binder: 13517:13519 BC_FREE_BUFFER u0000000000000000 no match
BUG: unable to handle kernel paging request at ffffed005a332fff
binder: 13517:13547 BC_FREE_BUFFER u0000000000000000 no match
binder: 13517:13547 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3
binder: 13517:13547 BC_DEAD_BINDER_DONE 0000000000000002 not found
binder: 13517:13547 BC_FREE_BUFFER u0000000000000000 no match
binder: 13517:13547 ioctl c0306201 200003c0 returned -14
IP: [<ffffffff81860b3a>] fuse_dev_do_write+0x132a/0x2390 fs/fuse/dev.c:1901
PGD 21fffb067 [  235.474699] PUD 21fff9067 
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 13546 Comm: syz-executor5 Not tainted 4.9.128+ #42
task: ffff8801c970af80 task.stack: ffff8801cd9b0000
RIP: 0010:[<ffffffff81860b3a>]  [<ffffffff81860b3a>] fuse_dev_do_write+0x132a/0x2390 fs/fuse/dev.c:1901
RSP: 0018:ffff8801cd9b7910  EFLAGS: 00010a07
RAX: dffffc0000000000 RBX: ffff8801c8d3e920 RCX: ffff8801d1998000
RDX: 1ffff1005a332fff RSI: ffff8802d1997fff RDI: ffff8801c8d3e9d0
RBP: ffff8801cd9b7ba0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff8801cd9b7bd0 R14: ffff8801d2f78000 R15: 1ffff10039b36f2f
FS:  00007fa962d62700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed005a332fff CR3: 00000001d25a6000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000000000 ffff8801cd9b7bd0 ffff8801c8d3e920 ffff8801c8d3e9d0
 ffffffff00000001 ffff880100001000 ffff8801c8d3e9bc ffff8801d2f78008
 ffff8801c8d3e9c8 ffff8801c8d3e950 ffff8801d2f78010 ffff8801c709d500
Call Trace:
 [<ffffffff818628e2>] fuse_dev_write+0x142/0x1d0 fs/fuse/dev.c:1940
 [<ffffffff81507fa7>] new_sync_write fs/read_write.c:496 [inline]
 [<ffffffff81507fa7>] __vfs_write+0x3d7/0x580 fs/read_write.c:509
 [<ffffffff8150a7f7>] vfs_write+0x187/0x520 fs/read_write.c:557
 [<ffffffff8150e629>] SYSC_write fs/read_write.c:604 [inline]
 [<ffffffff8150e629>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff827f7e53>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 02 84 c0 74 08 3c 03 0f 8e 56 10 00 00 8b 83 b0 00 00 00 83 e8 01 48 8d 34 01 48 b8 00 00 00 00 00 fc ff df 48 89 f2 48 c1 ea 03 <0f> b6 04 02 48 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 ca 0d 00 
RIP  [<ffffffff81860b3a>] fuse_dev_do_write+0x132a/0x2390 fs/fuse/dev.c:1901
 RSP <ffff8801cd9b7910>
CR2: ffffed005a332fff
---[ end trace 2a732f0d81eca804 ]---