binder: 10175:10177 unknown command 14
binder: 10175:10177 ioctl c0306201 20000040 returned -22
binder: 10175:10177 unknown command 0
binder: 10175:10177 ioctl c0306201 2000dfd0 returned -22
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2193!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 10177 Comm: syz-executor3 Not tainted 4.4.162+ #120
task: ffff8800b8e7df00 task.stack: ffff88009fc58000
RIP: 0010:[<ffffffff821eda14>]  [<ffffffff821eda14>] skb_copy_and_csum_bits+0x6a4/0x7f0 net/core/skbuff.c:2193
RSP: 0018:ffff8801db7072a0  EFLAGS: 00010206
RAX: ffff8800b8e7df00 RBX: 00000000afd17f30 RCX: 1ffff100164dd7a9
RDX: 0000000000000100 RSI: ffffffff821eda14 RDI: ffff8800b26ebd48
RBP: ffff8801db707328 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003c R11: ffff8800b3f2105f R12: 0000000000000000
R13: 0000000000000224 R14: 000000000000003c R15: ffff8800b26ebd40
FS:  0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000400200 CR3: 0000000002e0a000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff821d9ac0 ffff8800b504b208 ffffffff810e1dbd ffffffff82714801
 ffffffff82713b5d ffff8800b3f20de8 0000003c8142fec1 ffff8800b504b204
 ffffffff0000003c 00000000afd17f30 0000003c000001e8 ffff8800b504b140
Call Trace:
 <IRQ> 
 [<ffffffff8248d37f>] icmp_glue_bits+0x7f/0x1e0 net/ipv4/icmp.c:344
 [<ffffffff823c5026>] __ip_append_data.isra.2+0x1e66/0x2a00 net/ipv4/ip_output.c:1045
 [<ffffffff823c5ca4>] ip_append_data.part.4+0xe4/0x150 net/ipv4/ip_output.c:1195
 [<ffffffff823ca698>] ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1184
 [<ffffffff8248cf8e>] icmp_push_reply+0x19e/0x510 net/ipv4/icmp.c:362
 [<ffffffff8248e6ca>] icmp_send+0xaca/0x1430 net/ipv4/icmp.c:727
 [<ffffffff823c5ebc>] ip_fragment.constprop.5+0x1ac/0x200 net/ipv4/ip_output.c:511
 [<ffffffff823c62a6>] ip_finish_output+0x396/0xc00 net/ipv4/ip_output.c:286
 [<ffffffff823ca389>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823ca389>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823c72ab>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823c72ab>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823c85fe>] ip_queue_xmit+0x88e/0x1a80 net/ipv4/ip_output.c:461
 [<ffffffff8242aec0>] __tcp_transmit_skb+0x1870/0x2c50 net/ipv4/tcp_output.c:1034
 [<ffffffff824356ac>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff824356ac>] __tcp_retransmit_skb+0x63c/0x18e0 net/ipv4/tcp_output.c:2661
 [<ffffffff82437043>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2678
 [<ffffffff8243cacd>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff8243e3d1>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff8243e98a>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff812553bc>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff812560a5>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff812560a5>] run_timer_softirq+0x605/0xbb0 kernel/time/timer.c:1444
 [<ffffffff8271509c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff810e1dbd>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff810e1dbd>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff82714801>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff82714801>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
binder: 10186:10187 Acquire 1 refcount change on invalid ref 0 ret -22
binder: 10186:10187 unknown command 14
binder: 10186:10187 ioctl c0306201 20000040 returned -22
binder: 10186:10187 unknown command 0
binder: 10186:10187 ioctl c0306201 2000dfd0 returned -22
 [<ffffffff82713b5d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff8142df22>] zap_pte_range mm/memory.c:1160 [inline]
 [<ffffffff8142df22>] zap_pmd_range mm/memory.c:1253 [inline]
 [<ffffffff8142df22>] zap_pud_range mm/memory.c:1274 [inline]
 [<ffffffff8142df22>] unmap_page_range mm/memory.c:1298 [inline]
 [<ffffffff8142df22>] unmap_single_vma+0xa82/0x10d0 mm/memory.c:1343
 [<ffffffff8142fec1>] unmap_vmas+0x81/0xd0 mm/memory.c:1373
 [<ffffffff81446b74>] exit_mmap+0x1d4/0x390 mm/mmap.c:2958
 [<ffffffff810caa56>] __mmput kernel/fork.c:717 [inline]
 [<ffffffff810caa56>] mmput+0xd6/0x350 kernel/fork.c:737
 [<ffffffff810d914a>] exit_mm kernel/exit.c:440 [inline]
 [<ffffffff810d914a>] do_exit+0x8ca/0x28d0 kernel/exit.c:742
 [<ffffffff810df3b1>] do_group_exit+0x111/0x300 kernel/exit.c:885
 [<ffffffff81100c1c>] get_signal+0x4ec/0x14a0 kernel/signal.c:2321
 [<ffffffff8100bf65>] do_signal+0x95/0x1840 arch/x86/kernel/signal.c:712
 [<ffffffff81003eba>] exit_to_usermode_loop+0x11a/0x160 arch/x86/entry/common.c:250
 [<ffffffff81005924>] prepare_exit_to_usermode arch/x86/entry/common.c:287 [inline]
 [<ffffffff81005924>] syscall_return_slowpath+0x254/0x2d0 arch/x86/entry/common.c:352
 [<ffffffff8271232d>] int_ret_from_sys_call+0x25/0xa3
Code: 00 00 4d 8b 24 24 44 8b 6d d0 4d 85 e4 0f 85 1b ff ff ff 8b 5d c0 e8 dc 92 11 ff 8b 45 c8 85 c0 0f 84 83 fe ff ff e8 cc 92 11 ff <0f> 0b 8b 5d c0 e9 74 fe ff ff c7 45 ac 00 00 00 00 e9 73 fa ff 
RIP  [<ffffffff821eda14>] skb_copy_and_csum_bits+0x6a4/0x7f0 net/core/skbuff.c:2193
 RSP <ffff8801db7072a0>
---[ end trace f94069c6e44148e1 ]---