===================================== [ BUG: bad unlock balance detected! ] 4.9.67-gf26d3c7 #106 Not tainted ------------------------------------- syz-executor6/29588 is trying to release lock ([ 169.941439] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=13 sclass=netlink_route_socket pig=29595 comm=syz-executor5 mrt_lock) at: but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor6/29588: #0: (&p->lock){+.+.+.}, at: [] seq_read+0xdd/0x1290 fs/seq_file.c:178 stack backtrace: CPU: 0 PID: 29588 Comm: syz-executor6 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c95278e8 ffffffff81d906e9 ffffffff849ae8f8 ffff8801cd76e000 ffffffff834dec54 ffffffff849ae8f8 ffff8801cd76e888 ffff8801c9527918 ffffffff812353f4 dffffc0000000000 ffffffff849ae8f8 00000000ffffffff Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_unlock_imbalance_bug+0x174/0x1a0 kernel/locking/lockdep.c:3398 [] __lock_release kernel/locking/lockdep.c:3540 [inline] [] lock_release+0x6f8/0xb80 kernel/locking/lockdep.c:3775 [] __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline] [] _raw_read_unlock+0x1a/0x50 kernel/locking/spinlock.c:255 [] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553 [] seq_read+0xa83/0x1290 fs/seq_file.c:283 [] proc_reg_read+0xef/0x170 fs/proc/inode.c:202 [] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714 [] do_loop_readv_writev fs/read_write.c:880 [inline] [] do_readv_writev+0x520/0x750 fs/read_write.c:874 [] vfs_readv+0x84/0xc0 fs/read_write.c:898 [] do_readv+0xe6/0x250 fs/read_write.c:924 [] SYSC_readv fs/read_write.c:1011 [inline] [] SyS_readv+0x27/0x30 fs/read_write.c:1008 [] entry_SYSCALL_64_fastpath+0x23/0xc6 netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'. SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=29669 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=29669 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=29669 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=29690 comm=syz-executor5 netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. device gre0 entered promiscuous mode binder: 29847:29848 ioctl c0086420 20ee6000 returned -22 netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. ALSA: seq fatal error: cannot create timer (-22) netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. ALSA: seq fatal error: cannot create timer (-22) binder: 29847:29868 ERROR: BC_REGISTER_LOOPER called without request binder_alloc: 29847: binder_alloc_buf, no vma binder: 29847:29848 transaction failed 29189/-3, size 0-0 line 3130 binder: 29847:29883 ioctl c0086420 20ee6000 returned -22 binder: BINDER_SET_CONTEXT_MGR already set device gre0 entered promiscuous mode binder: 29847:29848 ERROR: BC_REGISTER_LOOPER called without request binder: 29847:29883 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29189 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26952 sclass=netlink_route_socket pig=29971 comm=syz-executor6 device gre0 entered promiscuous mode binder: 29975:29976 got reply transaction with no transaction stack binder: 29975:29976 transaction failed 29201/-71, size 0-8 line 2923 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26952 sclass=netlink_route_socket pig=29971 comm=syz-executor6 binder: 29975:29976 ioctl c018620b 2000bfe8 returned -14 binder: 29975:29980 got reply transaction with no transaction stack binder: 29975:29980 transaction failed 29201/-71, size 0-8 line 2923 binder: BINDER_SET_CONTEXT_MGR already set binder: 29975:29976 ioctl 40046207 0 returned -16 binder: 29975:29990 unknown command 0 binder: 29975:29990 ioctl c0306201 20007000 returned -22 binder_alloc: 29975: binder_alloc_buf, no vma binder: 29975:29980 transaction failed 29189/-3, size 0-0 line 3130 binder: 29975:29980 ioctl c018620b 2000bfe8 returned -14 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 29975:29976 transaction 433 out, still active binder: release 29975:29976 transaction 432 in, still active device gre0 entered promiscuous mode device lo entered promiscuous mode binder: undelivered TRANSACTION_COMPLETE binder: release 29975:29980 transaction 432 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 433, target dead binder: send failed reply for transaction 432, target dead device lo left promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode binder: 