INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.9' (ECDSA) to the list of known hosts. 2018/04/03 23:12:12 parsed 1 programs 2018/04/03 23:12:12 executed programs: 0 syzkaller login: [ 27.977880] IPVS: ftp: loaded support on port[0] = 21 [ 28.022640] IPVS: ftp: loaded support on port[0] = 21 [ 28.052543] binder: 4449:4450 ioctl 400448c8 20000200 returned -22 [ 28.059780] IPVS: ftp: loaded support on port[0] = 21 [ 28.085114] binder: BINDER_SET_CONTEXT_MGR already set [ 28.096108] binder: 4451:4453 ioctl 40046207 0 returned -16 [ 28.102560] binder: 4451:4453 ioctl 400448c8 20000200 returned -22 [ 28.105397] IPVS: ftp: loaded support on port[0] = 21 [ 28.127441] binder: BINDER_SET_CONTEXT_MGR already set [ 28.137641] binder: 4454:4456 ioctl 40046207 0 returned -16 [ 28.143756] binder: 4454:4456 ioctl 400448c8 20000200 returned -22 [ 28.154977] IPVS: ftp: loaded support on port[0] = 21 [ 28.166670] binder: BINDER_SET_CONTEXT_MGR already set [ 28.172186] binder: 4457:4459 ioctl 40046207 0 returned -16 [ 28.178648] binder: 4457:4459 ioctl 400448c8 20000200 returned -22 [ 28.200815] IPVS: ftp: loaded support on port[0] = 21 [ 28.232576] binder: BINDER_SET_CONTEXT_MGR already set [ 28.241181] binder: 4460:4462 ioctl 40046207 0 returned -16 [ 28.252529] IPVS: ftp: loaded support on port[0] = 21 [ 28.261804] binder: BINDER_SET_CONTEXT_MGR already set [ 28.262701] binder: 4460:4462 ioctl 400448c8 20000200 returned -22 [ 28.271724] binder: 4463:4464 ioctl 40046207 0 returned -16 [ 28.282393] binder: 4463:4464 ioctl 400448c8 20000200 returned -22 [ 28.305918] IPVS: ftp: loaded support on port[0] = 21 [ 28.322762] binder: BINDER_SET_CONTEXT_MGR already set [ 28.330113] binder: 4466:4468 ioctl 40046207 0 returned -16 [ 28.336616] binder: 4466:4468 ioctl 400448c8 20000200 returned -22 [ 28.363735] binder: BINDER_SET_CONTEXT_MGR already set [ 28.370334] binder: 4469:4471 ioctl 40046207 0 returned -16 [ 28.376798] binder: 4469:4471 ioctl 400448c8 20000200 returned -22 [ 28.857833] binder: release 4449:4450 transaction 3 out, still active [ 28.864669] binder: release 4449:4450 transaction 2 in, still active [ 28.871189] binder: undelivered TRANSACTION_COMPLETE [ 28.876814] binder: BINDER_SET_CONTEXT_MGR already set [ 28.882235] binder: 4449:4472 ioctl 40046207 0 returned -16 [ 28.887206] binder: 4451:4473 got new transaction with bad transaction stack, transaction 4 has target 4449:0 [ 28.888088] binder: 4449:4450 ioctl c0306201 20004000 returned -14 [ 28.898080] binder: 4451:4473 transaction failed 29201/-71, size 0-0 line 2875 [ 28.910837] binder: 4449:4450 ioctl 400448c8 20000200 returned -22 [ 28.914107] binder: release 4451:4473 transaction 4 out, still active [ 28.919322] binder_alloc: binder_alloc_mmap_handler: 4449 2000c000-2000e000 already mapped failed -16 [ 28.924802] binder: undelivered TRANSACTION_COMPLETE [ 28.924813] binder: undelivered TRANSACTION_ERROR: 29201 [ 28.945349] binder_alloc: 4449: binder_alloc_buf, no vma [ 28.950913] binder: 4449:4475 transaction failed 29189/-3, size 0-0 line 2963 [ 28.951187] binder_alloc: 4449: binder_alloc_buf, no vma [ 28.959399] binder: release 4449:4472 transaction 3 in, still active [ 28.970258] binder: release 4449:4472 transaction 2 out, still active [ 28.976894] binder: send failed reply for transaction 3, target dead [ 28.976899] binder: 4454:4474 transaction failed 29189/-3, size 0-0 line 2963 [ 28.981538] binder_alloc: 4449: binder_alloc_buf, no vma [ 28.983401] binder: send failed reply for transaction 2, target dead [ 28.991711] binder: undelivered TRANSACTION_ERROR: 29189 RESULT: signal 0, coverage 0 errno 0 [ 28.996180] binder: 4449:4450 transaction failed 29189/-3, size 0-0 line 2963 [ 28.996349] binder_alloc: 4449: binder_alloc_buf, no vma [ 29.007854] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.008305] binder: 4457:4476 transaction failed 29189/-3, size 0-0 line 2963 [ 29.014963] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.015809] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.040878] binder: 4460:4477 transaction failed 29189/-22, size 0-0 line 2848 [ 29.045564] binder: send failed reply for transaction 4, target dead [ 29.060532] binder: 4451:4473 ioctl c0306201 20004000 returned -14 [ 29.066710] binder: 4451:4479 ioctl 400448c8 20000200 returned -22 [ 29.068278] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.076972] binder: BINDER_SET_CONTEXT_MGR already set [ 29.084899] binder: 4481:4483 ioctl 40046207 0 returned -16 [ 29.090715] binder: 4463:4478 got new transaction with bad transaction stack, transaction 12 has target 4451:4453 [ 29.094214] binder_alloc: binder_alloc_mmap_handler: 4451 2000c000-2000e000 already mapped failed -16 [ 29.101220] binder: 4463:4478 transaction failed 29201/-71, size 0-0 line 2875 [ 29.102990] binder: 4481:4483 ioctl 400448c8 20000200 returned -22 [ 29.115515] binder: release 4463:4478 transaction 12 out, still active [ 29.118633] binder_alloc: 4451: binder_alloc_buf, no vma [ 29.124432] binder: undelivered TRANSACTION_COMPLETE [ 29.124443] binder: undelivered TRANSACTION_ERROR: 29201 [ 29.127551] binder: 4457:4476 ioctl c0306201 20004000 returned -14 RESULT: signal 0, coverage 0 errno 0 [ 29.131272] binder: 4451:4473 transaction failed 29189/-3, size 0-0 line 2963 [ 29.137150] binder_alloc: 4451: binder_alloc_buf, no vma [ 29.141805] binder: BINDER_SET_CONTEXT_MGR already set [ 29.147270] binder: 4451:4453 transaction failed 29189/-3, size 0-0 line 2963 [ 29.147743] binder: 4454:4474 ioctl c0306201 20004000 returned -14 [ 29.153689] binder: BINDER_SET_CONTEXT_MGR already set [ 29.153696] binder: 4454:4486 ioctl 40046207 0 returned -16 [ 29.153853] binder_alloc: 4451: binder_alloc_buf, no vma [ 29.165824] binder: 4457:4485 ioctl 40046207 0 returned -16 [ 29.166508] binder: 4466:4484 transaction failed 29189/-3, size 0-0 line 2963 [ 