INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 21948 Comm: syz-executor3 Not tainted 4.15.0-rc3-next-20171214+ #67 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xe9/0x14b lib/dump_stack.c:53 register_lock_class+0x164/0x5d0 kernel/locking/lockdep.c:752 __lock_acquire+0xb4/0x1430 kernel/locking/lockdep.c:3314 lock_acquire+0xbf/0x220 kernel/locking/lockdep.c:3914 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:310 [inline] ipc_lock_object ipc/util.h:171 [inline] sem_lock ipc/sem.c:375 [inline] do_semtimedop+0x9bd/0x1970 ipc/sem.c:1972 SYSC_semop ipc/sem.c:2153 [inline] SyS_semop+0x26/0x30 ipc/sem.c:2150 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x452a39 RSP: 002b:00007f13900dbc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000041 RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452a39 RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 0000000000000575 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f6398 R13: 00000000ffffffff R14: 00007f13900dc6d4 R15: 0000000000000000 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable QAT: Invalid ioctl device lo entered promiscuous mode device eql entered promiscuous mode binder: 22164:22165 BC_DEAD_BINDER_DONE 0000000000000003 not found binder: 22164:22165 got transaction with invalid parent offset or type binder: 22164:22165 transaction failed 29201/-22, size 32-16 line 3070 binder: 22164:22165 transaction failed 29201/-22, size 0-0 line 2947 binder: BINDER_SET_CONTEXT_MGR already set binder: 22164:22169 ioctl 40046207 0 returned -16 binder: 22164:22165 BC_DEAD_BINDER_DONE 0000000000000003 not found binder_alloc: 22164: binder_alloc_buf, no vma binder: 22164:22165 transaction failed 29189/-3, size 32-16 line 2947 binder_alloc: 22164: binder_alloc_buf, no vma binder: 22164:22169 transaction failed 29189/-3, size 0-0 line 2947 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 nla_parse: 17 callbacks suppressed netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'. sctp: [Deprecated]: syz-executor4 (pid 22237) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor4 (pid 22237) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. sctp: [Deprecated]: syz-executor4 (pid 22237) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor4 (pid 22237) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor4 (pid 22248) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead netlink: 16 bytes leftover after parsing attributes in process `syz-executor4'. sctp: [Deprecated]: syz-executor4 (pid 22252) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead netlink: 2 bytes leftover after parsing attributes in process `syz-executor3'. device lo entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22271 comm=syz-executor3 QAT: Invalid ioctl netlink: 2 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. QAT: Invalid ioctl netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 37 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 37 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 'syz-executor3': attribute type 39 has an invalid length. netlink: 'syz-executor3': attribute type 39 has an invalid length. device gre0 entered promiscuous mode SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22594 comm=syz-executor4 netlink: 'syz-executor7': attribute type 2 has an invalid length. netlink: 'syz-executor0': attribute type 10 has an invalid length. netlink: 'syz-executor0': attribute type 10 has an invalid length. netlink: 'syz-executor7': attribute type 2 has an invalid length. kvm [22614]: vcpu4, guest rIP: 0xfff0 unimplemented MMIO_CONF_BASE wrmsr: 0x3e2d SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64030 sclass=netlink_route_socket pig=22636 comm=syz-executor6 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64030 sclass=netlink_route_socket pig=22636 comm=syz-executor6 Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable tc_ctl_action: received NO action attribs Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable kvm_hv_set_msr: 11 callbacks suppressed kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x4000008f data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x4000008e data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x4000008d data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x4000008c data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x4000008b data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x4000008a data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000089 data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000088 data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000087 data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000086 data 0x0 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000020 data 0x0 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=22764 comm=syz-executor4 tc_ctl_action: received NO action attribs SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pig=22764 comm=syz-executor4 kvm [22744]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000020 data 0x0 binder: 22800 invalid dec weak, ref 199 desc 0 s 1 w 0 binder: 22800:22801 BC_FREE_BUFFER uffffffffffffffff no match binder: 22800:22801 BC_FREE_BUFFER u0000000000000000 no match binder: 22800:22801 BC_DEAD_BINDER_DONE 0000000000000004 not found binder: 22800:22801 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER binder: 22800:22801 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 binder: 22800:22801 got reply transaction with no transaction stack