30091:30093 got reply transaction with no transaction stack binder: 30091:30093 transaction failed 29201/-71, size 2-1144397507205 line 2923 binder: 30091:30104 BC_INCREFS_DONE uffffffffffffffff no match binder: 30091:30104 got transaction to invalid handle binder: 30091:30104 transaction failed 29201/-22, size 40-16 line 3007 binder: send failed reply for transaction 439 to 30091:30104 binder: 30091:30093 ioctl c0306201 2000efd0 returned -14 binder: 30091:30093 ioctl 541b 20010000 returned -22 binder: 30091:30104 got reply transaction with no transaction stack binder: 30091:30104 transaction failed 29201/-71, size 2-1144397507205 line 2923 binder: BINDER_SET_CONTEXT_MGR already set binder: 30091:30093 ioctl 40046207 0 returned -16 binder: 30091:30104 BC_INCREFS_DONE uffffffffffffffff no match binder: 30091:30104 got transaction to invalid handle binder: 30091:30104 transaction failed 29201/-22, size 40-16 line 3007 binder_alloc: 30091: binder_alloc_buf, no vma binder: 30091:30127 transaction failed 29189/-3, size 0-0 line 3130 binder: 30091:30127 ioctl 541b 20010000 returned -22 binder: 30091:30104 ioctl c0306201 20003000 returned -14 binder: undelivered TRANSACTION_ERROR: 29189 IPVS: Creating netns size=2536 id=41 keychord: invalid keycode count 0 keychord: invalid keycode count 0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=30261 comm=syz-executor2 pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads sock: process `syz-executor5' is using obsolete setsockopt SO_BSDCOMPAT binder: 30286:30289 ERROR: BC_REGISTER_LOOPER called without request binder_alloc: 30286: binder_alloc_buf, no vma binder: 30286:30303 transaction failed 29189/-3, size 0-0 line 3130 binder: BINDER_SET_CONTEXT_MGR already set binder: 30286:30326 ioctl 40046207 0 returned -16 binder: 30286:30326 BC_ACQUIRE_DONE node 443 has no pending acquire request binder: 30286:30326 got reply transaction with no transaction stack binder: 30286:30326 transaction failed 29201/-71, size 48-40 line 2923 binder: BINDER_SET_CONTEXT_MGR already set binder: 30286:30289 ioctl 40046207 0 returned -16 binder: 30286:30348 ERROR: BC_REGISTER_LOOPER called without request binder_alloc: 30286: binder_alloc_buf, no vma binder: 30286:30326 transaction failed 29189/-3, size 0-0 line 3130 binder: 30368:30369 ERROR: BC_REGISTER_LOOPER called without request binder: BINDER_SET_CONTEXT_MGR already set binder: 30286:30348 ioctl 40046207 0 returned -16 binder: 30286:30348 BC_ACQUIRE_DONE u0000000000000000 no match binder: 30286:30348 got reply transaction with no transaction stack binder: 30286:30348 transaction failed 29201/-71, size 48-40 line 2923 device eql entered promiscuous mode binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 device lo entered promiscuous mode binder: BINDER_SET_CONTEXT_MGR already set binder: 30368:30392 ioctl 40046207 0 returned -16 binder: 30368:30381 ERROR: BC_REGISTER_LOOPER called without request SELinux: unrecognized netlink message: protocol=6 nlmsg_type=64 sclass=netlink_xfrm_socket pig=30397 comm=syz-executor6 IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready device lo left promiscuous mode SELinux: unrecognized netlink message: protocol=6 nlmsg_type=64 sclass=netlink_xfrm_socket pig=30397 comm=syz-executor6 binder: 30415:30416 BC_DEAD_BINDER_DONE 0000000000000003 not found binder: 30415:30416 BC_INCREFS_DONE u000000002011a000 no match binder: 30415:30416 got transaction with invalid parent offset or type binder: 30415:30416 transaction failed 29201/-22, size 32-24 line 3253 binder: 30415:30416 got transaction with unaligned buffers size, 58534 binder: 30415:30416 transaction failed 29201/-22, size 0-40 line 3175 binder_alloc: binder_alloc_mmap_handler: 30415 2011a000-2051a000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 30415:30417 ioctl 40046207 0 returned -16 binder: 30415:30417 unknown command 0 binder: 30415:30417 ioctl c0306201 20004000 returned -22 binder_alloc: 30415: binder_alloc_buf, no vma binder: 30415:30416 transaction failed 29189/-3, size 0-40 line 3130 binder: undelivered TRANSACTION_ERROR: 29201 device lo entered promiscuous mode device lo left promiscuous mode FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 30434 Comm: syz-executor7 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801a653f6c0 