binder: 9426:9441 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 9426:9458 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 9426:9458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 9426:9447 Release 1 refcount change on invalid ref 2 ret -22 BUG: unable to handle kernel paging request at ffffebe000000020 IP: virt_to_head_page include/linux/mm.h:615 [inline] IP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] IP: qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163 PGD 0 P4D 0 Oops: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 9457 Comm: syz-executor7 Not tainted 4.14.0-mm1+ #26 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d9e20380 task.stack: ffff8801c65b0000 RIP: 0010:virt_to_head_page include/linux/mm.h:615 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:127 [inline] RIP: 0010:qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163 RSP: 0018:ffff8801c65b73b8 EFLAGS: 00010286 RAX: 0000000000000001 RBX: 0000000000000286 RCX: ffffea0000000000 RDX: ffffebe000000000 RSI: ffff8801d9e20c38 RDI: 0000000000000286 RBP: ffff8801c65b73f0 R08: 1ffff10038cb6e45 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff85ecb840 FS: 00007f6402179700(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffebe000000020 CR3: 00000001d9eff000 CR4: 00000000001426e0 Call Trace: quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259 kasan_kmalloc+0xca/0xe0 mm/kasan/kasan.c:536 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slab.c:3329 [inline] kmem_cache_alloc_node_trace+0x139/0x760 mm/slab.c:3655 __do_kmalloc_node mm/slab.c:3675 [inline] __kmalloc_node+0x33/0x70 mm/slab.c:3683 kmalloc_node include/linux/slab.h:556 [inline] kvmalloc_node+0x99/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:541 [inline] kvzalloc include/linux/mm.h:549 [inline] kvm_arch_create_memslot+0xa7/0x470 arch/x86/kvm/x86.c:8342 __kvm_set_memory_region+0x1940/0x24d0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:986 kvm_set_memory_region+0x2e/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1058 kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1070 [inline] kvm_vm_ioctl+0x10bc/0x1c40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2950 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x452867 RSP: 002b:00007f6402177078 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000000452867 RDX: 00007f64021774f0 RSI: 000000004020ae46 RDI: 0000000000000018 RBP: 0000000000000086 R08: 0000000000000001 R09: 0000000000000004 R10: 0000000000000018 R11: 0000000000000206 R12: 00000000006f5578 R13: 00000000ffffffff R14: 00007f64021796d4 R15: 0000000000000002 Code: 00 00 00 80 48 01 c2 72 44 48 b9 00 00 00 80 ff 77 00 00 48 01 ca 48 b9 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 ca <48> 8b 4a 20 48 8d 71 ff 83 e1 01 48 0f 45 d6 4c 8b 6a 30 e9 f4 RIP: virt_to_head_page include/linux/mm.h:615 [inline] RSP: ffff8801c65b73b8 RIP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] RSP: ffff8801c65b73b8 RIP: qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801c65b73b8 CR2: ffffebe000000020 ---[ end trace 0e5ae5f26d196ef2 ]---