./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1148540656 <...> Warning: Permanently added '10.128.1.164' (ED25519) to the list of known hosts. execve("./syz-executor1148540656", ["./syz-executor1148540656"], 0x7fffba344de0 /* 10 vars */) = 0 brk(NULL) = 0x555555b98000 brk(0x555555b98d00) = 0x555555b98d00 arch_prctl(ARCH_SET_FS, 0x555555b98380) = 0 set_tid_address(0x555555b98650) = 333 set_robust_list(0x555555b98660, 24) = 0 rseq(0x555555b98ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1148540656", 4096) = 28 getrandom("\x45\x79\x07\x78\x9b\xa9\x8e\x53", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555b98d00 brk(0x555555bb9d00) = 0x555555bb9d00 brk(0x555555bba000) = 0x555555bba000 mprotect(0x7f23265cc000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555b98650) = 334 ./strace-static-x86_64: Process 334 attached [pid 334] set_robust_list(0x555555b98660, 24) = 0 [pid 334] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 334] setsid() = 1 [pid 334] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 334] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 334] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 334] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 334] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 334] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 334] unshare(CLONE_NEWNS) = 0 [pid 334] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 334] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 334] unshare(CLONE_NEWCGROUP) = 0 [pid 334] unshare(CLONE_NEWUTS) = 0 [pid 334] unshare(CLONE_SYSVSEM) = 0 [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 334] getpid() = 1 [pid 334] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 64.855317][ T39] dump_stack_lvl+0x151/0x1c0 [ 64.934079][ T39] ? io_uring_drop_tctx_refs+0x190/0x190 [ 64.939536][ T39] ? panic+0x760/0x760 [ 64.943444][ T39] ? kasan_quarantine_put+0x34/0x1a0 [ 64.948560][ T39] print_address_description+0x87/0x3b0 [ 64.953948][ T39] kasan_report+0x179/0x1c0 [ 64.958282][ T39] ? _raw_spin_lock+0xa4/0x1b0 [ 64.962889][ T39] ? __list_del_entry_valid+0x2f/0x120 [ 64.968179][ T39] ? __list_del_entry_valid+0x2f/0x120 [ 64.973482][ T39] __asan_report_load8_noabort+0x14/0x20 [ 64.978945][ T39] __list_del_entry_valid+0x2f/0x120 [ 64.984071][ T39] binder_release_work+0xcd/0x680 [ 64.988928][ T39] binder_deferred_func+0x1847/0x1bc0 [ 64.994130][ T39] ? read_word_at_a_time+0x12/0x20 [ 64.999079][ T39] process_one_work+0x6bb/0xc10 [ 65.003775][ T39] worker_thread+0xad5/0x12a0 [ 65.008283][ T39] ? _raw_spin_lock+0x1b0/0x1b0 [ 65.012976][ T39] kthread+0x421/0x510 [ 65.016873][ T39] ? worker_clr_flags+0x180/0x180 [ 65.021741][ T39] ? kthread_blkcg+0xd0/0xd0 [ 65.026161][ T39] ret_from_fork+0x1f/0x30 [ 65.030529][ T39] [ 65.033387][ T39] [ 65.035555][ T39] Allocated by task 335: [ 65.039633][ T39] ____kasan_kmalloc+0xdb/0x110 [ 65.044316][ T39] __kasan_kmalloc+0x9/0x10 [ 65.048900][ T39] kmem_cache_alloc_trace+0x115/0x210 [ 65.054101][ T39] binder_thread_write+0x9f5/0x6ec0 [ 65.059144][ T39] binder_ioctl_write_read+0x1ba/0xd00 [ 65.064434][ T39] binder_ioctl+0x371/0x2640 [ 65.068859][ T39] __se_sys_ioctl+0x114/0x190 [ 65.073367][ T39] __x64_sys_ioctl+0x7b/0x90 [ 65.077801][ T39] x64_sys_call+0x98/0x9a0 [ 65.082062][ T39] do_syscall_64+0x3b/0xb0 [ 65.086310][ T39] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 65.092029][ T39] [ 65.094206][ T39] Freed by task 39: [ 65.097853][ T39] kasan_set_track+0x4b/0x70 [ 65.102430][ T39] kasan_set_free_info+0x23/0x40 [ 65.107200][ T39] ____kasan_slab_free+0x126/0x160 [ 65.112145][ T39] __kasan_slab_free+0x11/0x20 [ 65.116743][ T39] slab_free_freelist_hook+0xbd/0x190 [ 65.121956][ T39] kfree+0xc8/0x220 [ 65.125604][ T39] binder_free_ref+0x128/0x260 [ 65.130204][ T39] binder_deferred_func+0x171c/0x1bc0 [ 65.135413][ T39] process_one_work+0x6bb/0xc10 [ 65.140093][ T39] worker_thread+0xad5/0x12a0 [ 65.144611][ T39] kthread+0x421/0x510 [ 65.148519][ T39] ret_from_fork+0x1f/0x30 [ 65.152773][ T39] [ 65.154938][ T39] The buggy address belongs to the object at ffff88811ebaa300 [ 65.154938][ T39] which belongs to the cache kmalloc-64 of size 64 [ 65.168657][ T39] The buggy address is located 8 bytes inside of [ 65.168657][ T39] 64-byte region [ffff88811ebaa300, ffff88811ebaa340) [ 65.181500][ T39] The buggy address belongs to the page: [ 65.186987][ T39] page:ffffea00047aea80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ebaa [ 65.197043][ T39] flags: 0x4000000000000200(slab|zone=1) [ 65.202532][ T39] raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042780 [ 65.210951][ T39] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 65.219345][ T39] page dumped because: kasan: bad access detected [ 65.225611][ T39] page_owner tracks the page as allocated [ 65.231148][ T39] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 334, ts 64755460672, free_ts 64755056436 [ 65.246954][ T39] post_alloc_hook+0x1a3/0x1b0 [ 65.251550][ T39] prep_new_page+0x1b/0x110 [ 65.255886][ T39] get_page_from_freelist+0x3550/0x35d0 [ 65.261270][ T39] __alloc_pages+0x27e/0x8f0 [ 65.265695][ T39] new_slab+0x9a/0x4e0 [ 65.269602][ T39] ___slab_alloc+0x39e/0x830 [ 65.274026][ T39] __slab_alloc+0x4a/0x90 [ 65.278192][ T39] kmem_cache_alloc_trace+0x142/0x210 [ 65.283401][ T39] get_mountpoint+0x212/0x450 [ 65.287917][ T39] attach_recursive_mnt+0x16d/0x1560 [ 65.293049][ T39] do_new_mount+0x7f2/0xb30 [ 65.297377][ T39] path_mount+0x671/0x1070 [ 65.301635][ T39] __se_sys_mount+0x2c4/0x3b0 [ 65.306148][ T39] __x64_sys_mount+0xbf/0xd0 [ 65.310571][ T39] x64_sys_call+0x49d/0x9a0 [ 65.314915][ T39] do_syscall_64+0x3b/0xb0 [ 65.319162][ T39] page last free stack trace: [ 65.323679][ T39] free_unref_page_prepare+0x7c8/0x7d0 [ 65.328970][ T39] free_unref_page+0xe8/0x750 [ 65.333486][ T39] __free_pages+0x61/0xf0 [ 65.337656][ T39] free_pages+0x7c/0x90 [ 65.341651][ T39] selinux_genfs_get_sid+0x24d/0x2a0 [ 65.346763][ T39] inode_doinit_with_dentry+0x8d2/0x1070 [ 65.352236][ T39] sb_finish_set_opts+0x8b8/0xa90 [ 65.357095][ T39] selinux_set_mnt_opts+0x1622/0x20d0 [ 65.362301][ T39] security_sb_set_mnt_opts+0x74/0xe0 [ 65.367515][ T39] vfs_get_tree+0x156/0x290 [ 65.371851][ T39] do_new_mount+0x2ba/0xb30 [ 65.376193][ T39] path_mount+0x671/0x1070 [ 65.380443][ T39] __se_sys_mount+0x2c4/0x3b0 [ 65.384958][ T39] __x64_sys_mount+0xbf/0xd0 [ 65.389384][ T39] x64_sys_call+0x49d/0x9a0 [ 65.393726][ T39] do_syscall_64+0x3b/0xb0 [ 65.397984][ T39] [ 65.400147][ T39] Memory state around the buggy address: [ 65.405628][ T39] ffff88811ebaa200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.413700][ T39] ffff88811ebaa280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.421600][ T39] >ffff88811ebaa300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 65.429487][ T39] ^ [ 65.433661][ T39] ffff88811ebaa380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.441560][ T39] ffff88811ebaa400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.449455][ T39] ================================================================== [ 65.457353][ T39] Disabling lock debugging due to kernel taint [ 65.463554][ T39] general protection fault, probably for non-canonical address 0xfa33fc2160000004: 0000 [#1] PREEMPT SMP KASAN [ 65.475137][ T39] KASAN: maybe wild-memory-access in range [0xd1a0010b00000020-0xd1a0010b00000027] [ 65.484258][ T39] CPU: 1 PID: 39 Comm: kworker/1:1 Tainted: G B 5.15.161-syzkaller-00463-g8e36931104ac #0 [ 65.495273][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 65.505174][ T39] Workqueue: events binder_deferred_func [ 65.510641][ T39] RIP: 