binder: 14218:14220 BC_CLEAR_DEATH_NOTIFICATION death notification not active
==================================================================
BUG: KASAN: slab-out-of-bounds in strnlen+0xc1/0xd0 lib/string.c:498
Read of size 1 at addr ffff8800ab3c8e90 by task syz-executor3/14229

CPU: 1 PID: 14229 Comm: syz-executor3 Not tainted 4.4.113-ge70c132 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 a5aa51fd6f9eb3aa ffff8800b3077710 ffffffff81d0278d
 ffffea0002acf200 ffff8800ab3c8e90 0000000000000000 ffff8800ab3c8e90
 ffff8800b30779e0 ffff8800b3077748 ffffffff814fd053 ffff8800ab3c8e90
Call Trace:
 [<ffffffff81d0278d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0278d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fd053>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fd565>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fd565>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fd664>] __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:426
 [<ffffffff81d1e171>] strnlen+0xc1/0xd0 lib/string.c:498
 [<ffffffff81d25dfc>] string.isra.4+0x4c/0x240 lib/vsprintf.c:518
 [<ffffffff81d2b2a6>] vsnprintf+0x766/0x15f0 lib/vsprintf.c:1907
 [<ffffffff8117160f>] __request_module+0x14f/0x810 kernel/kmod.c:146
 [<ffffffff8302c64b>] xt_request_find_target+0x8b/0xb0 net/netfilter/x_tables.c:255
 [<ffffffff832690d1>] find_check_entry net/ipv4/netfilter/ip_tables.c:685 [inline]
 [<ffffffff832690d1>] translate_table+0x12c1/0x1cf0 net/ipv4/netfilter/ip_tables.c:872
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff8326bc53>] do_replace net/ipv4/netfilter/ip_tables.c:1289 [inline]
 [<ffffffff8326bc53>] do_ipt_set_ctl+0x2a3/0x450 net/ipv4/netfilter/ip_tables.c:1852
 [<ffffffff82f94d77>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
 [<ffffffff82f94d77>] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114
 [<ffffffff830fc1c1>] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1226
 [<ffffffff8311ac32>] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2632
 [<ffffffff82df0645>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2659
 [<ffffffff82ded730>] SYSC_setsockopt net/socket.c:1767 [inline]
 [<ffffffff82ded730>] SyS_setsockopt+0x160/0x250 net/socket.c:1746
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98

Allocated by task 14229:
 [<ffffffff81035df6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fc0c3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fc38d>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fc38d>] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f8674>] __kmalloc+0x124/0x320 mm/slub.c:3613
 [<ffffffff8302de91>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff8302de91>] xt_alloc_table_info+0x71/0x100 net/netfilter/x_tables.c:911
 [<ffffffff8326bbe2>] do_replace net/ipv4/netfilter/ip_tables.c:1278 [inline]
 [<ffffffff8326bbe2>] do_ipt_set_ctl+0x232/0x450 net/ipv4/netfilter/ip_tables.c:1852
 [<ffffffff82f94d77>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
 [<ffffffff82f94d77>] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114
 [<ffffffff830fc1c1>] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1226
 [<ffffffff8311ac32>] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2632
 [<ffffffff82df0645>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2659
 [<ffffffff82ded730>] SYSC_setsockopt net/socket.c:1767 [inline]
 [<ffffffff82ded730>] SyS_setsockopt+0x160/0x250 net/socket.c:1746
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98

Freed by task 9339:
 [<ffffffff81035df6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fc0c3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fc9e2>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fc9e2>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814f947c>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814f947c>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814f947c>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814f947c>] kfree+0xfc/0x300 mm/slub.c:3749
 [<ffffffff815b6fb3>] iter_file_splice_write+0x4a3/0xae0 fs/splice.c:1053
 [<ffffffff815b3a75>] do_splice_from fs/splice.c:1128 [inline]
 [<ffffffff815b3a75>] direct_splice_actor+0x125/0x180 fs/splice.c:1294
 [<ffffffff815b4d82>] splice_direct_to_actor+0x2d2/0x830 fs/splice.c:1247
 [<ffffffff815b5487>] do_splice_direct+0x1a7/0x270 fs/splice.c:1337
 [<ffffffff8151fbbc>] do_sendfile+0x54c/0xd30 fs/read_write.c:1227
 [<ffffffff81521c13>] SYSC_sendfile64 fs/read_write.c:1282 [inline]
 [<ffffffff81521c13>] SyS_sendfile64+0xc3/0x150 fs/read_write.c:1274
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98