binder: 22800:22801 transaction failed 29201/-71, size 72-40 line 2747 binder: 22800:22811 BC_FREE_BUFFER u0000000000000000 no match binder: 22800:22801 DecRefs 0 refcount change on invalid ref 0 ret -22 binder: 22800:22801 BC_FREE_BUFFER uffffffffffffffff no match binder: 22800:22801 IncRefs 0 refcount change on invalid ref 0 ret -22 binder: 22800:22811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 22800:22811 BC_DEAD_BINDER_DONE 0000000000000004 not found binder: 22800:22811 ERROR: BC_REGISTER_LOOPER called without request binder: 22800:22811 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 binder: 22800:22811 got reply transaction with no transaction stack binder: 22800:22811 transaction failed 29201/-71, size 72-40 line 2747 kvm [22899]: vcpu0, guest rIP: 0x9124 disabled perfctr wrmsr: 0x187 data 0xe0000011 kvm [22894]: vcpu0, guest rIP: 0x9115 Hyper-V uhandled wrmsr: 0x40000020 data 0xe0050031 binder: 23011:23012 got transaction with invalid handle, 0 binder: 23011:23012 transaction failed 29201/-22, size 64-16 line 3039 binder: BINDER_SET_CONTEXT_MGR already set binder: 23011:23012 ioctl 40046207 0 returned -16 binder_alloc: 23011: binder_alloc_buf, no vma binder: 23011:23028 transaction failed 29189/-3, size 64-16 line 2947 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 device gre0 entered promiscuous mode device gre0 entered promiscuous mode sctp: [Deprecated]: syz-executor3 (pid 23145) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead binder: BINDER_SET_CONTEXT_MGR already set binder: 23091:23102 ioctl 40046207 0 returned -16 sctp: [Deprecated]: syz-executor3 (pid 23151) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor3 (pid 23151) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor3 (pid 23151) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable device gre0 entered promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl binder: 23219:23226 BC_DEAD_BINDER_DONE 0000000000000003 not found binder: 23219:23226 DecRefs 0 refcount change on invalid ref 1 ret -22 binder: 23219:23226 BC_INCREFS_DONE u0000000020265000 no match binder: 23219:23226 transaction failed 29189/-22, size 32-24 line 2832 binder: 23219:23226 transaction failed 29189/-22, size 0-40 line 2832 binder: 23219:23226 BC_DEAD_BINDER_DONE 0000000000000003 not found QAT: Invalid ioctl binder: 23219:23226 DecRefs 0 refcount change on invalid ref 1 ret -22 binder: 23219:23233 ioctl c0306201 2000f000 returned -14 binder: 23219:23243 transaction failed 29189/-22, size 0-40 line 2832 binder: 23219:23226 BC_INCREFS_DONE u0000000020265000 no match binder: 23219:23226 transaction failed 29189/-22, size 32-24 line 2832 device lo entered promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready binder: 23320:23321 unknown command 0 binder: 23320:23321 ioctl c0306201 2000a000 returned -22 binder: 23320:23321 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 23320:23321 BC_DEAD_BINDER_DONE 0000000000000001 not found binder: 23320:23321 got transaction with invalid offset (48, min 24 max 24) or object. binder: 23320:23321 transaction failed 29201/-22, size 24-16 line 3010 kauditd_printk_skb: 415 callbacks suppressed audit: type=1326 audit(1513299242.768:6250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 binder: BINDER_SET_CONTEXT_MGR already set binder: 23320:23343 ioctl 40046207 0 returned -16 binder: 23320:23321 unknown command 0 binder: 23320:23321 ioctl c0306201 2000a000 returned -22 binder: 23320:23343 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 23320:23343 BC_DEAD_BINDER_DONE 0000000000000001 not found binder_alloc: 23320: binder_alloc_buf, no vma binder: 23320:23343 transaction failed 29189/-3, size 24-16 line 2947 audit: type=1326 audit(1513299242.804:6251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=16 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.804:6252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.804:6253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.824:6254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=41 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.824:6255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.824:6256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.824:6257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=41 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.824:6258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 audit: type=1326 audit(1513299242.824:6259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=23350 comm="syz-executor5" exe="/root/syz-executor5" sig=0 arch=c000003e syscall=202 compat=0 ip=0x452a39 code=0x7ffc0000 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl sock: sock_set_timeout: `syz-executor0' (pid 23483) tries to set negative timeout QAT: Invalid ioctl sock: sock_set_timeout: `syz-executor0' (pid 23483) tries to set negative timeout QAT: Invalid ioctl QAT: Invalid ioctl RDS: rds_bind could not find a transport for 172.20.1.170, load rds_tcp or rds_rdma? RDS: rds_bind could not find a transport for 172.20.1.170, load rds_tcp or rds_rdma? Option ' ä…õ ø' to dns_resolver key: bad/missing value Option ' ä…õ ø' to dns_resolver key: bad/missing value 9pnet_virtio: no channels available for device ./file0 9pnet_virtio: no channels available for device ./file0 QAT: Invalid ioctl nla_parse: 38 callbacks suppressed netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. binder: 23931:23935 Release 1 refcount change on invalid ref 2 ret -22 binder: 23931:23935 BC_FREE_BUFFER u0000000000000000 