29.171909] binder: 4454:4474 ioctl 400448c8 20000200 returned -22 [ 29.192863] binder: BINDER_SET_CONTEXT_MGR already set [ 29.203129] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.208506] binder_alloc: 4451: binder_alloc_buf, no vma [ 29.215236] binder: release 4451:4453 transaction 12 in, still active [ 29.244381] binder: send failed reply for transaction 12, target dead [ 29.244388] binder: 4469:4487 transaction failed 29189/-3, size 0-0 line 2963 [ 29.245675] binder: 4460:4477 ioctl c0306201 20004000 returned -14 [ 29.250991] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.258575] binder: 4463:4478 ioctl c0306201 20004000 returned -14 [ 29.264613] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.278495] binder: 4457:4476 ioctl 400448c8 20000200 returned -22 [ 29.282427] binder_alloc: binder_alloc_mmap_handler: 4454 2000c000-2000e000 already mapped failed -16 [ 29.288799] binder: BINDER_SET_CONTEXT_MGR already set [ 29.298338] binder_alloc: binder_alloc_mmap_handler: 4457 2000c000-2000e000 already mapped failed -16 [ 29.304506] binder: 4460:4492 ioctl 40046207 0 returned -16 [ 29.312571] binder: 4490:4491 ioctl 40046207 0 returned -16 [ 29.318254] binder: 4463:4478 ioctl 400448c8 20000200 returned -22 [ 29.330629] binder: release 4454:4494 transaction 19 out, still active [ 29.331042] binder: 4460:4477 ioctl 400448c8 20000200 returned -22 [ 29.337371] binder: undelivered TRANSACTION_COMPLETE [ 29.345575] binder: 4490:4491 ioctl 400448c8 20000200 returned -22 [ 29.350412] binder_alloc: binder_alloc_mmap_handler: 4460 2000c000-2000e000 already mapped failed -16 [ 29.358398] binder_alloc: binder_alloc_mmap_handler: 4463 2000c000-2000e000 already mapped failed -16 [ 29.365103] binder: 4460:4492 got new transaction with bad transaction stack, transaction 24 has target 4463:0 [ 29.374456] binder_alloc: 4463: binder_alloc_buf, no vma [ 29.384351] binder: 4460:4492 transaction failed 29201/-71, size 0-0 line 2875 [ 29.397261] binder: 4463:4478 transaction failed 29189/-3, size 0-0 line 2963 [ 29.397264] binder_alloc: 4463: binder_alloc_buf, no vma [ 29.397283] binder: 4463:4464 transaction failed 29189/-3, size 0-0 line 2963 [ 29.417686] binder: BINDER_SET_CONTEXT_MGR already set [ 29.417698] binder: 4466:4484 ioctl c0306201 20004000 returned -14 [ 29.423031] binder: 4466:4501 ioctl 40046207 0 returned -16 [ 29.432916] binder: 4466:4501 ioctl 400448c8 20000200 returned -22 [ 29.438607] binder: BINDER_SET_CONTEXT_MGR already set [ 29.446907] binder_alloc: 4463: binder_alloc_buf, no vma RESULT: signal 0, coverage 0 errno 0 RESULT: signal 0, coverage 0 errno 0 RESULT: signal 0, coverage 0 errno 0 RESULT: signal 0, coverage 0 errno 0 [ 29.447098] binder_alloc: binder_alloc_mmap_handler: 4466 2000c000-2000e000 already mapped failed -16 [ 29.452500] binder: 4466:4501 transaction failed 29189/-3, size 0-0 line 2963 [ 29.461820] binder: 4469:4495 ioctl 40046207 0 returned -16 [ 29.477225] binder: release 4460:4492 transaction 24 out, still active [ 29.483938] binder: undelivered TRANSACTION_COMPLETE [ 29.488129] binder: BINDER_SET_CONTEXT_MGR already set [ 29.489070] binder: undelivered TRANSACTION_ERROR: 29201 [ 29.511595] binder: BINDER_SET_CONTEXT_MGR already set [ 29.522335] binder: 4469:4499 ioctl 400448c8 20000200 returned -22 [ 29.528852] binder: BINDER_SET_CONTEXT_MGR already set [ 29.534348] binder: release 4463:4464 transaction 19 in, still active [ 29.541008] binder: send failed reply for transaction 19, target dead [ 29.544168] binder_alloc: binder_alloc_mmap_handler: 4469 2000c000-2000e000 already mapped failed -16 [ 29.547625] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.547639] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.547672] binder: send failed reply for transaction 20 to 4457:4496 [ 29.561811] binder: 4503:4504 ioctl 40046207 0 returned -16 [ 29.562619] binder: send failed reply for transaction 21 to 4469:4495 [ 29.568266] binder: 4508:4510 ioctl 40046207 0 returned -16 [ 29.574642] binder: send failed reply for transaction 22 to 4454:4474 [ 29.574656] binder: send failed reply for transaction 23 to 4457:4476 RESULT: signal 0, coverage 0 errno 0 [ 29.574668] binder: send failed reply for transaction 24, target dead [ 29.576274] binder: 4507:4509 ioctl 40046207 0 returned -16 [ 29.592379] binder: 4503:4504 ioctl 400448c8 20000200 returned -22 [ 29.594059] binder: 4469:4517 transaction failed 29189/-22, size 0-0 line 2848 [ 29.600836] binder: 4512:4515 ioctl 400448c8 20000200 returned -22 [ 29.608620] binder: 4507:4509 ioctl 400448c8 20000200 returned -22 [ 29.619721] binder: 4508:4510 ioctl 400448c8 20000200 returned -22 [ 29.632136] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.650583] binder: BINDER_SET_CONTEXT_MGR already set [ 29.651182] binder: undelivered TRANSACTION_COMPLETE [ 29.656826] binder: 4520:4521 ioctl 40046207 0 returned -16 [ 29.661964] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.670625] binder: undelivered TRANSACTION_COMPLETE [ 29.674356] binder: 4520:4521 ioctl 400448c8 20000200 returned -22 [ 29.678465] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.678967] binder: undelivered TRANSACTION_COMPLETE [ 29.700595] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.706080] binder: undelivered TRANSACTION_COMPLETE [ 29.711197] binder: undelivered TRANSACTION_ERROR: 29189 RESULT: signal 0, coverage 0 errno 0 [ 29.778112] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.783713] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.794408] binder: BINDER_SET_CONTEXT_MGR already set [ 29.800479] binder: 4524:4525 ioctl 40046207 0 returned -16 [ 29.806560] binder: 4524:4525 ioctl 400448c8 20000200 returned -22 [ 29.870917] binder_alloc: 4512: binder_alloc_buf, no vma [ 29.876532] binder: 4481:4526 transaction failed 29189/-3, size 0-0 line 2963 [ 29.891325] binder: undelivered