The buggy address belongs to the object at ffff8800ab3c8dc0
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 208 bytes inside of
 256-byte region [ffff8800ab3c8dc0, ffff8800ab3c8ec0)
The buggy address belongs to the page:
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:460!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.113-ge70c132 #34
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffffffff84217840 task.stack: ffffffff84200000
RIP: 0010:[<ffffffff8148f8e1>]  [<ffffffff8148f8e1>] dump_page mm/debug.c:105 [inline]
RIP: 0010:[<ffffffff8148f8e1>]  [<ffffffff8148f8e1>] page_mapcount include/linux/mm.h:460 [inline]
RIP: 0010:[<ffffffff8148f8e1>]  [<ffffffff8148f8e1>] dump_page_badflags+0x191/0x250 mm/debug.c:85
RSP: 0018:ffff8801db207df0  EFLAGS: 00010006
RAX: ffffffff84217840 RBX: ffff8800b2151d90 RCX: ffffffff812ac810
RDX: 0000000000010000 RSI: ffffffff839fe320 RDI: ffff8800b2151d90
RBP: ffff8801db207ee0 R08: 1ffff1003b209361 R09: 0000000000000001
R10: 0000000000000000 R11: 1ffff1003b640f6a R12: ffffffff8148f8e1
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8801db219640
FS:  0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca7e85ff0 CR3: 00000001c6472000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff812ac816 ffff88021fffd017 ffff88021fffd01b ffff88021fffd00f
 1ffff1003b640fcb ffff8801db2196a0 ffffed003b640fca ffff8801db219780
 0303fc0000000001 ffff8801db219678 ffffed003b6432d4 ffff8801db219798
Call Trace:
 <IRQ> 
 [<ffffffff812aece6>] hrtimer_interrupt+0x1a6/0x440 kernel/time/hrtimer.c:1351
 [<ffffffff810b0c7a>] local_apic_timer_interrupt+0x6a/0xb0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff837747b6>] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff83773710>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:737
 <EOI> 
 [<ffffffff81027ed5>] arch_safe_halt arch/x86/include/asm/paravirt.h:117 [inline]
 [<ffffffff81027ed5>] default_idle+0x55/0x3c0 arch/x86/kernel/process.c:291
 [<ffffffff8102945a>] arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:282
 [<ffffffff81220418>] default_idle_call+0x48/0x70 kernel/sched/idle.c:93
 [<ffffffff81220b1d>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff81220b1d>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff81220b1d>] cpu_startup_entry+0x5fd/0x8f0 kernel/sched/idle.c:301
 [<ffffffff8375ead9>] rest_init+0x189/0x190 init/main.c:410
 [<ffffffff84821811>] start_kernel+0x6b9/0x6ee init/main.c:682
 [<ffffffff84820312>] x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:196
 [<ffffffff84820454>] x86_64_start_kernel+0x140/0x163 arch/x86/kernel/head64.c:185
Code: 46 e8 64 03 ed ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 50 03 ed ff 31 d2 48 c7 c6 e0 8d 8a 83 48 89 df e8 6f fe ff ff <0f> 0b e8 a8 dd 06 00 e9 21 ff ff ff 89 4d d4 e8 9b dd 06 00 8b 
RIP  [<ffffffff8148f8e1>] dump_page mm/debug.c:105 [inline]
RIP  [<ffffffff8148f8e1>] page_mapcount include/linux/mm.h:460 [inline]
RIP  [<ffffffff8148f8e1>] dump_page_badflags+0x191/0x250 mm/debug.c:85
 RSP <ffff8801db207df0>
---[ end trace 51d94fa1167f3c29 ]---