binder_alloc: 16547: binder_alloc_buf, no vma
binder: 16547:16553 transaction failed 29189/-3, size 0-0 line 3137
------------[ cut here ]------------
syz-executor0 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
kernel BUG at fs/ext4/inode.c:2462!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 2130 Comm: kworker/u4:2 Not tainted 4.4.161+ #112
binder: 16547:16566 got reply transaction with no transaction stack
binder: 16547:16566 transaction failed 29201/-71, size 0-0 line 2922
Workqueue: writeback wb_workfn (flush-8:0)
task: ffff8800b69797c0 task.stack: ffff8800a8ad0000
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket
RIP: 0010:[<ffffffff816400d0>]  [<ffffffff816400d0>] mpage_prepare_extent_to_map+0x670/0x8e0 fs/ext4/inode.c:2462
RSP: 0018:ffff8800a8ad7330  EFLAGS: 00010293
RAX: ffff8800b69797c0 RBX: ffffea0006ef4280 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff816400d0 RDI: ffffea0006ef4290
RBP: ffff8800a8ad74e8 R08: ffff8800b697a088 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000001 R14: dffffc0000000000 R15: ffff8800a8ad7630
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a3fd98 CR3: 00000001c223d000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 1ffff1001515ae74 ffff8800a8ad73c0 ffff8800a8ad7638 ffff8800a8ad7640
 000000001515ae6c 0007ffffffffffff ffff8801d6d7a3b8 000000090000000c
 0000000000001c00 ffff8800a8ad7400 ffff8800a8ad7648 ffffed001515aec7
Call Trace:
 [<ffffffff8164f32c>] ext4_writepages+0xd4c/0x2c20 fs/ext4/inode.c:2617
 [<ffffffff813d763f>] do_writepages+0xef/0x1d0 mm/page-writeback.c:2334
 [<ffffffff815200f1>] __writeback_single_inode+0x101/0x1340 fs/fs-writeback.c:1285
 [<ffffffff815217db>] writeback_sb_inodes+0x4ab/0xee0 fs/fs-writeback.c:1548
 [<ffffffff8152230b>] __writeback_inodes_wb+0xfb/0x1e0 fs/fs-writeback.c:1617
 [<ffffffff81522919>] wb_writeback+0x529/0xd00 fs/fs-writeback.c:1726
 [<ffffffff81524e73>] wb_do_writeback fs/fs-writeback.c:1858 [inline]
 [<ffffffff81524e73>] wb_workfn+0x243/0x1010 fs/fs-writeback.c:1894
 [<ffffffff81122cb4>] process_one_work+0x824/0x1670 kernel/workqueue.c:2064
 [<ffffffff81123bd9>] worker_thread+0xd9/0x1060 kernel/workqueue.c:2196
 [<ffffffff81134038>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff82705fc5>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510
Code: 48 89 df e8 23 45 d7 ff e9 32 ff ff ff e8 49 6e cc ff 48 89 df e8 b1 5e d7 ff e9 fa fd ff ff e8 37 6e cc ff 0f 0b e8 30 6e cc ff <0f> 0b 31 c0 89 85 b0 fe ff ff e8 21 6e cc ff 8b 85 18 ff ff ff 
RIP  [<ffffffff816400d0>] mpage_prepare_extent_to_map+0x670/0x8e0 fs/ext4/inode.c:2462
 RSP <ffff8800a8ad7330>
audit: type=1400 audit(1540006578.954:27): avc:  denied  { mounton } for  pid=16546 comm="syz-executor5" path="pipe:[6861]" dev="pipefs" ino=6861 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1
---[ end trace 6c621a83409a566d ]---