TRANSACTION_ERROR: 29189 [ 29.996472] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.002123] binder: 4490:4527 transaction failed 29189/-3, size 0-0 line 2963 [ 30.002738] binder: 4481:4526 ioctl c0306201 20004000 returned -14 [ 30.015903] binder: BINDER_SET_CONTEXT_MGR already set [ 30.021590] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.021716] binder: 4481:4528 ioctl 40046207 0 returned -16 [ 30.035548] binder: 4481:4526 ioctl 400448c8 20000200 returned -22 [ 30.064450] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.070086] binder: 4481:4529 transaction failed 29189/-3, size 0-0 line 2963 [ 30.075167] binder_alloc: binder_alloc_mmap_handler: 4481 2000c000-2000e000 already mapped failed -16 [ 30.131759] binder: 4490:4527 ioctl c0306201 20004000 returned -14 [ 30.132059] binder: BINDER_SET_CONTEXT_MGR already set [ 30.144271] binder: 4490:4531 ioctl 40046207 0 returned -16 [ 30.156156] binder: 4490:4527 ioctl 400448c8 20000200 returned -22 RESULT: signal 0, coverage 0 errno 0 [ 30.185570] binder_alloc: binder_alloc_mmap_handler: 4490 2000c000-2000e000 already mapped failed -16 [ 30.191790] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.195394] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.206136] binder: 4490:4532 transaction failed 29189/-3, size 0-0 line 2963 [ 30.214544] binder: BINDER_SET_CONTEXT_MGR already set [ 30.220187] binder: 4533:4534 ioctl 40046207 0 returned -16 [ 30.225419] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.226220] binder: 4533:4534 ioctl 400448c8 20000200 returned -22 [ 30.237821] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.243368] binder: 4490:4527 transaction failed 29189/-3, size 0-0 line 2963 [ 30.291629] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.297293] binder: 4503:4536 transaction failed 29189/-3, size 0-0 line 2963 [ 30.311962] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.315627] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.323004] binder: 4507:4538 transaction failed 29189/-3, size 0-0 line 2963 [ 30.324083] binder: 4512:4515 got new transaction with bad transaction stack, transaction 39 has target 4512:0 RESULT: signal 0, coverage 0 errno 0 [ 30.338126] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.340608] binder: 4512:4515 transaction failed 29201/-71, size 0-0 line 2875 [ 30.340643] binder: 4508:4537 got new transaction with bad transaction stack, transaction 38 has target 4512:4515 [ 30.340654] binder: 4508:4537 transaction failed 29201/-71, size 0-0 line 2875 [ 30.340791] binder: release 4512:4515 transaction 39 out, still active [ 30.346804] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.353562] binder: release 4512:4515 transaction 38 in, still active [ 30.353567] binder: undelivered TRANSACTION_COMPLETE [ 30.353578] binder: undelivered TRANSACTION_ERROR: 29201 [ 30.353639] binder: release 4508:4537 transaction 38 out, still active [ 30.353643] binder: undelivered TRANSACTION_COMPLETE [ 30.353653] binder: undelivered TRANSACTION_ERROR: 29201 [ 30.377532] binder: BINDER_SET_CONTEXT_MGR already set [ 30.389184] binder: 4512:4515 ioctl c0306201 20004000 returned -14 [ 30.391248] binder: 4541:4542 ioctl 40046207 0 returned -16 [ 30.395811] binder: BINDER_SET_CONTEXT_MGR already set [ 30.401797] binder: 4541:4542 ioctl 400448c8 20000200 returned -22 [ 30.408775] binder: 4512:4539 ioctl 40046207 0 returned -16 [ 30.430843] binder: 4503:4536 ioctl c0306201 20004000 returned -14 [ 30.436201] binder: BINDER_SET_CONTEXT_MGR already set [ 30.446576] binder: 4512:4515 ioctl 400448c8 20000200 returned -22 [ 30.447722] binder: 4503:4544 ioctl 40046207 0 returned -16 [ 30.455079] binder: 4503:4536 ioctl 400448c8 20000200 returned -22 [ 30.466727] binder: 4520:4545 got new transaction with bad transaction stack, transaction 42 has target 4512:0 [ 30.484385] binder: 4512:4543 got new transaction with bad transaction stack, transaction 44 has target 4512:0 [ 30.504070] binder: 4512:4543 transaction failed 29201/-71, size 0-0 line 2875 [ 30.504075] binder: 4520:4545 transaction failed 29201/-71, size 0-0 line 2875 [ 30.511579] binder_alloc: binder_alloc_mmap_handler: 4512 2000c000-2000e000 already mapped failed -16 [ 30.520388] binder_alloc: binder_alloc_mmap_handler: 4503 2000c000-2000e000 already mapped failed -16 [ 30.531602] binder: release 4520:4545 transaction 42 out, still active [ 30.538131] binder: 4507:4538 ioctl c0306201 20004000 returned -14 [ 30.544428] binder: undelivered TRANSACTION_COMPLETE [ 30.544440] binder: undelivered TRANSACTION_ERROR: 29201 [ 30.551627] binder: BINDER_SET_CONTEXT_MGR already set [ 30.556277] binder: 4508:4537 ioctl c0306201 20004000 returned -14 [ 30.561564] binder: 4507:4548 ioctl 40046207 0 returned -16 [ 30.566739] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.580252] binder: 4507:4538 ioctl 400448c8 20000200 returned -22 [ 30.584297] binder: 4503:4547 transaction failed 29189/-3, size 0-0 line 2963 [ 30.584657] binder: BINDER_SET_CONTEXT_MGR already set [ 30.594323] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.598518] binder: 4508:4549 ioctl 40046207 0 returned -16 [ 30.603380] binder: 4503:4536 transaction failed 29189/-3, size 0-0 line 2963 [ 30.609105] binder: 4508:4537 ioctl 400448c8 20000200 returned -22 [ 30.615061] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.622642] binder_alloc: binder_alloc_mmap_handler: 4507 2000c000-2000e000 already mapped failed -16 [ 30.628407] binder: 4524:4552 transaction failed 29189/-3, size 0-0 line 2963 [ 30.634219] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.644654] binder_alloc: binder_alloc_mmap_handler: 4508 2000c000-2000e000 already mapped failed -16 [ 30.650553] binder: 4507:4553 transaction failed 29189/-3, size 0-0 line 2963 [ 30.653185] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.664138] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.665456] binder: 