0010:__list_del_entry_valid+0x75/0x120 [ 65.516546][ T39] Code: 1e 48 85 db 74 68 4d 85 ff 74 74 48 ba 00 01 00 00 00 00 ad de 48 39 d3 74 76 48 83 c2 22 49 39 d7 74 7e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 3c b4 48 ff 49 8b 17 4c 39 f2 75 [ 65.535987][ T39] RSP: 0018:ffffc9000028fc00 EFLAGS: 00010a03 [ 65.541894][ T39] RAX: 1a34002160000004 RBX: ffff8881073dde00 RCX: ffffffff8269fff9 [ 65.549703][ T39] RDX: dead000000000122 RSI: 0000000000000282 RDI: ffff88811ebaa300 [ 65.557513][ T39] RBP: ffffc9000028fc20 R08: ffffffff814194db R09: 0000000000000003 [ 65.565327][ T39] R10: fffffbfff0e99e4c R11: dffffc0000000001 R12: dffffc0000000000 [ 65.573132][ T39] R13: ffff88811ebaa300 R14: ffff88811ebaa300 R15: d1a0010b00000027 [ 65.580948][ T39] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 65.589718][ T39] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.596141][ T39] CR2: 00007f23265d00e0 CR3: 000000011ebba000 CR4: 00000000003506a0 [ 65.603956][ T39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.611760][ T39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.619578][ T39] Call Trace: [ 65.622697][ T39] [ 65.625482][ T39] ? __die_body+0x62/0xb0 [ 65.629653][ T39] ? die_addr+0x9f/0xd0 [ 65.633723][ T39] ? exc_general_protection+0x311/0x4b0 [ 65.639115][ T39] ? check_panic_on_warn+0x65/0xb0 [ 65.644050][ T39] ? asm_exc_general_protection+0x27/0x30 [ 65.649612][ T39] ? check_panic_on_warn+0x5b/0xb0 [ 65.654558][ T39] ? __list_del_entry_valid+0x49/0x120 [ 65.659847][ T39] ? __list_del_entry_valid+0x75/0x120 [ 65.665150][ T39] binder_release_work+0xcd/0x680 [ 65.670011][ T39] binder_deferred_func+0x1847/0x1bc0 [ 65.675216][ T39] ? read_word_at_a_time+0x12/0x20 [ 65.680161][ T39] process_one_work+0x6bb/0xc10 [ 65.684854][ T39] worker_thread+0xad5/0x12a0 [ 65.689364][ T39] ? _raw_spin_lock+0x1b0/0x1b0 [ 65.694060][ T39] kthread+0x421/0x510 [ 65.697958][ T39] ? worker_clr_flags+0x180/0x180 [ 65.702818][ T39] ? kthread_blkcg+0xd0/0xd0 [ 65.707243][ T39] ret_from_fork+0x1f/0x30 [ 65.711504][ T39] [ 65.714356][ T39] Modules linked in: [ 65.718210][ T39] ---[ end trace 0e057a23bce586ed ]--- [ 65.723630][ T39] RIP: 0010:__list_del_entry_valid+0x75/0x120 [pid 335] close(4) = 0 [pid 335] close(5) = 0 [pid 335] close(6) = -1 EBADF (Bad file descriptor) [pid 335] close(7) = -1 EBADF (Bad file descriptor) [pid 335] close(8) = -1 EBADF (Bad file descriptor) [pid 335] close(9) = -1 EBADF (Bad file descriptor) [pid 335] close(10) = -1 EBADF (Bad file descriptor) [pid 335] close(11) = -1 EBADF (Bad file descriptor) [pid 335] close(12) = -1 EBADF (Bad file descriptor) [pid 335] close(13) = -1 EBADF (Bad file descriptor) [pid 335] close(14) = -1 EBADF (Bad file descriptor) [pid 335] close(15) = -1 EBADF (Bad file descriptor) [pid 335] close(16) = -1 EBADF (Bad file descriptor) [pid 335] close(17) = -1 EBADF (Bad file descriptor) [pid 335] close(18) = -1 EBADF (Bad file descriptor) [pid 335] close(19) = -1 EBADF (Bad file descriptor) [pid 335] close(20) = -1 EBADF (Bad file descriptor) [pid 335] close(21) = -1 EBADF (Bad file descriptor) [pid 335] close(22) = -1 EBADF (Bad file descriptor) [pid 335] close(23) = -1 EBADF (Bad file descriptor) [pid 335] close(24) = -1 EBADF (Bad file descriptor) [pid 335] close(25) = -1 EBADF (Bad file descriptor) [pid 335] close(26) = -1 EBADF (Bad file descriptor) [pid 335] close(27) = -1 EBADF (Bad file descriptor) [pid 335] close(28) = -1 EBADF (Bad file descriptor) [pid 335] close(29) = -1 EBADF (Bad file descriptor) [ 65.729523][ T39] Code: 1e 48 85 db 74 68 4d 85 ff 74 74 48 ba 00 01 00 00 00 00 ad de 48 39 d3 74 76 48 83 c2 22 49 39 d7 74 7e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 3c b4 48 ff 49 8b 17 4c 39 f2 75 [ 65.748982][ T39] RSP: 0018:ffffc9000028fc00 EFLAGS: 00010a03 [ 65.749313][ T30] audit: type=1400 audit(1727672669.578:74): avc: denied { unmount } for pid=334 comm="syz-executor114" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 65.754876][ T39] RAX: 1a34002160000004 RBX: ffff8881073dde00 RCX: ffffffff8269fff9 [pid 335] exit_group(0) = ? [pid 335] +++ exited with 0 +++ [pid 334] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 334] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555b98650) = 3 ./strace-static-x86_64: Process 337 attached [pid 337] set_robust_list(0x555555b98660, 24) = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] write(1, "executing program\n", 18executing program ) = 18 [pid 337] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY) = 3 [pid 337] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY) = 4 [pid 337] dup3(4, 3, 0) = 3 [ 65.782131][ T39] RDX: dead000000000122 RSI: 0000000000000282 RDI: ffff88811ebaa300 [ 65.789941][ T39] RBP: ffffc9000028fc20 R08: ffffffff814194db R09: 0000000000000003 [ 65.791467][ T30] audit: type=1400 audit(1727672669.598:75): avc: denied { mounton } for pid=334 comm="syz-executor114" path="/dev/binderfs" dev="devtmpfs" ino=362 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 65.797722][ T39] R10: fffffbfff0e99e4c R11: dffffc0000000001 R12: dffffc0000000000 [pid 337] openat(AT_FDCWD, "./binderfs/binder0", O_RDONLY) = 5 [pid 337] ioctl(5, BINDER_SET_CONTEXT_MGR_EXT, 0x20000000) = -1 EBUSY (Device or resource busy) [pid 337] ioctl(3, BINDER_WRITE_READ, 0x20000480) = 0 [pid 337] close(3) = 0 [pid 337] close(4) = 0 [pid 337] close(5) = 0 [pid 337] close(6) = -1 EBADF (Bad file descriptor) [pid 337] close(7) = -1 EBADF (Bad file descriptor) [pid 337] close(8) = -1 EBADF (Bad file descriptor) [pid 337] close(9) = -1 EBADF (Bad file descriptor) [pid 337] close(10) = -1 EBADF (Bad file descriptor) [pid 337] close(11) = -1 EBADF (Bad file descriptor) [pid 337] close(12) = -1 EBADF (Bad file descriptor) [pid 337] close(13) = -1 EBADF (Bad file descriptor) [pid 337] close(14) = -1 EBADF (Bad file descriptor) [pid 337] close(15) = -1 EBADF (Bad file descriptor) [pid 337] close(16) = -1 EBADF (Bad file descriptor) [pid 337] close(17) = -1 EBADF (Bad file descriptor) [pid 337] close(18) = -1 EBADF (Bad file descriptor) [pid 337] close(19) = -1 EBADF (Bad file descriptor) [pid 337] close(20) = -1 EBADF (Bad file descriptor) [pid 337] close(21) = -1 EBADF (Bad file descriptor) [pid 337] close(22) = -1 EBADF (Bad file descriptor) [pid 337] close(23) = -1 EBADF (Bad file descriptor) [pid 337] close(24) = -1 EBADF (Bad file descriptor) [pid 337] close(25) = -1 EBADF (Bad file descriptor) [pid 337] close(26) = -1 EBADF (Bad file descriptor) [pid 337] close(27) = -1 EBADF (Bad file descriptor) [pid 337] close(28) = -1 EBADF (Bad file descriptor) [pid 337] close(29) = -1 EBADF (Bad file descriptor) [pid 337] exit_group(0) = ? [pid 337] +++ exited with 0 +++ [pid 334] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 334] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 334] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555b98650) = 4 [ 65.797770][ T39] R13: ffff88811ebaa300 R14: ffff88811ebaa300 R15: d1a0010b00000027 [ 65.797818][ T39] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 65.837451][ T337] binder: BINDER_SET_CONTEXT_MGR already set [ 65.844989][ T39] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.845037][ T39] CR2: 00007f23265d00e0 CR3: 0000000006a0f000 CR4: 00000000003506a0 [ 65.845084][ T39] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.845121][ T39] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.851318][ T337] binder: 337:337 ioctl 4018620d 20000000 returned -16 [ 65.857380][ T39] Kernel panic - not syncing: Fatal exception [ 65.893591][ T39] Kernel Offset: disabled [ 65.897749][ T39] Rebooting in 86400 seconds..