------------[ cut here ]------------ WARNING: CPU: 1 PID: 5296 at include/linux/mmap_lock.h:155 mmap_assert_locked include/linux/mmap_lock.h:155 [inline] WARNING: CPU: 1 PID: 5296 at include/linux/mmap_lock.h:155 binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] WARNING: CPU: 1 PID: 5296 at include/linux/mmap_lock.h:155 binder_alloc_vma_close+0x98/0xb0 drivers/android/binder_alloc.c:986 Modules linked in: CPU: 1 PID: 5296 Comm: syz-executor.2 Not tainted 6.0.0-rc6-syzkaller-17727-gaa49f95768a9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mmap_assert_locked include/linux/mmap_lock.h:155 [inline] pc : binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] pc : binder_alloc_vma_close+0x98/0xb0 drivers/android/binder_alloc.c:986 lr : mmap_assert_locked include/linux/mmap_lock.h:155 [inline] lr : binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] lr : binder_alloc_vma_close+0x98/0xb0 drivers/android/binder_alloc.c:986 sp : ffff8000136dbbb0 x29: ffff8000136dbbb0 x28: 0000000000000000 x27: 0000000000000840 x26: ffff0000c0250000 x25: ffff0000ff742d48 x24: 0000000000000bfe x23: ffff80000afc7020 x22: ffff80000cb842f0 x21: 0000000000000000 x20: ffff0000c0250540 x19: ffff0000fef525e0 x18: fffffffffffffff5 x17: 0000000000000000 x16: ffff80000db59158 x15: ffff0000ffeb1a80 x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000ffeb1a80 x11: ff8080000afcc008 x10: 0000000000000000 x9 : ffff80000afcc008 x8 : ffff0000ffeb1a80 x7 : 0060000000000fc3 x6 : 0000000010000091 x5 : 0000000000000008 x4 : 0000000020d1f000 x3 : 0000000020d1d000 x2 : 00000000000014aa x1 : 0000000000000000 x0 : 0000000000000000 Call trace: mmap_assert_locked include/linux/mmap_lock.h:155 [inline] binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] binder_alloc_vma_close+0x98/0xb0 drivers/android/binder_alloc.c:986 binder_vma_close+0x48/0x58 drivers/android/binder.c:5545 remove_vma mm/mmap.c:143 [inline] exit_mmap+0x148/0x2e4 mm/mmap.c:3124 __mmput+0x90/0x204 kernel/fork.c:1187 mmput+0x64/0xa0 kernel/fork.c:1208 exit_mm+0x16c/0x1c0 kernel/exit.c:510 do_exit+0x1f4/0xbe0 kernel/exit.c:782 __do_sys_exit kernel/exit.c:892 [inline] __se_sys_exit kernel/exit.c:890 [inline] do_group_exit+0x0/0xe8 kernel/exit.c:890 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654 el0t_64_sync+0x18c/0x190 irq event stamp: 1100 hardirqs last enabled at (1099): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (1099): [] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194 hardirqs last disabled at (1100): [] el1_dbg+0x24/0x5c arch/arm64/kernel/entry-common.c:404 softirqs last enabled at (192): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (190): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- mm ffff0000c0250540 mmap 0000000000000000 seqnum 1 task_size 281474976710656 get_unmapped_area ffff800008487740 mmap_base 281472826122240 mmap_legacy_base 0 highest_vm_end 281474482995200 pgd ffff0000ff7be000 mm_users 0 mm_count 1 pgtables_bytes 0 map_count 26 hiwater_rss 86f hiwater_vm 3507 total_vm 3507 locked_vm 0 pinned_vm 0 data_vm 1fa0 exec_vm ea stack_vm 21 start_code ffff7ec00000 end_code ffff7ece85cc start_data ffff7ecf8be0 end_data ffff7ed56148 start_brk aaaaab450000 brk aaaaab472000 start_stack ffffe29271d0 arg_start ffffe2927ec9 arg_end ffffe2927ee3 env_start ffffe2927ee3 env_end ffffe2927fe3 binfmt ffff80000d48d0f0 flags 8d ioctx_table 0000000000000000 owner 0000000000000000 exe_file 0000000000000000 ------------[ cut here ]------------ kernel BUG at include/linux/mmap_lock.h:156! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 5296 Comm: syz-executor.2 Tainted: G W 6.0.0-rc6-syzkaller-17727-gaa49f95768a9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mmap_assert_locked include/linux/mmap_lock.h:156 [inline] pc : binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] pc : binder_alloc_vma_close+0xac/0xb0 drivers/android/binder_alloc.c:986 lr : mmap_assert_locked include/linux/mmap_lock.h:156 [inline] lr : binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] lr : binder_alloc_vma_close+0xac/0xb0 drivers/android/binder_alloc.c:986 sp : ffff8000136dbbb0 x29: ffff8000136dbbb0 x28: 0000000000000000 x27: 0000000000000840 x26: ffff0000c0250000 x25: ffff0000ff742d48 x24: 0000000000000bfe x23: ffff80000afc7020 x22: ffff80000cb842f0 x21: 0000000000000000 x20: ffff0000c0250540 x19: ffff0000fef525e0 x18: 000000000000030a x17: ffff80000c00d6bc x16: ffff80000db59158 x15: ffff0000ffeb1a80 x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000ffeb1a80 x11: ff808000081c30a4 x10: 0000000000000000 x9 : 6f5df330e0dbf400 x8 : 6f5df330e0dbf400 x7 : ffff800008163f60 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 000000000000035c Call trace: mmap_assert_locked include/linux/mmap_lock.h:156 [inline] binder_alloc_set_vma drivers/android/binder_alloc.c:327 [inline] binder_alloc_vma_close+0xac/0xb0 drivers/android/binder_alloc.c:986 binder_vma_close+0x48/0x58 drivers/android/binder.c:5545 remove_vma mm/mmap.c:143 [inline] exit_mmap+0x148/0x2e4 mm/mmap.c:3124 __mmput+0x90/0x204 kernel/fork.c:1187 mmput+0x64/0xa0 kernel/fork.c:1208 exit_mm+0x16c/0x1c0 kernel/exit.c:510 do_exit+0x1f4/0xbe0 kernel/exit.c:782 __do_sys_exit kernel/exit.c:892 [inline] __se_sys_exit kernel/exit.c:890 [inline] do_group_exit+0x0/0xe8 kernel/exit.c:890 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654 el0t_64_sync+0x18c/0x190 Code: 17fffff2 974b5471 aa1403e0 97521f4b (d4210000) ---[ end trace 0000000000000000 ]---