BUG: unable to handle kernel paging request at ffffeafff9770020 IP: [] __read_once_size include/linux/compiler.h:243 [inline] IP: [] compound_head include/linux/page-flags.h:143 [inline] IP: [] PageMlocked include/linux/page-flags.h:327 [inline] IP: [] __split_huge_pmd+0x391/0x1870 mm/huge_memory.c:1773 PGD 0 [ 125.004081] Oops: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 10377 Comm: syz-executor0 Not tainted 4.9.122-g54068d6 #30 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d4646000 task.stack: ffff8801cef68000 RIP: 0010:[] [] __read_once_size include/linux/compiler.h:243 [inline] RIP: 0010:[] [] compound_head include/linux/page-flags.h:143 [inline] RIP: 0010:[] [] PageMlocked include/linux/page-flags.h:327 [inline] RIP: 0010:[] [] __split_huge_pmd+0x391/0x1870 mm/huge_memory.c:1773 RSP: 0018:ffff8801cef6fa40 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffeafff9770000 RCX: ffffc9000090e000 RDX: 1ffffd5fff2ee004 RSI: ffffffff8154df6e RDI: ffffeafff9770020 RBP: ffff8801cef6fb70 R08: ffff8801d4646910 R09: 0000000000000001 R10: ffff8801d4646000 R11: 1ffff1003a8c8d1d R12: ffffea0000000000 R13: 0000000000000000 R14: ffff8801cd772420 R15: ffff8801c0ad0800 FS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f57beb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: ffffeafff9770020 CR3: 00000001d3ce8000 CR4: 00000000001606f0 Stack: ffffffff8153e677 ffffffff8153ec42 ffffffff8153a57e ffffffff814e075c ffffffff855d3050 ffffffff814f000e 0000000000006511 ffff8801d4646908 ffff8801d46468b8 ffff8801d4646910 ffff8801d46468c0 1ffff10039dedf5d Call Trace: [] split_huge_pmd_address+0x1a9/0x1f0 mm/huge_memory.c:1800 [] vma_adjust_trans_huge+0x1e3/0x250 mm/huge_memory.c:1826 [] __vma_adjust+0x168/0x16c0 mm/mmap.c:777 [] vma_adjust include/linux/mm.h:1965 [inline] [] __split_vma.isra.40+0x530/0x670 mm/mmap.c:2624 [] do_munmap+0x252/0xe50 mm/mmap.c:2703 [] mremap_to mm/mremap.c:435 [inline] [] SYSC_mremap mm/mremap.c:526 [inline] [] SyS_mremap+0x82e/0xd20 mm/mremap.c:492 [] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline] [] do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387 [] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 Code: ff df 4c 21 e3 49 bc 00 00 00 00 00 ea ff ff 48 c1 eb 06 4c 01 e3 48 8d 7b 20 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 14 [ 125.294147] binder: 10399:10420 unknown command 0 binder: 10399:10420 ioctl c0306201 200001c0 returned -22 binder: 10399:10420 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 10399:10400 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder_alloc: binder_alloc_mmap_handler: 10399 20001000-20004000 already mapped failed -16 binder_alloc: 10399: binder_alloc_buf, no vma binder: 10399:10420 transaction failed 29189/-3, size 24-8 line 3136 binder: BINDER_SET_CONTEXT_MGR already set binder: 10399:10400 ioctl 40046207 0 returned -16 binder: 10399:10420 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 10399:10400 Release 1 refcount change on invalid ref 1 ret -22 binder: 10399:10400 unknown command 0 binder: 10399:10400 ioctl c0306201 200001c0 returned -22 binder: 10399:10420 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 10399:10400 BC_ACQUIRE_DONE u0000000000000000 no match binder: 10399:10400 BC_INCREFS_DONE u0000000000000000 no match binder: release 10399:10420 transaction 44 out, still active binder: send failed reply for transaction 44, target dead 13 00 00 <4c> 8b 6b 20 49 89 dc 41 f6 c5 01 0f 85 ab 0a 00 00 e8 b9 2d e1 RIP [] __read_once_size include/linux/compiler.h:243 [inline] RIP [] compound_head include/linux/page-flags.h:143 [inline] RIP [] PageMlocked include/linux/page-flags.h:327 [inline] RIP [] __split_huge_pmd+0x391/0x1870 mm/huge_memory.c:1773 RSP CR2: ffffeafff9770020 ---[ end trace 464e6ae6eb2d4ddd ]---