./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4089303562
<...>
DUID 00:04:06:88:74:a7:04:75:62:cb:55:93:34:09:94:90:e1:fe
forked to background, child pid 3178
[ 27.737295][ T3179] 8021q: adding VLAN 0 to HW filter on device bond0
[ 27.747467][ T3179] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.91' (ECDSA) to the list of known hosts.
execve("./syz-executor4089303562", ["./syz-executor4089303562"], 0x7ffdcfb22e70 /* 10 vars */) = 0
brk(NULL) = 0x555556b48000
brk(0x555556b48c40) = 0x555556b48c40
arch_prctl(ARCH_SET_FS, 0x555556b48300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4089303562", 4096) = 28
brk(0x555556b69c40) = 0x555556b69c40
brk(0x555556b6a000) = 0x555556b6a000
mprotect(0x7fd3e0f69000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3601 attached
, child_tidptr=0x555556b485d0) = 3601
[pid 3601] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3601] setpgid(0, 0) = 0
[pid 3601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3601] write(3, "1000", 4) = 4
[pid 3601] close(3) = 0
[pid 3601] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3
[pid 3601] bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0
[pid 3601] sendto(3, NULL, 0, MSG_DONTROUTE|MSG_PROBE|MSG_EOR|MSG_SENDPAGE_NOTLAST|MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
[pid 3601] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000700, license="GPL", log_level=4, log_size=64912, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4
[pid 3601] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5
[pid 3601] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=4, attach_type=BPF_SK_SKB_VERDICT, attach_flags=0}, 16) = 0
[pid 3601] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x20000340, value=0x20000040, flags=BPF_ANY}, 32) = 0
[pid 3601] shutdown(3, SHUT_WR) = 0
[pid 3601] exit_group(0) = ?
syzkaller login: [ 51.525998][ T3601] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
[ 51.557464][ T3601] ------------[ cut here ]------------
[ 51.563097][ T3601] WARNING: CPU: 1 PID: 3601 at net/core/stream.c:205 sk_stream_kill_queues+0x2ee/0x3d0
[ 51.572834][ T3601] Modules linked in:
[ 51.576748][ T3601] CPU: 1 PID: 3601 Comm: syz-executor408 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 51.586779][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 51.596906][ T3601] RIP: 0010:sk_stream_kill_queues+0x2ee/0x3d0
[ 51.603013][ T3601] Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 28 02 00 00 e9 60 ff ff ff e8 4b 39 2a fa 0f 0b eb 97 e8 42 39 2a fa <0f> 0b eb a0 e8 39 39 2a fa 0f 0b e9 6a fe ff ff e8 fd 3d 76 fa e9
[ 51.622679][ T3601] RSP: 0018:ffffc900030dfb48 EFLAGS: 00010293
[ 51.628790][ T3601] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 51.636804][ T3601] RDX: ffff888076cc8000 RSI: ffffffff87507dce RDI: 0000000000000005
[ 51.644835][ T3601] RBP: 0000000000000b00 R08: 0000000000000005 R09: 0000000000000000
[ 51.652846][ T3601] R10: 0000000000000b00 R11: 0000000000000004 R12: ffff888078340e28
[ 51.660891][ T3601] R13: ffffffff913100c0 R14: ffff888078340c28 R15: ffff888078340db8
[ 51.668923][ T3601] FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
[ 51.677937][ T3601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 51.684591][ T3601] CR2: 000000002000cf3d CR3: 00000000741a4000 CR4: 00000000003506e0
[ 51.692588][ T3601] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 51.700621][ T3601] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 51.708663][ T3601] Call Trace:
[ 51.712016][ T3601]
[ 51.715019][ T3601] inet_csk_destroy_sock+0x1a5/0x440
[ 51.720341][ T3601] __tcp_close+0xb92/0xf50
[ 51.724831][ T3601] tcp_close+0x29/0xc0
[ 51.728929][ T3601] sock_map_close+0x6b3/0x780
[ 51.733616][ T3601] ? sock_map_update_elem+0x350/0x350
[ 51.739067][ T3601] ? down_write+0xde/0x150
[ 51.743545][ T3601] ? ip_mc_drop_socket+0x16/0x260
[ 51.748651][ T3601] ? locks_remove_file+0x2f7/0x570
[ 51.753815][ T3601] inet_release+0x12e/0x270
[ 51.758407][ T3601] __sock_release+0xcd/0x280
[ 51.763031][ T3601] sock_close+0x18/0x20
[ 51.767270][ T3601] __fput+0x277/0x9d0
[ 51.771287][ T3601] ? __sock_release+0x280/0x280
[ 51.776203][ T3601] task_work_run+0xdd/0x1a0
[ 51.780744][ T3601] do_exit+0xaf1/0x29f0
[ 51.784961][ T3601] ? lock_downgrade+0x6e0/0x6e0
[ 51.789857][ T3601] ? mm_update_next_owner+0x7b0/0x7b0
[ 51.795325][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 51.800563][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 51.805859][ T3601] do_group_exit+0xd2/0x2f0
[ 51.810413][ T3601] __x64_sys_exit_group+0x3a/0x50
[ 51.815606][ T3601] do_syscall_64+0x35/0xb0
[ 51.820047][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 51.826115][ T3601] RIP: 0033:0x7fd3e0eface9
[ 51.830609][ T3601] Code: Unable to access opcode bytes at RIP 0x7fd3e0efacbf.
