syzbot

 sign-in | mailing list | source | docs
🐞 Open [142]
🐞 Fixed [16]
🐞 Invalid [163]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

possible deadlock in ashmem_ioctl

Status: auto-closed as invalid on 2019/02/22 14:50
First crash: 2456d, last: 2433d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 possible deadlock in ashmem_ioctl 1 2452d 2452d 0/3 auto-closed as invalid on 2019/02/22 14:56

Sample crash report:
binder: BC_ACQUIRE_RESULT not supported

======================================================
[ INFO: possible circular locking dependency detected ]
4.4.120-gd63fdf6 #28 Not tainted
-------------------------------------------------------
syz-executor7/7734 is trying to acquire lock:
 (&mm->mmap_sem){++++++}, at: [   56.880108] audit: type=1400 audit(1521762754.058:34): avc:  denied  { setopt } for  pid=7744 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
binder: 7727:7729 ioctl c0306201 2000bfd0 returned -22
[<ffffffff81495684>] __might_fault+0xe4/0x1d0 mm/memory.c:3809

but task is already holding lock:
 (ashmem_mutex){+.+.+.}, at: [<ffffffff82c628a7>] ashmem_pin_unpin drivers/staging/android/ashmem.c:701 [inline]
 (ashmem_mutex){+.+.+.}, at: [<ffffffff82c628a7>] ashmem_ioctl+0x367/0xfa0 drivers/staging/android/ashmem.c:778

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff8123d7ce>] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592
       [<ffffffff8376a39b>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8376a39b>] mutex_lock_nested+0xbb/0x850 kernel/locking/mutex.c:621
       [<ffffffff82c61463>] ashmem_mmap+0x53/0x400 drivers/staging/android/ashmem.c:366
       [<ffffffff814b0e4f>] mmap_region+0x94f/0x1250 mm/mmap.c:1664
       [<ffffffff814b1c4d>] do_mmap+0x4fd/0x9d0 mm/mmap.c:1441
       [<ffffffff814700ce>] do_mmap_pgoff include/linux/mm.h:1915 [inline]
       [<ffffffff814700ce>] vm_mmap_pgoff+0x16e/0x1c0 mm/util.c:296
       [<ffffffff814afe1f>] SYSC_mmap_pgoff mm/mmap.c:1491 [inline]
       [<ffffffff814afe1f>] SyS_mmap_pgoff+0x33f/0x560 mm/mmap.c:1449
       [<ffffffff8101beb6>] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
       [<ffffffff8101beb6>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
       [<ffffffff8377395f>] entry_SYSCALL_64_fastpath+0x1c/0x98

       [<ffffffff8123ab2f>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff8123ab2f>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff8123ab2f>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff8123ab2f>] __lock_acquire+0x371f/0x4b50 kernel/locking/lockdep.c:3213
       [<ffffffff8123d7ce>] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592
       [<ffffffff814956ea>] __might_fault+0x14a/0x1d0 mm/memory.c:3810
       [<ffffffff82c628f4>] copy_from_user arch/x86/include/asm/uaccess.h:724 [inline]
       [<ffffffff82c628f4>] ashmem_pin_unpin drivers/staging/android/ashmem.c:706 [inline]
       [<ffffffff82c628f4>] ashmem_ioctl+0x3b4/0xfa0 drivers/staging/android/ashmem.c:778
       [<ffffffff81559daa>] vfs_ioctl fs/ioctl.c:43 [inline]
       [<ffffffff81559daa>] do_vfs_ioctl+0x7aa/0xee0 fs/ioctl.c:607
       [<ffffffff8155a56f>] SYSC_ioctl fs/ioctl.c:622 [inline]
       [<ffffffff8155a56f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
       [<ffffffff8377395f>] entry_SYSCALL_64_fastpath+0x1c/0x98

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(ashmem_mutex);
                               lock(&mm->mmap_sem);
                               lock(ashmem_mutex);
  lock(&mm->mmap_sem);

