[ 38.594534][ T26] audit: type=1800 audit(1553785864.573:26): pid=7655 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 38.620977][ T26] audit: type=1800 audit(1553785864.583:27): pid=7655 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 38.642055][ T26] audit: type=1800 audit(1553785864.583:28): pid=7655 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 39.500733][ T26] audit: type=1800 audit(1553785865.513:29): pid=7655 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.247' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 68.726706][ T7815] binder: 7810:7815 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 68.727905][ T7821] binder: 7818:7821 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 68.738539][ T7824] binder: 7817:7824 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 68.743474][ T7822] binder: 7816:7822 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 68.751785][ T7825] binder: 7819:7825 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 68.760907][ T7823] binder: 7820:7823 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 68.767772][ T7824] binder: 7817:7824 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 68.777191][ T7828] binder: BINDER_SET_CONTEXT_MGR already set [ 68.784281][ T7815] binder: 7810:7815 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 68.790186][ T7821] binder: 7818:7821 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 68.806819][ T7822] binder: 7816:7822 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 68.807613][ T7825] binder: 7819:7825 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 68.815549][ T7823] binder: 7820:7823 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 68.831925][ T7828] binder: 7816:7828 ioctl 40046207 0 returned -16 [ 68.831938][ T7829] binder: BINDER_SET_CONTEXT_MGR already set [ 68.843435][ T7824] ------------[ cut here ]------------ [ 68.845252][ T7830] binder: BINDER_SET_CONTEXT_MGR already set [ 68.850503][ T7824] kernel BUG at drivers/android/binder_alloc.c:1141! [ 68.852025][ T7824] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 68.856718][ T7829] binder: 7817:7829 ioctl 40046207 0 returned -16 [ 68.863159][ T7824] CPU: 1 PID: 7824 Comm: syz-executor095 Not tainted 5.1.0-rc2+ #40 [ 68.863164][ T7824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.863177][ T7824] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 68.863186][ T7824] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 68.863196][ T7824] RSP: 0018:ffff888087a47550 EFLAGS: 00010293 [ 68.869437][ T7827] binder: BINDER_SET_CONTEXT_MGR already set [ 68.875788][ T7824] RAX: ffff88808eeda1c0 RBX: 0000000020001000 RCX: ffffffff854c7d3c [ 68.875795][ T7824] RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 68.875799][ T7824] RBP: ffff888087a475d0 R08: ffff88808eeda1c0 R09: 0000000000000028 [ 68.875803][ T7824] R10: ffffed1010f48f01 R11: ffff888087a4780f R12: 0000000000000008 [ 68.875808][ T7824] R13: 0000000000000028 R14: ffff8880957a38d0 R15: 0000000000000000 [ 68.875814][ T7824] FS: 00007f7700005700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 68.875819][ T7824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.875831][ T7824] CR2: 00007f76fffe3db8 CR3: 0000000095252000 CR4: 00000000001406e0 [ 68.884094][ T7830] binder: 7819:7830 ioctl 40046207 0 returned -16 [ 68.893865][ T7824] Call Trace: [ 68.893886][ T7824] ? memcpy+0x46/0x50 [ 68.893896][ T7824] binder_alloc_copy_from_buffer+0x37/0x42 [ 68.893906][ T7824] binder_get_object+0xc3/0x200 [ 68.893921][ T7824] binder_transaction+0x2b4a/0x6690 [ 68.900841][ T7815] ------------[ cut here ]------------ [ 68.920062][ T7824] ? binder_thread_read+0x3d50/0x3d50 [ 68.926116][ T7815] kernel BUG at drivers/android/binder_alloc.c:1141! [ 68.932077][ T7824] ? __lock_acquire+0x548/0x3fb0 [ 68.940331][ T7827] binder: 7818:7827 ioctl 40046207 0 returned -16 [ 68.947989][ T7824] ? __might_fault+0x12b/0x1e0 [ 68.948001][ T7824] ? lock_downgrade+0x880/0x880 [ 68.948013][ T7824] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 68.948029][ T7824] ? _copy_from_user+0xdd/0x150 [ 69.074541][ T7824] binder_thread_write+0x87e/0x2820 [ 69.079930][ T7824] ? binder_transaction+0x6690/0x6690 [ 69.085302][ T7824] ? __might_fault+0x12b/0x1e0 [ 69.090065][ T7824] ? lock_downgrade+0x880/0x880 [ 69.094914][ T7824] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.101195][ T7824] ? _copy_from_user+0xdd/0x150 [ 69.106046][ T7824] binder_ioctl+0x1033/0x183b [ 69.110727][ T7824] ? binder_thread_write+0x2820/0x2820 [ 69.116268][ T7824] ? tomoyo_path_number_perm+0x263/0x520 [ 69.121897][ T7824] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 69.127705][ T7824] ? binder_thread_write+0x2820/0x2820 [ 69.133350][ T7824] do_vfs_ioctl+0xd6e/0x1390 [ 69.138029][ T7824] ? ioctl_preallocate+0x210/0x210 [ 69.143118][ T7824] ? __fget+0x381/0x550 [ 69.147305][ T7824] ? ksys_dup3+0x3e0/0x3e0 [ 69.151718][ T7824] ? tomoyo_file_ioctl+0x23/0x30 [ 69.156712][ T7824] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 69.162934][ T7824] ? security_file_ioctl+0x93/0xc0 [ 69.168109][ T7824] ksys_ioctl+0xab/0xd0 [ 69.172253][ T7824] __x64_sys_ioctl+0x73/0xb0 [ 69.176833][ T7824] do_syscall_64+0x103/0x610 [ 69.181406][ T7824] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 69.187284][ T7824] RIP: 0033:0x44ad19 [ 69.191164][ T7824] Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 69.210809][ T7824] RSP: 002b:00007f7700004ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 69.219213][ T7824] RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044ad19 [ 69.227170][ T7824] RDX: 0000000020000240 RSI: 00000000c0306201 RDI: 0000000000000003 [ 69.235142][ T7824] RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 [ 69.243097][ T7824] R10: 00000000006dcc20 R11: 0000000000000246 R12: 00000000006dcc2c [ 69.251139][ T7824] R13: 00007fff52642a0f R14: 00007f77000059c0 R15: 0000000000000000 [ 69.259532][ T7824] Modules linked in: [ 69.263781][ T7815] invalid opcode: 0000 [#2] PREEMPT SMP KASAN [ 69.264547][ T7822] ------------[ cut here ]------------ [ 69.270006][ T7815] CPU: 0 PID: 7815 Comm: syz-executor095 Tainted: G D 5.1.0-rc2+ #40 [ 69.275445][ T7822] kernel BUG at drivers/android/binder_alloc.c:1141! [ 69.284792][ T7815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.291997][ T7823] ------------[ cut here ]------------ [ 69.301553][ T7815] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 69.307151][ T7823] kernel BUG at drivers/android/binder_alloc.c:1141! [ 69.313777][ T7815] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 69.320871][ T7821] ------------[ cut here ]------------ [ 69.340106][ T7815] RSP: 0018:ffff888090f07550 EFLAGS: 00010293 [ 69.345583][ T7821] kernel BUG at drivers/android/binder_alloc.c:1141! [ 69.351690][ T7815] RAX: ffff8880a8fbc300 RBX: 0000000020001008 RCX: ffffffff854c7d3c [ 69.358785][ T7825] ------------[ cut here ]------------ [ 69.366341][ T7815] RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 69.366357][ T7815] RBP: ffff888090f075d0 R08: ffff8880a8fbc300 R09: 0000000000000028 [ 69.371806][ T7825] kernel BUG at drivers/android/binder_alloc.c:1141! [ 69.379753][ T7815] R10: ffffed10121e0f01 R11: ffff888090f0780f R12: 0000000000000008 [ 69.379767][ T7815] R13: 0000000000000028 R14: ffff8880957a38d0 R15: 0000000000000000 [ 69.387888][ T7831] binder: BINDER_SET_CONTEXT_MGR already set [ 69.394405][ T7815] FS: 00007f7700005700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 69.394410][ T7815] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.394414][ T7815] CR2: 00007f76fffe3db8 CR3: 000000009011e000 CR4: 00000000001406f0 [ 69.394420][ T7815] Call Trace: [ 69.394441][ T7815] ? memcpy+0x46/0x50 [ 69.394459][ T7815] binder_alloc_copy_from_buffer+0x37/0x42 [ 69.402520][ T7831] binder: 7820:7831 ioctl 40046207 0 returned -16 [ 69.410378][ T7815] binder_get_object+0xc3/0x200 [ 69.410390][ T7815] binder_transaction+0x2b4a/0x6690 [ 69.410405][ T7815] ? binder_thread_read+0x3d50/0x3d50 [ 69.410414][ T7815] ? __lock_acquire+0x548/0x3fb0 [ 69.410427][ T7815] ? __might_fault+0x12b/0x1e0 [ 69.410444][ T7815] ? lock_downgrade+0x880/0x880 [ 69.489222][ T7815] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.495453][ T7815] ? _copy_from_user+0xdd/0x150 [ 69.500295][ T7815] binder_thread_write+0x87e/0x2820 [ 69.505477][ T7815] ? binder_transaction+0x6690/0x6690 [ 69.510890][ T7815] ? __might_fault+0x12b/0x1e0 [ 69.515638][ T7815] ? lock_downgrade+0x880/0x880 [ 69.520479][ T7815] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.526702][ T7815] ? _copy_from_user+0xdd/0x150 [ 69.531538][ T7815] binder_ioctl+0x1033/0x183b [ 69.536253][ T7815] ? binder_thread_write+0x2820/0x2820 [ 69.541698][ T7815] ? tomoyo_path_number_perm+0x263/0x520 [ 69.547314][ T7815] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 69.553234][ T7815] ? binder_thread_write+0x2820/0x2820 [ 69.558682][ T7815] do_vfs_ioctl+0xd6e/0x1390 [ 69.563271][ T7815] ? ioctl_preallocate+0x210/0x210 [ 69.568367][ T7815] ? __fget+0x381/0x550 [ 69.572504][ T7815] ? ksys_dup3+0x3e0/0x3e0 [ 69.576904][ T7815] ? tomoyo_file_ioctl+0x23/0x30 [ 69.581829][ T7815] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 69.588184][ T7815] ? security_file_ioctl+0x93/0xc0 [ 69.593342][ T7815] ksys_ioctl+0xab/0xd0 [ 69.597479][ T7815] __x64_sys_ioctl+0x73/0xb0 [ 69.602054][ T7815] do_syscall_64+0x103/0x610 [ 69.606738][ T7815] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 69.612613][ T7815] RIP: 0033:0x44ad19 [ 69.616503][ T7815] Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 69.636225][ T7815] RSP: 002b:00007f7700004ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 69.644625][ T7815] RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044ad19 [ 69.652584][ T7815] RDX: 0000000020000240 RSI: 00000000c0306201 RDI: 0000000000000003 [ 69.660540][ T7815] RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 [ 69.668505][ T7815] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc2c [ 69.676508][ T7815] R13: 00007fff52642a0f R14: 00007f77000059c0 R15: 0000000000000000 [ 69.684472][ T7815] Modules linked in: [ 69.688373][ T7822] invalid opcode: 0000 [#3] PREEMPT SMP KASAN [ 69.689546][ T7824] ---[ end trace 7bcb203b6a815762 ]--- [ 69.694492][ T7822] CPU: 1 PID: 7822 Comm: syz-executor095 Tainted: G D 5.1.0-rc2+ #40 [ 69.694498][ T7822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.694510][ T7822] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 69.694519][ T7822] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 69.694529][ T7822] RSP: 0018:ffff888096d97550 EFLAGS: 00010293 [ 69.700055][ T7824] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 69.709525][ T7822] RAX: ffff8880a8e68400 RBX: 0000000020001010 RCX: ffffffff854c7d3c [ 69.709531][ T7822] RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 69.709535][ T7822] RBP: ffff888096d975d0 R08: ffff8880a8e68400 R09: 0000000000000028 [ 69.709539][ T7822] R10: ffffed1012db2f01 R11: ffff888096d9780f R12: 0000000000000008 [ 69.709544][ T7822] R13: 0000000000000028 R14: ffff8880957a38d0 R15: 0000000000000000 [ 69.709551][ T7822] FS: 00007f7700005700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 69.709555][ T7822] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.709559][ T7822] CR2: 00007f76fffe3db8 CR3: 00000000972e4000 CR4: 00000000001406e0 [ 69.709565][ T7822] Call Trace: [ 69.709583][ T7822] ? memcpy+0x46/0x50 [ 69.709594][ T7822] binder_alloc_copy_from_buffer+0x37/0x42 [ 69.709610][ T7822] binder_get_object+0xc3/0x200 [ 69.720060][ T7824] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 69.726324][ T7822] binder_transaction+0x2b4a/0x6690 [ 69.726340][ T7822] ? binder_thread_read+0x3d50/0x3d50 [ 69.726349][ T7822] ? __lock_acquire+0x548/0x3fb0 [ 69.726363][ T7822] ? preempt_schedule+0x4b/0x60 [ 69.746348][ T7815] ---[ end trace 7bcb203b6a815763 ]--- [ 69.752177][ T7822] ? __might_fault+0x12b/0x1e0 [ 69.752190][ T7822] ? lock_downgrade+0x880/0x880 [ 69.752205][ T7822] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.758773][ T7824] RSP: 0018:ffff888087a47550 EFLAGS: 00010293 [ 69.766667][ T7822] ? _copy_from_user+0xdd/0x150 [ 69.766681][ T7822] binder_thread_write+0x87e/0x2820 [ 69.766698][ T7822] ? binder_transaction+0x6690/0x6690 [ 69.774950][ T7815] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 69.782685][ T7822] ? __might_fault+0x12b/0x1e0 [ 69.782697][ T7822] ? lock_downgrade+0x880/0x880 [ 69.782710][ T7822] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.782725][ T7822] ? _copy_from_user+0xdd/0x150 [ 69.790968][ T7815] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 69.798714][ T7822] binder_ioctl+0x1033/0x183b [ 69.798726][ T7822] ? binder_thread_write+0x2820/0x2820 [ 69.798734][ T7822] ? tomoyo_path_number_perm+0x263/0x520 [ 69.798741][ T7822] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 69.798755][ T7822] ? binder_thread_write+0x2820/0x2820 [ 69.807907][ T7824] RAX: ffff88808eeda1c0 RBX: 0000000020001000 RCX: ffffffff854c7d3c [ 69.814257][ T7822] do_vfs_ioctl+0xd6e/0x1390 [ 69.814269][ T7822] ? ioctl_preallocate+0x210/0x210 [ 69.814278][ T7822] ? __fget+0x381/0x550 [ 69.814294][ T7822] ? ksys_dup3+0x3e0/0x3e0 [ 69.822438][ T7824] RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 69.825541][ T7822] ? tomoyo_file_ioctl+0x23/0x30 [ 69.825551][ T7822] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 69.825561][ T7822] ? security_file_ioctl+0x93/0xc0 [ 69.825569][ T7822] ksys_ioctl+0xab/0xd0 [ 69.825582][ T7822] __x64_sys_ioctl+0x73/0xb0 [ 69.829724][ T7824] RBP: ffff888087a475d0 R08: ffff88808eeda1c0 R09: 0000000000000028 [ 69.835333][ T7822] do_syscall_64+0x103/0x610 [ 69.835344][ T7822] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 69.835351][ T7822] RIP: 0033:0x44ad19 [ 69.835361][ T7822] Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 69.835365][ T7822] RSP: 002b:00007f7700004ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 69.835380][ T7822] RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044ad19 [ 69.840383][ T7815] RSP: 0018:ffff888087a47550 EFLAGS: 00010293 [ 69.859862][ T7822] RDX: 0000000020000240 RSI: 00000000c0306201 RDI: 0000000000000003 [ 69.859868][ T7822] RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 [ 69.859872][ T7822] R10: 00000000006dcc20 R11: 0000000000000246 R12: 00000000006dcc2c [ 69.859876][ T7822] R13: 00007fff52642a0f R14: 00007f77000059c0 R15: 0000000000000000 [ 69.859886][ T7822] Modules linked in: [ 69.861577][ T7823] invalid opcode: 0000 [#4] PREEMPT SMP KASAN [ 69.866005][ T7824] R10: ffffed1010f48f01 R11: ffff888087a4780f R12: 0000000000000008 [ 69.870688][ T7823] CPU: 1 PID: 7823 Comm: syz-executor095 Tainted: G D 5.1.0-rc2+ #40 [ 69.870693][ T7823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 69.870706][ T7823] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 69.870720][ T7823] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 69.875946][ T7824] R13: 0000000000000028 R14: ffff8880957a38d0 R15: 0000000000000000 [ 69.880546][ T7823] RSP: 0018:ffff888094337550 EFLAGS: 00010293 [ 69.880554][ T7823] RAX: ffff88808f3f26c0 RBX: 