binder: 3914:3918 Acquire 1 refcount change on invalid ref 3 ret -22
binder: 3914:3918 got transaction to invalid handle
binder: 3914:3918 transaction failed 29201/-22, size 80-8 line 3013
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 3966 Comm: syz-executor1 Not tainted 4.9.135+ #117
task: ffff88019dbe97c0 task.stack: ffff8801ab958000
RIP: 0010:[<ffffffff81de0888>]  [<ffffffff81de0888>] is_loop_device drivers/block/loop.c:645 [inline]
RIP: 0010:[<ffffffff81de0888>]  [<ffffffff81de0888>] loop_validate_file+0x208/0x400 drivers/block/loop.c:656
RSP: 0018:ffff8801ab95fae0  EFLAGS: 00010206
RAX: 0000000000000036 RBX: dffffc0000000000 RCX: ffffc90000917000
RDX: 0000000000000e10 RSI: ffffffff81de0858 RDI: 00000000000001b0
RBP: ffff8801ab95faf8 R08: ffff88019dbea070 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff8801da016780 R14: ffff8801da016780 R15: ffff8801d70697d8
FS:  00007fea90b84700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004cc178 CR3: 000000017daf7000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffff8801d7069680 ffff88017d528200 00000000fffffff0 ffff8801ab95fb80
 ffffffff81de79b5 000000000072b000 ffff8801a65f8b00 0000000000000f0c
 ffff8801ab95fb80 ffff8801ab95fde0 ffff8801d70697d0 1ffff1003572bf6c
Call Trace:
 [<ffffffff81de79b5>] loop_set_fd drivers/block/loop.c:909 [inline]
 [<ffffffff81de79b5>] lo_ioctl+0x865/0x1910 drivers/block/loop.c:1375
 [<ffffffff81b0cc64>] __blkdev_driver_ioctl block/ioctl.c:294 [inline]
 [<ffffffff81b0cc64>] blkdev_ioctl+0x7a4/0x1a50 block/ioctl.c:590
 [<ffffffff815ca22e>] block_ioctl+0xde/0x120 fs/block_dev.c:1688
 [<ffffffff81546ddc>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81546ddc>] file_ioctl fs/ioctl.c:493 [inline]
 [<ffffffff81546ddc>] do_vfs_ioctl+0x1ac/0x11a0 fs/ioctl.c:677
 [<ffffffff81547e5f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff81547e5f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82816b93>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: 00 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 f7 01 00 00 4d 8b a4 24 f0 00 00 00 49 8d bc 24 b0 01 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 cc 01 00 00 4d 8b a4 24 b0 01 00 00 4c 89 e0 
RIP  [<ffffffff81de0888>] is_loop_device drivers/block/loop.c:645 [inline]
RIP  [<ffffffff81de0888>] loop_validate_file+0x208/0x400 drivers/block/loop.c:656
 RSP <ffff8801ab95fae0>
---[ end trace 028b2b8e8fdcb48c ]---