 *** DEADLOCK ***

1 lock held by syz-executor7/7734:
 #0:  (ashmem_mutex){+.+.+.}, at: [<ffffffff82c628a7>] ashmem_pin_unpin drivers/staging/android/ashmem.c:701 [inline]
 #0:  (ashmem_mutex){+.+.+.}, at: [<ffffffff82c628a7>] ashmem_ioctl+0x367/0xfa0 drivers/staging/android/ashmem.c:778

stack backtrace:
CPU: 0 PID: 7734 Comm: syz-executor7 Not tainted 4.4.120-gd63fdf6 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 cbcc67b62e341212 ffff8801c0d079b8 ffffffff81d0408d
 ffffffff851a0010 ffffffff851a0010 ffffffff851be610 ffff8800b01de8f8
 ffff8800b01de000 ffff8801c0d07a00 ffffffff81233ba1 ffff8800b01de8f8
Call Trace:
 [<ffffffff81d0408d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0408d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81233ba1>] print_circular_bug+0x271/0x310 kernel/locking/lockdep.c:1226
 [<ffffffff8123ab2f>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff8123ab2f>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff8123ab2f>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff8123ab2f>] __lock_acquire+0x371f/0x4b50 kernel/locking/lockdep.c:3213
 [<ffffffff8123d7ce>] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592
 [<ffffffff814956ea>] __might_fault+0x14a/0x1d0 mm/memory.c:3810
 [<ffffffff82c628f4>] copy_from_user arch/x86/include/asm/uaccess.h:724 [inline]
 [<ffffffff82c628f4>] ashmem_pin_unpin drivers/staging/android/ashmem.c:706 [inline]
 [<ffffffff82c628f4>] ashmem_ioctl+0x3b4/0xfa0 drivers/staging/android/ashmem.c:778
 [<ffffffff81559daa>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81559daa>] do_vfs_ioctl+0x7aa/0xee0 fs/ioctl.c:607
 [<ffffffff8155a56f>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff8155a56f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
 [<ffffffff8377395f>] entry_SYSCALL_64_fastpath+0x1c/0x98
binder: BC_ACQUIRE_RESULT not supported
binder: 7759:7760 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 7759:7760 ioctl c0306201 2000bfd0 returned -22
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket
binder: BC_ACQUIRE_RESULT not supported
binder: 7804:7806 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 7804:7806 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 7815:7818 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 7815:7818 ioctl c0306201 2000bfd0 returned -22
audit: type=1400 audit(1521762754.918:35): avc:  denied  { transfer } for  pid=7860 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
binder_alloc: binder_alloc_mmap_handler: 7860 20000000-20002000 already mapped failed -16
binder: BINDER_SET_CONTEXT_MGR already set
binder: 7860:7884 ioctl 40046207 0 returned -16
binder_alloc: 7860: binder_alloc_buf, no vma
binder: 7860:7894 transaction failed 29189/-3, size 40-8 line 3128
binder: release 7860:7868 transaction 40 out, still active
binder: unexpected work type, 4, not freed
binder: 7899:7903 unknown command 12423566
binder: undelivered TRANSACTION_COMPLETE
binder: 7899:7903 ioctl c0306201 2000bfd0 returned -22
binder: send failed reply for transaction 40, target dead
netlink: 12 bytes leftover after parsing attributes in process `syz-executor7'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor7'.
binder: BC_ACQUIRE_RESULT not supported
binder: 7928:7932 ioctl c0306201 2000bfd0 returned -22
binder: 7951:7956 ioctl c018643a 20000000 returned -22
binder: 7951:7956 unknown command -687865856
binder: 7951:7956 ioctl c0306201 2000bfd0 returned -22
binder: 7951:7970 ioctl c018643a 20000000 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 7981:7982 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 7981:7982 ioctl c0306201 2000bfd0 returned -22
binder: 8026:8030 ioctl 5600 20000000 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8025:8033 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8025:8033 ioctl c0306201 2000bfd0 returned -22
binder: 8026:8041 ioctl c0306201 20004000 returned -14
binder: 8026:8041 unknown command 20
binder: 8026:8041 ioctl c0306201 2000a000 returned -22
binder: 8026:8050 ioctl 5600 20000000 returned -22
binder: BINDER_SET_CONTEXT_MGR already set
binder: 8026:8050 ioctl 40046207 0 returned -16
binder_alloc: 8026: binder_alloc_buf, no vma
binder: 8026:8051 transaction failed 29189/-3, size 0-0 line 3128
binder: 8026:8052 ioctl c0306201 20004000 returned -14
binder: 8026:8052 unknown command 22
binder: 8026:8052 ioctl c0306201 2000a000 returned -22
binder: release 8026:8030 transaction 45 out, still active
