==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2eff/0x3640 kernel/locking/lockdep.c:3224 at addr ffff8801c3261238
Read of size 8 by task syzkaller016943/3320
CPU: 0 PID: 3320 Comm: syzkaller016943 Not tainted 4.9.70-g9542d2a #109
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c2d478b0 ffffffff81d90a29 ffff8801da001280 ffff8801c3261180
 ffff8801c3261380 ffffed003864c247 ffff8801c3261238 ffff8801c2d478d8
 ffffffff8153a45c ffffed003864c247 ffff8801da001280 0000000000000000
Call Trace:
 [<ffffffff81d90a29>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d90a29>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153a45c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153a71c>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153a71c>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153a71c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
 [<ffffffff8153aab9>] kasan_report mm/kasan/report.c:330 [inline]
 [<ffffffff8153aab9>] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:330
 [<ffffffff8123c37f>] __lock_acquire+0x2eff/0x3640 kernel/locking/lockdep.c:3224
 [<ffffffff8123d4fe>] lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
 [<ffffffff838aa25e>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline]
 [<ffffffff838aa25e>] _raw_spin_lock_irqsave+0x4e/0x70 kernel/locking/spinlock.c:159
 [<ffffffff81221a64>] remove_wait_queue+0x14/0x40 kernel/sched/wait.c:49
 [<ffffffff8164d4cf>] ep_remove_wait_queue fs/eventpoll.c:535 [inline]
 [<ffffffff8164d4cf>] ep_unregister_pollwait.isra.6+0xaf/0x240 fs/eventpoll.c:553
 [<ffffffff8164e216>] ep_free+0x96/0x1b0 fs/eventpoll.c:770
 [<ffffffff8164e374>] ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:802
 [<ffffffff8157195c>] __fput+0x28c/0x6e0 fs/file_table.c:208
 [<ffffffff81571e35>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff81193685>] task_work_run+0x115/0x190 kernel/task_work.c:116
 [<ffffffff8113a4d7>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff8113a4d7>] do_exit+0x7e7/0x2a40 kernel/exit.c:833
 [<ffffffff81140be8>] do_group_exit+0x108/0x320 kernel/exit.c:937
 [<ffffffff81140e1d>] SYSC_exit_group kernel/exit.c:948 [inline]
 [<ffffffff81140e1d>] SyS_exit_group+0x1d/0x20 kernel/exit.c:946
 [<ffffffff838aa405>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801c3261180, in cache kmalloc-512 size: 512
Allocated:
PID = 3320
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 kmem_cache_alloc_trace+0xfb/0x2a0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 binder_get_thread+0x15d/0x750 drivers/android/binder.c:4454
 binder_poll+0x4a/0x210 drivers/android/binder.c:4557
 ep_item_poll fs/eventpoll.c:811 [inline]
 ep_insert fs/eventpoll.c:1347 [inline]
 SYSC_epoll_ctl fs/eventpoll.c:1975 [inline]
 SyS_epoll_ctl+0x11d7/0x2190 fs/eventpoll.c:1861
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 3320
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 binder_free_thread drivers/android/binder.c:4482 [inline]
 binder_thread_dec_tmpref+0x1cc/0x240 drivers/android/binder.c:2038
 binder_thread_release+0x27d/0x540 drivers/android/binder.c:4546
 binder_ioctl+0x9c0/0x11b0 drivers/android/binder.c:4762
 vfs_ioctl fs/ioctl.c:43 [inline]
 do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679
 SYSC_ioctl fs/ioctl.c:694 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801c3261100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c3261180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801c3261200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff8801c3261280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c3261300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x2c56/0x3640 kernel/locking/lockdep.c:3228 at addr ffff8801c3261240
Read of size 8 by task syzkaller016943/3320
CPU: 0 PID: 3320 Comm: syzkaller016943 Tainted: G    B           4.9.70-g9542d2a #109
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c2d478b0 ffffffff81d90a29 ffff8801da001280 ffff8801c3261180
