binder: undelivered transaction 15, process died.
handle_userfault: 9 callbacks suppressed
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 6557 Comm: syz-executor0 Not tainted 4.4.120-gd63fdf6 #29
BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor1/6569
caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 4af868b23556828a ffff8801d755f8a0 ffffffff81d0408d
 ffff8800baeba480 1ffff1003aeabf21 ffff8801d755fa28 0000000000000000
 0000000000000000 ffff8801d755fa50 ffffffff81607305 ffffffff81237410
Call Trace:
 [<ffffffff81d0408d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0408d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81607305>] handle_userfault+0x715/0xf50 fs/userfaultfd.c:316
 [<ffffffff814a2d88>] do_anonymous_page mm/memory.c:2731 [inline]
 [<ffffffff814a2d88>] handle_pte_fault mm/memory.c:3295 [inline]
 [<ffffffff814a2d88>] __handle_mm_fault mm/memory.c:3426 [inline]
 [<ffffffff814a2d88>] handle_mm_fault+0x2938/0x3190 mm/memory.c:3455
 [<ffffffff810dc6cb>] __do_page_fault+0x35b/0xa00 arch/x86/mm/fault.c:1245
 [<ffffffff810dcd97>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1308
 [<ffffffff83774d88>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1033
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
CPU: 1 PID: 6569 Comm: syz-executor1 Not tainted 4.4.120-gd63fdf6 #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 0db0bba42f90f0a3 ffff8800b9d67788 ffffffff81d0408d
 0000000000000001 ffffffff839fe5a0 ffffffff83cefc20 ffff8800b9cf9800
 0000000000000003 ffff8800b9d677c8 ffffffff81d63fe4 ffffffff810002b8
Call Trace:
 [<ffffffff81d0408d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0408d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81d63fe4>] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff81d6404c>] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
 [<ffffffff8312b439>] tcp_try_coalesce+0x249/0x4d0 net/ipv4/tcp_input.c:4278
 [<ffffffff831335b7>] tcp_queue_rcv+0x127/0x720 net/ipv4/tcp_input.c:4485
 [<ffffffff8314ae8b>] tcp_send_rcvq+0x39b/0x450 net/ipv4/tcp_input.c:4531
 [<ffffffff831220ef>] tcp_sendmsg+0x1e8f/0x2b10 net/ipv4/tcp.c:1134
 [<ffffffff831d7d4c>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:755
 [<ffffffff82deba6a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82deba6a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82dec9b8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1665
 [<ffffffff82deeeb0>] SyS_sendto+0x40/0x50 net/socket.c:1633
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
BUG: using __this_cpu_add() in preemptible [00000000] code: syz-executor1/6569
caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
CPU: 1 PID: 6569 Comm: syz-executor1 Not tainted 4.4.120-gd63fdf6 #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 0db0bba42f90f0a3 ffff8800b9d67788 ffffffff81d0408d
 0000000000000001 ffffffff839fe5a0 ffffffff83cefc20 ffff8800b9cf9800
 0000000000000003 ffff8800b9d677c8 ffffffff81d63fe4 ffffffff810002b8
Call Trace:
 [<ffffffff81d0408d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0408d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81d63fe4>] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff81d6404c>] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
 [<ffffffff8312b439>] tcp_try_coalesce+0x249/0x4d0 net/ipv4/tcp_input.c:4278
 [<ffffffff831335b7>] tcp_queue_rcv+0x127/0x720 net/ipv4/tcp_input.c:4485
 [<ffffffff8314ae8b>] tcp_send_rcvq+0x39b/0x450 net/ipv4/tcp_input.c:4531
 [<ffffffff831220ef>] tcp_sendmsg+0x1e8f/0x2b10 net/ipv4/tcp.c:1134
 [<ffffffff831d7d4c>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:755
 [<ffffffff82deba6a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82deba6a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82dec9b8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1665
 [<ffffffff82deeeb0>] SyS_sendto+0x40/0x50 net/socket.c:1633
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 6642 Comm: syz-executor4 Not tainted 4.4.120-gd63fdf6 #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800b9f3c800 task.stack: ffff8800ba0e8000
RIP: 0010:[<ffffffff825bab57>]  [<ffffffff825bab57>] sg_read_oxfer drivers/scsi/sg.c:1976 [inline]
RIP: 0010:[<ffffffff825bab57>]  [<ffffffff825bab57>] sg_read+0xd17/0x1490 drivers/scsi/sg.c:530
RSP: 0018:ffff8800ba0efb50  EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff825bab1e
RDX: 0000000000000000 RSI: ffffc900019be000 RDI: ffff8800b9400170
RBP: ffff8800ba0efc58 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 1ffff1001741df30 R12: 000000007fffefdc
R13: 0000000000000000 R14: ffff8800b9d6d720 R15: ffff8800b9400140
FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f6f79b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f6f3fdb0 CR3: 00000001cbdc2000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8800b9f3d0d0 ffff8800b8dd5360 0000000000000013 ffff8800b9400158
 fb96493ebe4d0afb ffff8800b9400168 000000007ffff000 0000000000000000
 ffff8800b7046c80 0000000000001000 1ffff1001741df76 0000000020000024
Call Trace:
 [<ffffffff8151cf33>] __vfs_read+0x103/0x440 fs/read_write.c:432
 [<ffffffff8151edd3>] vfs_read+0x123/0x3a0 fs/read_write.c:454
 [<ffffffff81521719>] SYSC_read fs/read_write.c:569 [inline]
 [<ffffffff81521719>] SyS_read+0xd9/0x1b0 fs/read_write.c:562
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 97 06 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 5f 28 48 89 da 48 c1 ea 03 <80> 3c 02 00 0f 85 6b 06 00 00 48 8b 1b 48 85 db 0f 84 3b 03 00 
RIP  [<ffffffff825bab57>] sg_read_oxfer drivers/scsi/sg.c:1976 [inline]
RIP  [<ffffffff825bab57>] sg_read+0xd17/0x1490 drivers/scsi/sg.c:530
 RSP <ffff8800ba0efb50>
---[ end trace 4cf71eb16d0b43ff ]---