ffffffff81d906e9 ffff8801a653f9a0 0000000000000000 ffff8801cea15610 ffff8801a653f890 ffff8801cea15500 ffff8801a653f8b8 ffffffff8165e307 1ffff10034ca7edc ffff8801a653f810 00000001cb6e9067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] process_vm_rw+0x1bf/0x210 mm/process_vm_access.c:280 [] SYSC_process_vm_writev mm/process_vm_access.c:307 [inline] [] SyS_process_vm_writev+0x47/0x60 mm/process_vm_access.c:302 [] entry_SYSCALL_64_fastpath+0x23/0xc6 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 30431 Comm: syz-executor7 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c6e07820 ffffffff81d906e9 ffff8801c6e07b00 0000000000000000 ffff8801cea15610 ffff8801c6e079f0 ffff8801cea15500 ffff8801c6e07a18 ffffffff8165e307 ffff8801a542b000 ffff8801c6e07970 00000001cb6e9067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] removexattr+0x8d/0x130 fs/xattr.c:689 [] SYSC_fremovexattr fs/xattr.c:742 [inline] [] SyS_fremovexattr+0x10e/0x160 fs/xattr.c:732 [] entry_SYSCALL_64_fastpath+0x23/0xc6 CPU: 0 PID: 30455 Comm: syz-executor7 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d56a7860 ffffffff81d906e9 ffff8801d56a7b40 0000000000000000 ffff8801cea15610 ffff8801d56a7a30 ffff8801cea15500 ffff8801d56a7a58 ffffffff8165e307 ffffffff811b6f31 ffff8801d56a79b0 00000001cb6e9067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] SyS_rt_sigtimedwait+0x2d/0x40 kernel/signal.c:2819 [] entry_SYSCALL_64_fastpath+0x23/0xc6 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=32 sclass=netlink_tcpdiag_socket pig=30533 comm=syz-executor4 nla_parse: 4 callbacks suppressed netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. binder: 30594:30599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 netlink: 2 bytes leftover after parsing attributes in process `syz-executor4'. binder: 30594:30615 BC_DEAD_BINDER_DONE 0000000000000003 not found binder: 30594:30615 Release 1 refcount change on invalid ref 0 ret -22 binder: 30594:30615 got transaction to invalid handle binder: 30594:30615 transaction failed 29201/-22, size 24-16 line 3007 netlink: 2 bytes leftover after parsing attributes in process `syz-executor4'. binder: 30594:30615 BC_DEAD_BINDER_DONE 0000000000000003 not found binder: 30594:30615 Release 1 refcount change on invalid ref 0 ret -22 binder: 30594:30615 got transaction to invalid handle binder: 30594:30615 transaction failed 29201/-22, size 24-16 line 3007 device gre0 entered promiscuous mode device gre0 entered promiscuous mode device gre0 entered promiscuous mode binder_alloc: binder_alloc_mmap_handler: 30767 20000000-20002000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 30767:30768 ioctl 40046207 0 returned -16 netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. FAULT_FLAG_ALLOW_RETRY missing 31 CPU: 1 PID: 30841 Comm: syz-executor4 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c6dc7870 ffffffff81d906e9 ffff8801c6dc7b50 0000000000000000 ffff8801a6075f10 ffff8801c6dc7a40 ffff8801a6075e00 ffff8801c6dc7a68 ffffffff8165e307 ffff8801c6dc78a0 ffffffff811b890d 0000000006ddf740 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2783 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1f82/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] SYSC_getrandom drivers/char/random.c:1899 [inline] [] SyS_getrandom+0x165/0x2a0 drivers/char/random.c:1880 [] entry_SYSCALL_64_fastpath+0x23/0xc6 netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. device lo left promiscuous mode binder: 30978:30984 transaction failed 29189/-22, size 80-32 line 3007 binder: 30978:30984 transaction failed 29189/-22, size 80-32 line 3007 device lo entered promiscuous mode device lo left promiscuous mode FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 31055 Comm: syz-executor3 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d8f97850 ffffffff81d906e9 ffff8801d8f97b30 0000000000000000 ffff8801a6074a10 ffff8801d8f97a20 ffff8801a6074900 ffff8801d8f97a48 ffffffff8165e307 ffff8801d8f978b8 ffff8801d8f979a0 00000001cd360067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] do_fcntl fs/fcntl.c:284 [inline] [] SYSC_fcntl fs/fcntl.c:372 [inline] [] SyS_fcntl+0x81c/0xc70 fs/fcntl.c:357 [] entry_SYSCALL_64_fastpath+0x23/0xc6 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 31063 Comm: syz-executor3 