 ffff8801c3261380 ffffed003864c248 ffff8801c3261240 ffff8801c2d478d8
 ffffffff8153a45c ffffed003864c248 ffff8801da001280 0000000000000000
Call Trace:
 [<ffffffff81d90a29>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d90a29>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153a45c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153a71c>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153a71c>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153a71c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
 [<ffffffff8153aab9>] kasan_report mm/kasan/report.c:330 [inline]
 [<ffffffff8153aab9>] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:330
 [<ffffffff8123c0d6>] __lock_acquire+0x2c56/0x3640 kernel/locking/lockdep.c:3228
 [<ffffffff8123d4fe>] lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
 [<ffffffff838aa25e>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline]
 [<ffffffff838aa25e>] _raw_spin_lock_irqsave+0x4e/0x70 kernel/locking/spinlock.c:159
 [<ffffffff81221a64>] remove_wait_queue+0x14/0x40 kernel/sched/wait.c:49
 [<ffffffff8164d4cf>] ep_remove_wait_queue fs/eventpoll.c:535 [inline]
 [<ffffffff8164d4cf>] ep_unregister_pollwait.isra.6+0xaf/0x240 fs/eventpoll.c:553
 [<ffffffff8164e216>] ep_free+0x96/0x1b0 fs/eventpoll.c:770
 [<ffffffff8164e374>] ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:802
 [<ffffffff8157195c>] __fput+0x28c/0x6e0 fs/file_table.c:208
 [<ffffffff81571e35>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff81193685>] task_work_run+0x115/0x190 kernel/task_work.c:116
 [<ffffffff8113a4d7>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff8113a4d7>] do_exit+0x7e7/0x2a40 kernel/exit.c:833
 [<ffffffff81140be8>] do_group_exit+0x108/0x320 kernel/exit.c:937
 [<ffffffff81140e1d>] SYSC_exit_group kernel/exit.c:948 [inline]
 [<ffffffff81140e1d>] SyS_exit_group+0x1d/0x20 kernel/exit.c:946
 [<ffffffff838aa405>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801c3261180, in cache kmalloc-512 size: 512
Allocated:
PID = 3320
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 kmem_cache_alloc_trace+0xfb/0x2a0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 binder_get_thread+0x15d/0x750 drivers/android/binder.c:4454
 binder_poll+0x4a/0x210 drivers/android/binder.c:4557
 ep_item_poll fs/eventpoll.c:811 [inline]
 ep_insert fs/eventpoll.c:1347 [inline]
 SYSC_epoll_ctl fs/eventpoll.c:1975 [inline]
 SyS_epoll_ctl+0x11d7/0x2190 fs/eventpoll.c:1861
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 3320
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 binder_free_thread drivers/android/binder.c:4482 [inline]
 binder_thread_dec_tmpref+0x1cc/0x240 drivers/android/binder.c:2038
 binder_thread_release+0x27d/0x540 drivers/android/binder.c:4546
 binder_ioctl+0x9c0/0x11b0 drivers/android/binder.c:4762
 vfs_ioctl fs/ioctl.c:43 [inline]
 do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679
 SYSC_ioctl fs/ioctl.c:694 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801c3261100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c3261180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801c3261200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff8801c3261280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c3261300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline] at addr ffff8801c3261224
BUG: KASAN: use-after-free in do_raw_spin_lock+0x1ac/0x1e0 kernel/locking/spinlock_debug.c:112 at addr ffff8801c3261224
Read of size 4 by task syzkaller016943/3320
CPU: 0 PID: 3320 Comm: syzkaller016943 Tainted: G    B           4.9.70-g9542d2a #109
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c2d47ac0 ffffffff81d90a29 ffff8801da001280 ffff8801c3261180
 ffff8801c3261380 ffffed003864c244 ffff8801c3261224 ffff8801c2d47ae8
 ffffffff8153a45c ffffed003864c244 ffff8801da001280 0000000000000000
Call Trace:
