syzbot

binder: 11099:11099 transaction failed 29189/-3, size 0-0 line 3128
binder: BINDER_SET_CONTEXT_MGR already set
binder: 11101:11101 ioctl 40046207 0 returned -16
binder_alloc: 3902: binder_alloc_buf, no vma
binder: 11101:11101 transaction failed 29189/-3, size 0-0 line 3128
INFO: task jbd2/sda1-8:1866 blocked for more than 120 seconds.
      Not tainted 4.4.115-gaa856bd #6
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
jbd2/sda1-8     D ffff8801d3b3f580 26632  1866      2 0x00000000
 ffff8801d3b3f580 0000000000000000 0000000000000002 0000000000000000
 ffff8801d3b3f5a8 0000000000000200 ffff8801db31fdb8 ffff8801db31fde0
 ffff8801db31f4d8 ffff8801d9b4e000 ffff8801d3a98000 0000000000000000
Call Trace:
 [<ffffffff837662da>] schedule+0x7a/0x1b0 kernel/sched/core.c:3353
 [<ffffffff837715f0>] schedule_timeout+0x3a0/0x970 kernel/time/timer.c:1515
 [<ffffffff8376426e>] io_schedule_timeout+0x1be/0x390 kernel/sched/core.c:4935
 [<ffffffff8376759b>] io_schedule include/linux/sched.h:447 [inline]
 [<ffffffff8376759b>] bit_wait_io+0x1b/0xc0 kernel/sched/wait.c:595
 [<ffffffff83766cdc>] __wait_on_bit+0x8c/0x140 kernel/sched/wait.c:395
 [<ffffffff83766e80>] out_of_line_wait_on_bit+0xf0/0x130 kernel/sched/wait.c:408
 [<ffffffff815c5ccc>] wait_on_bit_io include/linux/wait.h:1015 [inline]
 [<ffffffff815c5ccc>] __wait_on_buffer+0x5c/0x70 fs/buffer.c:123
 [<ffffffff8181df41>] wait_on_buffer include/linux/buffer_head.h:342 [inline]
 [<ffffffff8181df41>] journal_wait_on_commit_record fs/jbd2/commit.c:178 [inline]
 [<ffffffff8181df41>] jbd2_journal_commit_transaction+0x33b1/0x64e0 fs/jbd2/commit.c:895
 [<ffffffff8182e4fa>] kjournald2+0x22a/0x840 fs/jbd2/journal.c:223
 [<ffffffff811907e8>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff83774845>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:506
INFO: lockdep is turned off.
Sending NMI to all CPUs:
NMI backtrace for cpu 0
CPU: 0 PID: 332 Comm: kworker/u4:3 Not tainted 4.4.115-gaa856bd #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: binder binder_deferred_func
task: ffff8801d9213000 task.stack: ffff8801d9268000
RIP: 0010:[<ffffffff81f84a4b>]  [<ffffffff81f84a4b>] inb arch/x86/include/asm/io.h:316 [inline]
RIP: 0010:[<ffffffff81f84a4b>]  [<ffffffff81f84a4b>] io_serial_in+0x6b/0x90 drivers/tty/serial/8250/8250_port.c:398
RSP: 0018:ffff8801d926f708  EFLAGS: 00000002
RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8607a878
RBP: ffff8801d926f718 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: fffffbfff0ad7e33 R12: ffffffff8607a840
R13: 0000000000000060 R14: fffffbfff0c0f54f R15: fffffbfff0c0f511
FS:  0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020008ff3 CR3: 000000000420c000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8607a840 0000000000002710 ffff8801d926f768 ffffffff81f86649
 ffff8801d926f768 ffffffff8607a888 ffffffff8607aa7a ffffffff8607a840
 1ffff1003b24def6 0000000000000000 ffff8801d926f870 ffffffff8607a888
Call Trace:
 [<ffffffff81f86649>] serial_in drivers/tty/serial/8250/8250.h:97 [inline]
 [<ffffffff81f86649>] wait_for_xmitr+0x89/0x1d0 drivers/tty/serial/8250/8250_port.c:1717
 [<ffffffff81f905fd>] serial8250_console_write+0x2ed/0x860 drivers/tty/serial/8250/8250_port.c:2878
 [<ffffffff81f7f794>] univ8250_console_write+0x64/0x80 drivers/tty/serial/8250/8250_core.c:594
 [<ffffffff81266fdc>] call_console_drivers.constprop.26+0x1ec/0x3e0 kernel/printk/printk.c:1463