binder: undelivered TRANSACTION_COMPLETE
binder: 8063:8075 unknown command 19
binder: send failed reply for transaction 45, target dead
binder_alloc: 8080: binder_alloc_buf, no vma
binder: 8080:8083 transaction failed 29189/-3, size -8514425539733225472--7023847082660345939 line 3128
binder: 8063:8081 unknown command 22
binder: 8063:8081 ioctl c0306201 2000bfd0 returned -22
binder: BINDER_SET_CONTEXT_MGR already set
binder: 8080:8083 ioctl 40046207 0 returned -16
binder_alloc: 8080: binder_alloc_buf, no vma
binder: 8080:8096 transaction failed 29189/-3, size -8514425539733225472--7023847082660345939 line 3128
netlink: 64 bytes leftover after parsing attributes in process `syz-executor3'.
binder: undelivered TRANSACTION_ERROR: 29189
binder: undelivered TRANSACTION_ERROR: 29189
binder: 8063:8075 ioctl c0306201 2000bfd0 returned -22
binder: undelivered TRANSACTION_ERROR: 29189
netlink: 64 bytes leftover after parsing attributes in process `syz-executor3'.
binder: BC_ACQUIRE_RESULT not supported
binder: 8112:8119 ioctl c0306201 20000000 returned -22
binder_alloc: binder_alloc_mmap_handler: 8113 20000000-20002000 already mapped failed -16
binder: BINDER_SET_CONTEXT_MGR already set
binder: 8113:8127 ioctl 40046207 0 returned -16
binder_alloc: 8113: binder_alloc_buf, no vma
binder: 8113:8130 transaction failed 29189/-3, size 0-0 line 3128
binder: undelivered TRANSACTION_ERROR: 29189
binder: release 8113:8120 transaction 51 out, still active
binder: undelivered TRANSACTION_COMPLETE
netlink: 64 bytes leftover after parsing attributes in process `syz-executor3'.
binder: 8140:8149 unknown command 17
binder: 8140:8149 ioctl c0306201 2000bfd0 returned -22
binder: release 8113:8127 transaction 51 in, still active
binder: send failed reply for transaction 51, target dead
binder: BC_ACQUIRE_RESULT not supported
audit: type=1326 audit(1521762755.988:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=8143 comm="syz-executor5" exe="/root/syz-executor5" sig=9 arch=c000003e syscall=202 compat=0 ip=0x454239 code=0x0
binder: 8163:8167 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8163:8182 ioctl c0306201 2000bfd0 returned -22
audit: type=1326 audit(1521762756.088:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=8143 comm="syz-executor5" exe="/root/syz-executor5" sig=9 arch=c000003e syscall=202 compat=0 ip=0x454239 code=0x0
binder: BC_ACQUIRE_RESULT not supported
binder: 8197:8199 ioctl c0306201 2000bfd0 returned -22
binder: 8197:8199 DecRefs 0 refcount change on invalid ref 0 ret -22
binder: 8197:8199 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
binder: 8197:8199 Release 1 refcount change on invalid ref 4 ret -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8197:8223 DecRefs 0 refcount change on invalid ref 0 ret -22
binder: 8197:8222 ioctl c0306201 2000bfd0 returned -22
binder: 8197:8223 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
binder: 8197:8223 Release 1 refcount change on invalid ref 4 ret -22
binder: 8262:8271 ioctl 4b6c 20000200 returned -22
binder: 8262:8271 ioctl 80045400 20000000 returned -22
binder: 8262:8271 ioctl 4b6c 20000200 returned -22
binder: 8262:8275 ioctl 80045400 20000000 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8293:8302 ioctl c0306201 2000bfd0 returned -22
binder: 8324:8331 unknown command -1
binder: 8324:8331 ioctl c0306201 20000140 returned -22
DRBG: could not allocate digest TFM handle: hmac(sha256)
DRBG: could not allocate digest TFM handle: hmac(sha256)
binder: 8378:8380 unknown command 1074815746
binder: 8378:8380 ioctl c0306201 2000bfd0 returned -22
binder: 8378:8400 unknown command 1074815746
binder: 8378:8400 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8414:8420 ioctl c0306201 2000a000 returned -14
binder: 8406:8418 ioctl c0306201 2000bfd0 returned -22
binder_alloc: binder_alloc_mmap_handler: 8414 20000000-20002000 already mapped failed -16
binder: BINDER_SET_CONTEXT_MGR already set
binder: 8414:8445 ioctl 40046207 0 returned -16
binder: 8414:8427 ioctl c0306201 2000a000 returned -14
binder_alloc: 8414: binder_alloc_buf, no vma
binder: BC_ACQUIRE_RESULT not supported
binder: 8414:8427 transaction failed 29189/-3, size 0-0 line 3128
binder: send failed reply for transaction 54 to 8414:8420
binder: undelivered TRANSACTION_ERROR: 29189
binder: undelivered death notification, 0000000000000000
binder: 8457:8459 ioctl c0306201 2000bfd0 returned -22
binder: BINDER_SET_CONTEXT_MGR already set