no match binder_alloc: 23931: binder_alloc_buf, no vma binder: 23931:23947 transaction failed 29189/-3, size 0-0 line 2947 binder: 23931:23947 ioctl c0306201 2000dfd0 returned -14 device gre0 entered promiscuous mode binder: BINDER_SET_CONTEXT_MGR already set binder: 23931:23958 ioctl 40046207 0 returned -16 binder: 23931:23958 Release 1 refcount change on invalid ref 2 ret -22 binder: 23931:23958 BC_FREE_BUFFER u0000000000000000 no match binder: 23931:23958 DecRefs 0 refcount change on invalid ref 4 ret -22 binder: 23931:23958 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 binder: 23931:23958 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 23958 RLIMIT_NICE not set binder_alloc: 23931: binder_alloc_buf, no vma binder: 23931:23947 transaction failed 29189/-3, size 0-0 line 2947 binder: 23931:23958 got reply transaction with no transaction stack binder: 23931:23958 transaction failed 29201/-71, size 32-8 line 2747 binder: 23931:23935 DecRefs 0 refcount change on invalid ref 4 ret -22 binder: 23931:23935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 binder: 23931:23935 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 23935 RLIMIT_NICE not set binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 binder: 24012:24030 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 binder: 24012:24040 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 QAT: Invalid ioctl binder: 24153:24157 Release 1 refcount change on invalid ref 2 ret -22 binder: 24153:24157 BC_FREE_BUFFER u0000000000000000 no match binder: 24153:24157 DecRefs 0 refcount change on invalid ref 4 ret -22 binder: 24153:24157 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 binder: 24153:24157 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 24157 RLIMIT_NICE not set netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. binder: 24157 RLIMIT_NICE not set binder: 24157 RLIMIT_NICE not set binder: 24153:24157 ioctl c0306201 2000dfd0 returned -14 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_COMPLETE binder: undelivered transaction 223, process died. binder: 24153:24171 Release 1 refcount change on invalid ref 2 ret -22 binder: 24153:24171 BC_FREE_BUFFER u0000000000000000 no match binder: 24153:24171 DecRefs 0 refcount change on invalid ref 4 ret -22 binder: 24153:24171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 binder: 24153:24171 BC_DEAD_BINDER_DONE 0000000000000002 not found binder: 24171 RLIMIT_NICE not set binder: 24171 RLIMIT_NICE not set binder: 24153:24157 got reply transaction with bad transaction stack, transaction 227 has target 24153:24171 binder: 24153:24157 transaction failed 29201/-71, size 32-8 line 2762 binder: 24153:24157 ioctl c0306201 2000dfd0 returned -14 netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. binder: release 24153:24157 transaction 227 out, still active binder: undelivered TRANSACTION_ERROR: 29201 binder: release 24153:24171 transaction 227 in, still active binder: send failed reply for transaction 227, target dead device gre0 entered promiscuous mode netlink: 'syz-executor1': attribute type 28 has an invalid length. netlink: 13 bytes leftover after parsing attributes in process `syz-executor1'. netlink: 'syz-executor1': attribute type 28 has an invalid length. netlink: 13 bytes leftover after parsing attributes in process `syz-executor1'. device gre0 entered promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor4'. IPv6: NLM_F_REPLACE set, but no existing node found! netlink: 11 bytes leftover after parsing attributes in process `syz-executor0'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor0'. device gre0 entered promiscuous mode rfkill: input handler disabled rfkill: input handler enabled device gre0 entered promiscuous mode netlink: 11 bytes leftover after parsing attributes in process `syz-executor5'. binder: 24585:24589 got transaction to invalid handle binder: 24585:24589 transaction failed 29201/-22, size 0-0 line 2832 binder: 24585:24600 got transaction to invalid handle binder: 24585:24600 transaction failed 29201/-22, size 0-0 line 2832 binder: BINDER_SET_CONTEXT_MGR already set binder: 24585:24589 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 kvm: apic: phys broadcast and lowest prio device ip6tnl0 entered promiscuous mode binder: 24686:24687 ioctl 541b 20865000 returned -22 binder: 24686:24700 ioctl 541b 20865000 returned -22 device gre0 entered promiscuous mode binder: 24814:24816 IncRefs 0 refcount change on invalid ref 2 ret -22 binder: 24814:24816 unknown command 0 binder: 24814:24816 ioctl c0306201 2000a000 returned -22 binder: 24814:24816 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 24814:24816 BC_DEAD_BINDER_DONE 0000000000000001 not found binder: 24814:24816 got transaction with fd, -1, but target does not allow fds binder: 24814:24816 transaction failed 29201/-1, size 24-16 line 3052 binder: BINDER_SET_CONTEXT_MGR already set binder: 24814:24822 ioctl 40046207 0 returned -16 binder: 24814:24816 IncRefs 0 refcount change on invalid ref 2 ret -22 binder: 24814:24816 unknown command 0 binder: 24814:24816 ioctl c0306201 2000a000 returned -22 binder: 24814:24822 Acquire 1 refcount change on invalid ref 1 ret -22 binder: 24814:24822 BC_DEAD_BINDER_DONE 0000000000000001 not found binder_alloc: 24814: binder_alloc_buf, no vma binder: 24814:24822 transaction failed 29189/-3, size 24-16 line 2947 futex_wake_op: syz-executor4 tries to shift op by -1; fix this program futex_wake_op: syz-executor4 tries to shift op by -1; fix this program