./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2953388862
<...>
Warning: Permanently added '10.128.1.50' (ED25519) to the list of known hosts.
execve("./syz-executor2953388862", ["./syz-executor2953388862"], 0x7fff794e4940 /* 10 vars */) = 0
brk(NULL) = 0x555555899000
brk(0x555555899d00) = 0x555555899d00
arch_prctl(ARCH_SET_FS, 0x555555899380) = 0
set_tid_address(0x555555899650) = 5033
set_robust_list(0x555555899660, 24) = 0
rseq(0x555555899ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2953388862", 4096) = 28
getrandom("\x30\x53\xb6\x07\xb1\xc0\x67\xd6", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555899d00
brk(0x5555558bad00) = 0x5555558bad00
brk(0x5555558bb000) = 0x5555558bb000
mprotect(0x7f4cb528c000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
mkdir("./syzkaller.0nzmm2", 0700) = 0
chmod("./syzkaller.0nzmm2", 0777) = 0
chdir("./syzkaller.0nzmm2") = 0
mkdir("./0", 0777) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555899650) = 5034
./strace-static-x86_64: Process 5034 attached
[pid 5034] set_robust_list(0x555555899660, 24) = 0
[pid 5034] chdir("./0") = 0
[pid 5034] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5034] setpgid(0, 0) = 0
[pid 5034] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5034] write(3, "1000", 4) = 4
[pid 5034] close(3) = 0
[pid 5034] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5034] socket(AF_UNIX, SOCK_DGRAM, 0) = 3
[pid 5034] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000540, license="GPL", log_level=4, log_size=64912, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4
[pid 5034] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5
[pid 5034] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=4, attach_type=BPF_SK_SKB_VERDICT, attach_flags=0}, 16) = 0
[pid 5034] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x20000180, value=0x200000c0, flags=BPF_ANY}, 32) = 0
[pid 5034] bind(3, {sa_family=AF_UNIX, sun_path="./file0"}, 110) = 0
[pid 5034] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5034] write(6, "7", 1) = 1
[ 58.934310][ T5034] FAULT_INJECTION: forcing a failure.
[ 58.934310][ T5034] name failslab, interval 1, probability 0, space 0, times 1
[ 58.947059][ T5034] CPU: 0 PID: 5034 Comm: syz-executor295 Not tainted 6.5.0-syzkaller-03967-gbd6c11bc43c4 #0
[ 58.957316][ T5034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 58.967365][ T5034] Call Trace:
[ 58.970646][ T5034]
[ 58.973586][ T5034] dump_stack_lvl+0x125/0x1b0
[ 58.978283][ T5034] should_fail_ex+0x496/0x5b0
[ 58.982958][ T5034] should_failslab+0x9/0x20
[ 58.987498][ T5034] kmem_cache_alloc_node+0x389/0x3f0
[ 58.992814][ T5034] ? __alloc_skb+0x287/0x330
[ 58.997426][ T5034] __alloc_skb+0x287/0x330
[ 59.001847][ T5034] ? __napi_build_skb+0x50/0x50
[ 59.006703][ T5034] ? mark_held_locks+0x9f/0xe0
[ 59.011584][ T5034] ? kasan_quarantine_put+0x102/0x230
[ 59.016977][ T5034] ? find_held_lock+0x2d/0x110
[ 59.021759][ T5034] alloc_skb_with_frags+0xe4/0x710
[ 59.026905][ T5034] sock_alloc_send_pskb+0x7c8/0x950
[ 59.032122][ T5034] ? aa_profile_af_perm+0x470/0x470
[ 59.037353][ T5034] ? tomoyo_unix_entry+0x1d2/0x650
[ 59.042461][ T5034] ? sock_wmalloc+0x120/0x120
[ 59.047140][ T5034] ? unix_gc+0x12b0/0x12b0
[ 59.051559][ T5034] ? apparmor_socket_getpeersec_dgram+0x9/0x10
[ 59.057715][ T5034] unix_dgram_sendmsg+0x455/0x1c30
[ 59.062833][ T5034] ? aa_sk_perm+0x2c1/0xae0
[ 59.067360][ T5034] ? unix_dgram_connect+0xba0/0xba0
[ 59.072583][ T5034] ? aa_af_perm+0x260/0x260
[ 59.077100][ T5034] ? reacquire_held_locks+0x4b0/0x4b0
[ 59.082512][ T5034] ? bpf_lsm_socket_sendmsg+0x9/0x10
[ 59.087803][ T5034] ? unix_dgram_connect+0xba0/0xba0
[ 59.093009][ T5034] sock_sendmsg+0xd9/0x180
[ 59.097425][ T5034] ____sys_sendmsg+0x2ac/0x940
[ 59.102188][ T5034] ? copy_msghdr_from_user+0x10b/0x160
[ 59.107657][ T5034] ? kernel_sendmsg+0x50/0x50
[ 59.112344][ T5034] ? find_held_lock+0x2d/0x110
[ 59.117134][ T5034] ___sys_sendmsg+0x135/0x1d0
[ 59.121811][ T5034] ? do_recvmmsg+0x740/0x740
[ 59.126411][ T5034] ? __lock_acquire+0x182f/0x5de0
[ 59.131459][ T5034] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 59.137470][ T5034] ? __fget_light+0x1fc/0x260
[ 59.142165][ T5034] __sys_sendmmsg+0x1a1/0x450
[ 59.146844][ T5034] ? __ia32_sys_sendmsg+0xb0/0xb0
[ 59.151865][ T5034] ? cgroup_update_frozen+0x144/0x6b0
[ 59.157253][ T5034] ? rcu_is_watching+0x12/0xb0
[ 59.162022][ T5034] ? _raw_spin_unlock_irq+0x29/0x50
[ 59.167230][ T5034] __x64_sys_sendmmsg+0x9c/0x100
