binder: 18204:18205 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18219:18223 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18216:18233 unknown command 0 ===================================== binder: 18216:18233 ioctl c0306201 200001c0 returned -22 WARNING: bad unlock balance detected! binder: 18216:18233 Acquire 1 refcount change on invalid ref 1073741824 ret -22 4.14.103+ #18 Not tainted ------------------------------------- migration/0/11 is trying to release lock (&rq->lock) at: [] migration_cpu_stop+0x2dd/0x430 kernel/sched/core.c:1036 but there are no more locks to release! other info that might help us debug this: binder: 18216:18233 unknown command 0 1 lock held by migration/0/11: #0: (&p->pi_lock){-.-.}, at: [] migration_cpu_stop+0xe1/0x430 kernel/sched/core.c:1027 stack backtrace: CPU: 0 PID: 11 Comm: migration/0 Not tainted 4.14.103+ #18 Call Trace: binder: 18216:18233 ioctl c0306201 20000000 returned -22 __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_unlock_imbalance_bug kernel/locking/lockdep.c:3548 [inline] print_unlock_imbalance_bug.cold+0x110/0x11f kernel/locking/lockdep.c:3525 binder: 18216:18233 unknown command 0 binder: 18216:18238 Acquire 1 refcount change on invalid ref 1073741824 ret -22 binder: 18216:18238 unknown command 0 binder: 18216:18233 ioctl c0306201 200001c0 returned -22 binder: 18216:18238 ioctl c0306201 20000000 returned -22 binder: 18244:18250 BC_CLEAR_DEATH_NOTIFICATION death notification not active binder: 18257:18263 unknown command -925746537 binder: 18258:18262 BC_CLEAR_DEATH_NOTIFICATION death notification not active binder: 18257:18263 ioctl c0306201 20008fd0 returned -22 binder: 18257:18266 unknown command -925746537 binder: 18269:18270 BC_CLEAR_DEATH_NOTIFICATION death notification not active binder: 18257:18266 ioctl c0306201 20008fd0 returned -22 binder: 18275:18282 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 18275:18282 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18285:18286 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 18285:18286 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18287:18290 unknown command 164061966 binder: 18287:18290 ioctl c0306201 20000000 returned -22 binder: 18287:18290 unknown command 164061966 binder: 18287:18290 ioctl c0306201 20000000 returned -22 binder: 18298:18300 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 18298:18300 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 selinux_nlmsg_perm: 4408 callbacks suppressed SELinux: unrecognized netlink message: protocol=6 nlmsg_type=14795 sclass=netlink_xfrm_socket pig=18312 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=14795 sclass=netlink_xfrm_socket pig=18312 comm=syz-executor.1 binder: 18336:18337 ioctl c0306201 0 returned -14 audit: type=1400 audit(1550997626.946:181): avc: denied { map } for pid=18333 comm="syz-executor.0" path="/dev/zero" dev="devtmpfs" ino=1030 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file permissive=1 binder: undelivered death notification, 0000000000000000 binder: 18345:18346 ioctl c0306201 0 returned -14 binder: undelivered death notification, 0000000000000000 binder: 18350:18353 ioctl c0306201 0 returned -14 binder: 18359:18360 unknown command 1074553583 binder: 18359:18360 ioctl c0306201 20008fd0 returned -22 binder: 18359:18360 unknown command 1074553583 binder: 18359:18360 ioctl c0306201 20008fd0 returned -22 binder: 18381:18389 ioctl 4c81 0 returned -22 binder: 18381:18389 Acquire 1 refcount change on invalid ref 10191104 ret -22 binder: 18381:18389 unknown command 0 binder: 18381:18389 ioctl c0306201 20000000 returned -22 binder: 18381:18403 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18381:18389 ioctl 4c81 0 returned -22 binder: 18381:18403 Acquire 1 refcount change on invalid ref 10191104 ret -22 binder: 18381:18414 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18381:18403 unknown command 0 binder: 18381:18403 ioctl c0306201 20000000 returned -22 binder: 18424:18425 unknown command 8972 binder: 18424:18425 ioctl c0306201 200001c0 returned -22 binder: 18424:18427 unknown command 8972 binder: 18424:18427 ioctl c0306201 200001c0 returned -22 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 18472:18475 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18472:18475 unknown command -1205852776 binder: 18472:18475 ioctl c0306201 20008fd0 returned -22 binder: 18485:18490 