binder: 18317:18318 IncRefs 0 refcount change on invalid ref 0 ret -22
binder: 18317:18318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
binder: 18317:18318 DecRefs 0 refcount change on invalid ref 0 ret -22
binder: 18317:18318 IncRefs 0 refcount change on invalid ref 4 ret -22
==================================================================
BUG: KASAN: out-of-bounds in vsnprintf+0x19f7/0x1b60 lib/vsprintf.c:2267
Read of size 8 at addr ffff8801d97ce8b0 by task syz-executor3/18332
CPU: 0 PID: 18332 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #127
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
vsnprintf+0x19f7/0x1b60 lib/vsprintf.c:2267
vscnprintf+0x2d/0x80 lib/vsprintf.c:2370
vprintk_emit+0x1ab/0xdf0 kernel/printk/printk.c:1853
The buggy address belongs to the page:
page:ffffea000765f380 count:0 mapcount:0 mapping:0000000000000000 index:0xffff8801d97ceac0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000
raw: ffff8801d97ceac0 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801d97ce780: f2 01 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 00
ffff8801d97ce800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801d97ce880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8801d97ce900: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00
ffff8801d97ce980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================