check_preemption_disabled: 27 callbacks suppressed BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor4/5994 caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 CPU: 0 PID: 5994 Comm: syz-executor4 Not tainted 4.9.80-g20c8a00 #30 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d756f6d8 ffffffff81d94b69 0000000000000000 ffffffff83c18800 ffffffff83f454c0 ffff8801d7bf1800 0000000000000003 ffff8801d756f718 ffffffff81dfc144[ 56.348744] syz-executor1: vmalloc: allocation failure: 15157949456 bytes, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM) [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46 [] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 [] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline] [] ipcomp_init_state+0x188/0x930 net/xfrm/xfrm_ipcomp.c:363 [] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137 [] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2096 [] xfrm_init_state+0x1a/0x20 net/xfrm/xfrm_state.c:2122 [] pfkey_msg2xfrm_state net/key/af_key.c:1289 [inline] [] pfkey_add+0x1fb9/0x3470 net/key/af_key.c:1506 audit: type=1400 audit(1518103842.055:21): avc: denied { create } for pid=6021 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [] pfkey_process+0x68b/0x750 net/key/af_key.c:2834 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [] pfkey_sendmsg+0x3a9/0x760 net/key/af_key.c:3678 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x6d1/0x7e0 net/socket.c:1969 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2003 [] SYSC_sendmsg net/socket.c:2014 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2010 [] entry_SYSCALL_64_fastpath+0x29/0xe8 CPU: 1 PID: 6011 Comm: syz-executor1 Not tainted 4.9.80-g20c8a00 #30 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d7c7f880 ffffffff81d94b69 1ffff1003af8ff13 ffff8801d7ef8000 ffffffff83ab8ea0 0000000000000001 0000000000400000 ffff8801d7c7f990 ffffffff81451ca2 024000c200000003 0000000041b58ab3 ffffffff84195215 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] warn_alloc+0x212/0x240 mm/page_alloc.c:3056 [] __vmalloc_node_range+0x3f5/0x5f0 mm/vmalloc.c:1722 [] __vmalloc_node mm/vmalloc.c:1744 [inline] [] __vmalloc_node_flags mm/vmalloc.c:1758 [inline] [] vmalloc+0x5b/0x70 mm/vmalloc.c:1773 [] xt_alloc_entry_offsets+0x41/0x60 net/netfilter/x_tables.c:722 [] translate_table+0x2da/0x1cd0 net/ipv4/netfilter/arp_tables.c:549 [] ? 0xffffffff810002b8 [] do_replace net/ipv4/netfilter/arp_tables.c:986 [inline] [] do_arpt_set_ctl+0x2b7/0x650 net/ipv4/netfilter/arp_tables.c:1465 [] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline] [] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114 [] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1248 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2740 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2706 [] SYSC_setsockopt net/socket.c:1772 [inline] [] SyS_setsockopt+0x160/0x250 net/socket.c:1751 [] entry_SYSCALL_64_fastpath+0x29/0xe8 Mem-Info: active_anon:52449 inactive_anon:43 isolated_anon:0 active_file:3512 inactive_file:8241 isolated_file:0 unevictable:0 dirty:165 writeback:0 unstable:0 slab_reclaimable:5705 slab_unreclaimable:60402 mapped:24031 shmem:50 pagetables:659 bounce:0 free:1476508 free_pcp:420 free_cma:0 Node 0 active_anon:205680kB inactive_anon:272kB active_file:14048kB inactive_file:32976kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96276kB dirty:672kB writeback:0kB shmem:400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 75776kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no mmap: syz-executor2 (6055) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. DMA free:15908kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 2908 6410 6410 DMA32 free:2980084kB min:30592kB low:38240kB high:45888kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129292kB managed:2980720kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:636kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 3501 3501 Normal free:2909492kB min:36824kB low:46028kB high:55232kB active_anon:210644kB inactive_anon:176kB active_file:14048kB inactive_file:32988kB unevictable:0kB writepending:684kB present:4718592kB managed:3585212kB mlocked:0kB slab_reclaimable:22868kB slab_unreclaimable:241836kB kernel_stack:5408kB pagetables:2524kB bounce:0kB free_pcp:712kB local_pcp:380kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB DMA32: 3*4kB (M) 5*8kB (M) 4*16kB (M) 2*32kB (M) 3*64kB (M) 3*128kB (M) 2*256kB (M) 4*512kB (M) 1*1024kB (M) 1*2048kB (M) 726*4096kB (M) = 2980084kB Normal: 637*4kB (UE) 408*8kB (UME) 176*16kB (UE) 12*32kB (UME) 46*64kB (UME) 2*128kB (UM) 4*256kB (ME) 46*512kB (UME) 48*1024kB (UME) 1*2048kB (E) 689*4096kB (UM) = 2910132kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 13075 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 1965969 pages RAM 0 pages HighMem/MovableOnly 320509 pages reserved syz-executor5 (6069): /proc/6060/oom_adj is deprecated, please use /proc/6060/oom_score_adj instead. audit: type=1400 audit(1518103843.085:22): avc: denied { read } for pid=6141 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'. audit: type=1400 audit(1518103843.695:23): avc: denied { set_context_mgr } for pid=6334 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1518103843.725:24): avc: denied { call } for pid=6338 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1518103843.725:25): avc: denied { transfer } for pid=6338 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: BINDER_SET_CONTEXT_MGR already set binder: 6338:6339 ioctl 40046207 0 returned -16 binder_alloc: binder_alloc_mmap_handler: 6338 20000000-20002000 already mapped failed -16 binder_alloc: 6338: binder_alloc_buf, no vma binder: 6338:6339 transaction failed 29189/-3, size 40-8 line 3127 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 6338:6339 transaction 2 out, still active binder: unexpected work type, 4, not freed binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 2, target dead binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 6334: binder_alloc_buf, no vma binder: 6334:6340 transaction failed 29189/-3, size 0-0 line 3127 binder: 6334:6360 ioctl 40046207 0 returned -16 binder_alloc: 6334: binder_alloc_buf, no vma binder: 6334:6364 transaction failed 29189/-3, size 0-0 line 3127 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 6372:6382 ioctl c0306201 20008fd0 returned -14 binder: 6372:6382 ioctl c0306201 20008fd0 returned -14 random: crng init done device lo entered promiscuous mode device eql entered promiscuous mode device lo left promiscuous mode BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor6/6520 caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 CPU: 0 PID: 6520 Comm: syz-executor6 Not tainted 4.9.80-g20c8a00 #30 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d461f6d8 ffffffff81d94b69 0000000000000000 ffffffff83c18800 ffffffff83f454c0 ffff8801d4839800 0000000000000003 ffff8801d461f718 ffffffff81dfc144 ffff8801d461f730 ffffffff83f454c0 dffffc0000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46 [] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 [] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline] [] ipcomp_init_state+0x188/0x930 net/xfrm/xfrm_ipcomp.c:363 [] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137 [] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2096 [] xfrm_init_state+0x1a/0x20 net/xfrm/xfrm_state.c:2122 [] pfkey_msg2xfrm_state net/key/af_key.c:1289 [inline] [] pfkey_add+0x1fb9/0x3470 net/key/af_key.c:1506 [] pfkey_process+0x68b/0x750 net/key/af_key.c:2834 [] pfkey_sendmsg+0x3a9/0x760 net/key/af_key.c:3678 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x6d1/0x7e0 net/socket.c:1969 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2003 [] SYSC_sendmsg net/socket.c:2014 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2010 [] entry_SYSCALL_64_fastpath+0x29/0xe8 BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor6/6549 caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 CPU: 0 PID: 6549 Comm: syz-executor6 Not tainted 4.9.80-g20c8a00 #30 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801adcf76d8 ffffffff81d94b69 0000000000000000 ffffffff83c18800 ffffffff83f454c0 ffff8801d38eb000 0000000000000003 ffff8801adcf7718 ffffffff81dfc144 ffff8801adcf7730 ffffffff83f454c0 dffffc0000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46 [] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62 [] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline] [] ipcomp_init_state+0x188/0x930 net/xfrm/xfrm_ipcomp.c:363 [] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137 [] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2096 [] xfrm_init_state+0x1a/0x20 net/xfrm/xfrm_state.c:2122 [] pfkey_msg2xfrm_state net/key/af_key.c:1289 [inline] [] pfkey_add+0x1fb9/0x3470 net/key/af_key.c:1506 [] pfkey_process+0x68b/0x750 net/key/af_key.c:2834 [] pfkey_sendmsg+0x3a9/0x760 net/key/af_key.c:3678 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x6d1/0x7e0 net/socket.c:1969 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2003 [] SYSC_sendmsg net/socket.c:2014 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2010 [] entry_SYSCALL_64_fastpath+0x29/0xe8 device gre0 entered promiscuous mode device lo entered promiscuous mode device lo left promiscuous mode binder: 6616:6620 got new transaction with bad transaction stack, transaction 12 has target 6616:0 binder: 6616:6620 transaction failed 29201/-71, size 0-0 line 3031 binder: BINDER_SET_CONTEXT_MGR already set binder: 6616:6640 ioctl 40046207 0 returned -16 binder_alloc: 6616: binder_alloc_buf, no vma binder: 6616:6620 transaction failed 29189/-3, size 0-0 line 3127 binder_alloc: 6616: binder_alloc_buf, no vma binder: 6616:6640 transaction failed 29189/-3, size 0-0 line 3127 tc_dump_action: action bad kind tc_dump_action: action bad kind binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: release 6616:6620 transaction 12 out, still active binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: send failed reply for transaction 12, target dead IPVS: length: 24 != 3145848 IPVS: length: 24 != 3145848 audit: type=1400 audit(1518103846.385:26): avc: denied { setgid } for pid=6813 comm="syz-executor5" capability=6 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'. binder: 6845:6870 unknown command 0 binder: 6845:6870 