4507:4538 transaction failed 29189/-3, size 0-0 line 2963 RESULT: signal 0, coverage 0 errno 0 RESULT: signal 0, coverage 0 errno 0 [ 30.665805] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.673252] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.686284] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.691212] binder: 4508:4551 transaction failed 29189/-3, size 0-0 line 2963 [ 30.692083] binder_alloc: 4512: binder_alloc_buf, no vma [ 30.696756] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.702220] binder: 4508:4537 transaction failed 29189/-3, size 0-0 line 2963 [ 30.710586] binder: 4520:4545 ioctl c0306201 20004000 returned -14 RESULT: signal 0, coverage 0 errno 0 [ 30.714979] binder: BINDER_SET_CONTEXT_MGR already set [ 30.745787] binder: release 4512:4543 transaction 44 out, still active [ 30.748057] binder: 4555:4561 ioctl 400448c8 20000200 returned -22 [ 30.752620] binder: undelivered TRANSACTION_COMPLETE [ 30.752631] binder: undelivered TRANSACTION_ERROR: 29201 [ 30.766844] binder: 4520:4554 ioctl 40046207 0 returned -16 [ 30.769541] binder: send failed reply for transaction 39, target dead [ 30.775774] binder: BINDER_SET_CONTEXT_MGR already set [ 30.781834] binder: send failed reply for transaction 38, target dead [ 30.781844] binder: send failed reply for transaction 42, target dead [ 30.781853] binder: send failed reply for transaction 44, target dead [ 30.807085] binder: BINDER_SET_CONTEXT_MGR already set [ 30.807629] binder: 4524:4552 ioctl c0306201 20004000 returned -14 [ 30.814311] binder: BINDER_SET_CONTEXT_MGR already set [ 30.822336] binder: 4520:4545 ioctl 400448c8 20000200 returned -22 [ 30.824621] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.837917] binder: 4563:4564 ioctl 40046207 0 returned -16 RESULT: signal 0, coverage 0 errno 0 [ 30.838115] binder: 4556:4558 ioctl 40046207 0 returned -16 [ 30.846898] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.854416] binder_alloc: binder_alloc_mmap_handler: 4520 2000c000-2000e000 already mapped failed -16 [ 30.854965] binder: undelivered TRANSACTION_ERROR: 29189 [ 30.856244] binder: 4563:4564 ioctl 400448c8 20000200 returned -22 [ 30.865098] binder: 4524:4552 ioctl 400448c8 20000200 returned -22 [ 30.871215] binder: 4556:4558 ioctl 400448c8 20000200 returned -22 [ 30.880825] binder: BINDER_SET_CONTEXT_MGR already set [ 30.886062] binder: 4524:4565 ioctl 40046207 0 returned -16 [ 30.890316] binder_alloc: 4555: binder_alloc_buf, no vma [ 30.894672] binder: 4568:4569 ioctl 40046207 0 returned -16 [ 30.900096] binder: 4520:4567 transaction failed 29189/-3, size 0-0 line 2963 [ 30.908762] binder_alloc: binder_alloc_mmap_handler: 4524 2000c000-2000e000 already mapped failed -16 [ 30.911880] binder_alloc: 4555: binder_alloc_buf, no vma [ 30.919193] binder: 4568:4569 ioctl 400448c8 20000200 returned -22 [ 30.928166] binder: 4520:4545 transaction failed 29189/-3, size 0-0 line 2963 [ 30.928459] binder_alloc: 4555: binder_alloc_buf, no vma [ 30.952809] binder_alloc: 4555: binder_alloc_buf, no vma [ 30.952814] binder: 4524:4571 transaction failed 29189/-3, size 0-0 line 2963 [ 30.965766] binder: 4524:4552 transaction failed 29189/-3, size 0-0 line 2963 RESULT: signal 0, coverage 0 errno 0 RESULT: signal 0, coverage 0 errno 0 [ 31.016796] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.022562] binder: 4533:4573 transaction failed 29189/-3, size 0-0 line 2963 [ 31.035429] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.038431] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.047062] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.060000] binder: BINDER_SET_CONTEXT_MGR already set [ 31.065702] binder: BINDER_SET_CONTEXT_MGR already set [ 31.072781] binder: 4577:4578 ioctl 40046207 0 returned -16 [ 31.078531] binder: 4574:4576 ioctl 40046207 0 returned -16 [ 31.078738] binder: 4574:4576 ioctl 400448c8 20000200 returned -22 [ 31.084893] binder: 4577:4578 ioctl 400448c8 20000200 returned -22 [ 31.093134] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.102695] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.147099] binder: 4533:4573 ioctl c0306201 20004000 returned -14 [ 31.153695] binder: BINDER_SET_CONTEXT_MGR already set [ 31.159238] binder: 4533:4580 ioctl 40046207 0 returned -16 [ 31.171937] binder: 4533:4573 ioctl 400448c8 20000200 returned -22 [ 31.181104] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.186713] binder: 4541:4581 transaction failed 29189/-3, size 0-0 line 2963 [ 31.200607] binder_alloc: binder_alloc_mmap_handler: 4533 2000c000-2000e000 already mapped failed -16 [ 31.210277] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.210339] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.221240] binder: 4533:4582 transaction failed 29189/-3, size 0-0 line 2963 [ 31.231861] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.231882] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.242887] binder: 4533:4573 transaction failed 29189/-3, size 0-0 line 2963 RESULT: signal 0, coverage 0 errno 0 [ 31.321605] binder: 4541:4581 ioctl c0306201 20004000 returned -14 [ 31.327177] binder: BINDER_SET_CONTEXT_MGR already set [ 31.333594] binder: 4541:4583 ioctl 40046207 0 returned -16 [ 31.341384] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.356102] binder: BINDER_SET_CONTEXT_MGR already set [ 31.359664] binder: 4541:4581 ioctl 400448c8 20000200 returned -22 [ 31.361801] binder: 4584:4586 ioctl 40046207 0 returned -16 [ 31.373959] binder: 4584:4586 ioctl 400448c8 20000200 returned -22 [ 31.388454] binder_alloc: binder_alloc_mmap_handler: 4541 2000c000-2000e000 already mapped failed -16 [ 31.398315] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.403860] binder: 4541:4587 transaction failed 29189/-3, size 0-0 line 2963 [ 31.414712] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.420265] binder: 