0000000020001018 RCX: ffffffff854c7d3c [ 69.880558][ T7823] RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 69.880562][ T7823] RBP: ffff8880943375d0 R08: ffff88808f3f26c0 R09: 0000000000000028 [ 69.880566][ T7823] R10: ffffed1012866f01 R11: ffff88809433780f R12: 0000000000000008 [ 69.880576][ T7823] R13: 0000000000000028 R14: ffff8880957a38d0 R15: 0000000000000000 [ 69.886208][ T7824] FS: 00007f7700005700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 69.890749][ T7823] FS: 00007f7700005700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 69.890755][ T7823] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.890759][ T7823] CR2: 00007f76fffe3db8 CR3: 0000000098344000 CR4: 00000000001406e0 [ 69.890764][ T7823] Call Trace: [ 69.890788][ T7823] ? memcpy+0x46/0x50 [ 69.895815][ T7815] RAX: ffff88808eeda1c0 RBX: 0000000020001000 RCX: ffffffff854c7d3c [ 69.901877][ T7823] binder_alloc_copy_from_buffer+0x37/0x42 [ 69.901888][ T7823] binder_get_object+0xc3/0x200 [ 69.901902][ T7823] binder_transaction+0x2b4a/0x6690 [ 69.908178][ T7824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.912851][ T7823] ? binder_thread_read+0x3d50/0x3d50 [ 69.912860][ T7823] ? __lock_acquire+0x548/0x3fb0 [ 69.912868][ T7823] ? preempt_schedule+0x4b/0x60 [ 69.912882][ T7823] ? __might_fault+0x12b/0x1e0 [ 69.918175][ T7815] RDX: 0000000000000000 RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 69.923406][ T7823] ? lock_downgrade+0x880/0x880 [ 69.923420][ T7823] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.923435][ T7823] ? _copy_from_user+0xdd/0x150 [ 69.930016][ T7824] CR2: 000000000251e000 CR3: 0000000095252000 CR4: 00000000001406f0 [ 69.934737][ T7823] binder_thread_write+0x87e/0x2820 [ 69.934751][ T7823] ? binder_transaction+0x6690/0x6690 [ 69.934765][ T7823] ? __might_fault+0x12b/0x1e0 [ 69.939724][ T7815] RBP: ffff888087a475d0 R08: ffff88808eeda1c0 R09: 0000000000000028 [ 69.945896][ T7823] ? lock_downgrade+0x880/0x880 [ 69.945913][ T7823] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 69.945922][ T7823] ? _copy_from_user+0xdd/0x150 [ 69.945937][ T7823] binder_ioctl+0x1033/0x183b [ 69.950997][ T7824] Kernel panic - not syncing: Fatal exception [ 69.970470][ T7823] ? binder_thread_write+0x2820/0x2820 [ 70.447432][ T7823] ? tomoyo_path_number_perm+0x263/0x520 [ 70.453048][ T7823] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 70.458838][ T7823] ? binder_thread_write+0x2820/0x2820 [ 70.464327][ T7823] do_vfs_ioctl+0xd6e/0x1390 [ 70.468903][ T7823] ? ioctl_preallocate+0x210/0x210 [ 70.473989][ T7823] ? __fget+0x381/0x550 [ 70.478129][ T7823] ? ksys_dup3+0x3e0/0x3e0 [ 70.482522][ T7823] ? tomoyo_file_ioctl+0x23/0x30 [ 70.487442][ T7823] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 70.493705][ T7823] ? security_file_ioctl+0x93/0xc0 [ 70.498805][ T7823] ksys_ioctl+0xab/0xd0 [ 70.502935][ T7823] __x64_sys_ioctl+0x73/0xb0 [ 70.507497][ T7823] do_syscall_64+0x103/0x610 [ 70.512060][ T7823] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 70.517932][ T7823] RIP: 0033:0x44ad19 [ 70.521855][ T7823] Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 70.541448][ T7823] RSP: 002b:00007f7700004ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 70.549847][ T7823] RAX: ffffffffffffffda RBX: 00000000006dcc28 RCX: 000000000044ad19 [ 70.557806][ T7823] RDX: 0000000020000240 RSI: 00000000c0306201 RDI: 0000000000000003 [ 70.565785][ T7823] RBP: 00000000006dcc20 R08: 0000000000000000 R09: 0000000000000000 [ 70.573803][ T7823] R10: 00000000006dcc20 R11: 0000000000000246 R12: 00000000006dcc2c [ 70.581757][ T7823] R13: 00007fff52642a0f R14: 00007f77000059c0 R15: 0000000000000000 [ 70.589766][ T7823] Modules linked in: [ 70.594352][ T7824] Kernel Offset: disabled [ 70.598683][ T7824] Rebooting in 86400 seconds..