====================================================== [ INFO: possible circular locking dependency detected ] 4.9.141+ #23 Not tainted ------------------------------------------------------- syz-executor.4/15624 is trying to acquire lock: (&p->lock){+.+.+.}, at: [] seq_read+0xdd/0x12d0 fs/seq_file.c:178 but task is already holding lock: (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock_nested fs/pipe.c:66 [inline] (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x5e/0x70 fs/pipe.c:74 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 __mutex_lock_common kernel/locking/mutex.c:521 [inline] mutex_lock_nested+0xc0/0x900 kernel/locking/mutex.c:621 __pipe_lock fs/pipe.c:87 [inline] fifo_open+0x15c/0x9e0 fs/pipe.c:921 do_dentry_open+0x3ef/0xc90 fs/open.c:766 vfs_open+0x11c/0x210 fs/open.c:879 do_last fs/namei.c:3410 [inline] path_openat+0x542/0x2790 fs/namei.c:3534 do_filp_open+0x197/0x270 fs/namei.c:3568 do_open_execat+0x10f/0x640 fs/exec.c:844 do_execveat_common.isra.14+0x687/0x1ed0 fs/exec.c:1723 compat_do_execve fs/exec.c:1856 [inline] C_SYSC_execve fs/exec.c:1931 [inline] compat_SyS_execve+0x48/0x60 fs/exec.c:1927 do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline] do_fast_syscall_32+0x2f1/0xa10 arch/x86/entry/common.c:390 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 __mutex_lock_common kernel/locking/mutex.c:521 [inline] mutex_lock_killable_nested+0xcc/0x9f0 kernel/locking/mutex.c:641 lock_trace+0x44/0xc0 fs/proc/base.c:431 proc_pid_syscall+0xa9/0x260 fs/proc/base.c:663 proc_single_show+0xfd/0x170 fs/proc/base.c:785 seq_read+0x4b6/0x12d0 fs/seq_file.c:240 do_loop_readv_writev.part.1+0xd5/0x280 fs/read_write.c:718 do_loop_readv_writev fs/read_write.c:707 [inline] do_readv_writev+0x56e/0x7b0 fs/read_write.c:873 vfs_readv+0x84/0xc0 fs/read_write.c:897 kernel_readv fs/splice.c:363 [inline] default_file_splice_read+0x451/0x7f0 fs/splice.c:435 do_splice_to+0x10c/0x170 fs/splice.c:899 splice_direct_to_actor+0x23f/0x7e0 fs/splice.c:971 do_splice_direct+0x1a3/0x270 fs/splice.c:1080 do_sendfile+0x4f0/0xc30 fs/read_write.c:1393 C_SYSC_sendfile fs/read_write.c:1475 [inline] compat_SyS_sendfile+0x143/0x160 fs/read_write.c:1458 do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline] do_fast_syscall_32+0x2f1/0xa10 arch/x86/entry/common.c:390 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 check_prev_add kernel/locking/lockdep.c:1828 [inline] check_prevs_add kernel/locking/lockdep.c:1938 [inline] validate_chain kernel/locking/lockdep.c:2265 [inline] __lock_acquire+0x3189/0x4a10 kernel/locking/lockdep.c:3345 lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 __mutex_lock_common kernel/locking/mutex.c:521 [inline] mutex_lock_nested+0xc0/0x900 kernel/locking/mutex.c:621 seq_read+0xdd/0x12d0 fs/seq_file.c:178 do_loop_readv_writev.part.1+0xd5/0x280 fs/read_write.c:718 do_loop_readv_writev fs/read_write.c:707 [inline] do_readv_writev+0x56e/0x7b0 fs/read_write.c:873 vfs_readv+0x84/0xc0 fs/read_write.c:897 kernel_readv fs/splice.c:363 [inline] default_file_splice_read+0x451/0x7f0 fs/splice.c:435 audit_printk_skb: 1803 callbacks suppressed audit: type=1400 audit(1575134051.275:388940): avc: denied { net_raw } for pid=15611 comm="syz-executor.0" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.275:388941): avc: denied { net_admin } for pid=2075 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.285:388942): avc: denied { net_admin } for pid=2075 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.285:388943): avc: denied { net_admin } for pid=2075 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.285:388944): avc: denied { net_admin } for pid=2075 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.295:388945): avc: denied { net_admin } for pid=2075 comm="syz-executor.5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.365:388946): avc: denied { sys_admin } for pid=2075 comm="syz-executor.5" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.365:388947): avc: denied { sys_admin } for pid=2075 comm="syz-executor.5" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.365:388948): avc: denied { sys_admin } for pid=2075 comm="syz-executor.5" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134051.375:388949): avc: denied { sys_admin } for pid=2075 comm="syz-executor.5" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 do_splice_to+0x10c/0x170 fs/splice.c:899 do_splice fs/splice.c:1192 [inline] SYSC_splice fs/splice.c:1416 [inline] SyS_splice+0x10d2/0x14d0 fs/splice.c:1399 do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline] do_fast_syscall_32+0x2f1/0xa10 arch/x86/entry/common.c:390 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 other info that might help us debug this: Chain exists of: &p->lock --> &sig->cred_guard_mutex --> &pipe->mutex/1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); lock(&pipe->mutex/1); lock(&p->lock); *** DEADLOCK *** 1 lock held by syz-executor.4/15624: #0: (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock_nested fs/pipe.c:66 [inline] #0: (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x5e/0x70 fs/pipe.c:74 stack backtrace: CPU: 1 PID: 15624 Comm: syz-executor.4 Not tainted 