4541:4581 transaction failed 29189/-3, size 0-0 line 2963 [ 31.427633] binder: undelivered TRANSACTION_ERROR: 29189 RESULT: signal 0, coverage 0 errno 0 [ 31.537697] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.543330] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.548884] binder: 4556:4588 transaction failed 29189/-3, size 0-0 line 2963 [ 31.554071] binder: 4555:4589 got new transaction with bad transaction stack, transaction 65 has target 4555:0 [ 31.566448] binder: 4555:4589 transaction failed 29201/-71, size 0-0 line 2875 [ 31.576912] binder: BINDER_SET_CONTEXT_MGR already set [ 31.577758] binder: release 4555:4561 transaction 65 in, still active [ 31.582392] binder: 4590:4592 ioctl 40046207 0 returned -16 [ 31.588946] binder: send failed reply for transaction 65 to 4555:4589 [ 31.594725] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.602279] binder: BINDER_SET_CONTEXT_MGR already set [ 31.609216] binder: 4555:4561 ioctl c0306201 20004000 returned -14 [ 31.612525] binder: 4590:4592 ioctl 400448c8 20000200 returned -22 [ 31.619236] binder: 4555:4589 ioctl 40046207 0 returned -16 [ 31.626219] binder: 4563:4593 got new transaction with bad transaction stack, transaction 67 has target 4555:0 [ 31.633824] binder: 4555:4561 ioctl 400448c8 20000200 returned -22 [ 31.641039] binder: 4563:4593 transaction failed 29201/-71, size 0-0 line 2875 [ 31.644637] binder: release 4563:4593 transaction 67 out, still active [ 31.651591] binder_alloc: binder_alloc_mmap_handler: 4555 2000c000-2000e000 already mapped failed -16 [ 31.654955] binder: undelivered TRANSACTION_COMPLETE [ 31.654966] binder: undelivered TRANSACTION_ERROR: 29201 [ 31.655054] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.655077] binder: 4555:4589 transaction failed 29189/-3, size 0-0 line 2963 [ 31.681297] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.699962] binder: 4555:4561 transaction failed 29189/-3, size 0-0 line 2963 [ 31.699965] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.699984] binder: 4568:4594 transaction failed 29189/-3, size 0-0 line 2963 [ 31.715365] binder_alloc: 4555: binder_alloc_buf, no vma [ 31.723168] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.725695] binder: 4568:4596 transaction failed 29189/-3, size 0-0 line 2963 RESULT: signal 0, coverage 0 errno 0 [ 31.726154] binder: 4556:4588 ioctl c0306201 20004000 returned -14 [ 31.731194] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.731217] binder: send failed reply for transaction 67, target dead [ 31.747414] binder: BINDER_SET_CONTEXT_MGR already set [ 31.762780] binder: 4598:4599 ioctl 40046207 0 returned -16 [ 31.768676] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.772566] binder: 4556:4588 ioctl 400448c8 20000200 returned -22 [ 31.776039] binder: 4598:4599 ioctl 400448c8 20000200 returned -22 [ 31.784432] binder: 4563:4593 ioctl c0306201 20004000 returned -14 [ 31.787066] binder: BINDER_SET_CONTEXT_MGR already set [ 31.798731] binder: 4563:4601 ioctl 40046207 0 returned -16 [ 31.801711] binder_alloc: binder_alloc_mmap_handler: 4556 2000c000-2000e000 already mapped failed -16 [ 31.804539] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.804560] binder: 4556:4602 transaction failed 29189/-3, size 0-0 line 2963 [ 31.821472] binder: 4563:4593 ioctl 400448c8 20000200 returned -22 [ 31.834413] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.834438] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.845430] binder: 4556:4588 transaction failed 29189/-3, size 0-0 line 2963 [ 31.856170] binder_alloc: binder_alloc_mmap_handler: 4563 2000c000-2000e000 already mapped failed -16 [ 31.866491] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.872066] binder: 4563:4605 transaction failed 29189/-3, size 0-0 line 2963 [ 31.872069] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.872091] binder: 4574:4603 transaction failed 29189/-3, size 0-0 line 2963 [ 31.879504] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.888928] binder: BINDER_SET_CONTEXT_MGR already set [ 31.892182] binder: 4577:4604 transaction failed 29189/-3, size 0-0 line 2963 [ 31.898153] binder: 4568:4594 ioctl c0306201 20004000 returned -14 [ 31.903093] binder: 4568:4596 ioctl 40046207 0 returned -16 [ 31.910623] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.919066] binder: undelivered TRANSACTION_ERROR: 29189 RESULT: signal 0, coverage 0 errno 0 [ 31.922397] binder: 4563:4593 transaction failed 29189/-3, size 0-0 line 2963 [ 31.922637] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.931824] binder: 4568:4594 ioctl 400448c8 20000200 returned -22 [ 31.933478] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.944997] binder_alloc: 4556: binder_alloc_buf, no vma [ 31.948268] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.952656] binder: 4568:4596 transaction failed 29189/-3, size 0-0 line 2963 [ 31.959226] binder_alloc: binder_alloc_mmap_handler: 4568 2000c000-2000e000 already mapped failed -16 RESULT: signal 0, coverage 0 errno 0 [ 31.976283] binder: 4607:4608 ioctl 400448c8 20000200 returned -22 [ 31.983654] binder_alloc: 4607: binder_alloc_buf, no vma [ 31.995178] binder: undelivered TRANSACTION_ERROR: 29189 [ 31.997580] binder: 4568:4594 transaction failed 29189/-3, size 0-0 line 2963 [ 32.026176] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.039315] binder: 4574:4603 ioctl c0306201 20004000 returned -14 [ 32.040603] binder: BINDER_SET_CONTEXT_MGR already set [ 32.051309] binder: BINDER_SET_CONTEXT_MGR already set [ 32.051680] binder: 4610:4611 ioctl 40046207 0 returned -16 [ 32.061633] binder: 4574:4609 ioctl 40046207 0 returned -16 [ 32.063207] binder: 4610:4611 ioctl 400448c8 20000200 returned -22 [ 32.072072] binder: 4577:4604 ioctl c0306201 20004000 returned -14 [ 32.076135] binder: BINDER_SET_CONTEXT_MGR already set RESULT: signal 0, coverage 0 errno 0 [ 32.086307] binder: 4574:4603 ioctl 400448c8 20000200 returned -22 [ 32.092662] binder: 4577:4613 ioctl 40046207 0 returned -16 [ 32.104157] binder: 4577:4604 ioctl 400448c8 20000200 returned -22 [ 32.112643] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.114204] binder_alloc: binder_alloc_mmap_handler: 4574 2000c000-2000e000 already mapped failed -16 [ 32.128598] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.134184] binder: 4574:4614 transaction failed 29189/-3, size 0-0 line 2963 [ 32.141990] binder: BINDER_SET_CONTEXT_MGR already set [ 32.147483] binder_alloc: binder_alloc_mmap_handler: 4577 2000c000-2000e000 already mapped failed -16 [ 32.147545] binder: 4616:4617 ioctl 40046207 0 returned -16 [ 32.157824] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.163480] binder: 4616:4617 ioctl 400448c8 20000200 returned -22 [ 32.168172] binder: 4574:4603 transaction failed 29189/-3, size 0-0 line 2963 [ 32.168428] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.174670] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.192849] binder: 4584:4618 transaction failed 29189/-3, size 0-0 line 2963 [ 32.200160] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.200181] binder: 4577:4619 transaction failed 29189/-3, size 0-0 line 2963 [ 32.211214] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.216891] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.222140] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.224063] binder: 4577:4604 transaction failed 29189/-3, size 0-0 line 2963 RESULT: signal 0, coverage 0 errno 0 [ 32.288481] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.300340] binder: BINDER_SET_CONTEXT_MGR already set [ 32.305954] binder: 4620:4621 ioctl 40046207 0 returned -16 [ 32.312344] binder: 4620:4621 ioctl 400448c8 20000200 returned -22 [ 32.323500] binder: 4584:4618 ioctl c0306201 20004000 returned -14 [ 32.326072] binder: BINDER_SET_CONTEXT_MGR already set RESULT: signal 0, coverage 0 errno 0 [ 32.335205] binder: 4584:4623 ioctl 40046207 0 returned -16 [ 32.342651] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.350102] binder: 4584:4618 ioctl 400448c8 20000200 returned -22 [ 32.355787] binder: BINDER_SET_CONTEXT_MGR already set [ 32.363069] binder: 4624:4626 ioctl 40046207 0 returned -16 [ 32.369144] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.370743] binder: 4624:4626 ioctl 400448c8 20000200 returned -22 [ 32.374674] binder: 4590:4627 transaction failed 29189/-3, size 0-0 line 2963 [ 32.381866] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.388828] binder_alloc: binder_alloc_mmap_handler: 4584 2000c000-2000e000 already mapped failed -16 [ 32.395284] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.408914] binder: 4584:4628 transaction failed 29189/-3, size 0-0 line 2963 [ 32.417458] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.423063] binder: 4584:4618 transaction failed 29189/-3, size 0-0 line 2963 [ 32.423110] binder: undelivered TRANSACTION_ERROR: 29189 RESULT: signal 0, coverage 0 errno 0 [ 32.499632] binder: 4590:4627 ioctl c0306201 20004000 returned -14 [ 32.506204] binder: BINDER_SET_CONTEXT_MGR already set [ 32.511624] binder: 4590:4629 ioctl 40046207 0 returned -16 [ 32.524467] binder: 4590:4627 ioctl 400448c8 20000200 returned -22 [ 32.540061] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.552401] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.554493] binder: BINDER_SET_CONTEXT_MGR already set [ 32.558010] binder: 4598:4630 transaction failed 29189/-3, size 0-0 line 2963 [ 32.563265] binder: 4631:4632 ioctl 40046207 0 returned -16 [ 32.576182] binder_alloc: binder_alloc_mmap_handler: 4590 2000c000-2000e000 already mapped failed -16 [ 32.576473] binder: 4631:4632 ioctl 400448c8 20000200 returned -22 [ 32.589529] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.594184] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.603060] binder: 4590:4633 transaction failed 29189/-3, size 0-0 line 2963 [ 32.610918] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.616463] binder: 4590:4635 transaction failed 29189/-3, size 0-0 line 2963 RESULT: signal 0, coverage 0 errno 0 [ 32.702425] binder: 4598:4630 ioctl c0306201 20004000 returned -14 [ 32.702646] binder: BINDER_SET_CONTEXT_MGR already set [ 32.714156] binder: 4598:4637 ioctl 40046207 0 returned -16 [ 32.714627] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.725512] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.732259] binder: 4598:4630 ioctl 400448c8 20000200 returned -22 [ 32.735421] binder: BINDER_SET_CONTEXT_MGR already set [ 32.744395] binder: 4639:4640 ioctl 40046207 0 returned -16 [ 32.751974] binder: 4639:4640 ioctl 400448c8 20000200 returned -22 [ 32.761933] binder_alloc: binder_alloc_mmap_handler: 4598 2000c000-2000e000 already mapped failed -16 [ 32.771755] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.777359] binder: 4598:4641 transaction failed 29189/-3, size 0-0 line 2963 [ 32.788653] binder: release 4607:4608 transaction 96 out, still active [ 32.795384] binder: release 4607:4608 transaction 95 in, still active [ 32.801963] binder: undelivered TRANSACTION_COMPLETE [ 32.802162] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.807745] binder: BINDER_SET_CONTEXT_MGR already set [ 32.818216] binder: 4607:4608 ioctl c0306201 20004000 returned -14 [ 32.818277] binder: 4607:4642 ioctl 40046207 0 returned -16 [ 32.832958] binder: 4607:4608 ioctl 400448c8 20000200 returned -22 [ 32.841188] binder_alloc: binder_alloc_mmap_handler: 4607 2000c000-2000e000 already mapped failed -16 [ 32.850691] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.856323] binder: 4610:4643 transaction failed 29189/-3, size 0-0 line 2963 [ 32.856334] binder_alloc: 4607: binder_alloc_buf, no vma [ 32.869127] binder: 4607:4642 transaction failed 29189/-3, size 0-0 