INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-next-kasan-gce-9,10.128.15.206' (ECDSA) to the list of known hosts. 2017/12/06 06:09:05 parsed 1 programs 2017/12/06 06:09:05 executed programs: 0 syzkaller login: [ 20.543672] binder: 3114:3116 got new transaction with bad transaction stack, transaction 4 has target 3114:0 [ 20.545146] binder: 3114:3116 transaction failed 29201/-71, size 0-0 line 2859 [ 20.546947] binder: 3099:3104 got new transaction with bad transaction stack, transaction 3 has target 3099:0 [ 20.546960] binder: 3099:3104 transaction failed 29201/-71, size 0-0 line 2859 [ 20.547273] binder: 3117:3118 got new transaction with bad transaction stack, transaction 8 has target 3117:0 [ 20.547283] binder: 3117:3118 transaction failed 29201/-71, size 0-0 line 2859 [ 20.548880] binder: 3097:3101 got new transaction with bad transaction stack, transaction 11 has target 3097:0 [ 20.548891] binder: 3097:3101 transaction failed 29201/-71, size 0-0 line 2859 [ 20.553106] binder: 3106:3113 got new transaction with bad transaction stack, transaction 15 has target 3106:0 [ 20.553119] binder: 3106:3113 transaction failed 29201/-71, size 0-0 line 2859 [ 20.555010] binder: 3096:3100 got new transaction with bad transaction stack, transaction 17 has target 3096:0 [ 20.555058] binder: 3096:3100 transaction failed 29201/-71, size 0-0 line 2859 [ 20.562438] binder: send failed reply for transaction 11 to 3097:3101 [ 20.563529] binder: 3097:3101 got new transaction with bad transaction stack, transaction 20 has target 3097:0 [ 20.563542] binder: 3097:3101 transaction failed 29201/-71, size 0-0 line 2859 [ 20.566549] binder: 3114:3130 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 20.570198] binder: release 3097:3101 transaction 20 out, still active [ 20.571168] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.571252] binder: send failed reply for transaction 20, target dead [ 20.590645] binder: send failed reply for transaction 15 to 3106:3113 [ 20.593983] binder: 3108:3110 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 20.596925] binder: send failed reply for transaction 8 to 3117:3118 [ 20.598649] binder: send failed reply for transaction 17 to 3096:3100 [ 20.602725] binder: 3106:3131 transaction failed 29189/-22, size 0-0 line 2832 [ 20.605503] binder: send failed reply for transaction 3 to 3099:3104 [ 20.610442] binder: 3109:3112 got new transaction with bad transaction stack, transaction 29 has target 3109:0 [ 20.610453] binder: 3109:3112 transaction failed 29201/-71, size 0-0 line 2859 [ 20.616502] binder: 3099:3140 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 20.621912] binder: 3117:3148 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 20.627709] binder: send failed reply for transaction 27 to 3106:3113 [ 20.628457] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.628479] binder: undelivered TRANSACTION_COMPLETE [ 20.628486] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.630595] binder: send failed reply for transaction 4 to 3114:3116 [ 20.630656] binder: send failed reply for transaction 29 to 3109:3112 [ 20.631633] binder: 3096:3119 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 20.652858] binder: 3146:3147 got new transaction with bad transaction stack, transaction 45 has target 3146:0 [ 20.652869] binder: 3146:3147 transaction failed 29201/-71, size 0-0 line 2859 [ 20.657564] binder: 3109:3126 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 20.657610] binder: 3114:3130 got new transaction with bad transaction stack, transaction 43 has target 3114:0 [ 20.657619] binder: 3114:3130 transaction failed 29201/-71, size 0-0 line 2859 [ 20.663508] binder: send failed reply for transaction 35 to 3117:3148 [ 20.663520] binder: send failed reply for transaction 38 to 3117:3133 [ 20.665465] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.665476] binder: undelivered TRANSACTION_COMPLETE [ 20.665482] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.665492] binder: undelivered TRANSACTION_COMPLETE [ 20.665499] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.665536] binder: send failed reply for transaction 32 to 3099:3140 [ 20.665548] binder: send failed reply for transaction 33 to 3099:3124 [ 20.665651] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.665660] binder: undelivered TRANSACTION_COMPLETE [ 20.665666] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.665674] binder: undelivered TRANSACTION_COMPLETE [ 20.665681] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.673799] binder: send failed reply for transaction 37 to 3096:3137 [ 20.673812] binder: send failed reply for transaction 39 to 3096:3119 [ 20.673866] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.673875] binder: undelivered TRANSACTION_COMPLETE [ 20.673882] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.673891] binder: undelivered TRANSACTION_COMPLETE [ 20.673897] binder: undelivered TRANSACTION_ERROR: 29189 [ 20.683741] binder: send failed reply for transaction 45 to 3146:3147 [ 20.689310] binder: send failed reply for transaction 41 to 3109:3126 [ 20.689322] binder: send failed reply for transaction 47 to 3109:3112 [ 20.689325] ------------[ cut here ]------------ [ 20.689328] Unexpected reply error: 29189 [ 20.689461] WARNING: CPU: 0 PID: 23 at drivers/android/binder.c:1985 binder_send_failed_reply+0x13b/0x390 [ 20.689465] Kernel panic - not syncing: panic_on_warn set ... [ 20.689465] [ 20.689473] CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 4.15.0-rc2-next-20171206+ #60 [ 20.689477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 20.689485] Workqueue: events binder_deferred_func [ 20.689490] Call Trace: [ 20.689500] dump_stack+0x194/0x257 [ 20.689515] ? arch_local_irq_restore+0x53/0x53 [ 20.689532] ? vsnprintf+0x1ed/0x1900 [ 20.689551] panic+0x1e4/0x41c [ 20.689561] ? refcount_error_report+0x214/0x214 [ 20.689569] ? show_regs_print_info+0x18/0x18 [ 20.689591] ? __warn+0x1c1/0x200 [ 20.689607] ? binder_send_failed_reply+0x13b/0x390 [ 20.689614] __warn+0x1dc/0x200 [ 20.689623] ? binder_send_failed_reply+0x13b/0x390 [ 20.689637] report_bug+0x211/0x2d0 [ 20.689659] fixup_bug.part.11+0x37/0x80 [ 20.689670] do_error_trap+0x2d7/0x3e0 [ 20.689676] ? __down_trylock_console_sem+0x10d/0x1e0 [ 20.689692] ? math_error+0x400/0x400 [ 20.689700] ? vprintk_emit+0x3ea/0x590 [ 20.689712] ? vprintk_emit+0x3ea/0x590 [ 20.689736] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 20.689756] do_invalid_op+0x1b/0x20 [ 20.689764] invalid_op+0x22/0x40 [ 20.689771] RIP: 0010:binder_send_failed_reply+0x13b/0x390 [ 20.689776] RSP: 0018:ffff8801d9d070c8 EFLAGS: 00010286 [ 20.689783] RAX: dffffc0000000008 RBX: ffff8801d8a08c00 RCX: ffffffff815a01be [ 20.689788] RDX: 0000000000000000 RSI: 1ffff1003b39f129 RDI: 0000000000000293 [ 20.689795] RBP: ffff8801d9d070f0 R08: 1ffff1003b3a0dac R09: 0000000000000000 [ 20.689799] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cbbdb040 [ 20.689803] R13: 0000000000007205 R14: 0000000000007205 R15: 0000000000000c25 [ 20.689827] ? vprintk_func+0x5e/0xc0 [ 20.689847] ? binder_send_failed_reply+0x13b/0x390 [ 20.689863] binder_cleanup_transaction+0xd2/0x140 [ 20.689877] binder_release_work+0x340/0x490 [ 20.689894] ? kzalloc.constprop.53+0x20/0x20 [ 20.689914] ? do_raw_spin_trylock+0x190/0x190 [ 20.689928] ? kfree+0xe4/0x250 [ 20.689936] ? binder_deferred_func+0xe8a/0x12f0 [ 20.689953] ? _raw_spin_unlock+0x22/0x30 [ 20.689968] binder_deferred_func+0xdf5/0x12f0 [ 20.690003] ? binder_cleanup_ref_olocked+0xab0/0xab0 [ 20.690028] ? find_held_lock+0x39/0x1d0 [ 20.690045] ? check_noncircular+0x20/0x20 [ 20.690070] ? lock_acquire+0x1d5/0x580 [ 20.690078] ? process_one_work+0xb2f/0x1bc0 [ 20.690088] ? lock_downgrade+0x980/0x980 [ 20.690114] ? __lock_is_held+0xbc/0x140 [ 20.690147] process_one_work+0xbfd/0x1bc0 [ 20.690180] ? pwq_dec_nr_in_flight+0x450/0x450 [ 20.690188] ? finish_task_switch+0x4eb/0x740 [ 20.690227] ? perf_trace_lock_acquire+0xe3/0x980 [ 20.690251] ? perf_trace_lock+0x900/0x900 [ 20.690257] ? __sched_text_start+0x8/0x8 [ 20.690276] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 20.690292] ? select_task_rq_fair+0x2770/0x2770 [ 20.690302] ? check_noncircular+0x20/0x20 [ 20.690322] ? find_held_lock+0x39/0x1d0 [ 20.690355] ? lock_acquire+0x1d5/0x580 [ 20.690362] ? worker_thread+0x4a3/0x1990 [ 20.690384] ? lock_release+0xda0/0xda0 [ 20.690395] ? check_noncircular+0x20/0x20 [ 20.690408] ? do_raw_spin_trylock+0x190/0x190 [ 20.690442] worker_thread+0x223/0x1990 [ 20.690489] ? process_one_work+0x1bc0/0x1bc0 [ 20.690504] ? _raw_spin_unlock_irq+0x27/0x70 [ 20.690517] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 20.690528] ? trace_hardirqs_on+0xd/0x10 [ 20.690537] ? mmdrop+0x18/0x30 [ 20.690546] ? finish_task_switch+0x1f6/0x740 [ 20.690562] ? copy_overflow+0x20/0x20 [ 20.690591] ? __schedule+0x8f3/0x2060 [ 20.690597] ? check_noncircular+0x20/0x20 [ 20.690622] ? find_held_lock+0x39/0x1d0 [ 20.690656] ? find_held_lock+0x39/0x1d0 [ 20.690686] ? lock_downgrade+0x980/0x980 [ 20.690697] ? default_wake_function+0x30/0x50 [ 20.690721] ? __schedule+0x2060/0x2060 [ 20.690728] ? do_wait_intr+0x3e0/0x3e0 [ 20.690742] ? do_raw_spin_trylock+0x190/0x190 [ 20.690755] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 20.690768] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 20.690779] ? trace_hardirqs_on+0xd/0x10 [ 20.690787] ? __kthread_parkme+0x175/0x240 [ 20.690804] kthread+0x37a/0x440 [ 20.690812] ? process_one_work+0x1bc0/0x1bc0 [ 20.690817] ? kthread_stop+0x7b0/0x7b0 [ 20.690831] ret_from_fork+0x24/0x30 [ 20.693249] Dumping ftrace buffer: [ 20.693284] (ftrace buffer empty) [ 20.693286] Kernel Offset: disabled [ 21.448163] Rebooting in 86400 seconds..