binder: 8454:8463 ioctl 40046207 0 returned -16
binder: undelivered death notification, 0000000000000000
binder: 8500:8511 unknown command -1991957977
binder: 8500:8511 ioctl c0306201 2000bfd0 returned -22
binder: 8500:8511 unknown command -1991957977
binder: 8500:8511 ioctl c0306201 2000bfd0 returned -22
binder: 8548:8561 unknown command -1073478400
binder: 8548:8561 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8581:8584 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8581:8599 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
audit: type=1400 audit(1521762757.448:38): avc:  denied  { dyntransition } for  pid=8622 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0 tclass=process permissive=1
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
binder: 8619:8624 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8619:8637 ioctl c0306201 2000bfd0 returned -22
binder: 8644:8649 unknown command 1955564830
binder: 8644:8649 ioctl c0306201 2000bfd0 returned -22
binder: 8644:8649 unknown command 1955564830
binder: 8644:8649 ioctl c0306201 2000bfd0 returned -22
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
audit: type=1400 audit(1521762757.668:39): avc:  denied  { create } for  pid=8701 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1
binder: 8699:8720 unknown command 1074005762
binder: 8699:8720 ioctl c0306201 2000bfd0 returned -22
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'.
binder: 8727:8734 unknown command 0
binder: 8727:8734 ioctl c0306201 2000bfd0 returned -22
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket
binder: BC_ACQUIRE_RESULT not supported
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket
binder: 8786:8792 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8786:8810 ioctl c0306201 2000bfd0 returned -22
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket
binder: 8834:8837 unknown command 536871680
binder: 8834:8837 ioctl c0306201 2000bfd0 returned -22
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=8434 sclass=netlink_tcpdiag_socket
binder: BC_ACQUIRE_RESULT not supported
binder: 8868:8880 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8911:8915 ioctl c0306201 2000bfd0 returned -22
binder: 8930:8931 unknown command -1879929948
binder: 8930:8931 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8949:8959 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 8949:8959 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9004:9006 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9004:9006 ioctl c0306201 2000bfd0 returned -22
audit: type=1400 audit(1521762758.888:40): avc:  denied  { ioctl } for  pid=9023 comm="syz-executor2" path="socket:[21273]" dev="sockfs" ino=21273 ioctlcmd=8917 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1
binder: 9033:9037 unknown command 512079
binder: 9033:9037 ioctl c0306201 2000bfd0 returned -22
binder: 9033:9040 unknown command 512079
binder: 9033:9040 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9042:9046 ioctl c0306201 2000bfd0 returned -22
audit: type=1400 audit(1521762758.958:41): avc:  denied  { write } for  pid=9023 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1
binder: 9054:9056 unknown command -100452071
binder: 9054:9056 ioctl c0306201 2000bfd0 returned -22
binder: 9054:9062 unknown command -100452071
binder: 9054:9062 ioctl c0306201 2000bfd0 returned -22
binder: 9066:9070 unknown command -1643879678
binder: 9066:9070 ioctl c0306201 2000bfd0 returned -22
binder: 9066:9070 unknown command -1643879678
binder: 9066:9070 ioctl c0306201 2000bfd0 returned -22
binder: 9086:9090 unknown command 1074029285
binder: 9086:9090 ioctl c0306201 2000bfd0 returned -22
binder: 9086:9109 unknown command 1074029285
binder: 9086:9109 ioctl c0306201 2000bfd0 returned -22
binder: 9125:9129 DecRefs 0 refcount change on invalid ref 4 ret -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9125:9129 ioctl c0306201 2000bfd0 returned -22
binder: 9125:9151 DecRefs 0 refcount change on invalid ref 4 ret -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9125:9158 ioctl c0306201 2000bfd0 returned -22
binder: 9177:9178 unknown command -650344174
binder: 9177:9178 ioctl c0306201 2000bfd0 returned -22
binder: 9177:9178 unknown command -650344174
binder: 9177:9178 ioctl c0306201 2000bfd0 returned -22
binder: 9222:9223 unknown command 1074160386
binder: 9222:9223 ioctl c0306201 2000bfd0 returned -22
binder: 9222:9223 unknown command 1074160386