 [<ffffffff81d90a29>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d90a29>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153a45c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153a71c>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153a71c>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153a71c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
 [<ffffffff8153aa89>] kasan_report mm/kasan/report.c:329 [inline]
 [<ffffffff8153aa89>] __asan_report_load4_noabort+0x29/0x30 mm/kasan/report.c:329
 [<ffffffff8124626c>] debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]
 [<ffffffff8124626c>] do_raw_spin_lock+0x1ac/0x1e0 kernel/locking/spinlock_debug.c:112
 [<ffffffff838aa266>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:119 [inline]
 [<ffffffff838aa266>] _raw_spin_lock_irqsave+0x56/0x70 kernel/locking/spinlock.c:159
 [<ffffffff81221a64>] remove_wait_queue+0x14/0x40 kernel/sched/wait.c:49
 [<ffffffff8164d4cf>] ep_remove_wait_queue fs/eventpoll.c:535 [inline]
 [<ffffffff8164d4cf>] ep_unregister_pollwait.isra.6+0xaf/0x240 fs/eventpoll.c:553
 [<ffffffff8164e216>] ep_free+0x96/0x1b0 fs/eventpoll.c:770
 [<ffffffff8164e374>] ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:802
 [<ffffffff8157195c>] __fput+0x28c/0x6e0 fs/file_table.c:208
 [<ffffffff81571e35>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff81193685>] task_work_run+0x115/0x190 kernel/task_work.c:116
 [<ffffffff8113a4d7>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff8113a4d7>] do_exit+0x7e7/0x2a40 kernel/exit.c:833
 [<ffffffff81140be8>] do_group_exit+0x108/0x320 kernel/exit.c:937
 [<ffffffff81140e1d>] SYSC_exit_group kernel/exit.c:948 [inline]
 [<ffffffff81140e1d>] SyS_exit_group+0x1d/0x20 kernel/exit.c:946
 [<ffffffff838aa405>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801c3261180, in cache kmalloc-512 size: 512
Allocated:
PID = 3320
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 kmem_cache_alloc_trace+0xfb/0x2a0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 binder_get_thread+0x15d/0x750 drivers/android/binder.c:4454
 binder_poll+0x4a/0x210 drivers/android/binder.c:4557
 ep_item_poll fs/eventpoll.c:811 [inline]
 ep_insert fs/eventpoll.c:1347 [inline]
 SYSC_epoll_ctl fs/eventpoll.c:1975 [inline]
 SyS_epoll_ctl+0x11d7/0x2190 fs/eventpoll.c:1861
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 3320
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 binder_free_thread drivers/android/binder.c:4482 [inline]
 binder_thread_dec_tmpref+0x1cc/0x240 drivers/android/binder.c:2038
 binder_thread_release+0x27d/0x540 drivers/android/binder.c:4546
 binder_ioctl+0x9c0/0x11b0 drivers/android/binder.c:4762
 vfs_ioctl fs/ioctl.c:43 [inline]
 do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679
 SYSC_ioctl fs/ioctl.c:694 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801c3261100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c3261180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801c3261200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                               ^
 ffff8801c3261280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c3261300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:84 [inline] at addr ffff8801c3261230
BUG: KASAN: use-after-free in do_raw_spin_lock+0x1d3/0x1e0 kernel/locking/spinlock_debug.c:112 at addr ffff8801c3261230
Read of size 8 by task syzkaller016943/3320
CPU: 0 PID: 3320 Comm: syzkaller016943 Tainted: G    B           4.9.70-g9542d2a #109
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c2d47ac0 ffffffff81d90a29 ffff8801da001280 ffff8801c3261180
 ffff8801c3261380 ffffed003864c246 ffff8801c3261230 ffff8801c2d47ae8
 ffffffff8153a45c ffffed003864c246 ffff8801da001280 0000000000000000
Call Trace:
 [<ffffffff81d90a29>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d90a29>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153a45c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153a71c>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153a71c>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153a71c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309