./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3246640497 <...> forked to background, child pid 3208 no interfaces have a carrier [ 27.607181][ T3209] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.617954][ T3209] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.82' (ECDSA) to the list of known hosts. execve("./syz-executor3246640497", ["./syz-executor3246640497"], 0x7ffe75e57aa0 /* 10 vars */) = 0 brk(NULL) = 0x5555556ac000 brk(0x5555556acc40) = 0x5555556acc40 arch_prctl(ARCH_SET_FS, 0x5555556ac300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3246640497", 4096) = 28 brk(0x5555556cdc40) = 0x5555556cdc40 brk(0x5555556ce000) = 0x5555556ce000 mprotect(0x7f54d871d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 chmod("/dev/raw-gadget", 0666) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556ac5d0) = 3630 ./strace-static-x86_64: Process 3630 attached [pid 3630] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3630] setsid() = 1 [pid 3630] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3630] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3630] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3630] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3630] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3630] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3630] unshare(CLONE_NEWNS) = 0 [pid 3630] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3630] unshare(CLONE_NEWIPC) = 0 [pid 3630] unshare(CLONE_NEWCGROUP) = 0 [pid 3630] unshare(CLONE_NEWUTS) = 0 [pid 3630] unshare(CLONE_SYSVSEM) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "16777216", 8) = 8 [pid 3630] close(3) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "536870912", 9) = 9 [pid 3630] close(3) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "1024", 4) = 4 [pid 3630] close(3) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "8192", 4) = 4 [pid 3630] close(3) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "1024", 4) = 4 [pid 3630] close(3) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "1024", 4) = 4 [pid 3630] close(3) = 0 [pid 3630] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3630] close(3) = 0 [pid 3630] getpid() = 1 [pid 3630] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 53.522862][ T3630] dump_stack_lvl+0xd1/0x138 [ 53.527441][ T3630] print_report+0x15e/0x45d [ 53.531941][ T3630] ? __phys_addr+0xc8/0x140 [ 53.536440][ T3630] ? strlen+0x7d/0xa0 [ 53.540516][ T3630] kasan_report+0xbf/0x1f0 [ 53.544924][ T3630] ? strlen+0x7d/0xa0 [ 53.549000][ T3630] strlen+0x7d/0xa0 [ 53.552808][ T3630] set_de_name_and_namelen+0x4c4/0x6a0 [ 53.558532][ T3630] search_by_entry_key+0x4f3/0x960 [ 53.563657][ T3630] reiserfs_readdir_inode+0x24f/0x13b0 [ 53.569202][ T3630] ? reiserfs_dir_fsync+0x140/0x140 [ 53.574502][ T3630] ? lock_release+0x810/0x810 [ 53.579200][ T3630] ? aa_path_link+0x2f0/0x2f0 [ 53.583973][ T3630] ? down_read_killable+0x1ab/0x490 [ 53.589160][ T3630] ? down_read+0x450/0x450 [ 53.593557][ T3630] ? fsnotify_perm.part.0+0x221/0x610 [ 53.598916][ T3630] ? apparmor_file_permission+0x268/0x4e0 [ 53.605058][ T3630] iterate_dir+0x56e/0x6f0 [ 53.609459][ T3630] __x64_sys_getdents64+0x13e/0x2c0 [ 53.614652][ T3630] ? __ia32_sys_getdents+0x2c0/0x2c0 [ 53.619918][ T3630] ? compat_filldir+0x6b0/0x6b0 [ 53.624764][ T3630] ? lockdep_hardirqs_on+0x7d/0x100 [ 53.629941][ T3630] ? _raw_spin_unlock_irq+0x2e/0x50 [ 53.635120][ T3630] ? ptrace_notify+0xfe/0x140 [ 53.639784][ T3630] do_syscall_64+0x39/0xb0 [ 53.644184][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.650061][ T3630] RIP: 0033:0x7f54d86aeeb9 [ 53.654454][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.674041][ T3630] RSP: 002b:00007ffd2e7f79b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 53.682462][ T3630] RAX: ffffffffffffffda RBX: 00007f54d871ded0 RCX: 00007f54d86aeeb9 [ 53.690420][ T3630] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 53.698368][ T3630] RBP: 00007ffd2e7f79c8 R08: 00007f54d871de40 R09: 00007f54d871de40 [ 53.706508][ T3630] R10: 00000000000010e3 R11: 0000000000000246 R12: 00007ffd2e7f79d0 [ 53.714459][ T3630] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 53.722499][ T3630] [ 53.725493][ T3630] [ 53.727788][ T3630] The buggy address belongs to the physical page: [ 53.734172][ T3630] page:ffffea0001ba1c40 refcount:1 mapcount:1 mapping:0000000000000000 index:0x31 pfn:0x6e871 [ 53.744388][ T3630] memcg:ffff888140140000 [ 53.748599][ T3630] anon flags: 0xfff000000a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x7ff) [ 53.759339][ T3630] raw: 