binder: undelivered transaction 16, process died. binder: undelivered TRANSACTION_COMPLETE binder: 9985:9987 BC_FREE_BUFFER u0000000020002000 matched unreturned or currently freeing buffer list_del corruption. prev->next should be ffff8881cc377030, but was ffff8881cdc7f470 ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:53! invalid opcode: 0000 [#1] PREEMPT SMP KASAN binder: undelivered TRANSACTION_COMPLETE CPU: 0 PID: 6306 Comm: kworker/0:3 Not tainted 4.20.0-rc6-next-20181210+ #164 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_power_efficient neigh_periodic_work binder: undelivered transaction 20, process died. RIP: 0010:__list_del_entry_valid.cold.1+0x48/0x4a lib/list_debug.c:51 Code: e4 80 88 e8 22 1f d2 fd 0f 0b 48 89 de 48 c7 c7 c0 e5 80 88 e8 11 1f d2 fd 0f 0b 48 89 de 48 c7 c7 60 e5 80 88 e8 00 1f d2 fd <0f> 0b 48 89 d9 48 c7 c7 20 e6 80 88 e8 ef 1e d2 fd 0f 0b 48 89 f1 RSP: 0018:ffff88818b63f440 EFLAGS: 00010282 RAX: 0000000000000054 RBX: ffff8881cc377030 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff816621c5 RDI: 0000000000000005 kobject: 'loop5' (00000000c7fa1b08): kobject_uevent_env RBP: ffff88818b63f458 R08: ffff88818b630200 R09: ffffed103b585020 kobject: 'loop5' (00000000c7fa1b08): fill_kobj_path: path = '/devices/virtual/block/loop5' R10: ffffed103b585020 R11: ffff8881dac28107 R12: ffff8881c9a84b70 R13: ffffffff8a1dca60 R14: ffff88818b63f560 R15: 1ffff110316c7e94 FS: 0000000000000000(0000) GS:ffff8881dac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb96b6124a0 CR3: 00000001cdd4b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_del_init include/linux/list.h:159 [inline] neigh_mark_dead+0x13b/0x410 net/core/neighbour.c:125 neigh_periodic_work+0x89a/0xc30 net/core/neighbour.c:905 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace 7454e005e5db79f8 ]--- RIP: 0010:__list_del_entry_valid.cold.1+0x48/0x4a lib/list_debug.c:51 Code: e4 80 88 e8 22 1f d2 fd 0f 0b 48 89 de 48 c7 c7 c0 e5 80 88 e8 11 1f d2 fd 0f 0b 48 89 de 48 c7 c7 60 e5 80 88 e8 00 1f d2 fd <0f> 0b 48 89 d9 48 c7 c7 20 e6 80 88 e8 ef 1e d2 fd 0f 0b 48 89 f1 RSP: 0018:ffff88818b63f440 EFLAGS: 00010282 RAX: 0000000000000054 RBX: ffff8881cc377030 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff816621c5 RDI: 0000000000000005 RBP: ffff88818b63f458 R08: ffff88818b630200 R09: ffffed103b585020 R10: ffffed103b585020 R11: ffff8881dac28107 R12: ffff8881c9a84b70 kobject: 'loop1' (00000000abe55b8a): kobject_uevent_env R13: ffffffff8a1dca60 R14: ffff88818b63f560 R15: 1ffff110316c7e94 FS: 0000000000000000(0000) GS:ffff8881dac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb96b6124a0 CR3: 00000001cdd4b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400