ioctl c0306201 20bc3000 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 6845:6870 ioctl 40046207 0 returned -16 binder_alloc: 6845: binder_alloc_buf, no vma binder: 6845:6873 transaction failed 29189/-3, size 0-0 line 3127 binder: 6845:6873 unknown command 0 binder: 6845:6873 ioctl c0306201 20bc3000 returned -22 binder: release 6845:6855 transaction 21 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 21, target dead audit: type=1400 audit(1518103847.185:27): avc: denied { create } for pid=7022 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_rdma_socket permissive=1 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. binder_alloc: binder_alloc_mmap_handler: 7081 2033d000-2033e000 already mapped failed -16 syz-executor0 (7133) used greatest stack depth: 23296 bytes left binder: 7194:7196 ioctl 890b 20901000 returned -22 binder_alloc: binder_alloc_mmap_handler: 7194 20000000-20002000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 7194:7196 ioctl 40046207 0 returned -16 binder_alloc: 7194: binder_alloc_buf, no vma binder: 7194:7214 transaction failed 29189/-3, size 40-0 line 3127 binder: 7194:7218 ioctl 890b 20901000 returned -22 binder_alloc: 7194: binder_alloc_buf, no vma binder: 7194:7218 transaction failed 29189/-3, size 0-0 line 3127 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_COMPLETE binder: undelivered transaction 25, process died. binder: undelivered transaction 24, process died. FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 1 PID: 7238 Comm: syz-executor6 Not tainted 4.9.80-g20c8a00 #30 audit: type=1400 audit(1518103848.135:28): avc: denied { getopt } for pid=7256 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801ce58f8a0[ 62.562623] audit: type=1400 audit(1518103848.175:29): avc: denied { ioctl } for pid=7256 comm="syz-executor5" path="socket:[17261]" dev="sockfs" ino=17261 ioctlcmd=0x4b31 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1518103848.175:30): avc: denied { getattr } for pid=7256 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 ffffffff81d94b69 ffff8801ce58fb80 0000000000000000 ffff8801d0107790 ffff8801ce58fa70 ffff8801d0107680 ffff8801ce58fa98 ffffffff816624ba 0000000000001244 ffff8801cf3388f0 ffff8801cf3388a0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323 audit: type=1400 audit(1518103848.285:31): avc: denied { setopt } for pid=7293 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055 [] entry_SYSCALL_64_fastpath+0x29/0xe8 netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. keychord: invalid keycode count 0 audit: type=1400 audit(1518103849.035:32): avc: denied { validate_trans } for pid=7471 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1 netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. audit: type=1400 audit(1518103849.145:33): avc: denied { create } for pid=7500 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_iscsi_socket permissive=1 PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. binder: send failed reply for transaction 29 to 7525:7535 binder: BINDER_SET_CONTEXT_MGR already set binder: 7525:7528 ioctl 40046207 0 returned -16 binder_alloc: 7525: binder_alloc_buf, no vma binder: 7525:7535 transaction failed 29189/-3, size 0-0 line 3127 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 device gre0 entered promiscuous mode binder_alloc: binder_alloc_mmap_handler: 7636 20000000-20002000 already mapped failed -16 FAULT_FLAG_ALLOW_RETRY missing 30 CPU: 0 PID: 7761 Comm: syz-executor5 Not tainted 4.9.80-g20c8a00 #30 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801cedc78a0 ffffffff81d94b69 ffff8801cedc7b80 0000000000000000 ffff8801da372410 ffff8801cedc7a70 ffff8801da372300 ffff8801cedc7a98 ffffffff816624ba 0000000000001244 ffff8801cc0e08f0 ffff8801cc0e08a0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323 [] do_anonymous_page mm/memory.c:2747 [inline] [] handle_pte_fault mm/memory.c:3488 [inline] [] __handle_mm_fault mm/memory.c:3577 [inline] [] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614 [] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407 [] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470 [] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055 [] entry_SYSCALL_64_fastpath+0x29/0xe8 binder: 7814:7819 transaction failed 29189/-22, size 0-0 line 3004 audit: type=1400 audit(1518103850.395:34): avc: denied { accept } for pid=7805 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 binder: 7814:7831 transaction failed 29189/-22, size 0-0 line 3004 binder: 7814:7831 transaction failed 29189/-22, size 0-0 line 3004 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 7832:7834 transaction failed 29189/-22, size 56-5 line 3004 binder: 7832:7853 transaction failed 29189/-22, size 56-5 line 3004 binder: 7854:7859 got transaction with invalid offsets ptr binder: 7854:7859 transaction failed 29201/-14, size 0-4096 line 3155 binder: BINDER_SET_CONTEXT_MGR already set binder: 7854:7868 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18032 sclass=netlink_route_socket pig=7995 comm=syz-executor0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=18032 sclass=netlink_route_socket pig=7995 comm=syz-executor0