================================================ WARNING: lock held when returning to user space! 4.18.0+ #196 Not tainted ------------------------------------------------ syz-executor3/7753 is leaving the kernel with locks still held! 1 lock held by syz-executor3/7753: #0: 00000000f607379a (&fi->mutex){+.+.}, at: fuse_lock_inode+0xaf/0xe0 fs/fuse/inode.c:363 dccp_invalid_packet: P.Data Offset(66) too large binder_alloc: binder_alloc_mmap_handler: 7806 20001000-20004000 already mapped failed -16 dccp_invalid_packet: P.Data Offset(66) too large binder: BINDER_SET_CONTEXT_MGR already set binder: 7806:7808 ioctl 40046207 0 returned -16 binder_alloc: 7806: binder_alloc_buf, no vma dccp_invalid_packet: P.Data Offset(66) too large dccp_invalid_packet: P.Data Offset(66) too large binder_alloc: binder_alloc_mmap_handler: 7858 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 7858:7859 ioctl 40046207 0 returned -16 binder_alloc: 7858: binder_alloc_buf, no vma dccp_invalid_packet: P.Data Offset(66) too large dccp_invalid_packet: P.Data Offset(66) too large binder_alloc: binder_alloc_mmap_handler: 7890 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 7890:7893 ioctl 40046207 0 returned -16 dccp_invalid_packet: P.Data Offset(66) too large binder_alloc: 7890: binder_alloc_buf, no vma binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 7940: binder_alloc_buf, no vma binder: 7940:7941 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 7967: binder_alloc_buf, no vma binder: 7967:7974 ioctl 40046207 0 returned -16 binder_transaction: 15 callbacks suppressed binder: 8017:8019 transaction failed 29201/-22, size 0-0 line 2970 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8017: binder_alloc_buf, no vma binder: 8017:8037 transaction failed 29189/-3, size 0-0 line 2970 binder: 8017:8036 ioctl 40046207 0 returned -16 binder: 8061:8062 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc_mmap_handler: 3 callbacks suppressed binder_alloc: binder_alloc_mmap_handler: 8061 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8061:8062 ioctl 40046207 0 returned -16 binder_release_work: 15 callbacks suppressed binder: undelivered TRANSACTION_ERROR: 29201 binder: 8086:8087 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8086 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8086:8087 ioctl 40046207 0 returned -16 binder: 8086:8091 transaction failed 29189/-3, size 0-0 line 2970 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: 8113:8115 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8113 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8113:8115 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: 8143:8153 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8143 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8143:8153 ioctl 40046207 0 returned -16 binder: 8143:8161 transaction failed 29189/-3, size 0-0 line 2970 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: 8189:8190 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8189 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8189:8203 transaction failed 29189/-3, size 0-0 line 2970 binder: 8189:8190 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder_alloc: binder_alloc_mmap_handler: 8221 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc_new_buf_locked: 3 callbacks suppressed binder_alloc: 8221: binder_alloc_buf, no vma binder: 8221:8222 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder_alloc: binder_alloc_mmap_handler: 8264 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8264:8265 ioctl 40046207 0 returned -16 binder_alloc: 8264: binder_alloc_buf, no vma binder_alloc: binder_alloc_mmap_handler: 8289 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8289:8290 ioctl 40046207 0 returned -16 binder_alloc: binder_alloc_mmap_handler: 8315 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8315:8317 ioctl 40046207 0 returned -16 binder_alloc: 8315: binder_alloc_buf, no vma binder_alloc: binder_alloc_mmap_handler: 8353 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8353:8359 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8391: binder_alloc_buf, no vma binder: 8391:8392 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8413: binder_alloc_buf, no vma binder: 8413:8414 ioctl 40046207 0 returned -16 sctp: [Deprecated]: syz-executor7 (pid 8435) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor7 (pid 8435) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8450: binder_alloc_buf, no vma binder: 8450:8451 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8477: binder_alloc_buf, no vma binder: 8477:8478 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8497: binder_alloc_buf, no vma binder: 8497:8498 ioctl 40046207 0 returned -16 binder_alloc: 8516: binder_alloc_buf, no vma binder: BINDER_SET_CONTEXT_MGR already set binder: 8516:8518 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 8550: binder_alloc_buf, no vma binder: 8550:8551 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8570:8571 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8586:8587 ioctl 40046207 0 returned -16 binder: BINDER_SET_CONTEXT_MGR already set binder_transaction: 27 callbacks suppressed binder: 8616:8631 transaction failed 29189/-3, size 0-0 line 2970 binder: 8616:8617 ioctl 40046207 0 returned -16 binder: 8652:8653 transaction failed 29201/-22, size 0-0 line 2970 binder: BINDER_SET_CONTEXT_MGR already set binder: 8652:8658 transaction failed 29189/-3, size 0-0 line 2970 binder: 8652:8653 ioctl 40046207 0 returned -16 binder: 8666:8668 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc_mmap_handler: 11 callbacks suppressed binder_alloc: binder_alloc_mmap_handler: 8666 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8666:8668 ioctl 40046207 0 returned -16 binder: 8666:8680 transaction failed 29189/-3, size 0-0 line 2970 binder_release_work: 28 callbacks suppressed binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: 8710:8712 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8710 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8710:8712 ioctl 40046207 0 returned -16 binder: 8710:8730 transaction failed 29189/-3, size 0-0 line 2970 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: 8742:8743 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8742 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8742:8743 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: 8782:8783 transaction failed 29201/-22, size 0-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8782 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8782:8783 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: 8821:8823 transaction failed 29201/-22, size 1207959552-0 line 2970 binder_alloc: binder_alloc_mmap_handler: 8821 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8821:8823 ioctl 40046207 0 returned -16 binder_alloc_new_buf_locked: 6 callbacks suppressed binder_alloc: 8821: binder_alloc_buf, no vma binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder_alloc: binder_alloc_mmap_handler: 8872 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8872:8875 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder_alloc: binder_alloc_mmap_handler: 8897 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8897:8898 ioctl 40046207 0 returned -16 binder_alloc: 8897: binder_alloc_buf, no vma binder: undelivered TRANSACTION_ERROR: 29201 binder_alloc: binder_alloc_mmap_handler: 8914 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 8914:8915 ioctl 40046207 0 returned -16