audit: type=1400 audit(1542313867.420:392): avc: denied { search } for pid=469 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1542313867.450:393): avc: denied { search } for pid=580 comm="udevd" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:vhost_device_t:s0 tclass=dir permissive=1 audit: type=1400 audit(1542313867.510:394): avc: denied { create } for pid=18889 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 binder: 18876:18883 ioctl 40045568 c returned -22 INFO: task syz-executor5:7258 blocked for more than 140 seconds. binder: 18876:18885 ioctl 40046207 0 returned -16 binder: 18876:18883 Release 1 refcount change on invalid ref 0 ret -22 binder_alloc: 18876: binder_alloc_buf, no vma binder: undelivered TRANSACTION_ERROR: 29201 binder: 18876:18884 transaction failed 29189/-3, size 0-8 line 3137 Not tainted 4.4.163+ #122 binder: undelivered TRANSACTION_ERROR: 29189 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor5 D binder: 18896:18902 ioctl 40087602 200001c0 returned -22 ffff8801c0a4f8e0 binder: 18896:18902 unknown command 10295052 29712 7258 7257 0x00000000 ffff8801c0a4f8e0 ffff8801c0a4f8c0 ffff8801cfeea0c8 ffffffff83acf190 ffff8801cfeea000 ffff8801db71f180 ffff8801db71f1a8 ffff8801db71e898 ffff8801db71e880 ffff8801da6897c0 ffff8801cfee97c0 0000000000000000 binder: 18896:18902 ioctl c0306201 20000140 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 18896:18911 ioctl 40046207 0 returned -16 binder: 18896:18902 ioctl 40087602 200001c0 returned -22 binder: 18896:18911 unknown command 10295052 Call Trace: binder: BINDER_SET_CONTEXT_MGR already set [] schedule+0x7a/0x1b0 kernel/sched/core.c:3355 binder: 18896:18924 Release 1 refcount change on invalid ref 1 ret -22 [] schedule_timeout+0x481/0x7b0 kernel/time/timer.c:1515 binder_alloc: 18896: binder_alloc_buf, no vma binder: 18896:18902 transaction failed 29189/-3, size 24-8 line 3137 binder: 18896:18904 ioctl 40046207 0 returned -16 [] down_read_failed+0x294/0x580 drivers/tty/tty_ldsem.c:241 [] __ldsem_down_read_nested drivers/tty/tty_ldsem.c:332 [inline] [] ldsem_down_read+0x94/0xc0 drivers/tty/tty_ldsem.c:367 [] tty_ldisc_ref_wait+0x2b/0xb0 drivers/tty/tty_ldisc.c:263 [] tty_ioctl+0x3a7/0x2090 drivers/tty/tty_io.c:2988 [] vfs_ioctl fs/ioctl.c:43 [inline] [] file_ioctl fs/ioctl.c:470 [inline] [] do_vfs_ioctl+0x63f/0xf40 fs/ioctl.c:605 [] SYSC_ioctl fs/ioctl.c:622 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [] entry_SYSCALL_64_fastpath+0x1e/0x9a binder: 18896:18911 ioctl c0306201 20000140 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 18896:18922 ioctl 40046207 0 returned -16 binder: send failed reply for transaction 694 to 18896:18904 binder: undelivered TRANSACTION_ERROR: 29189 binder: 18928:18931 got transaction with invalid offset (0, min 0 max 0) or object. binder: 18928:18936 unknown command 33841948 binder: 18928:18931 transaction failed 29201/-22, size 0-8 line 3200 binder: 18928:18936 ioctl c0306201 20000380 returned -22 binder_alloc: binder_alloc_mmap_handler: 18928 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 18928:18931 ioctl 40046207 0 returned -16 binder_alloc: 18928: binder_alloc_buf, no vma binder: undelivered TRANSACTION_ERROR: 29201 binder: 18928:18941 transaction failed 29189/-3, size 0-8 line 3137 binder: undelivered TRANSACTION_ERROR: 29189 binder: 18943:18944 ioctl 40087602 200001c0 returned -22 binder: 18943:18944 unknown command -989568244 binder: 18943:18944 ioctl c0306201 20000140 returned -22 binder: 18943:18954 BC_INCREFS_DONE node 703 has no pending increfs request binder: BINDER_SET_CONTEXT_MGR already set binder: 18963:18965 ioctl 40046207 0 returned -16 binder: 18963:18966 got transaction with invalid offset (0, min 0 max 0) or object. binder: 18963:18966 transaction failed 29201/-22, size 0-8 line 3200 binder_alloc: binder_alloc_mmap_handler: 18963 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 18963:18965 ioctl 40046207 0 returned -16 binder: 18943:18954 ioctl 40087602 200001c0 returned -22 binder: 18963:18966 got transaction with invalid offset (0, min 0 max 0) or object. binder_alloc: binder_alloc_mmap_handler: 18943 20001000-20004000 already mapped failed -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: 18943:18971 unknown command -989568244 binder: 18963:18966 transaction failed 29201/-22, size 0-8 line 3200 binder: 18943:18971 ioctl c0306201 20000140 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 18943:18970 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder_alloc: 18943: binder_alloc_buf, no vma