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18485:18490 unknown command -1205852776 binder: undelivered death notification, 0000000000000000 binder: 18485:18490 ioctl c0306201 20008fd0 returned -22 binder: undelivered death notification, 0000000000000000 binder: 18498:18500 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18498:18500 unknown command -1205852776 binder: 18498:18500 ioctl c0306201 20008fd0 returned -22 binder: 18509:18510 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18509:18510 unknown command -1205852776 binder: 18509:18510 ioctl c0306201 20008fd0 returned -22 binder: 18520:18521 ioctl c0306201 20000040 returned -14 binder: 18520:18521 unknown command 811790 binder: 18520:18521 ioctl c0306201 20000000 returned -22 binder: 18520:18521 BC_CLEAR_DEATH_NOTIFICATION death notification not active binder: 18520:18522 ioctl c0306201 20000040 returned -14 binder: 18520:18522 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18520:18521 unknown command 811790 binder: 18520:18521 ioctl c0306201 20000000 returned -22 binder: 18524:18531 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18524:18531 unknown command -1205852776 binder: 18524:18531 ioctl c0306201 20008fd0 returned -22 binder: undelivered death notification, 0000000000000000 binder: 18543:18545 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: undelivered death notification, 0000000000000000 binder: 18543:18545 unknown command -1205852776 binder: 18543:18545 ioctl c0306201 20008fd0 returned -22 binder: 18558:18559 unknown command 0 binder: 18558:18559 ioctl c0306201 20000100 returned -22 binder: 18558:18559 unknown command 1074619151 binder: 18558:18559 ioctl c0306201 20008fd0 returned -22 binder: 18558:18559 unknown command 0 binder: 18558:18560 unknown command 1074619151 binder: 18558:18559 ioctl c0306201 20000100 returned -22 binder: 18558:18560 ioctl c0306201 20008fd0 returned -22 binder: 18565:18569 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18575:18576 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 858a0f657229e0ed binder: 18565:18569 unknown command -1205852776 binder: 18565:18569 ioctl c0306201 20008fd0 returned -22 binder: 18575:18578 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 858a0f657229e0ed binder: 18583:18586 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18583:18586 unknown command -1205852776 binder: 18583:18586 ioctl c0306201 20008fd0 returned -22 binder: 18599:18602 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18599:18602 unknown command -1205852776 binder: 18599:18602 ioctl c0306201 20008fd0 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 18606:18607 ioctl 40046207 0 returned -16 binder: 18606:18607 unknown command 2 binder: 18606:18607 ioctl c0306201 200001c0 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 18606:18610 unknown command 2 binder: 18606:18610 ioctl c0306201 200001c0 returned -22 binder: 18606:18607 ioctl 40046207 0 returned -16 binder: undelivered death notification, 0000000000000000 binder: undelivered death notification, 0000000000000000 binder: 18615:18620 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18615:18620 unknown command -1205852776 binder: 18615:18620 ioctl c0306201 20008fd0 returned -22 binder: 18637:18641 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18637:18641 unknown command -1205852776 binder: 18637:18641 ioctl c0306201 20008fd0 returned -22 binder: 18640:18647 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18655:18658 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18655:18658 unknown command -1205852776 binder: 18640:18661 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 18655:18658 ioctl c0306201 20008fd0 returned -22 binder: 18669:18672 BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch 0000000000000000 != 57e68c0cbdf9e102 binder: 18669:18672 unknown command -1205852776 binder: 18669:18672 ioctl c0306201 20008fd0 returned -22 binder: 18680:18681 Acquire 1 refcount change on invalid ref 16777216 ret -22 binder: 18680:18681 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 18680:18681 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1073805736 binder: 18680:18681 Acquire 1 refcount change on invalid ref 16777216 ret -22 binder: 18680:18688 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1073805736 binder: 18680:18681 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0