syzbot has bisected this bug to:

commit 1a7c3d9bb7a926e88d5f57643e75ad1abfc55013 Author: Todd Kjos tkjos@android.com Date: Fri Feb 8 18:35:14 2019 +0000

binder: create userspace-to-binder-buffer copy function

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15b9383f200000 start commit: 1a9df9e2 Merge git://git.kernel.org/pub/scm/linux/kernel/g.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=17b9383f200000 console output: https://syzkaller.appspot.com/x/log.txt?x=13b9383f200000 kernel config: https://syzkaller.appspot.com/x/.config?x=8dcdce25ea72bedf dashboard link: https://syzkaller.appspot.com/bug?extid=f9f3f388440283da2965 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17d05637200000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1677e62f200000

Reported-by: syzbot+f9f3f388440283da2965@syzkaller.appspotmail.com Fixes: 1a7c3d9bb7a9 ("binder: create userspace-to-binder-buffer copy function")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection