[....] Starting enhanced syslogd: rsyslogd[ 13.012872] audit: type=1400 audit(1520339404.699:4): avc: denied { syslog } for pid=3642 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.40' (ECDSA) to the list of known hosts. 2018/03/06 12:30:18 parsed 1 programs 2018/03/06 12:30:18 executed programs: 0 syzkaller login: [ 26.563160] IPVS: Creating netns size=2536 id=1 [ 26.581970] audit: type=1400 audit(1520339418.269:5): avc: denied { set_context_mgr } for pid=3811 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 26.603791] binder: 3811:3813 ERROR: BC_REGISTER_LOOPER called without request [ 26.612903] audit: type=1400 audit(1520339418.299:6): avc: denied { call } for pid=3811 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 26.636282] binder: release 3811:3812 transaction 3 out, still active [ 26.642877] binder: undelivered TRANSACTION_COMPLETE [ 26.693442] binder: 3811:3814 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 26.700393] binder: 3811:3814 got reply transaction with bad transaction stack, transaction 4 has target 3811:0 [ 26.710640] binder: 3811:3814 transaction failed 29201/-71, size 40-72 line 2935 [ 26.726029] binder: release 3811:3813 transaction 1 out, still active [ 26.732617] binder: undelivered TRANSACTION_COMPLETE [ 26.737698] binder: release 3811:3814 transaction 4 out, still active [ 26.745200] binder: undelivered TRANSACTION_COMPLETE [ 26.750316] binder: undelivered TRANSACTION_ERROR: 29201 [ 26.751111] binder: 3815:3816 ERROR: BC_REGISTER_LOOPER called without request [ 26.763160] binder: send failed reply for transaction 1, target dead [ 26.769635] binder: send failed reply for transaction 3, target dead [ 26.774772] binder: release 3815:3816 transaction 8 out, still active [ 26.774777] binder: release 3815:3816 transaction 7 in, still active [ 26.774779] binder: undelivered TRANSACTION_COMPLETE [ 26.794264] binder: send failed reply for transaction 4, target dead [ 26.798463] binder: 3815:3817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 26.798475] binder: 3815:3817 got reply transaction with bad target transaction stack 0, expected 9 [ 26.798481] binder: 3815:3817 transaction failed 29201/-71, size 40-72 line 2956 [ 26.816600] binder: BINDER_SET_CONTEXT_MGR already set [ 26.816607] binder: 3818:3819 ioctl 40046207 0 returned -16 [ 26.817213] binder: 3818:3819 ERROR: BC_REGISTER_LOOPER called without request [ 26.839310] binder_alloc: 3815: binder_alloc_buf, no vma [ 26.839327] binder: 3818:3820 transaction failed 29189/-3, size 0-0 line 3127 [ 26.841584] binder: undelivered TRANSACTION_ERROR: 29189 [ 26.861101] binder: undelivered TRANSACTION_COMPLETE [ 26.866186] binder: send failed reply for transaction 9 to 3815:3817 [ 26.866379] binder: 3818:3821 transaction failed 29189/-22, size 0-0 line 3004 [ 26.880079] ------------[ cut here ]------------ [ 26.883765] binder: 3822:3823 ERROR: BC_REGISTER_LOOPER called without request [ 26.892142] kernel BUG at drivers/android/binder.c:2006! [ 26.897560] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 26.902888] Dumping ftrace buffer: [ 26.906398] (ftrace buffer empty) [ 26.906420] binder: release 3822:3823 transaction 15 out, still active [ 26.906424] binder: release 3822:3823 transaction 14 in, still active [ 26.906427] binder: undelivered TRANSACTION_COMPLETE [ 26.928324] Modules linked in:[ 26.930348] binder: 3822:3824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 26.930356] binder: 3822:3824 got reply transaction with bad target transaction stack 0, expected 16 [ 26.930363] binder: 3822:3824 transaction failed 29201/-71, size 40-72 line 2956 [ 26.945192] binder: BINDER_SET_CONTEXT_MGR already set [ 26.945198] binder: 3825:3826 ioctl 40046207 0 returned -16 [ 26.945747] binder: 3825:3826 ERROR: BC_REGISTER_LOOPER called without request [ 26.967190] binder_alloc: 3822: binder_alloc_buf, no vma [ 26.967229] binder: 3825:3827 transaction failed 29189/-3, size 0-0 line 3127 [ 26.969396] binder: undelivered TRANSACTION_ERROR: 29189 [ 26.991241] CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 4.9.86-gb324a70 #58 [ 26.994214] binder_alloc: 3822: binder_alloc_buf, no vma [ 26.994226] binder: 3825:3828 transaction failed 29189/-3, size 0-0 line 3127 [ 27.010308] binder: BINDER_SET_CONTEXT_MGR already set [ 27.010314] binder: 3829:3830 ioctl 40046207 0 returned -16 [ 27.010829] binder: 3829:3830 ERROR: BC_REGISTER_LOOPER called without request [ 27.029284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 27.032195] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.032206] binder: 3829:3831 transaction failed 29189/-3, size 0-0 line 3127 [ 27.034407] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.056674] Workqueue: events binder_deferred_func[ 27.059295] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.059306] binder: 3829:3832 transaction failed 29189/-3, size 0-0 line 3127 [ 27.074095] task: ffff8801d9510000 task.stack: ffff8801d9518000 [ 27.075458] binder: BINDER_SET_CONTEXT_MGR already set [ 27.075464] binder: 3833:3834 ioctl 40046207 0 returned -16 [ 27.075997] binder: 3833:3834 ERROR: BC_REGISTER_LOOPER called without request [ 27.097226] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.097237] binder: 3833:3835 transaction failed 29189/-3, size 0-0 line 3127 [ 27.099439] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.116426] RIP: 0010:[] [] binder_pop_transaction_ilocked+0x145/0x190 [ 27.124268] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.124279] binder: 3833:3836 transaction failed 29189/-3, size 0-0 line 3127 [ 27.139048] RSP: 0018:ffff8801d951fa80 EFLAGS: 00010293 [ 27.140471] binder: BINDER_SET_CONTEXT_MGR already set [ 27.140477] binder: 3837:3838 ioctl 40046207 0 returned -16 [ 27.141010] binder: 3837:3838 ERROR: BC_REGISTER_LOOPER called without request [ 27.162702] RAX: ffff8801d9510000 RBX: ffff8801c20db680 RCX: ffffffff82d565e5 [ 27.163196] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.163207] binder: 3837:3839 transaction failed 29189/-3, size 0-0 line 3127 [ 27.165407] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.188009] RDX: 0000000000000000 RSI: ffff8801d44d1200 RDI: ffff8801c20db6c0 [ 27.190302] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.190314] binder: 3837:3840 transaction failed 29189/-3, size 0-0 line 3127 [ 27.206520] binder: BINDER_SET_CONTEXT_MGR already set [ 27.206526] binder: 3841:3842 ioctl 40046207 0 returned -16 [ 27.207076] binder: 3841:3842 ERROR: BC_REGISTER_LOOPER called without request [ 27.226387] RBP: ffff8801d951faa0 R08: 0000000000000001 R09: 0000000000000000 [ 27.229210] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.229222] binder: 3841:3843 transaction failed 29189/-3, size 0-0 line 3127 [ 27.231422] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.251701] R10: 0000000000000003 R11: 0000000000000001 R12: 0000000000000000 [ 27.256347] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.256359] binder: 3841:3844 transaction failed 29189/-3, size 0-0 line 3127 [ 27.271591] R13: ffff8801d44d1200 R14: 0000000000007205 R15: 0000000000000ee7 [ 27.272753] binder: BINDER_SET_CONTEXT_MGR already set [ 27.272759] binder: 3845:3846 ioctl 40046207 0 returned -16 [ 27.273317] binder: 3845:3846 ERROR: BC_REGISTER_LOOPER called without request [ 27.295180] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.295191] binder: 3845:3847 transaction failed 29189/-3, size 0-0 line 3127 [ 27.297393] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.315142] FS: 0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 27.322278] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.322290] binder: 3845:3848 transaction failed 29189/-3, size 0-0 line 3127 [ 27.335991] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.338973] binder: BINDER_SET_CONTEXT_MGR already set [ 27.338979] binder: 3849:3850 ioctl 40046207 0 returned -16 [ 27.339516] binder: 3849:3850 ERROR: BC_REGISTER_LOOPER called without request [ 27.360086] CR2: 0000000008340008 CR3: 000000000441e000 CR4: 0000000000160670 [ 27.361170] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.361182] binder: 3849:3851 transaction failed 29189/-3, size 0-0 line 3127 [ 27.363382] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.385391] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.388280] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.388291] binder: 3849:3852 transaction failed 29189/-3, size 0-0 line 3127 [ 27.403834] binder: BINDER_SET_CONTEXT_MGR already set [ 27.403840] binder: 3853:3854 ioctl 40046207 0 returned -16 [ 27.404349] binder: 3853:3854 ERROR: BC_REGISTER_LOOPER called without request [ 27.423516] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.426201] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.426212] binder: 3853:3855 transaction failed 29189/-3, size 0-0 line 3127 [ 27.428412] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.448809] Stack: [ 27.450932] ffff8801d44d1200[ 27.453298] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.453309] binder: 3853:3856 transaction failed 29189/-3, size 0-0 line 3127 [ 27.466495] ffff8801c20db680[ 27.468855] binder: BINDER_SET_CONTEXT_MGR already set [ 27.468861] binder: 3857:3858 ioctl 40046207 0 returned -16 [ 27.469368] binder: 3857:3858 ERROR: BC_REGISTER_LOOPER called without request [ 27.487663] 0000000000000ee9 0000000000007205[ 27.491172] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.491183] binder: 3857:3859 transaction failed 29189/-3, size 0-0 line 3127 [ 27.493382] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.510240] ffff8801d951fad8 ffffffff82d64839 ffff8801d44d1200 ffff8801c0ce7400 [ 27.518208] 0000000000007205[ 27.518306] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.518317] binder: 3857:3860 transaction failed 29189/-3, size 0-0 line 3127 [ 27.533762] ffffffff83eaf4c0[ 27.533767] binder: BINDER_SET_CONTEXT_MGR already set [ 27.533773] binder: 3861:3862 ioctl 40046207 0 returned -16 [ 27.534268] binder: 3861:3862 ERROR: BC_REGISTER_LOOPER called without request [ 27.554939] ffffed003841b6d9[ 27.556197] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.556208] binder: 3861:3863 transaction failed 29189/-3, size 0-0 line 3127 [ 27.558408] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.575909] ffff8801d951fb08[ 27.578825] Call Trace: [ 27.581386] [] binder_send_failed_reply+0xe9/0x3a0 [ 27.583305] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.583316] binder: 3861:3864 transaction failed 29189/-3, size 0-0 line 3127 [ 27.598699] binder: BINDER_SET_CONTEXT_MGR already set [ 27.598705] binder: 3865:3866 ioctl 40046207 0 returned -16 [ 27.599228] binder: 3865:3866 ERROR: BC_REGISTER_LOOPER called without request [ 27.618828] [] binder_cleanup_transaction+0xd2/0x140 [ 27.621164] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.621176] binder: 3865:3867 transaction failed 29189/-3, size 0-0 line 3127 [ 27.623375] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.643626] [] binder_release_work+0x1b0/0x260 [ 27.648274] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.648285] binder: 3865:3868 transaction failed 29189/-3, size 0-0 line 3127 [ 27.662486] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.665010] binder: BINDER_SET_CONTEXT_MGR already set [ 27.665016] binder: 3869:3870 ioctl 40046207 0 returned -16 [ 27.665569] binder: 3869:3870 ERROR: BC_REGISTER_LOOPER called without request [ 27.686673] [] binder_thread_release+0x428/0x600 [ 27.687171] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.687183] binder: 3869:3871 transaction failed 29189/-3, size 0-0 line 3127 [ 27.689383] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.711109] [] ? _raw_spin_unlock+0x2c/0x50 [ 27.714315] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.714327] binder: 3869:3872 transaction failed 29189/-3, size 0-0 line 3127 [ 27.729712] [] binder_deferred_func+0x43f/0xd10 [ 27.730174] binder: BINDER_SET_CONTEXT_MGR already set [ 27.730180] binder: 3873:3874 ioctl 40046207 0 returned -16 [ 27.730726] binder: 3873:3874 ERROR: BC_REGISTER_LOOPER called without request [ 27.752171] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.752182] binder: 3873:3875 transaction failed 29189/-3, size 0-0 line 3127 [ 27.754396] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.772317] [] ? __lock_is_held+0xa1/0xf0 [ 27.778090] [] process_one_work+0x7e0/0x1610 [ 27.779267] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.779278] binder: 3873:3876 transaction failed 29189/-3, size 0-0 line 3127 [ 27.795547] binder: BINDER_SET_CONTEXT_MGR already set [ 27.795554] binder: 3877:3878 ioctl 40046207 0 returned -16 [ 27.796107] binder: 3877:3878 ERROR: BC_REGISTER_LOOPER called without request [ 27.815014] [] ? process_one_work+0x72c/0x1610 [ 27.818217] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.818229] binder: 3877:3879 transaction failed 29189/-3, size 0-0 line 3127 [ 27.820428] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.839280] [] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 