binder: 9222:9223 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
netlink: 64 bytes leftover after parsing attributes in process `syz-executor3'.
binder: 9257:9259 ioctl c0306201 2000bfd0 returned -22
netlink: 64 bytes leftover after parsing attributes in process `syz-executor3'.
binder: 9282:9290 unknown command 1073741824
audit: type=1400 audit(1521762759.898:42): avc:  denied  { create } for  pid=9288 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_rdma_socket permissive=1
binder: 9282:9290 ioctl c0306201 2000bfd0 returned -22
binder: 9306:9308 unknown command 1074553602
binder: 9306:9308 ioctl c0306201 2000bfd0 returned -22
binder: 9306:9308 unknown command 1074553602
binder: 9306:9308 ioctl c0306201 2000bfd0 returned -22
binder: 9346:9350 unknown command -1462752627
binder: 9346:9350 ioctl c0306201 2000bfd0 returned -22
binder: 9370:9379 unknown command 2022837773
binder: 9370:9379 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9398:9399 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9398:9399 ioctl c0306201 2000bfd0 returned -22
audit: type=1400 audit(1521762760.558:43): avc:  denied  { create } for  pid=9403 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_iscsi_socket permissive=1
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=11606 sclass=netlink_tcpdiag_socket
binder: 9414:9417 unknown command 2062645051
binder: 9414:9417 ioctl c0306201 2000bfd0 returned -22
binder: 9414:9429 unknown command 2062645051
binder: 9414:9429 ioctl c0306201 2000bfd0 returned -22
IPVS: Creating netns size=2552 id=10
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
binder: 9443:9447 unknown command 0
binder: 9443:9447 ioctl c0306201 2000bfd0 returned -22
binder: 9443:9467 unknown command 0
binder: 9443:9467 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9494:9499 ioctl c0306201 20000000 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9546:9555 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9571:9575 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9571:9575 ioctl c0306201 2000bfd0 returned -22
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
binder: 9602:9606 BC_DEAD_BINDER_DONE 0000000000000002 not found
binder: 9602:9606 got reply transaction with no transaction stack
binder: 9602:9606 transaction failed 29201/-71, size 32-24 line 2921
binder: 9602:9606 ioctl 4b40 200001c0 returned -22
binder: 9602:9620 BC_DEAD_BINDER_DONE 0000000000000002 not found
binder: 9602:9620 got reply transaction with no transaction stack
binder: 9602:9620 transaction failed 29201/-71, size 32-24 line 2921
binder: 9602:9620 ioctl 4b40 200001c0 returned -22
binder: 9654:9656 ioctl 8904 20000680 returned -22
binder: 9654:9656 unknown command 1084020738
binder: 9654:9656 ioctl c0306201 2000bfd0 returned -22
binder: 9654:9691 ioctl 8904 20000680 returned -22
binder: 9700:9701 unknown command 0
binder: 9700:9701 ioctl c0306201 2000bfd0 returned -22
binder: 9700:9701 unknown command 0
binder: 9700:9701 ioctl c0306201 2000bfd0 returned -22
binder: 9721:9725 unknown command 96
binder: 9721:9725 ioctl c0306201 2000bfd0 returned -22
binder: 9721:9725 unknown command 96
binder: 9721:9725 ioctl c0306201 2000bfd0 returned -22
binder: 9749:9751 unknown command 1089626882
binder: 9749:9751 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9768:9773 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9768:9773 ioctl c0306201 2000bfd0 returned -22
binder: 9806:9810 unknown command -1103138542
binder: 9806:9810 ioctl c0306201 2000bfd0 returned -22
binder: 9806:9825 unknown command -1103138542
binder: 9806:9825 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9852:9855 ioctl c0306201 2000bfd0 returned -22
binder: BC_ACQUIRE_RESULT not supported
binder: 9852:9858 ioctl c0306201 2000bfd0 returned -22
binder: 9868:9870 unknown command 0
binder: 9868:9870 ioctl c0306201 2000bfd0 returned -22
binder: 9868:9882 unknown command 0
binder: 9868:9882 ioctl c0306201 2000bfd0 returned -22
binder: 9894:9902 unknown command 0
TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
binder: 9894:9902 ioctl c0306201 2000bfd0 returned -22
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=53769 sclass=netlink_tcpdiag_socket
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=53769 sclass=netlink_tcpdiag_socket
audit: type=1400 audit(1521762763.838:44): avc:  denied  { create } for  pid=10108 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_scsitransport_socket permissive=1