[ 59.172180][ T5034] do_syscall_64+0x38/0xb0
[ 59.176630][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 59.182549][ T5034] RIP: 0033:0x7f4cb52195a9
[ 59.186958][ T5034] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 59.206563][ T5034] RSP: 002b:00007fffe7d1b5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[ 59.214969][ T5034] RAX: ffffffffffffffda RBX: 00007fffe7d1b5e0 RCX: 00007f4cb52195a9
[ 59.222960][ T5034] RDX: 0000000000000001 RSI: 00000000200063c0 RDI: 0000000000000003
[pid 5034] sendmmsg(3, [{msg_hdr={msg_name={sa_family=AF_UNIX, sun_path="./file0"}, msg_namelen=110, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}}], 1, 0) = -1 ENOBUFS (No buffer space available)
[pid 5034] exit_group(0) = ?
[pid 5034] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5034, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55555589a6f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFSOCK|0700, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/file0") = 0
getdents64(3, 0x55555589a6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5035 attached
, child_tidptr=0x555555899650) = 5035
[pid 5035] set_robust_list(0x555555899660, 24) = 0
[pid 5035] chdir("./1") = 0
[pid 5035] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5035] setpgid(0, 0) = 0
[pid 5035] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5035] write(3, "1000", 4) = 4
[pid 5035] close(3) = 0
[pid 5035] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5035] socket(AF_UNIX, SOCK_DGRAM, 0) = 3
[pid 5035] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000540, license="GPL", log_level=4, log_size=64912, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4
[pid 5035] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5
[pid 5035] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=4, attach_type=BPF_SK_SKB_VERDICT, attach_flags=0}, 16) = 0
[pid 5035] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x20000180, value=0x200000c0, flags=BPF_ANY}, 32) = 0
[pid 5035] bind(3, {sa_family=AF_UNIX, sun_path="./file0"}, 110) = 0
[pid 5035] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5035] write(6, "7", 1) = 1
[pid 5035] sendmmsg(3, [{msg_hdr={msg_name={sa_family=AF_UNIX, sun_path="./file0"}, msg_namelen=110, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, msg_len=0}], 1, 0) = 1
[pid 5035] exit_group(0) = ?
[pid 5035] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5035, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55555589a6f0 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 59.230924][ T5034] RBP: 0000000000000001 R08: 00007fffe7d1b357 R09: 00007fffe7d8c1a0
[ 59.238892][ T5034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 59.246854][ T5034] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 59.254846][ T5034]
newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/binderfs") = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFSOCK|0700, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/file0") = 0
getdents64(3, 0x55555589a6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5036 attached
, child_tidptr=0x555555899650) = 5036
[pid 5036] set_robust_list(0x555555899660, 24) = 0
[pid 5036] chdir("./2") = 0
[pid 5036] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5036] setpgid(0, 0) = 0
[pid 5036] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5036] write(3, "1000", 4) = 4
[pid 5036] close(3) = 0
[pid 5036] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5036] socket(AF_UNIX, SOCK_DGRAM, 0) = 3
[pid 5036] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000540, license="GPL", log_level=4, log_size=64912, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4
[pid 5036] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5
[pid 5036] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=4, attach_type=BPF_SK_SKB_VERDICT, attach_flags=0}, 16) = 0
[pid 5036] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x20000180, value=0x200000c0, flags=BPF_ANY}, 32) = 0
[pid 5036] bind(3, {sa_family=AF_UNIX, sun_path="./file0"}, 110) = 0
[pid 5036] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5036] write(6, "7", 1) = 1
[ 59.315842][ T26] ==================================================================
[ 59.323922][ T26] BUG: KASAN: slab-use-after-free in consume_skb+0x32/0x170
[ 59.331207][ T26] Read of size 4 at addr ffff8880742afea4 by task kworker/1:1/26
[ 59.336909][ T5036] FAULT_INJECTION: forcing a failure.
