TITLE: WARNING in ion_ioctl

[  173.566032] WARNING: CPU: 0 PID: 24071 at drivers/staging/android/ion/ion-ioctl.c:73 ion_ioctl+0x2db/0x380
[  173.575866] Kernel panic - not syncing: panic_on_warn set ...
[  173.575866] 
[  173.583229] CPU: 0 PID: 24071 Comm: syz-executor2 Not tainted 4.15.0-rc7+ #260
[  173.590576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  173.599921] Call Trace:
[  173.600286] binder: BINDER_SET_CONTEXT_MGR already set
[  173.600294] binder: 24065:24072 ioctl 40046207 0 returned -16
[  173.604587] binder_alloc: 24065: binder_alloc_buf, no vma
[  173.604610] binder: 24065:24072 transaction failed 29189/-3, size 40-8 line 2903
[  173.611966] netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
[  173.615430] netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
[  173.616072] binder: undelivered TRANSACTION_ERROR: 29189
[  173.616149] binder: release 24065:24072 transaction 116 out, still active
[  173.616155] binder: unexpected work type, 4, not freed
[  173.616157] binder: undelivered TRANSACTION_COMPLETE
[  173.616193] binder: send failed reply for transaction 116, target dead
[  173.672592]  dump_stack+0x194/0x257
[  173.676218]  ? arch_local_irq_restore+0x53/0x53
[  173.680862]  ? vsnprintf+0x1ed/0x1900
[  173.684640]  panic+0x1e4/0x41c
[  173.687803]  ? refcount_error_report+0x214/0x214
[  173.692528]  ? show_regs_print_info+0x18/0x18
[  173.697014]  ? __warn+0x1c1/0x200
[  173.700447]  ? ion_ioctl+0x2db/0x380
[  173.704129]  __warn+0x1dc/0x200
[  173.707381]  ? ion_ioctl+0x2db/0x380
[  173.711069]  report_bug+0x211/0x2d0
[  173.714674]  fixup_bug.part.11+0x37/0x80
[  173.718708]  do_error_trap+0x2d7/0x3e0
[  173.722570]  ? math_error+0x400/0x400
[  173.726344]  ? __might_fault+0x110/0x1d0
[  173.730379]  ? lock_downgrade+0x980/0x980
[  173.734513]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  173.739332]  do_invalid_op+0x1b/0x20
[  173.743021]  invalid_op+0x22/0x40
[  173.746446] RIP: 0010:ion_ioctl+0x2db/0x380
[  173.750734] RSP: 0018:ffff8801d8837ce0 EFLAGS: 00010216
[  173.756067] RAX: 0000000000010000 RBX: 0000000000000018 RCX: ffffffff841375eb
[  173.763326] RDX: 0000000000000073 RSI: ffffc90003568000 RDI: ffff8801d8837d14
[  173.770569] RBP: ffff8801d8837d78 R08: 2429e4b090fb5c17 R09: ffffed003b106fa5
[  173.777895] R10: 0000000000000003 R11: ffffed003b106fa4 R12: 1ffff1003b106f9e
[  173.785135] R13: 00000000c0184908 R14: ffff8801d8837d50 R15: dffffc0000000000
[  173.792393]  ? ion_ioctl+0x2db/0x380
[  173.796088]  ? ion_query_heaps+0x490/0x490
[  173.800305]  ? ion_query_heaps+0x490/0x490
[  173.804510]  do_vfs_ioctl+0x1b1/0x1520
[  173.808376]  ? _cond_resched+0x14/0x30
[  173.812237]  ? ioctl_preallocate+0x2b0/0x2b0
[  173.816620]  ? selinux_capable+0x40/0x40
[  173.820662]  ? syscall_return_slowpath+0x2ad/0x550
[  173.825569]  ? security_file_ioctl+0x89/0xb0
[  173.829955]  SyS_ioctl+0x8f/0xc0
[  173.833300]  entry_SYSCALL_64_fastpath+0x23/0x9a
[  173.838028] RIP: 0033:0x452cf9
[  173.841190] RSP: 002b:00007f51e978ec58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010
[  173.848868] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452cf9
[  173.856107] RDX: 0000000020000fd7 RSI: 00000000c0184908 RDI: 0000000000000013
[  173.863346] RBP: 00000000000003ad R08: 0000000000000000 R09: 0000000000000000
[  173.870585] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f38d8
[  173.877822] R13: 00000000ffffffff R14: 00007f51e978f6d4 R15: 0000000000000000
[  173.885767] Dumping ftrace buffer:
[  173.889380]    (ftrace buffer empty)
[  173.893064] Kernel Offset: disabled
[  173.896662] Rebooting in 86400 seconds..