binder: 3883:3885 transaction failed 29189/-3, size 0-0 line 3128
binder: undelivered TRANSACTION_ERROR: 29189
binder: release 3883:3885 transaction 85 in, still active
binder: send failed reply for transaction 85 to 3883:3885
==================================================================
BUG: KASAN: use-after-free in __list_del_entry+0x196/0x1d0 lib/list_debug.c:60
Read of size 8 at addr ffff8801cc6c2c10 by task kworker/u4:1/19

CPU: 0 PID: 19 Comm: kworker/u4:1 Not tainted 4.4.119-g855ea74 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: binder binder_deferred_func
 0000000000000000 8b74a5c01ac0db4e ffff8801d94a7a58 ffffffff81d0402d
 ffffea000731b080 ffff8801cc6c2c10 0000000000000000 ffff8801cc6c2c10
 ffffed00398d6d99 ffff8801d94a7a90 ffffffff814fe103 ffff8801cc6c2c10
Call Trace:
 [<ffffffff81d0402d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0402d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fe103>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fe615>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fe615>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fe774>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff81d64346>] __list_del_entry+0x196/0x1d0 lib/list_debug.c:60
 [<ffffffff82c7676e>] list_del_init include/linux/list.h:145 [inline]
 [<ffffffff82c7676e>] binder_dequeue_work_head_ilocked drivers/android/binder.c:914 [inline]
 [<ffffffff82c7676e>] binder_dequeue_work_head drivers/android/binder.c:934 [inline]
 [<ffffffff82c7676e>] binder_release_work+0x6e/0x260 drivers/android/binder.c:4356
 [<ffffffff82c76d85>] binder_thread_release+0x425/0x600 drivers/android/binder.c:4564
 [<ffffffff82c7b9f8>] binder_deferred_release drivers/android/binder.c:5105 [inline]
 [<ffffffff82c7b9f8>] binder_deferred_func+0x438/0xd10 drivers/android/binder.c:5177
 [<ffffffff8117fd37>] process_one_work+0x7d7/0x16e0 kernel/workqueue.c:2064
 [<ffffffff81180d19>] worker_thread+0xd9/0xfc0 kernel/workqueue.c:2196
 [<ffffffff81190788>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff83773a85>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:506

Allocated by task 3885:
 [<ffffffff81035d96>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd173>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fd43d>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fd43d>] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f93c0>] kmem_cache_alloc_trace+0x100/0x2b0 mm/slub.c:2642
 [<ffffffff82c86b4c>] kmalloc include/linux/slab.h:476 [inline]
 [<ffffffff82c86b4c>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff82c86b4c>] binder_transaction+0x103c/0x7290 drivers/android/binder.c:3057
 [<ffffffff82c8d5bf>] binder_thread_write+0x81f/0x33e0 drivers/android/binder.c:3680
 [<ffffffff82c9034f>] binder_ioctl_write_read.isra.55+0x1cf/0xbc0 drivers/android/binder.c:4619
 [<ffffffff82c91990>] binder_ioctl+0xc50/0x12e0 drivers/android/binder.c:4758
 [<ffffffff8161e57a>] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline]
 [<ffffffff8161e57a>] compat_SyS_ioctl+0x28a/0x2540 fs/compat_ioctl.c:1544
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff83774fea>] sysenter_flags_fixed+0xd/0x17

Freed by task 19:
 [<ffffffff81035d96>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd173>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fda92>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fda92>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814fa52c>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814fa52c>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814fa52c>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814fa52c>] kfree+0xfc/0x300 mm/slub.c:3749
 [<ffffffff82c6beca>] binder_free_transaction+0x6a/0x90 drivers/android/binder.c:2123
 [<ffffffff82c763a5>] binder_send_failed_reply+0x185/0x3a0 drivers/android/binder.c:2156
 [<ffffffff82c76d73>] binder_thread_release+0x413/0x600 drivers/android/binder.c:4563
 [<ffffffff82c7b9f8>] binder_deferred_release drivers/android/binder.c:5105 [inline]
 [<ffffffff82c7b9f8>] binder_deferred_func+0x438/0xd10 drivers/android/binder.c:5177
 [<ffffffff8117fd37>] process_one_work+0x7d7/0x16e0 kernel/workqueue.c:2064
 [<ffffffff81180d19>] worker_thread+0xd9/0xfc0 kernel/workqueue.c:2196
 [<ffffffff81190788>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff83773a85>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:506