[ 59.336909][ T5036] name failslab, interval 1, probability 0, space 0, times 0
[ 59.338902][ T26]
[ 59.338910][ T26] CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.5.0-syzkaller-03967-gbd6c11bc43c4 #0
[ 59.338937][ T26] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 59.338955][ T26] Workqueue: events sk_psock_destroy
[ 59.378835][ T26] Call Trace:
[ 59.382124][ T26]
[ 59.385062][ T26] dump_stack_lvl+0xd9/0x1b0
[ 59.389675][ T26] print_report+0xc4/0x620
[ 59.394124][ T26] ? __virt_addr_valid+0x5e/0x2d0
[ 59.399176][ T26] ? __phys_addr+0xc6/0x140
[ 59.403708][ T26] kasan_report+0xda/0x110
[ 59.408157][ T26] ? consume_skb+0x32/0x170
[ 59.412688][ T26] ? consume_skb+0x32/0x170
[ 59.417217][ T26] kasan_check_range+0xef/0x190
[ 59.422083][ T26] consume_skb+0x32/0x170
[ 59.426452][ T26] __sk_msg_free+0x230/0x380
[ 59.431060][ T26] ? lockdep_hardirqs_on+0x7d/0x100
[ 59.436287][ T26] ? _raw_spin_unlock_irqrestore+0x3b/0x70
[ 59.442122][ T26] sk_psock_destroy+0x335/0xa50
[ 59.446999][ T26] process_one_work+0xaa2/0x16f0
[ 59.451965][ T26] ? bpf_jit_binary_pack_hdr+0x200/0x200
[ 59.457610][ T26] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 59.463012][ T26] ? spin_bug+0x1d0/0x1d0
[ 59.467373][ T26] worker_thread+0x687/0x1110
[ 59.472082][ T26] ? __kthread_parkme+0x152/0x220
[ 59.477122][ T26] ? process_one_work+0x16f0/0x16f0
[ 59.482345][ T26] kthread+0x33a/0x430
[ 59.486431][ T26] ? kthread_complete_and_exit+0x40/0x40
[ 59.492083][ T26] ret_from_fork+0x2c/0x70
[ 59.496713][ T26] ? kthread_complete_and_exit+0x40/0x40
[ 59.502365][ T26] ret_from_fork_asm+0x11/0x20
[ 59.507162][ T26]
[ 59.510451][ T26]
[ 59.510637][ T5036] CPU: 0 PID: 5036 Comm: syz-executor295 Not tainted 6.5.0-syzkaller-03967-gbd6c11bc43c4 #0
[ 59.512761][ T26] Allocated by task 5035:
[ 59.512773][ T26] kasan_save_stack+0x33/0x50
[ 59.522808][ T5036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 59.527108][ T26] kasan_set_track+0x25/0x30
[ 59.531763][ T5036] Call Trace:
[ 59.531774][ T5036]
[ 59.541792][ T26] __kasan_slab_alloc+0x81/0x90
[ 59.546431][ T5036] dump_stack_lvl+0x125/0x1b0
[ 59.549688][ T26] kmem_cache_alloc_node+0x185/0x3f0
[ 59.552610][ T5036] should_fail_ex+0x496/0x5b0
[ 59.557432][ T26] __alloc_skb+0x287/0x330
[ 59.562091][ T5036] should_failslab+0x9/0x20
[ 59.567339][ T26] alloc_skb_with_frags+0xe4/0x710
[ 59.571993][ T5036] kmem_cache_alloc+0x33a/0x3b0
[ 59.576382][ T26] sock_alloc_send_pskb+0x7c8/0x950
[ 59.580864][ T5036] ? preempt_count_sub+0x150/0x150
[ 59.585942][ T26] unix_dgram_sendmsg+0x455/0x1c30
[ 59.590776][ T5036] jbd2__journal_start+0x190/0x690
[ 59.595946][ T26] sock_sendmsg+0xd9/0x180
[ 59.601040][ T5036] __ext4_journal_start_sb+0x40f/0x5c0
[ 59.606115][ T26] ____sys_sendmsg+0x2ac/0x940
[ 59.611204][ T5036] ? ext4_dirty_inode+0xa1/0x130
[ 59.615590][ T26] ___sys_sendmsg+0x135/0x1d0
[ 59.621029][ T5036] ? ext4_setattr+0x29a0/0x29a0
[ 59.625762][ T26] __sys_sendmmsg+0x1a1/0x450
[ 59.630677][ T5036] ext4_dirty_inode+0xa1/0x130
[ 59.635327][ T26] __x64_sys_sendmmsg+0x9c/0x100
[ 59.640157][ T5036] ? rcu_is_watching+0x12/0xb0
[ 59.644807][ T26] do_syscall_64+0x38/0xb0
[ 59.649555][ T5036] __mark_inode_dirty+0x1e0/0xd50
[ 59.654465][ T26] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 59.659211][ T5036] generic_update_time+0xcf/0xf0