 [<ffffffff81269b84>] console_unlock+0x534/0xa00 kernel/printk/printk.c:2330
 [<ffffffff8126a5ae>] vprintk_emit+0x55e/0x850 kernel/printk/printk.c:1832
 [<ffffffff8126a8c8>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
 [<ffffffff8126a8ed>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
 [<ffffffff8141b91d>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
 [<ffffffff82c76978>] binder_release_work+0x148/0x260 drivers/android/binder.c:4373
 [<ffffffff82c76d05>] binder_thread_release+0x275/0x540 drivers/android/binder.c:4543
 [<ffffffff82c7ba68>] binder_deferred_release drivers/android/binder.c:5082 [inline]
 [<ffffffff82c7ba68>] binder_deferred_func+0x438/0xd10 drivers/android/binder.c:5154
 [<ffffffff8117fd97>] process_one_work+0x7d7/0x16e0 kernel/workqueue.c:2064
 [<ffffffff81180d79>] worker_thread+0xd9/0xfc0 kernel/workqueue.c:2196
 [<ffffffff811907e8>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff83774845>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:506
Code: 24 c1 00 00 00 49 8d 7c 24 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 d3 e3 80 3c 02 00 75 17 41 03 5c 24 38 89 da ec <5b> 0f b6 c0 41 5c 5d c3 e8 88 9d 57 ff eb c2 e8 e1 9d 57 ff eb 
NMI backtrace for cpu 1
CPU: 1 PID: 486 Comm: khungtaskd Not tainted 4.4.115-gaa856bd #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800bac74800 task.stack: ffff8800bb2f8000
RIP: 0010:[<ffffffff810c3ec7>]  [<ffffffff810c3ec7>] native_apic_mem_write arch/x86/include/asm/apic.h:94 [inline]
RIP: 0010:[<ffffffff810c3ec7>]  [<ffffffff810c3ec7>] __default_send_IPI_dest_field arch/x86/include/asm/ipi.h:119 [inline]
RIP: 0010:[<ffffffff810c3ec7>]  [<ffffffff810c3ec7>] _flat_send_IPI_mask arch/x86/kernel/apic/apic_flat_64.c:61 [inline]
RIP: 0010:[<ffffffff810c3ec7>]  [<ffffffff810c3ec7>] flat_send_IPI_mask+0xf7/0x1a0 arch/x86/kernel/apic/apic_flat_64.c:69
RSP: 0018:ffff8800bb2ffcb8  EFLAGS: 00000046
RAX: 0000000003000000 RBX: 0000000000000c00 RCX: ffffffff8126a292
RDX: 0000000000000c00 RSI: 0000000000000002 RDI: ffffffffff5fb300
RBP: ffff8800bb2ffce0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
R13: 0000000000000003 R14: ffffffff8426f3a0 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2e00efa1c4 CR3: 00000001b2e0e000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8426f3a0 ffffffff847ef7c0 fffffbfff08fd9ac dffffc0000000000
 ffff8801db31bca0 ffff8800bb2ffd00 ffffffff810b99fb ffffffff839f61c0
 0000000000000003 ffff8800bb2ffd60 ffffffff81d0ed14 0000000000000001
Call Trace:
 [<ffffffff810b99fb>] nmi_raise_cpu_backtrace+0x5b/0x70 arch/x86/kernel/apic/hw_nmi.c:33
 [<ffffffff81d0ed14>] nmi_trigger_all_cpu_backtrace+0x4a4/0x550 lib/nmi_backtrace.c:85
 [<ffffffff810b9a94>] arch_trigger_all_cpu_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 [<ffffffff81368cca>] trigger_all_cpu_backtrace include/linux/nmi.h:44 [inline]
 [<ffffffff81368cca>] check_hung_task kernel/hung_task.c:125 [inline]
 [<ffffffff81368cca>] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline]
 [<ffffffff81368cca>] watchdog+0x6fa/0xae0 kernel/hung_task.c:238
 [<ffffffff811907e8>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff83774845>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:506
Code: b3 5f ff f6 c4 10 75 e1 44 89 e8 c1 e0 18 89 04 25 10 b3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 b3 5f ff <41> f7 c4 00 02 00 00 74 1a e8 0b 2f 17 00 4c 89 e7 57 9d 0f 1f