4.9.141+ #23 ffff88006f2472b8 ffffffff81b42e79 ffffffff83ca2fd0 ffffffff83ca9d80 ffffffff83ca4920 ffff8800a8de67d0 ffff8800a8de5f00 ffff88006f247300 ffffffff813fee40 0000000000000001 00000000a8de67b0 0000000000000001 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_circular_bug.cold.36+0x2f7/0x432 kernel/locking/lockdep.c:1202 [] check_prev_add kernel/locking/lockdep.c:1828 [inline] [] check_prevs_add kernel/locking/lockdep.c:1938 [inline] [] validate_chain kernel/locking/lockdep.c:2265 [inline] [] __lock_acquire+0x3189/0x4a10 kernel/locking/lockdep.c:3345 [] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xc0/0x900 kernel/locking/mutex.c:621 [] seq_read+0xdd/0x12d0 fs/seq_file.c:178 [] do_loop_readv_writev.part.1+0xd5/0x280 fs/read_write.c:718 [] do_loop_readv_writev fs/read_write.c:707 [inline] [] do_readv_writev+0x56e/0x7b0 fs/read_write.c:873 [] vfs_readv+0x84/0xc0 fs/read_write.c:897 [] kernel_readv fs/splice.c:363 [inline] [] default_file_splice_read+0x451/0x7f0 fs/splice.c:435 [] do_splice_to+0x10c/0x170 fs/splice.c:899 [] do_splice fs/splice.c:1192 [inline] [] SYSC_splice fs/splice.c:1416 [inline] [] SyS_splice+0x10d2/0x14d0 fs/splice.c:1399 [] do_syscall_32_irqs_on arch/x86/entry/common.c:328 [inline] [] do_fast_syscall_32+0x2f1/0xa10 arch/x86/entry/common.c:390 [] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137 binder: 15650:15658 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15650:15658 ioctl 6612 0 returned -22 binder: 15650:15658 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15650:15658 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15650:15658 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15658 RLIMIT_NICE not set binder: release 15650:15658 transaction 231 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15650:15658 transaction 230 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15650:15658 transaction 232 out, still active binder: undelivered TRANSACTION_COMPLETE binder: BINDER_SET_CONTEXT_MGR already set binder: 15650:15661 ioctl 40046207 0 returned -16 binder: release 15650:15658 transaction 230 in, still active binder: send failed reply for transaction 230, target dead binder: send failed reply for transaction 231, target dead binder: send failed reply for transaction 232, target dead binder: 15650:15658 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15650:15658 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15675:15681 BC_ACQUIRE_DONE u0000000000000000 no match binder: BINDER_SET_CONTEXT_MGR already set binder: 15684:15685 ioctl 40046207 0 returned -16 binder: 15675:15681 ioctl 6612 0 returned -22 binder: 15684:15685 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15684:15685 ioctl 6612 0 returned -22 binder: 15675:15687 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15684:15685 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15675:15687 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15675:15687 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15687 RLIMIT_NICE not set binder: 15684:15685 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15684:15685 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15684:15689 BC_FREE_BUFFER u0000000020ffc000 no match binder: release 15675:15687 transaction 238 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15675:15687 transaction 234 in, still active binder: send failed reply for transaction 234 to 15675:15681 binder: send failed reply for transaction 236 to 15675:15687 binder: send failed reply for transaction 238, target dead binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: release 15684:15689 transaction 239 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15684:15685 transaction 237 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15684:15685 transaction 235 out, still active binder: undelivered TRANSACTION_COMPLETE binder: 15709:15714 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15709:15714 ioctl 6612 0 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 15715:15716 ioctl 40046207 0 returned -16 binder: 15715:15716 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15715:15716 ioctl 6612 0 returned -22 binder: 15709:15718 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15715:15716 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15715:15716 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15715:15716 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15709:15718 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15709:15718 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15718 RLIMIT_NICE not set binder: 15715:15720 BC_FREE_BUFFER u0000000020ffc000 no match binder: release 15709:15718 transaction 245 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15709:15718 transaction 241 in, still active binder: send failed reply for transaction 241 to 15709:15714 binder: send failed reply for transaction 243 to 15709:15718 binder: send failed reply for transaction 245, target dead binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: 15737:15739 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15737:15739 ioctl 6612 0 returned -22 binder: 15737:15739 