binder: 3768:3769 transaction failed 29201/-22, size 0-0 line 3011 binder: undelivered TRANSACTION_ERROR: 29201 binder: release 3768:3770 transaction 5 in, still active binder: send failed reply for transaction 5 to 3768:3770 ================================================================== BUG: KASAN: use-after-free in __list_del_entry+0x196/0x1d0 lib/list_debug.c:60 Read of size 8 at addr ffff8801d4b8a210 by task kworker/u4:1/19 CPU: 1 PID: 19 Comm: kworker/u4:1 Not tainted 4.4.125-g38f41ec #21 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: binder binder_deferred_func 0000000000000000 53d1ade78f568b9a ffff8801d949fa58 ffffffff81d067bd ffffea000752e280 ffff8801d4b8a210 0000000000000000 ffff8801d4b8a210 ffffed00390dda89 ffff8801d949fa90 ffffffff814fea83 ffff8801d4b8a210 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] __list_del_entry+0x196/0x1d0 lib/list_debug.c:60 [] list_del_init include/linux/list.h:145 [inline] [] binder_dequeue_work_head_ilocked drivers/android/binder.c:914 [inline] [] binder_dequeue_work_head drivers/android/binder.c:934 [inline] [] binder_release_work+0x6e/0x260 drivers/android/binder.c:4362 [] binder_thread_release+0x425/0x600 drivers/android/binder.c:4570 [] binder_deferred_release drivers/android/binder.c:5111 [inline] [] binder_deferred_func+0x438/0xd10 drivers/android/binder.c:5183 [] process_one_work+0x7d7/0x16e0 kernel/workqueue.c:2064 [] worker_thread+0xd9/0xfc0 kernel/workqueue.c:2196 [] kthread+0x268/0x300 kernel/kthread.c:211 [] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510 Allocated by task 3770: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 [] kmem_cache_alloc_trace+0x100/0x2b0 mm/slub.c:2642 [] kmalloc include/linux/slab.h:476 [inline] [] kzalloc include/linux/slab.h:620 [inline] [] binder_transaction+0x103c/0x7290 drivers/android/binder.c:3063 [] binder_thread_write+0x81f/0x33e0 drivers/android/binder.c:3686 [] binder_ioctl_write_read.isra.55+0x1cf/0xbc0 drivers/android/binder.c:4625 [] binder_ioctl+0xc50/0x12e0 drivers/android/binder.c:4764 [] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline] [] compat_SyS_ioctl+0x28a/0x2540 fs/compat_ioctl.c:1544 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 Freed by task 19: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xfc/0x300 mm/slub.c:3749 [] binder_free_transaction+0x6a/0x90 drivers/android/binder.c:2123 [] binder_send_failed_reply+0x1c9/0x380 drivers/android/binder.c:2162 [] binder_thread_release+0x413/0x600 drivers/android/binder.c:4569 [] binder_deferred_release drivers/android/binder.c:5111 [inline] [] binder_deferred_func+0x438/0xd10 drivers/android/binder.c:5183 [] process_one_work+0x7d7/0x16e0 kernel/workqueue.c:2064 [] worker_thread+0xd9/0xfc0 kernel/workqueue.c:2196 [] kthread+0x268/0x300 kernel/kthread.c:211 [] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510 The buggy address belongs to the object at ffff8801d4b8a200 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 16 bytes inside of 192-byte region [ffff8801d4b8a200, ffff8801d4b8a2c0) The buggy address belongs to the page: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3772 at lib/debugobjects.c:263 debug_print_object+0x17d/0x220 lib/debugobjects.c:260() ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: tick_sched_timer+0x0/0x120 kernel/time/tick-sched.c:124