binder: 18943:18971 Release 1 refcount change on invalid ref 1 ret -22 binder: 18943:18954 BC_INCREFS_DONE u0000000000000000 no match binder: send failed reply for transaction 702 to 18943:18944 binder: 18943:18975 transaction failed 29189/-3, size 24-8 line 3137 1 lock held by syz-executor5/7258: #0: (&tty->ldisc_sem){++++++}, at: [] tty_ldisc_ref_wait+0x2b/0xb0 drivers/tty/tty_ldisc.c:263 Sending NMI to all CPUs: NMI backtrace for cpu 0 CPU: 0 PID: 18975 Comm: syz-executor1 Not tainted 4.4.163+ #122 task: ffff8801c0e04740 task.stack: ffff8800b6a48000 RIP: 0010:[] [] inb arch/x86/include/asm/io.h:316 [inline] RIP: 0010:[] [] io_serial_in+0x6b/0x90 drivers/tty/serial/8250/8250_port.c:398 RSP: 0018:ffff8800b6a4f2f0 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 RDX: 00000000000003fd RSI: ffffffff81cbb7a1 RDI: ffffffff84966558 RBP: ffff8800b6a4f300 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff83fd7192 R12: ffffffff84966520 R13: 0000000000000020 R14: fffffbfff092cceb R15: fffffbfff092ccad FS: 00007efc85d60700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4806552db8 CR3: 00000000b8b3b000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff84966520 0000000000002708 ffff8800b6a4f350 ffffffff81cbd89f ffffffff81acdd15 ffffffff84966568 ffffffff8496675a ffffffff84966520 0000000000000069 ffffffff81cbd9f0 dffffc0000000000 0000000000000069 Call Trace: [] serial_in drivers/tty/serial/8250/8250.h:97 [inline] [] wait_for_xmitr+0x8f/0x1e0 drivers/tty/serial/8250/8250_port.c:1717 [] serial8250_console_putchar+0x1f/0x60 drivers/tty/serial/8250/8250_port.c:2806 [] uart_console_write+0x59/0xf0 drivers/tty/serial/serial_core.c:1789 [] serial8250_console_write+0x539/0x830 drivers/tty/serial/8250/8250_port.c:2872 [] univ8250_console_write+0x5f/0x70 drivers/tty/serial/8250/8250_core.c:594 [] call_console_drivers.constprop.16+0x1ef/0x3f0 kernel/printk/printk.c:1463 [] console_unlock+0x605/0xa10 kernel/printk/printk.c:2330 [] vprintk_emit+0x3f5/0x830 kernel/printk/printk.c:1832 [] vprintk+0x28/0x30 kernel/printk/printk.c:1843 [] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844 [] printk+0xaf/0xd7 kernel/printk/printk.c:1922 [] binder_transaction.cold.55+0xc8c/0x190f drivers/android/binder.c:3431 [] binder_thread_write+0x66a/0x22c0 drivers/android/binder.c:3700 [] binder_ioctl_write_read drivers/android/binder.c:4629 [inline] [] binder_ioctl+0x1111/0x1c50 drivers/android/binder.c:4804 [] vfs_ioctl fs/ioctl.c:43 [inline] [] file_ioctl fs/ioctl.c:470 [inline] [] do_vfs_ioctl+0x63f/0xf40 fs/ioctl.c:605 [] SYSC_ioctl fs/ioctl.c:622 [inline] [] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Code: 24 c1 00 00 00 49 8d 7c 24 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 d3 e3 80 3c 02 00 75 17 41 03 5c 24 38 89 da ec <5b> 0f b6 c0 41 5c 5d c3 e8 a8 40 7c ff eb c2 e8 01 41 7c ff eb NMI backtrace for cpu 1 CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.163+ #122 task: ffff8801da6f2f80 task.stack: ffff8801d9ed0000 RIP: 0010:[] [] native_apic_mem_write arch/x86/include/asm/apic.h:93 [inline] RIP: 0010:[] [] __default_send_IPI_dest_field arch/x86/include/asm/ipi.h:119 [inline] RIP: 0010:[] [] _flat_send_IPI_mask arch/x86/kernel/apic/apic_flat_64.c:61 [inline] RIP: 0010:[] [] flat_send_IPI_mask+0xf6/0x1a0 arch/x86/kernel/apic/apic_flat_64.c:69 RSP: 0018:ffff8801d9ed7cc8 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000 RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300 RBP: ffff8801d9ed7cf0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246 R13: 0000000003000000 R14: ffffffff82e5f3a0 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feaacf03848 CR3: 00000001d7dca000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff82e5f3a0 ffffffff831a4760 0000000000000007 fffffbfff06347cc 0000000000000008 ffff8801d9ed7d10 ffffffff81093701 ffffffff829220a0 0000000000000003 ffff8801d9ed7d68 ffffffff81ab041e ffffffff813a7cfd Call Trace: [] nmi_raise_cpu_backtrace+0x61/0x80 arch/x86/kernel/apic/hw_nmi.c:33 [] nmi_trigger_all_cpu_backtrace.cold.0+0x70/0xae lib/nmi_backtrace.c:85 [] arch_trigger_all_cpu_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 [] trigger_all_cpu_backtrace include/linux/nmi.h:44 [inline] [] check_hung_task kernel/hung_task.c:125 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [] watchdog.cold.0+0xd3/0xee kernel/hung_task.c:238 [] kthread+0x268/0x300 kernel/kthread.c:211 [] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510 Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1a 4c 89 e7 57 9d 0f 1f 44 00 00 e8 c2