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15737:15739 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15737:15739 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15739 RLIMIT_NICE not set binder: release 15715:15720 transaction 246 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15715:15716 transaction 244 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15715:15716 transaction 242 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15737:15739 transaction 249 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15737:15739 transaction 248 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15737:15739 transaction 250 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15737:15739 transaction 248 in, still active binder: send failed reply for transaction 248, target dead binder: send failed reply for transaction 249, target dead binder: send failed reply for transaction 250, target dead binder: BINDER_SET_CONTEXT_MGR already set binder: 15765:15766 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15760:15761 ioctl 40046207 0 returned -16 binder: 15760:15768 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15760:15768 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15760:15768 BC_FREE_BUFFER u0000000020ffc000 no match binder: 15765:15766 ioctl 6612 0 returned -22 binder: 15765:15766 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15765:15766 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15765:15766 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15766 RLIMIT_NICE not set binder: release 15765:15766 transaction 253 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15765:15766 transaction 252 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15765:15766 transaction 252 in, still active binder: send failed reply for transaction 252, target dead binder: send failed reply for transaction 253, target dead binder: 15775:15777 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15775:15777 ioctl 6612 0 returned -22 binder: 15775:15777 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15775:15777 BC_FREE_BUFFER u0000000020ffc000 matched unreturned buffer binder: release 15775:15777 transaction 256 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15775:15777 transaction 255 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 255, target dead binder: send failed reply for transaction 256, target dead binder: BINDER_SET_CONTEXT_MGR already set binder: 15799:15800 ioctl 40046207 0 returned -16 binder: 15791:15795 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15791:15795 ioctl 6612 0 returned -22 binder: 15799:15800 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15799:15800 ioctl 6612 0 returned -22 binder: 15799:15800 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15799:15800 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15799:15800 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15791:15805 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15791:15805 BC_FREE_BUFFER u0000000020ffc000 matched unreturned buffer binder: release 15791:15795 transaction 258 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 258, target dead binder: send failed reply for transaction 261 to 15791:15805 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: 15815:15820 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15815:15820 ioctl 6612 0 returned -22 binder: 15815:15820 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15815:15820 BC_FREE_BUFFER u0000000020ffc000 matched unreturned buffer binder: release 15815:15820 transaction 265 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15815:15820 transaction 264 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 264, target dead binder: send failed reply for transaction 265, target dead audit_printk_skb: 5645 callbacks suppressed audit: type=1400 audit(1575134056.285:390834): avc: denied { sys_admin } for pid=2078 comm="syz-executor.3" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 binder: release 15799:15800 transaction 260 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15799:15800 transaction 259 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15799:15807 transaction 262 out, still active binder: undelivered TRANSACTION_COMPLETE audit: type=1400 audit(1575134056.325:390835): avc: denied { sys_admin } for pid=2074 comm="syz-executor.0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.325:390836): avc: denied { sys_admin } for pid=2074 comm="syz-executor.0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.335:390837): avc: denied { sys_admin } for pid=2074 comm="syz-executor.0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.345:390838): avc: denied { sys_admin } for pid=2074 comm="syz-executor.0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.365:390839): avc: denied { dac_override } for pid=2074 comm="syz-executor.0" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.365:390840): avc: denied { net_admin } for pid=2074 comm="syz-executor.0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.365:390841): avc: denied { net_admin } for pid=2074 comm="syz-executor.0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.365:390842): avc: denied { net_admin } for pid=2074 comm="syz-executor.0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1575134056.365:390843): avc: denied { net_admin } for pid=2074 comm="syz-executor.0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 binder: 15836:15840 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15836:15840 ioctl 6612 0 returned -22 binder: 15836:15840 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15836:15840 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15840 RLIMIT_NICE not set binder: release 15836:15840 transaction 267 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15836:15840 transaction 267 in, still active binder: send failed reply for transaction 267, target dead binder: BINDER_SET_CONTEXT_MGR already set binder: 15846:15848 ioctl 40046207 0 returned -16 binder: 15846:15848 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15846:15848 ioctl 6612 0 returned -22 binder: 15846:15848 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15846:15848 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15846:15848 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15854:15858 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15854:15858 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15854:15858 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15858 RLIMIT_NICE not set binder: release 15854:15858 transaction 272 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15854:15858 transaction 272 in, still active binder: send failed reply for transaction 272, target dead binder: 15864:15865 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15864:15865 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15864:15865 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15865 RLIMIT_NICE not set binder: release 15864:15865 transaction 274 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15864:15865 transaction 274 in, still active binder: send failed reply for transaction 274, target dead binder: release 15846:15848 transaction 269 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15846:15848 transaction 268 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15846:15851 transaction 270 out, still active binder: undelivered TRANSACTION_COMPLETE binder: 15879:15882 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15879:15882 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15879:15894 BC_FREE_BUFFER u0000000020ffc000 no match binder: BINDER_SET_CONTEXT_MGR already set binder: 15895:15896 ioctl 40046207 0 returned -16 binder: 15895:15898 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15895:15898 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: BINDER_SET_CONTEXT_MGR already set binder: 15903:15908 ioctl 40046207 0 returned -16 binder: 15903:15908 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15903:15908 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15903:15908 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15924:15929 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15924:15929 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15924:15937 BC_FREE_BUFFER u0000000020ffc000 no match binder: 15938:15939 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15938:15939 ioctl 6612 0 returned -22 binder: 15938:15939 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15938:15939 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15939 RLIMIT_NICE not set binder: 15938:15950 BC_FREE_BUFFER u0000000020ffc000 matched unreturned buffer binder: release 15903:15908 transaction 276 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15938:15939 transaction 279 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 15938:15939 transaction 279 in, still active binder: send failed reply for transaction 279, target dead binder: BINDER_SET_CONTEXT_MGR already set binder: 15952:15957 ioctl 40046207 0 returned -16 binder: 15952:15961 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15952:15961 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER SELinux: unrecognized netlink message: protocol=4 nlmsg_type=367 sclass=netlink_tcpdiag_socket pig=15960 comm=syz-executor.2 binder: 15978:15983 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15978:15983 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15978:15987 BC_FREE_BUFFER u0000000020ffc000 no match binder: BINDER_SET_CONTEXT_MGR already set binder: 15980:15991 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15980:15991 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 15980:15986 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 15993:15999 ioctl 40046207 0 returned -16 binder: 15993:16003 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 15993:16003 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: BINDER_SET_CONTEXT_MGR already set binder: 16018:16019 ioctl 40046207 0 returned -16 binder: 16020:16021 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 16020:16021 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 16018:16023 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 16018:16023 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 16020:16025 BC_FREE_BUFFER u0000000020ffc000 no match