495348][ T7776] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 ff f7 23 fc 4c 89 e6 4c 89 ef e8 14 f9 23 fc 4d 39 e5 76 07 e8 ea f7 23 fc <0f> 0b e8 e3 f7 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 f1 [ 53.515025][ T7776] RSP: 0018:ffff888086b976d8 EFLAGS: 00010293 [ 53.521155][ T7776] RAX: ffff8880a96ee280 RBX: 0000000020001000 RCX: ffffffff854c798c [ 53.529123][ T7776] RDX: 0000000000000000 RSI: ffffffff854c7996 RDI: 0000000000000006 [ 53.537132][ T7776] RBP: ffff888086b97758 R08: ffff8880a96ee280 R09: 0000000000000028 [ 53.545126][ T7776] R10: ffffed1010d72f32 R11: ffff888086b97997 R12: 0000000000000008 [ 53.553141][ T7776] R13: 0000000000000028 R14: ffff8880983d3410 R15: 0000000000000000 [ 53.561135][ T7776] FS: 0000000000000000(0000) GS:ffff8880ae900000(0063) knlGS:0000000009a58900 [ 53.570238][ T7776] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 53.576879][ T7776] CR2: 0000000000000000 CR3: 0000000093c38000 CR4: 00000000001406e0 [ 53.584980][ T7776] Kernel panic - not syncing: Fatal exception [ 53.591984][ T7776] Kernel Offset: disabled [ 53.596353][ T7776] Rebooting in 86400 seconds..