line 2963 [ 32.874530] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.885292] binder: release 4607:4642 transaction 98 in, still active [ 32.891900] binder: send failed reply for transaction 98 to 4607:4642 [ 32.898832] ================================================================== [ 32.906340] BUG: KASAN: use-after-free in __list_del_entry_valid+0x144/0x150 [ 32.913515] Read of size 8 at addr ffff8801d9106d10 by task kworker/1:1/24 [ 32.920511] [ 32.922125] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 4.16.0+ #13 [ 32.928607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.937953] Workqueue: events binder_deferred_func [ 32.942857] Call Trace: [ 32.945424] dump_stack+0x1a7/0x27d [ 32.949038] ? arch_local_irq_restore+0x53/0x53 [ 32.953703] ? show_regs_print_info+0x18/0x18 [ 32.958175] ? kasan_check_write+0x14/0x20 [ 32.962385] ? __list_del_entry_valid+0x144/0x150 [ 32.967206] print_address_description+0x73/0x250 [ 32.970735] binder: 4616:4647 transaction failed 29189/-22, size 0-0 line 2848 [ 32.972030] ? __list_del_entry_valid+0x144/0x150 [ 32.972051] kasan_report+0x23c/0x360 [ 32.972063] __asan_report_load8_noabort+0x14/0x20 [ 32.972071] __list_del_entry_valid+0x144/0x150 [ 32.972083] binder_release_work+0x163/0x4b0 [ 32.972094] ? binder_free_ref+0xa0/0xa0 [ 32.972104] ? kfree+0xf3/0x260 [ 32.972111] ? binder_free_transaction+0x6a/0xa0 [ 32.972123] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 32.985871] binder: undelivered TRANSACTION_ERROR: 29189 [ 32.988069] ? trace_hardirqs_on+0xd/0x10 [ 32.988083] ? kasan_check_write+0x14/0x20 [ 32.988093] ? binder_free_transaction+0x7b/0xa0 [ 32.988103] ? binder_send_failed_reply+0x1ce/0x380 [ 32.988114] binder_thread_release+0x4e1/0x730 [ 32.988127] ? binder_release_work+0x4b0/0x4b0 [ 32.988135] ? do_raw_spin_lock+0xc1/0x230 [ 32.988149] ? _raw_spin_unlock+0x22/0x30 [ 32.988159] binder_deferred_func+0x4f4/0x1350 [ 32.993553] binder: 4610:4643 ioctl c0306201 20004000 returned -14 [ 32.997717] ? find_held_lock+0x35/0x1d0 [ 32.997730] ? binder_cleanup_ref_olocked+0xad0/0xad0 [ 32.997741] ? debug_object_deactivate+0x364/0x560 [ 32.997751] ? lock_downgrade+0x980/0x980 [ 32.997763] ? lock_release+0xa40/0xa40 [ 32.997774] ? find_held_lock+0x35/0x1d0 [ 32.997786] ? trace_hardirqs_off+0x10/0x10 [ 32.997796] ? lock_acquire+0x1d5/0x580 [ 33.009957] binder: 4610:4643 ioctl 400448c8 20000200 returned -22 [ 33.014197] ? lock_acquire+0x1d5/0x580 [ 33.014208] ? process_one_work+0xbd9/0x1c40 [ 33.014226] ? __lock_is_held+0xb6/0x140 [ 33.014245] process_one_work+0xc97/0x1c40 [ 33.014255] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 33.014272] ? pwq_dec_nr_in_flight+0x470/0x470 [ 33.014293] ? __schedule+0x903/0x1ef0 [ 33.038831] binder_alloc: binder_alloc_mmap_handler: 4610 2000c000-2000e000 already mapped failed -16 [ 33.043276] ? pick_next_task_fair+0xb50/0x1740 [ 33.043288] ? trace_hardirqs_off+0x10/0x10 [ 33.043298] ? trace_hardirqs_off+0x10/0x10 [ 33.043310] ? find_held_lock+0x35/0x1d0 [ 33.043333] ? lock_acquire+0x1d5/0x580 [ 33.043341] ? lock_acquire+0x1d5/0x580 [ 33.043352] ? worker_thread+0x40e/0x1380 [ 33.043361] ? lock_downgrade+0x980/0x980 [ 33.043370] ? lock_release+0xa40/0xa40 [ 33.048566] binder_alloc: 4610: binder_alloc_buf, no vma [ 33.052497] ? kasan_check_read+0x11/0x20 [ 33.052515] ? do_raw_spin_trylock+0x1a0/0x1a0 [ 33.052535] worker_thread+0x1c3/0x1380 [ 33.052555] ? process_one_work+0x1c40/0x1c40 [ 33.052573] ? trace_hardirqs_off+0x10/0x10 [ 33.052583] ? find_held_lock+0x35/0x1d0 [ 33.052598] ? cache_grow_end.part.35+0x84/0x180 [ 33.056844] binder: 4610:4649 transaction failed 29189/-3, size 0-0 line 2963 [ 33.060932] ? find_held_lock+0x35/0x1d0 [ 33.060945] ? complete+0x62/0x80 [ 33.060957] ? schedule+0xf5/0x430 [ 33.060967] ? __schedule+0x1ef0/0x1ef0 [ 33.069612] binder_alloc: 4610: binder_alloc_buf, no vma [ 33.071821] ? do_raw_spin_unlock+0x9e/0x310 [ 33.071831] ? do_raw_spin_trylock+0x1a0/0x1a0 [ 33.071844] ? _raw_spin_unlock_irqrestore+0x31/0xc0 [ 33.071856] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 33.071865] ? trace_hardirqs_on+0xd/0x10 [ 33.071876] ? __kthread_parkme+0x176/0x240 [ 33.071887] kthread+0x33c/0x400 [ 33.071897] ? process_one_work+0x1c40/0x1c40 [ 33.071903] ? kthread_stop+0x7c0/0x7c0 [ 33.071911] ret_from_fork+0x3a/0x50 [ 33.076421] binder: 4610:4643 transaction failed 29189/-3, size 0-0 line 2963 [ 33.081558] [ 33.081564] Allocated by task 4642: [ 33.081576] save_stack+0x43/0xd0 [ 33.081584] kasan_kmalloc+0xad/0xe0 [ 33.087322] binder: undelivered TRANSACTION_ERROR: 29189 [ 33.090616] kmem_cache_alloc_trace+0x136/0x740 [ 33.090627] binder_transaction+0x13d2/0x8200 [ 33.090635] binder_thread_write+0xcf1/0x38b0 [ 33.090642] binder_ioctl_write_read.isra.39+0x261/0xcb0 [ 33.090649] binder_ioctl+0xb72/0x1417 [ 33.090658] do_vfs_ioctl+0x1b1/0x1520 [ 33.090665] ksys_ioctl+0x94/0xb0 [ 33.090672] SyS_ioctl+0x24/0x30 [ 33.090682] do_syscall_64+0x281/0x940 [ 33.090690] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 33.090693] [ 33.090697] Freed by task 24: [ 33.090705] save_stack+0x43/0xd0 [ 33.090713] __kasan_slab_free+0x11a/0x170 [ 33.101158] binder_alloc: 4610: binder_alloc_buf, no vma [ 33.102998] kasan_slab_free+0xe/0x10 [ 33.103005] kfree+0xd9/0x260 [ 33.103015] binder_free_transaction+0x6a/0xa0 [ 33.103022] binder_send_failed_reply+0x1c9/0x380 [ 33.103028] binder_thread_release+0x4cc/0x730 [ 33.103035] binder_deferred_func+0x4f4/0x1350 [ 33.103044] process_one_work+0xc97/0x1c40 [ 33.103052] worker_thread+0x1c3/0x1380 [ 33.103059] kthread+0x33c/0x400 [ 33.103067] ret_from_fork+0x3a/0x50 [ 33.103070] [ 33.103077] The buggy address belongs to the object at ffff8801d9106d00 [ 33.103077] which belongs to the cache kmalloc-192 of size 192 [ 33.103083] The buggy address is located 16 bytes inside of [ 33.103083] 192-byte region [ffff8801d9106d00, ffff8801d9106dc0) [ 33.103087] The buggy address belongs to the page: [ 33.107069] binder: 4620:4650 transaction failed 29189/-3, size 0-0 line 2963 [ 33.113328] page:ffffea0007644180 count:1 mapcount:0 mapping:ffff8801d9106000 index:0x0 [ 33.113337] flags: 0x2fffc0000000100(slab) [ 33.113348] raw: 02fffc0000000100 ffff8801d9106000 0000000000000000 0000000100000010 [ 33.113356] raw: ffffea0006b36de0 ffff8801dac01148 ffff8801dac00040 0000000000000000 [ 33.123875] binder: BINDER_SET_CONTEXT_MGR already set [ 33.125709] page dumped because: kasan: bad access detected [ 33.125713] [ 33.125716] Memory state around the buggy address: [ 33.125724] ffff8801d9106c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.125731] ffff8801d9106c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.125737] >ffff8801d9106d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 33.125741] ^ [ 33.125747] ffff8801d9106d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 33.125754] ffff8801d9106e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.125757] ================================================================== [ 33.125760] Disabling lock debugging due to kernel taint [ 33.125800] Kernel panic - not syncing: panic_on_warn set ... [ 33.125800] [ 33.131966] binder: 4616:4651 ioctl 40046207 0 returned -16 [ 33.135161] CPU: 1 PID: 24 Comm: kworker/1:1 Tainted: G B 4.16.0+ #13 [ 33.135166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.135181] Workqueue: events binder_deferred_func [ 33.135186] Call Trace: [ 33.135198] dump_stack+0x1a7/0x27d [ 33.135206] ? arch_local_irq_restore+0x53/0x53 [ 33.135216] ? kasan_end_report+0x32/0x50 [ 33.139979] binder: undelivered TRANSACTION_ERROR: 29189 [ 33.143722] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 33.143731] ? vsnprintf+0x1ed/0x1900 [ 33.143743] ? __list_del_entry_valid+0x120/0x150 [ 33.143752] panic+0x1f8/0x42c [ 33.143758] ? refcount_error_report+0x214/0x214 [ 33.143769] ? do_raw_spin_unlock+0x9e/0x310 [ 33.159545] binder_alloc: 4610: binder_alloc_buf, no vma [ 33.162813] ? do_raw_spin_unlock+0x9e/0x310 [ 33.162825] ? __list_del_entry_valid+0x144/0x150 [ 33.162835] kasan_end_report+0x50/0x50 [ 33.162843] kasan_report+0x149/0x360 [ 33.162851] __asan_report_load8_noabort+0x14/0x20 [ 33.162859] __list_del_entry_valid+0x144/0x150 [ 33.167174] binder: 4624:4652 transaction failed 29189/-3, size 0-0 line 2963 [ 33.171190] binder_release_work+0x163/0x4b0 [ 33.171198] ? binder_free_ref+0xa0/0xa0 [ 33.171206] ? kfree+0xf3/0x260 [ 33.175535] binder: 4616:4647 ioctl 400448c8 20000200 returned -22 [ 33.179096] ? binder_free_transaction+0x6a/0xa0 [ 33.179108] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 33.179116] ? trace_hardirqs_on+0xd/0x10 [ 33.179126] ? kasan_check_write+0x14/0x20 [ 33.179133] ? binder_free_transaction+0x7b/0xa0 [ 33.179138] ? binder_send_failed_reply+0x1ce/0x380 [ 33.179147] binder_thread_release+0x4e1/0x730 [ 33.189955] binder: undelivered TRANSACTION_ERROR: 29189 [ 33.191331] ? binder_release_work+0x4b0/0x4b0 [ 33.191340] ? do_raw_spin_lock+0xc1/0x230 [ 33.191352] ? _raw_spin_unlock+0x22/0x30 [ 33.191360] binder_deferred_func+0x4f4/0x1350 [ 33.191371] ? find_held_lock+0x35/0x1d0 [ 33.209083] binder_alloc: 4610: binder_alloc_buf, no vma [ 33.209426] ? binder_cleanup_ref_olocked+0xad0/0xad0 [ 33.213951] binder: 4616:4647 transaction failed 29189/-3, size 0-0 line 2963 [ 33.218186] ? debug_object_deactivate+0x364/0x560 [ 33.218195] ? lock_downgrade+0x980/0x980 [ 33.218204] ? lock_release+0xa40/0xa40 [ 33.225159] binder: BINDER_SET_CONTEXT_MGR already set [ 33.226967] ? find_held_lock+0x35/0x1d0 [ 33.226978] ? trace_hardirqs_off+0x10/0x10 [ 33.226986] ? lock_acquire+0x1d5/0x580 [ 33.226993] ? lock_acquire+0x1d5/0x580 [ 33.227002] ? process_one_work+0xbd9/0x1c40 [ 33.227013] ? __lock_is_held+0xb6/0x140 [ 33.227024] process_one_work+0xc97/0x1c40 [ 33.235252] binder: 4656:4657 ioctl 40046207 0 returned -16 [ 33.238744] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 33.238758] ? pwq_dec_nr_in_flight+0x470/0x470 [ 33.238775] ? __schedule+0x903/0x1ef0 [ 33.238788] ? pick_next_task_fair+0xb50/0x1740 [ 33.238797] ? trace_hardirqs_off+0x10/0x10 [ 33.238805] ? trace_hardirqs_off+0x10/0x10 [ 33.242409] binder_alloc: 4610: binder_alloc_buf, no vma [ 33.245741] ? find_held_lock+0x35/0x1d0 [ 33.245755] ? lock_acquire+0x1d5/0x580 [ 33.245762] ? lock_acquire+0x1d5/0x580 [ 33.245770] ? worker_thread+0x40e/0x1380 [ 33.245778] ? lock_downgrade+0x980/0x980 [ 33.245786] ? lock_release+0xa40/0xa40 [ 33.245796] ? kasan_check_read+0x11/0x20 [ 33.245805] ? do_raw_spin_trylock+0x1a0/0x1a0 [ 33.249768] binder: 4616:4646 transaction failed 29189/-3, size 0-0 line 2963 [ 33.255177] worker_thread+0x1c3/0x1380 [ 33.255190] ? process_one_work+0x1c40/0x1c40 [ 33.260174] binder: undelivered TRANSACTION_ERROR: 29189 [ 33.264127] ? trace_hardirqs_off+0x10/0x10 [ 33.264135] ? find_held_lock+0x35/0x1d0 [ 33.264148] ? cache_grow_end.part.35+0x84/0x180 [ 33.264156] ? find_held_lock+0x35/0x1d0 [ 33.264166] ? complete+0x62/0x80 [ 33.264179] ? schedule+0xf5/0x430 [ 33.264187] ? __schedule+0x1ef0/0x1ef0 [ 33.270300] binder: 4620:4650 ioctl c0306201 20004000 returned -14 [ 33.274257] ? do_raw_spin_unlock+0x9e/0x310 [ 33.274264] ? do_raw_spin_trylock+0x1a0/0x1a0 [ 33.274275] ? _raw_spin_unlock_irqrestore+0x31/0xc0 [ 33.274284] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 33.274291] ? trace_hardirqs_on+0xd/0x10 [ 33.274300] ? __kthread_parkme+0x176/0x240 [ 33.274308] kthread+0x33c/0x400 [ 33.278614] binder: 4656:4657 ioctl 400448c8 20000200 returned -22 [ 33.282720] ? process_one_work+0x1c40/0x1c40 [ 33.282726] ? kthread_stop+0x7c0/0x7c0 [ 33.282735] ret_from_fork+0x3a/0x50 [ 33.286528] Dumping ftrace buffer: [ 33.286532] (ftrace buffer empty) [ 33.286534] Kernel Offset: disabled [ 34.008020] Rebooting in 86400 seconds..