The buggy address belongs to the object at ffff8801cc6c2c00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 16 bytes inside of
 192-byte region [ffff8801cc6c2c00, ffff8801cc6c2cc0)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3890 Comm: syz-executor5 Not tainted 4.4.119-g855ea74 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800bb370000 task.stack: ffff8801c6d28000
RIP: 0010:[<ffffffff81d65fa6>]  [<ffffffff81d65fa6>] lookup_object lib/debugobjects.c:120 [inline]
RIP: 0010:[<ffffffff81d65fa6>]  [<ffffffff81d65fa6>] debug_object_deactivate+0x1a6/0x3c0 lib/debugobjects.c:465
RSP: 0018:ffff8801db307d20  EFLAGS: 00010803
RAX: 0000000000000092 RBX: e90006ddb8e80b0f RCX: ffff8801db319c40
RDX: 1d2000dbb71d0164 RSI: ffffffff842c6460 RDI: e90006ddb8e80b27
RBP: ffff8801db307de8 R08: 1ffff1003b02a273 R09: 0000000000000000
R10: ffffed0043fffa09 R11: 0000000000000000 R12: 1ffff1003b660fa8
R13: 0000000000000003 R14: dffffc0000000000 R15: ffffffff857d3748
FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f7766b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007f2d078dfdb8 CR3: 00000000bba18000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000000286 0000000000000286 ffffffff842c6460 ffff8801db319c40
 0000000041b58ab3 ffffffff83fce929 ffffffff81d65e00 ffffffff842bf1a0
 0000000000000286 ffff8801db307da0 ffffffff8121f80f ffffffff842beec0
Call Trace:
 <IRQ> 
 [<ffffffff812ada72>] debug_hrtimer_deactivate kernel/time/hrtimer.c:415 [inline]
 [<ffffffff812ada72>] debug_deactivate kernel/time/hrtimer.c:461 [inline]
 [<ffffffff812ada72>] __run_hrtimer kernel/time/hrtimer.c:1224 [inline]
 [<ffffffff812ada72>] __hrtimer_run_queues+0x492/0xfe0 kernel/time/hrtimer.c:1319
 [<ffffffff812afdc6>] hrtimer_interrupt+0x1a6/0x440 kernel/time/hrtimer.c:1353
 [<ffffffff810b0dea>] local_apic_timer_interrupt+0x6a/0xb0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff837762b6>] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff83775210>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:737
 <EOI> 
 [<ffffffff8126a5ae>] vprintk_emit+0x55e/0x850 kernel/printk/printk.c:1832
 [<ffffffff8126a8c8>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
 [<ffffffff8126a8ed>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
 [<ffffffff8141b73d>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
 [<ffffffff82c8c0c5>] binder_transaction+0x65b5/0x7290 drivers/android/binder.c:3023
 [<ffffffff82c8d6fb>] binder_thread_write+0x95b/0x33e0 drivers/android/binder.c:3691
 [<ffffffff82c9034f>] binder_ioctl_write_read.isra.55+0x1cf/0xbc0 drivers/android/binder.c:4619
 [<ffffffff82c91990>] binder_ioctl+0xc50/0x12e0 drivers/android/binder.c:4758
 [<ffffffff8161e57a>] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline]
 [<ffffffff8161e57a>] compat_SyS_ioctl+0x28a/0x2540 fs/compat_ioctl.c:1544
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff83774fea>] sysenter_flags_fixed+0xd/0x17
Code: eb 1a 48 89 da 48 c1 ea 03 42 80 3c 32 00 0f 85 86 01 00 00 48 8b 1b 48 85 db 74 7a 48 8d 7b 18 41 83 c5 01 48 89 fa 48 c1 ea 03 <42> 80 3c 32 00 0f 85 3c 01 00 00 48 3b 4b 18 75 c6 48 8d 7b 10 
RIP  [<ffffffff81d65fa6>] lookup_object lib/debugobjects.c:120 [inline]
RIP  [<ffffffff81d65fa6>] debug_object_deactivate+0x1a6/0x3c0 lib/debugobjects.c:465
 RSP <ffff8801db307d20>
---[ end trace 0a32d07ee2e18782 ]---