Crashes (20):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/03/22 23:52 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 2e9d9054 .config console log report ci-android-44-kasan-gce
2018/03/21 22:00 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc f63eeee9 .config console log report ci-android-44-kasan-gce
2018/03/17 15:51 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 08dacaa0 .config console log report ci-android-44-kasan-gce
2018/03/15 12:34 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 08dacaa0 .config console log report ci-android-44-kasan-gce
2018/03/12 20:51 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc f505ca4b .config console log report ci-android-44-kasan-gce
2018/03/11 06:42 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 36d1c454 .config console log report ci-android-44-kasan-gce
2018/03/10 08:46 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 36d1c454 .config console log report ci-android-44-kasan-gce
2018/03/10 05:14 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 36d1c454 .config console log report ci-android-44-kasan-gce
2018/03/08 07:48 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc d50edb7e .config console log report ci-android-44-kasan-gce
2018/03/01 21:53 https://android.googlesource.com/kernel/common android-4.4 024f962d4b24 2c6f473e .config console log report ci-android-44-kasan-gce
2018/03/24 17:30 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 2e9d9054 .config console log report ci-android-44-kasan-gce-386
2018/03/24 15:50 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 2e9d9054 .config console log report ci-android-44-kasan-gce-386
2018/03/21 01:05 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 113a43ff .config console log report ci-android-44-kasan-gce-386
2018/03/20 23:34 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 72c33b66 .config console log report ci-android-44-kasan-gce-386
2018/03/20 17:10 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 72c33b66 .config console log report ci-android-44-kasan-gce-386
2018/03/18 05:13 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 08dacaa0 .config console log report ci-android-44-kasan-gce-386
2018/03/16 19:16 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 08dacaa0 .config console log report ci-android-44-kasan-gce-386
2018/03/16 03:50 https://android.googlesource.com/kernel/common android-4.4 d63fdf61a4dc 08dacaa0 .config console log report ci-android-44-kasan-gce-386
2018/03/05 07:14 https://android.googlesource.com/kernel/common android-4.4 855ea747806b 2c6f473e .config console log report ci-android-44-kasan-gce-386
2018/03/03 10:54 https://android.googlesource.com/kernel/common android-4.4 855ea747806b 2c6f473e .config console log report ci-android-44-kasan-gce-386
* Struck through repros no longer work on HEAD.