00fff000000a0014 ffffea0001ba1c08 ffffea0001ba1c88 ffff88807f607001 [ 53.767897][ T3630] raw: 0000000000000031 0000000000000000 0000000100000000 ffff888140140000 [ 53.776454][ T3630] page dumped because: kasan: bad access detected [ 53.782841][ T3630] page_owner tracks the page as allocated [ 53.788615][ T3630] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 3632, tgid 3632 (udevd), ts 53481954747, free_ts 10561755503 [ 53.805714][ T3630] get_page_from_freelist+0x10b5/0x2d50 [ 53.811260][ T3630] __alloc_pages+0x1cb/0x5b0 [ 53.815857][ T3630] __folio_alloc+0x16/0x40 [ 53.820263][ T3630] vma_alloc_folio+0x155/0x870 [ 53.825011][ T3630] wp_page_copy+0x1eb/0x1ca0 [ 53.829873][ T3630] do_wp_page+0x538/0x1930 [ 53.834267][ T3630] __handle_mm_fault+0x181b/0x3a40 [ 53.839358][ T3630] handle_mm_fault+0x1cc/0x780 [ 53.844106][ T3630] do_user_addr_fault+0x475/0x1210 [ 53.849198][ T3630] exc_page_fault+0x98/0x170 [ 53.853772][ T3630] asm_exc_page_fault+0x26/0x30 [ 53.858610][ T3630] page last free stack trace: [ 53.863276][ T3630] free_pcp_prepare+0x65c/0xd90 [ 53.868116][ T3630] free_unref_page+0x1d/0x4d0 [ 53.872889][ T3630] free_contig_range+0xb5/0x180 [ 53.877730][ T3630] destroy_args+0xa8/0x64c [ 53.882140][ T3630] debug_vm_pgtable+0x2958/0x29e9 [ 53.887168][ T3630] do_one_initcall+0x141/0x780 [ 53.891918][ T3630] kernel_init_freeable+0x6ff/0x788 [ 53.897101][ T3630] kernel_init+0x1e/0x1d0 [ 53.901420][ T3630] ret_from_fork+0x1f/0x30 [ 53.905825][ T3630] [ 53.908126][ T3630] Memory state around the buggy address: [ 53.913738][ T3630] ffff88806e871880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.922048][ T3630] ffff88806e871900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.930093][ T3630] >ffff88806e871980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.938132][ T3630] ^ [ 53.944538][ T3630] ffff88806e871a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.952577][ T3630] ffff88806e871a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 53.960887][ T3630] ================================================================== [ 53.970006][ T3630] Kernel panic - not syncing: panic_on_warn set ... [ 53.976978][ T3630] CPU: 0 PID: 3630 Comm: syz-executor324 Not tainted 6.1.0-rc8-syzkaller-00148-g0d1409e4ff08 #0 [ 53.987395][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 53.997805][ T3630] Call Trace: [ 54.001071][ T3630] [ 54.003983][ T3630] dump_stack_lvl+0xd1/0x138 [ 54.008733][ T3630] panic+0x2cc/0x626 [ 54.012643][ T3630] ? panic_print_sys_info.part.0+0x110/0x110 [ 54.018619][ T3630] ? preempt_schedule_common+0x59/0xc0 [ 54.024076][ T3630] ? preempt_schedule_thunk+0x1a/0x1c [ 54.029445][ T3630] end_report.part.0+0x3f/0x7c [ 54.034193][ T3630] ? strlen+0x7d/0xa0 [ 54.038172][ T3630] kasan_report.cold+0xa/0xf [ 54.042746][ T3630] ? strlen+0x7d/0xa0 [ 54.046716][ T3630] strlen+0x7d/0xa0 [ 54.050532][ T3630] set_de_name_and_namelen+0x4c4/0x6a0 [ 54.056062][ T3630] search_by_entry_key+0x4f3/0x960 [ 54.061160][ T3630] reiserfs_readdir_inode+0x24f/0x13b0 [ 54.066625][ T3630] ? reiserfs_dir_fsync+0x140/0x140 [ 54.071826][ T3630] ? lock_release+0x810/0x810 [ 54.076486][ T3630] ? aa_path_link+0x2f0/0x2f0 [ 54.081152][ T3630] ? down_read_killable+0x1ab/0x490 [ 54.086347][ T3630] ? down_read+0x450/0x450 [ 54.090749][ T3630] ? fsnotify_perm.part.0+0x221/0x610 [ 54.096117][ T3630] ? apparmor_file_permission+0x268/0x4e0 [ 54.101836][ T3630] iterate_dir+0x56e/0x6f0 [ 54.106251][ T3630] __x64_sys_getdents64+0x13e/0x2c0 [ 54.111432][ T3630] ? __ia32_sys_getdents+0x2c0/0x2c0 [ 54.116700][ T3630] ? compat_filldir+0x6b0/0x6b0 [ 54.121535][ T3630] ? lockdep_hardirqs_on+0x7d/0x100 [ 54.126725][ T3630] ? _raw_spin_unlock_irq+0x2e/0x50 [ 54.131920][ T3630] ? ptrace_notify+0xfe/0x140 [ 54.136600][ T3630] do_syscall_64+0x39/0xb0 [ 54.141002][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.147313][ T3630] RIP: 0033:0x7f54d86aeeb9 [ 54.151723][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.171398][ T3630] RSP: 002b:00007ffd2e7f79b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 54.179806][ T3630] RAX: ffffffffffffffda RBX: 00007f54d871ded0 RCX: 00007f54d86aeeb9 [ 54.187757][ T3630] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 54.195706][ T3630] RBP: 00007ffd2e7f79c8 R08: 00007f54d871de40 R09: 00007f54d871de40 [ 54.203659][ T3630] R10: 00000000000010e3 R11: 0000000000000246 R12: 00007ffd2e7f79d0 [ 54.211611][ T3630] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.219739][ T3630] [ 54.223613][ T3630] Kernel Offset: disabled [ 54.227939][ T3630] Rebooting in 86400 seconds..