[ 59.663594][ T26]
[ 59.663599][ T26] Freed by task 26:
[ 59.668605][ T5036] touch_atime+0x4eb/0x5d0
[ 59.674465][ T26] kasan_save_stack+0x33/0x50
[ 59.679382][ T5036] unix_find_other+0x6c4/0x820
[ 59.681682][ T26] kasan_set_track+0x25/0x30
[ 59.685471][ T5036] ? unix_bind+0x1440/0x1440
[ 59.689852][ T26] kasan_save_free_info+0x2b/0x40
[ 59.694509][ T5036] ? apparmor_socket_getpeersec_dgram+0x9/0x10
[ 59.699239][ T26] ____kasan_slab_free+0x15e/0x1b0
[ 59.703815][ T5036] unix_dgram_sendmsg+0xdc8/0x1c30
[ 59.708371][ T26] slab_free_freelist_hook+0x10b/0x1e0
[ 59.713376][ T5036] ? aa_sk_perm+0x2c1/0xae0
[ 59.719492][ T26] kmem_cache_free+0xf0/0x490
[ 59.724585][ T5036] ? unix_dgram_connect+0xba0/0xba0
[ 59.729672][ T26] kfree_skbmem+0xef/0x1b0
[ 59.735104][ T5036] ? aa_af_perm+0x260/0x260
[ 59.739582][ T26] kfree_skb_reason+0x10e/0x210
[ 59.744234][ T5036] ? reacquire_held_locks+0x4b0/0x4b0
[ 59.749402][ T26] sk_psock_destroy+0x18d/0xa50
[ 59.753806][ T5036] ? bpf_lsm_socket_sendmsg+0x9/0x10
[ 59.758268][ T26] process_one_work+0xaa2/0x16f0
[ 59.763094][ T5036] ? unix_dgram_connect+0xba0/0xba0
[ 59.768446][ T26] worker_thread+0x687/0x1110
[ 59.773273][ T5036] sock_sendmsg+0xd9/0x180
[ 59.778524][ T26] kthread+0x33a/0x430
[ 59.783440][ T5036] ____sys_sendmsg+0x2ac/0x940
[ 59.788605][ T26] ret_from_fork+0x2c/0x70
[ 59.793262][ T5036] ? copy_msghdr_from_user+0x10b/0x160
[ 59.797646][ T26] ret_from_fork_asm+0x11/0x20
[ 59.801688][ T5036] ? kernel_sendmsg+0x50/0x50
[ 59.806421][ T26]
[ 59.806427][ T26] The buggy address belongs to the object at ffff8880742afdc0
[ 59.806427][ T26] which belongs to the cache skbuff_head_cache of size 240
[ 59.810819][ T5036] ? find_held_lock+0x2d/0x110
[ 59.816239][ T26] The buggy address is located 228 bytes inside of
[ 59.816239][ T26] freed 240-byte region [ffff8880742afdc0, ffff8880742afeb0)
[ 59.820991][ T5036] ___sys_sendmsg+0x135/0x1d0
[ 59.825628][ T26]
[ 59.825634][ T26] The buggy address belongs to the physical page:
[ 59.825643][ T26] page:ffffea0001d0abc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x742af
[ 59.827944][ T5036] ? do_recvmmsg+0x740/0x740
[ 59.842480][ T26] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 59.847218][ T5036] ? __lock_acquire+0x182f/0x5de0
[ 59.860980][ T26] page_type: 0xffffffff()
[ 59.861002][ T26] raw: 00fff00000000200 ffff88814226c500 dead000000000122 0000000000000000
[ 59.865652][ T5036] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 59.867953][ T26] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[ 59.874345][ T5036] ? __fget_light+0x1fc/0x260
[ 59.884441][ T26] page dumped because: kasan: bad access detected
[ 59.884453][ T26] page_owner tracks the page as allocated
[ 59.889013][ T5036] __sys_sendmmsg+0x1a1/0x450
[ 59.896519][ T26] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 5028, tgid 5028 (sshd), ts 59270976049, free_ts 53053702437
[ 59.901522][ T5036] ? __ia32_sys_sendmsg+0xb0/0xb0
[ 59.905825][ T26] post_alloc_hook+0x2d2/0x350
[ 59.914395][ T5036] ? cgroup_update_frozen+0x144/0x6b0
[ 59.920352][ T26] get_page_from_freelist+0x10a9/0x31e0
[ 59.928937][ T5036] ? find_held_lock+0x2d/0x110
[ 59.933576][ T26] __alloc_pages+0x1d0/0x4a0