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cff07850 ffffffff81d906e9 ffff8801cff07b30 0000000000000000 ffff8801d8fb5d90 ffff8801cff07a20 ffff8801d8fb5c80 ffff8801cff07a48 ffffffff8165e307 ffff8801a9114800 0000000000000000 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] do_fcntl fs/fcntl.c:284 [inline] [] SYSC_fcntl fs/fcntl.c:372 [inline] [] SyS_fcntl+0x81c/0xc70 fs/fcntl.c:357 [] entry_SYSCALL_64_fastpath+0x23/0xc6 netlink: 2 bytes leftover after parsing attributes in process `syz-executor2'. selinux_nlmsg_perm: 1 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=13 sclass=netlink_route_socket pig=31150 comm=syz-executor2 netlink: 2 bytes leftover after parsing attributes in process `syz-executor2'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=13 sclass=netlink_route_socket pig=31150 comm=syz-executor2 FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 31266 Comm: syz-executor0 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801a66378a0 ffffffff81d906e9 ffff8801a6637b80 0000000000000000 ffff8801d8fb5f10 ffff8801a6637a70 ffff8801d8fb5e00 ffff8801a6637a98 ffffffff8165e307 ffff8801a449d500 ffff8801a66379f0 00000001a662c067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 CPU: 1 PID: 31291 Comm: syz-executor0 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801ccd879a0 ffffffff81d906e9 ffff8801ccd87c80 0000000000000000 ffff8801d8fb5f10 ffff8801ccd87b70 ffff8801d8fb5e00 ffff8801ccd87b98 ffffffff8165e307 0000000000000282 ffff8801ccd87af0 00000001a662c067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 FAULT_FLAG_ALLOW_RETRY missing 30 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 31277 Comm: syz-executor0 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801a96c76c0 ffffffff81d906e9 ffff8801a96c79a0 0000000000000000 ffff8801d8fb5790 ffff8801a96c7890 ffff8801d8fb5680 ffff8801a96c78b8 ffffffff8165e307 1ffff100352d8edc ffff8801a96c7810 00000001a662c067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] sock_do_ioctl+0x94/0xb0 net/socket.c:899 [] sock_ioctl+0x2e0/0x3d0 net/socket.c:978 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679 [] SYSC_ioctl fs/ioctl.c:694 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 [] entry_SYSCALL_64_fastpath+0x23/0xc6 CPU: 1 PID: 31341 Comm: syz-executor0 Not tainted 4.9.67-gf26d3c7 #106 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cb9e79a0 ffffffff81d906e9 ffff8801cb9e7c80 0000000000000000 ffff8801d8fb5790 ffff8801cb9e7b70 ffff8801d8fb5680 ffff8801cb9e7b98 ffffffff8165e307 0000000000000000 ffff8801cb9e7af0 00000001a662c067 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa37/0x1300 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1012 [] entry_SYSCALL_64_fastpath+0x23/0xc6 netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3284 sclass=netlink_route_socket pig=31516 comm=syz-executor4 IPVS: Creating netns size=2536 id=42 device gre0 left promiscuous mode binder: 31651:31652 ioctl c0306201 20008fd0 returned -14 binder: 31651:31652 ioctl c018620b 20000fe8 returned -14 binder_alloc: binder_alloc_mmap_handler: 31651 20000000-20002000 already mapped failed -16 binder: 31651:31652 ioctl c0306201 20008fd0 returned -14 binder: 31651:31652 ioctl c018620b 20000fe8 returned -14 pktgen: kernel_thread() failed for cpu 0 pktgen: Cannot create thread for cpu 0 (-4) pktgen: kernel_thread() failed for cpu 1 pktgen: Cannot create thread for cpu 1 (-4) pktgen: Initialization failed for all threads devpts: called with bogus options devpts: called with bogus options device gre0 entered promiscuous mode binder: 31688:31689 got transaction with too large buffer binder: 31688:31689 transaction failed 29201/-22, size 80-16 line 3289 binder: BINDER_SET_CONTEXT_MGR already set nla_parse: 6 callbacks suppressed netlink: 11 bytes leftover after parsing attributes in process `syz-executor4'. device gre0 entered promiscuous mode binder: 31688:31702 ioctl 40046207 0 returned -16 binder_alloc: 31688: binder_alloc_buf, no vma binder: 31688:31689 transaction failed 29189/-3, size 80-16 line 3130 netlink: 11 bytes leftover after parsing attributes in process `syz-executor4'. binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 keychord: invalid keycode count 0 keychord: invalid keycode count 0 netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'.