27.845268] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.845279] binder: 3877:3880 transaction failed 29189/-3, size 0-0 line 3127 [ 27.858399] [] worker_thread+0xe0/0x10d0 [ 27.861764] binder: BINDER_SET_CONTEXT_MGR already set [ 27.861770] binder: 3881:3882 ioctl 40046207 0 returned -16 [ 27.862329] binder: 3881:3882 ERROR: BC_REGISTER_LOOPER called without request [ 27.882321] [] ? __schedule+0x683/0x1ba0 [ 27.884178] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.884190] binder: 3881:3883 transaction failed 29189/-3, size 0-0 line 3127 [ 27.886390] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.906068] [] kthread+0x26d/0x300 [ 27.911228] [] ? process_one_work+0x1610/0x1610 [ 27.911283] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.911294] binder: 3881:3884 transaction failed 29189/-3, size 0-0 line 3127 [ 27.928102] binder: BINDER_SET_CONTEXT_MGR already set [ 27.928108] binder: 3885:3886 ioctl 40046207 0 returned -16 [ 27.928659] binder: 3885:3886 ERROR: BC_REGISTER_LOOPER called without request [ 27.948411] [] ? kthread_park+0xa0/0xa0 [ 27.950194] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.950205] binder: 3885:3887 transaction failed 29189/-3, size 0-0 line 3127 [ 27.952351] binder: undelivered TRANSACTION_ERROR: 29189 [ 27.972065] [] ? kthread_park+0xa0/0xa0 [ 27.977220] binder_alloc: 3822: binder_alloc_buf, no vma [ 27.977231] binder: 3885:3888 transaction failed 29189/-3, size 0-0 line 3127 [ 27.990312] [] ? kthread_park+0xa0/0xa0 [ 27.993255] binder: BINDER_SET_CONTEXT_MGR already set [ 27.993261] binder: 3889:3890 ioctl 40046207 0 returned -16 [ 27.993652] binder: 3889:3890 ERROR: BC_REGISTER_LOOPER called without request [ 28.014157] [] ret_from_fork+0x5c/0x70 [ 28.015186] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.015198] binder: 3889:3891 transaction failed 29189/-3, size 0-0 line 3127 [ 28.017346] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.037726] Code: df 80 3c 02 00 75 62 [ 28.042279] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.042290] binder: 3889:3892 transaction failed 29189/-3, size 0-0 line 3127 [ 28.054981] 5b 49 c7 45 20 00 [ 28.058347] binder: BINDER_SET_CONTEXT_MGR already set [ 28.058353] binder: 3893:3894 ioctl 40046207 0 returned -16 [ 28.058872] binder: 3893:3894 ERROR: BC_REGISTER_LOOPER called without request [ 28.076900] 00 00 00 41 5c 41 [ 28.080169] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.080181] binder: 3893:3895 transaction failed 29189/-3, size 0-0 line 3127 [ 28.082382] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.098565] 5d 41 5e 5d c3 e8 09 4e 61 fe 0f 0b e8 02 4e 61 fe 0f 0b e8 [ 28.107300] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.107311] binder: 3893:3896 transaction failed 29189/-3, size 0-0 line 3127 [ 28.120119] fb 4d 61 fe <0f> 0b [ 28.123577] binder: BINDER_SET_CONTEXT_MGR already set [ 28.123583] binder: 3897:3898 ioctl 40046207 0 returned -16 [ 28.124146] binder: 3897:3898 ERROR: BC_REGISTER_LOOPER called without request [ 28.142212] e8 f4 4d 61 fe 0f 0b [ 28.146194] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.146206] binder: 3897:3899 transaction failed 29189/-3, size 0-0 line 3127 [ 28.148407] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.164263] e8 dd 80 7e fe e9 1c ff ff ff e8 f3 [ 28.170411] RIP [] binder_pop_transaction_ilocked+0x145/0x190 [ 28.173297] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.173307] binder: 3897:3900 transaction failed 29189/-3, size 0-0 line 3127 [ 28.189720] binder: BINDER_SET_CONTEXT_MGR already set [ 28.189726] binder: 3901:3902 ioctl 40046207 0 returned -16 [ 28.190265] binder: 3901:3902 ERROR: BC_REGISTER_LOOPER called without request [ 28.208931] RSP [ 28.212172] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.212183] binder: 3901:3903 transaction failed 29189/-3, size 0-0 line 3127 [ 28.214383] binder: undelivered TRANSACTION_ERROR: 29189 [ 28.230669] ---[ end trace b5562e39ac31520f ]--- [ 28.235405] Kernel panic - not syncing: Fatal exception [ 28.239950] binder_alloc: 3822: binder_alloc_buf, no vma [ 28.239961] binder: 3901:3904 transaction failed 29189/-3, size 0-0 line 3127 [ 28.253867] Dumping ftrace buffer: [ 28.257380] (ftrace buffer empty) [ 28.261060] Kernel Offset: disabled [ 28.264653] Rebooting in 86400 seconds..