[ 59.939993][ T5036] ? _raw_spin_unlock_irq+0x23/0x50
[ 59.945672][ T26] alloc_pages+0x1a9/0x270
[ 59.950326][ T5036] ? lockdep_hardirqs_on+0x7d/0x100
[ 59.967914][ T26] allocate_slab+0x24e/0x380
[ 59.972936][ T5036] __x64_sys_sendmmsg+0x9c/0x100
[ 59.977659][ T26] ___slab_alloc+0x8bc/0x1570
[ 59.983012][ T5036] do_syscall_64+0x38/0xb0
[ 59.988531][ T26] __slab_alloc.constprop.0+0x56/0xa0
[ 59.993317][ T5036] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 59.997877][ T26] kmem_cache_alloc+0x392/0x3b0
[ 60.003056][ T5036] RIP: 0033:0x7f4cb52195a9
[ 60.007443][ T26] skb_clone+0x171/0x3c0
[ 60.012618][ T5036] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 60.017178][ T26] dev_queue_xmit_nit+0x38b/0xb80
[ 60.022091][ T5036] RSP: 002b:00007fffe7d1b5b8 EFLAGS: 00000246
[ 60.026756][ T26] dev_hard_start_xmit+0x59/0x6c0
[ 60.031144][ T5036] ORIG_RAX: 0000000000000133
[ 60.036486][ T26] sch_direct_xmit+0x1ac/0xc20
[ 60.042363][ T5036] RAX: ffffffffffffffda RBX: 00007fffe7d1b5e0 RCX: 00007f4cb52195a9
[ 60.047192][ T26] __dev_queue_xmit+0x1282/0x3d80
[pid 5036] sendmmsg(3, [{msg_hdr={msg_name={sa_family=AF_UNIX, sun_path="./file0"}, msg_namelen=110, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, msg_len=0}], 1, 0) = 1
[pid 5036] exit_group(0) = ?
[pid 5036] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5036, si_uid=0, si_status=0, si_utime=0, si_stime=14 /* 0.14 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55555589a6f0 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./2/binderfs") = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/file0", {st_mode=S_IFSOCK|0700, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./2/file0") = 0
getdents64(3, 0x55555589a6f0 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./2") = 0
mkdir("./3", 0777) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555899650) = 5037
[ 60.051591][ T5036] RDX: 0000000000000001 RSI: 00000000200063c0 RDI: 0000000000000003
[ 60.055805][ T26] ip_finish_output2+0x1626/0x24c0
[ 60.075391][ T5036] RBP: 0000000000000001 R08: 00007fffe7d1b357 R09: 00007fffe7d8c1a0
[ 60.080390][ T26] __ip_finish_output+0x38b/0x640
[ 60.086434][ T5036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 60.091428][ T26] ip_finish_output+0x31/0x310
[ 60.096079][ T5036] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 60.100813][ T26] page last free stack trace:
[ 60.100820][ T26] free_unref_page_prepare+0x508/0xb90
[ 60.108784][ T5036]
[ 60.113758][ T26] free_unref_page+0x33/0x3b0
[ 60.179296][ T26] __folio_put+0xc5/0x140
[ 60.183634][ T26] anon_pipe_buf_release+0x3fa/0x4b0
[ 60.188927][ T26] pipe_read+0x635/0x1270
[ 60.193257][ T26] vfs_read+0x7ef/0x930
[ 60.197415][ T26] ksys_read+0x1f0/0x250
[ 60.201663][ T26] do_syscall_64+0x38/0xb0
[ 60.206085][ T26] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 60.211988][ T26]
[ 60.214303][ T26] Memory state around the buggy address:
[ 60.219921][ T26] ffff8880742afd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 60.227980][ T26] ffff8880742afe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 60.236035][ T26] >ffff8880742afe80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 60.244086][ T26] ^
[ 60.249185][ T26] ffff8880742aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 60.257241][ T26] ffff8880742aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
./strace-static-x86_64: Process 5037 attached
[pid 5037] set_robust_list(0x555555899660, 24) = 0
[pid 5037] chdir("./3") = 0
[pid 5037] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5037] setpgid(0, 0) = 0
[pid 5037] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5037] write(3, "1000", 4) = 4
[pid 5037] close(3) = 0
[pid 5037] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5037] socket(AF_UNIX, SOCK_DGRAM, 0) = 3
[pid 5037] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000540, license="GPL", log_level=4, log_size=64912, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4
[pid 5037] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5
[pid 5037] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=4, attach_type=BPF_SK_SKB_VERDICT, attach_flags=0}, 16) = 0
[pid 5037] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x20000180, value=0x200000c0, flags=BPF_ANY}, 32) = 0
[pid 5037] bind(3, {sa_family=AF_UNIX, sun_path="./file0"}, 110) = 0
[pid 5037] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5037] write(6, "7", 1) = 1
[pid 5037] sendmmsg(3, [{msg_hdr={msg_name={sa_family=AF_UNIX, sun_path="./file0"}, msg_namelen=110, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, msg_len=0}], 1, 0) = 1
[pid 5037] exit_group(0) = ?
[ 60.265293][ T26] ==================================================================
[ 60.276258][ T26] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 60.283473][ T26] CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.5.0-syzkaller-03967-gbd6c11bc43c4 #0
[ 60.293035][ T26] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 60.303110][ T26] Workqueue: events sk_psock_destroy
[ 60.308422][ T26] Call Trace:
[ 60.311697][ T26]
[ 60.314624][ T26] dump_stack_lvl+0xd9/0x1b0
[ 60.319230][ T26] panic+0x6a4/0x750
[ 60.323134][ T26] ? panic_smp_self_stop+0xa0/0xa0
[ 60.328252][ T26] ? preempt_schedule_thunk+0x1a/0x30
[ 60.333643][ T26] ? preempt_schedule_common+0x45/0xc0
[ 60.339130][ T26] check_panic_on_warn+0xab/0xb0
[ 60.344077][ T26] end_report+0x108/0x150
[ 60.348435][ T26] kasan_report+0xea/0x110
[ 60.352867][ T26] ? consume_skb+0x32/0x170
[ 60.357380][ T26] ? consume_skb+0x32/0x170
[ 60.361899][ T26] kasan_check_range+0xef/0x190
[ 60.366754][ T26] consume_skb+0x32/0x170
[ 60.371091][ T26] __sk_msg_free+0x230/0x380
[ 60.375689][ T26] ? lockdep_hardirqs_on+0x7d/0x100
[ 60.380902][ T26] ? _raw_spin_unlock_irqrestore+0x3b/0x70
[ 60.386716][ T26] sk_psock_destroy+0x335/0xa50
[ 60.391582][ T26] process_one_work+0xaa2/0x16f0
[ 60.396532][ T26] ? bpf_jit_binary_pack_hdr+0x200/0x200
[ 60.402169][ T26] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 60.407550][ T26] ? spin_bug+0x1d0/0x1d0
[ 60.411897][ T26] worker_thread+0x687/0x1110
[ 60.416594][ T26] ? __kthread_parkme+0x152/0x220
[ 60.421630][ T26] ? process_one_work+0x16f0/0x16f0
[ 60.426838][ T26] kthread+0x33a/0x430
[ 60.430916][ T26] ? kthread_complete_and_exit+0x40/0x40
[ 60.436553][ T26] ret_from_fork+0x2c/0x70
[ 60.440974][ T26] ? kthread_complete_and_exit+0x40/0x40
[ 60.446786][ T26] ret_from_fork_asm+0x11/0x20
[ 60.451569][ T26]
[ 60.454767][ T26] Kernel Offset: disabled
[ 60.459078][ T26] Rebooting in 86400 seconds..