[ 51.838020][ T3601] RSP: 002b:00007fffee7c94e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 51.846480][ T3601] RAX: ffffffffffffffda RBX: 00007fd3e0f6f330 RCX: 00007fd3e0eface9
[ 51.854466][ T3601] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 51.862503][ T3601] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00007fffee7c96d8
[ 51.870576][ T3601] R10: 00007fffee7c96d8 R11: 0000000000000246 R12: 00007fd3e0f6f330
[ 51.878616][ T3601] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 51.886667][ T3601]
[ 51.889686][ T3601] Kernel panic - not syncing: panic_on_warn set ...
[ 51.896273][ T3601] CPU: 1 PID: 3601 Comm: syz-executor408 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 51.906267][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 51.916319][ T3601] Call Trace:
[ 51.919597][ T3601]
[ 51.922524][ T3601] dump_stack_lvl+0xcd/0x134
[ 51.927131][ T3601] panic+0x2d7/0x636
[ 51.931047][ T3601] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 51.937048][ T3601] ? __warn.cold+0x248/0x2c4
[ 51.941657][ T3601] ? sk_stream_kill_queues+0x2ee/0x3d0
[ 51.947129][ T3601] __warn.cold+0x259/0x2c4
[ 51.951579][ T3601] ? sk_stream_kill_queues+0x2ee/0x3d0
[ 51.957073][ T3601] report_bug+0x1bc/0x210
[ 51.961427][ T3601] handle_bug+0x3c/0x60
[ 51.965613][ T3601] exc_invalid_op+0x14/0x40
[ 51.970184][ T3601] asm_exc_invalid_op+0x1b/0x20
[ 51.975054][ T3601] RIP: 0010:sk_stream_kill_queues+0x2ee/0x3d0
[ 51.981137][ T3601] Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 28 02 00 00 e9 60 ff ff ff e8 4b 39 2a fa 0f 0b eb 97 e8 42 39 2a fa <0f> 0b eb a0 e8 39 39 2a fa 0f 0b e9 6a fe ff ff e8 fd 3d 76 fa e9
[ 52.001460][ T3601] RSP: 0018:ffffc900030dfb48 EFLAGS: 00010293
[ 52.007711][ T3601] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 52.015741][ T3601] RDX: ffff888076cc8000 RSI: ffffffff87507dce RDI: 0000000000000005
[ 52.023713][ T3601] RBP: 0000000000000b00 R08: 0000000000000005 R09: 0000000000000000
[ 52.031709][ T3601] R10: 0000000000000b00 R11: 0000000000000004 R12: ffff888078340e28
[ 52.039688][ T3601] R13: ffffffff913100c0 R14: ffff888078340c28 R15: ffff888078340db8
[ 52.047776][ T3601] ? sk_stream_kill_queues+0x2ee/0x3d0
[ 52.053265][ T3601] ? sk_stream_kill_queues+0x2ee/0x3d0
[ 52.058765][ T3601] inet_csk_destroy_sock+0x1a5/0x440
[ 52.064156][ T3601] __tcp_close+0xb92/0xf50
[ 52.068588][ T3601] tcp_close+0x29/0xc0
[ 52.072662][ T3601] sock_map_close+0x6b3/0x780
[ 52.077446][ T3601] ? sock_map_update_elem+0x350/0x350
[ 52.082822][ T3601] ? down_write+0xde/0x150
[ 52.087249][ T3601] ? ip_mc_drop_socket+0x16/0x260
[ 52.092284][ T3601] ? locks_remove_file+0x2f7/0x570
[ 52.097408][ T3601] inet_release+0x12e/0x270
[ 52.101926][ T3601] __sock_release+0xcd/0x280
[ 52.106541][ T3601] sock_close+0x18/0x20
[ 52.110708][ T3601] __fput+0x277/0x9d0
[ 52.114698][ T3601] ? __sock_release+0x280/0x280
[ 52.119561][ T3601] task_work_run+0xdd/0x1a0
[ 52.124086][ T3601] do_exit+0xaf1/0x29f0
[ 52.128264][ T3601] ? lock_downgrade+0x6e0/0x6e0
[ 52.133126][ T3601] ? mm_update_next_owner+0x7b0/0x7b0
[ 52.138680][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 52.143925][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 52.149140][ T3601] do_group_exit+0xd2/0x2f0
[ 52.153664][ T3601] __x64_sys_exit_group+0x3a/0x50
[ 52.158690][ T3601] do_syscall_64+0x35/0xb0
[ 52.163114][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 52.169014][ T3601] RIP: 0033:0x7fd3e0eface9
[ 52.173434][ T3601] Code: Unable to access opcode bytes at RIP 0x7fd3e0efacbf.
[ 52.180988][ T3601] RSP: 002b:00007fffee7c94e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 52.189422][ T3601] RAX: ffffffffffffffda RBX: 00007fd3e0f6f330 RCX: 00007fd3e0eface9
[ 52.197398][ T3601] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 52.205372][ T3601] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00007fffee7c96d8
[ 52.213445][ T3601] R10: 00007fffee7c96d8 R11: 0000000000000246 R12: 00007fd3e0f6f330
[ 52.221422][ T3601] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 52.229643][ T3601]
[ 52.232961][ T3601] Kernel Offset: disabled
[ 52.237420][ T3601] Rebooting in 86400 seconds..