[ 45.485661][ T1] R10: 00005639df1f26c0 R11: 0000000000000246 R12: 00005639df1f26c0 [ 45.493675][ T1] R13: 0000000000000000 R14: 0000000000000017 R15: 00007ffffe57d430 [ OK ] Started Daily apt download activities. [ OK ] Started Daily apt upgrade and clean activities. [ OK ] Reached target Timers. [ OK ] Started Regular background program processing daemon. [ OK ] Started System Logging Service. [ OK ] Started Permit User Sessions. [ OK ] Started OpenBSD Secure Shell server. [ OK ] Started getty on tty2-tty6 if dbus and logind are not available. [ OK ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Started Getty on tty6. [ OK ] Started Getty on tty5. [ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ 55.523828][ T6731] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-rfkill/6731 [ 55.533492][ T6731] caller is ext4_mb_new_blocks+0xa77/0x3b30 [ 55.539404][ T6731] CPU: 1 PID: 6731 Comm: systemd-rfkill Not tainted 5.7.0-syzkaller #0 [ 55.547968][ T6731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.547974][ T6731] Call Trace: [ 55.547996][ T6731] dump_stack+0x188/0x20d [ 55.548020][ T6731] debug_smp_processor_id.cold+0x88/0x9b [ 55.571407][ T6731] ext4_mb_new_blocks+0xa77/0x3b30 [ 55.576540][ T6731] ? ext4_ext_search_right+0x2ca/0xb20 [ 55.582014][ T6731] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 55.588193][ T6731] ext4_ext_map_blocks+0x2044/0x3410 [ 55.593671][ T6731] ? ext4_ext_release+0x10/0x10 [ 55.598591][ T6731] ? __down_timeout+0x2d0/0x2d0 [ 55.603462][ T6731] ? ext4_es_lookup_extent+0x41d/0xd30 [ 55.608961][ T6731] ext4_map_blocks+0x4cb/0x1640 [ 55.613932][ T6731] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 55.619131][ T6731] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 55.624985][ T6731] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 55.630987][ T6731] ? prandom_u32_state+0xe/0x170 [ 55.636026][ T6731] ? __brelse+0x84/0xa0 [ 55.640187][ T6731] ? __ext4_new_inode+0x144/0x57c0 [ 55.645334][ T6731] ext4_getblk+0xad/0x520 [ 55.649693][ T6731] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 55.655442][ T6731] ? ext4_free_inode+0x17e0/0x17e0 [ 55.660591][ T6731] ext4_bread+0x7c/0x380 [ 55.664852][ T6731] ? ext4_getblk+0x520/0x520 [ 55.669687][ T6731] ? dqget+0xff0/0xff0 [ 55.673778][ T6731] ext4_append+0x153/0x360 [ 55.678189][ T6731] ext4_mkdir+0x5e0/0xdf0 [ 55.682586][ T6731] ? ext4_rmdir+0xde0/0xde0 [ 55.687100][ T6731] ? security_inode_permission+0xc4/0xf0 [ 55.692728][ T6731] vfs_mkdir+0x419/0x690 [ 55.697157][ T6731] do_mkdirat+0x21e/0x280 [ 55.701997][ T6731] ? __ia32_sys_mknod+0xb0/0xb0 [ 55.706867][ T6731] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 55.712864][ T6731] ? do_syscall_64+0x21/0x7d0 [ 55.717547][ T6731] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 55.724647][ T6731] do_syscall_64+0xf6/0x7d0 [ 55.729152][ T6731] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 55.735053][ T6731] RIP: 0033:0x7f7d42df4687 [ 55.739474][ T6731] Code: 00 b8 ff ff ff ff c3 0f 1f 40 00 48 8b 05 09 d8 2b 00 64 c7 00 5f 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 d7 2b 00 f7 d8 64 89 01 48 [ 55.759129][ T6731] RSP: 002b:00007ffc20df9638 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 55.768113][ T6731] RAX: ffffffffffffffda RBX: 000055bf0c757985 RCX: 00007f7d42df4687 [ 55.776245][ T6731] RDX: 00007ffc20df9500 RSI: 00000000000001ed RDI: 000055bf0c757985 [ 55.785098][ T6731] RBP: 00007f7d42df4680 R08: 0000000000000100 R09: 0000000000000000 [ 55.793216][ T6731] R10: 000055bf0c757980 R11: 0000000000000246 R12: 00000000000001ed [ 55.801182][ T6731] R13: 00007ffc20df97c0 R14: 0000000000000000 R15: 0000000000000000 [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.26' (ECDSA) to the list of known hosts. 2020/06/13 01:35:31 fuzzer started 2020/06/13 01:35:32 connecting to host at 10.128.0.26:34917 2020/06/13 01:35:32 checking machine... 2020/06/13 01:35:32 checking revisions... 2020/06/13 01:35:32 testing simple program... syzkaller login: [ 60.447307][ T6804] BUG: using smp_processor_id() in preemptible [00000000] code: syz-fuzzer/6804 [ 60.457604][ T6804] caller is ext4_mb_new_blocks+0xa77/0x3b30 [ 60.463983][ T6804] CPU: 0 PID: 6804 Comm: syz-fuzzer Not tainted 5.7.0-syzkaller #0 [ 60.471898][ T6804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.482764][ T6804] Call Trace: [ 60.486484][ T6804] dump_stack+0x188/0x20d [ 60.491863][ T6804] debug_smp_processor_id.cold+0x88/0x9b [ 60.497540][ T6804] ext4_mb_new_blocks+0xa77/0x3b30 [ 60.502686][ T6804] ? ext4_ext_search_right+0x2ca/0xb20 [ 60.508135][ T6804] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 60.513960][ T6804] ext4_ext_map_blocks+0x2044/0x3410 [ 60.519252][ T6804] ? ext4_ext_release+0x10/0x10 [ 60.524094][ T6804] ? __down_timeout+0x2d0/0x2d0 [ 60.528925][ T6804] ? ext4_es_lookup_extent+0x41d/0xd30 [ 60.534383][ T6804] ext4_map_blocks+0x4cb/0x1640 [ 60.539219][ T6804] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 60.544396][ T6804] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 60.549922][ T6804] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 60.555880][ T6804] ? prandom_u32_state+0xe/0x170 [ 60.560811][ T6804] ? __brelse+0x84/0xa0 [ 60.564943][ T6804] ? __ext4_new_inode+0x144/0x57c0 [ 60.570035][ T6804] ext4_getblk+0xad/0x520 [ 60.574373][ T6804] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 60.580088][ T6804] ? ext4_free_inode+0x17e0/0x17e0 [ 60.585188][ T6804] ext4_bread+0x7c/0x380 [ 60.589408][ T6804] ? ext4_getblk+0x520/0x520 [ 60.594008][ T6804] ? dqget+0xff0/0xff0 [ 60.599025][ T6804] ext4_append+0x153/0x360 [ 60.603447][ T6804] ext4_mkdir+0x5e0/0xdf0 [ 60.607774][ T6804] ? ext4_rmdir+0xde0/0xde0 [ 60.612269][ T6804] ? security_inode_permission+0xc4/0xf0 [ 60.617973][ T6804] vfs_mkdir+0x419/0x690 [ 60.622208][ T6804] do_mkdirat+0x21e/0x280 [ 60.626880][ T6804] ? __ia32_sys_mknod+0xb0/0xb0 [ 60.631709][ T6804] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.637880][ T6804] ? do_syscall_64+0x21/0x7d0 [ 60.642551][ T6804] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.648527][ T6804] do_syscall_64+0xf6/0x7d0 [ 60.653557][ T6804] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.659450][ T6804] RIP: 0033:0x4b02a0 [ 60.663337][ T6804] Code: 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 49 c7 c2 00 00 00 00 49 c7 c0 00 00 00 00 49 c7 c1 00 00 00 00 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 60.683008][ T6804] RSP: 002b:000000c0001034b8 EFLAGS: 00000212 ORIG_RAX: 0000000000000102 [ 60.691410][ T6804] RAX: ffffffffffffffda RBX: 000000c00002e500 RCX: 00000000004b02a0 [ 60.699367][ T6804] RDX: 00000000000001c0 RSI: 000000c000026c00 RDI: ffffffffffffff9c [ 60.707328][ T6804] RBP: 000000c000103510 R08: 0000000000000000 R09: 0000000000000000 [ 60.715293][ T6804] R10: 0000000000000000 R11: 0000000000000212 R12: ffffffffffffffff [ 60.723254][ T6804] R13: 0000000000000061 R14: 0000000000000060 R15: 0000000000000100 [ 60.740472][ T6821] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/6821 [ 60.749974][ T6821] caller is ext4_mb_new_blocks+0xa77/0x3b30 [ 60.755886][ T6821] CPU: 0 PID: 6821 Comm: syz-executor.0 Not tainted 5.7.0-syzkaller #0 [ 60.764111][ T6821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.774664][ T6821] Call Trace: [ 60.777949][ T6821] dump_stack+0x188/0x20d [ 60.782536][ T6821] debug_smp_processor_id.cold+0x88/0x9b [ 60.788158][ T6821] ext4_mb_new_blocks+0xa77/0x3b30 [ 60.793273][ T6821] ? ext4_ext_search_right+0x2ca/0xb20 [ 60.798731][ T6821] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 60.804490][ T6821] ext4_ext_map_blocks+0x2044/0x3410 [ 60.809778][ T6821] ? ext4_ext_release+0x10/0x10 [ 60.814616][ T6821] ? __down_timeout+0x2d0/0x2d0 [ 60.819463][ T6821] ? ext4_es_lookup_extent+0x41d/0xd30 [ 60.824995][ T6821] ext4_map_blocks+0x4cb/0x1640 [ 60.830369][ T6821] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 60.835565][ T6821] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 60.841129][ T6821] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 60.847114][ T6821] ? prandom_u32_state+0xe/0x170 [ 60.852213][ T6821] ? __brelse+0x84/0xa0 [ 60.856617][ T6821] ? __ext4_new_inode+0x144/0x57c0 [ 60.861731][ T6821] ext4_getblk+0xad/0x520 [ 60.866146][ T6821] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 60.871862][ T6821] ? ext4_free_inode+0x17e0/0x17e0 [ 60.876954][ T6821] ext4_bread+0x7c/0x380 [ 60.881210][ T6821] ? ext4_getblk+0x520/0x520 [ 60.885842][ T6821] ? dqget+0xff0/0xff0 [ 60.889937][ T6821] ext4_append+0x153/0x360 [ 60.894362][ T6821] ext4_mkdir+0x5e0/0xdf0 [ 60.899640][ T6821] ? ext4_rmdir+0xde0/0xde0 [ 60.904150][ T6821] ? security_inode_permission+0xc4/0xf0 [ 60.909774][ T6821] vfs_mkdir+0x419/0x690 [ 60.914013][ T6821] do_mkdirat+0x21e/0x280 [ 60.918535][ T6821] ? __ia32_sys_mknod+0xb0/0xb0 [ 60.923404][ T6821] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.929378][ T6821] ? do_syscall_64+0x21/0x7d0 [ 60.934042][ T6821] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.940090][ T6821] do_syscall_64+0xf6/0x7d0 [ 60.944578][ T6821] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 60.950469][ T6821] RIP: 0033:0x45bee7 [ 60.954362][ T6821] Code: 1f 40 00 b8 5a 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 7d c2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d c2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.974142][ T6821] RSP: 002b:00007ffce7152bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 60.982550][ T6821] RAX: ffffffffffffffda RBX: 000000000003a2f8 RCX: 000000000045bee7 [ 60.991148][ T6821] RDX: 0000000000000003 RSI: 00000000000001c0 RDI: 00007ffce7152db0 [ 60.999098][ T6821] RBP: 0000000000000001 R08: 000000000000f8c0 R09: 0000000000003240 [ 61.007048][ T6821] R10: 0000000000000011 R11: 0000000000000246 R12: 00000000000000c2 [ 61.015320][ T6821] R13: 00007ffce7152db0 R14: 8421084210842109 R15: 00007ffce7152dbc [ 61.141031][ T6823] IPVS: ftp: loaded support on port[0] = 21 [ 61.180193][ T6823] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/6823 [ 61.190067][ T6823] caller is ext4_mb_new_blocks+0xa77/0x3b30 [ 61.196056][ T6823] CPU: 1 PID: 6823 Comm: syz-executor.0 Not tainted 5.7.0-syzkaller #0 [ 61.204736][ T6823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.215063][ T6823] Call Trace: [ 61.218455][ T6823] dump_stack+0x188/0x20d [ 61.222783][ T6823] debug_smp_processor_id.cold+0x88/0x9b [ 61.228400][ T6823] ext4_mb_new_blocks+0xa77/0x3b30 [ 61.233504][ T6823] ? ext4_ext_search_right+0x2ca/0xb20 [ 61.239249][ T6823] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 61.244990][ T6823] ext4_ext_map_blocks+0x2044/0x3410 [ 61.250282][ T6823] ? ext4_ext_release+0x10/0x10 [ 61.255155][ T6823] ? __down_timeout+0x2d0/0x2d0 [ 61.260021][ T6823] ? ext4_es_lookup_extent+0x41d/0xd30 [ 61.265523][ T6823] ext4_map_blocks+0x4cb/0x1640 [ 61.270475][ T6823] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 61.275654][ T6823] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 61.281408][ T6823] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 61.287508][ T6823] ? prandom_u32_state+0xe/0x170 [ 61.292460][ T6823] ? __brelse+0x84/0xa0 [ 61.296613][ T6823] ? __ext4_new_inode+0x144/0x57c0 [ 61.301878][ T6823] ext4_getblk+0xad/0x520 [ 61.306244][ T6823] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 61.312217][ T6823] ? ext4_free_inode+0x17e0/0x17e0 [ 61.317352][ T6823] ext4_bread+0x7c/0x380 [ 61.321797][ T6823] ? ext4_getblk+0x520/0x520 [ 61.326491][ T6823] ? dqget+0xff0/0xff0 [ 61.330569][ T6823] ext4_append+0x153/0x360 [ 61.335322][ T6823] ext4_mkdir+0x5e0/0xdf0 [ 61.339648][ T6823] ? ext4_rmdir+0xde0/0xde0 [ 61.344145][ T6823] ? security_inode_permission+0xc4/0xf0 [ 61.349780][ T6823] vfs_mkdir+0x419/0x690 [ 61.354063][ T6823] do_mkdirat+0x21e/0x280 [ 61.358493][ T6823] ? __ia32_sys_mknod+0xb0/0xb0 [ 61.363533][ T6823] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.371590][ T6823] ? do_syscall_64+0x21/0x7d0 [ 61.376266][ T6823] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.382501][ T6823] do_syscall_64+0xf6/0x7d0 [ 61.387013][ T6823] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 61.392885][ T6823] RIP: 0033:0x45bee7 [ 61.396791][ T6823] Code: 1f 40 00 b8 5a 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 7d c2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d c2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 61.416388][ T6823] RSP: 002b:00007ffce7152ac8 EFLAGS: 00000202 ORIG_RAX: 0000000000000053 [ 61.424813][ T6823] RAX: ffffffffffffffda RBX: 000000000078c988 RCX: 000000000045bee7 [ 61.433022][ T6823] RDX: 00007ffce7152b13 RSI: 00000000000001ff RDI: 00007ffce7152b10 [ 61.441039][ T6823] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000003 [ 61.449092][ T6823] R10: 0000000000000064 R11: 0000000000000202 R12: 00000000004185d0 [ 61.457229][ T6823] R13: 00007ffce7152b00 R14: 0000000000000000 R15: 00007ffce7152b10 [ 61.505953][ T6823] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/6823 [ 61.515663][ T6823] caller is ext4_mb_new_blocks+0xa77/0x3b30 [ 61.521716][ T6823] CPU: 1 PID: 6823 Comm: syz-executor.0 Not tainted 5.7.0-syzkaller #0 [ 61.529950][ T6823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.539996][ T6823] Call Trace: [ 61.543290][ T6823] dump_stack+0x188/0x20d [ 61.547639][ T6823] debug_smp_processor_id.cold+0x88/0x9b [ 61.553283][ T6823] ext4_mb_new_blocks+0xa77/0x3b30 [ 61.558432][ T6823] ? ext4_ext_search_right+0x2ca/0xb20 [ 61.563906][ T6823] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 61.569650][ T6823] ext4_ext_map_blocks+0x2044/0x3410 [ 61.574956][ T6823] ? ext4_ext_release+0x10/0x10 [ 61.579846][ T6823] ? __down_timeout+0x2d0/0x2d0 [ 61.584720][ T6823] ? ext4_es_lookup_extent+0x41d/0xd30 [ 61.590216][ T6823] ext4_map_blocks+0x4cb/0x1640 [ 61.595103][ T6823] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 61.600306][ T6823] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 61.605847][ T6823] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 61.611820][ T6823] ? prandom_u32_state+0xe/0x170 [ 61.617198][ T6823] ? __brelse+0x84/0xa0 [ 61.621372][ T6823] ? __ext4_new_inode+0x144/0x57c0 [ 61.626501][ T6823] ext4_getblk+0xad/0x520 [ 61.630850][ T6823] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 61.636852][ T6823] ? ext4_free_inode+0x17e0/0x17e0 [ 61.641969][ T6823] ext4_bread+0x7c/0x380 [ 61.646220][ T6823] ? ext4_getblk+0x520/0x520 [ 61.650811][ T6823] ? dqget+0xff0/0xff0 [ 61.654997][ T6823] ext4_append+0x153/0x360 [ 61.659413][ T6823] ext4_mkdir+0x5e0/0xdf0 [ 61.663767][ T6823] ? ext4_rmdir+0xde0/0xde0 [ 61.668400][ T6823] ? security_inode_permission+0xc4/0xf0 [ 61.674043][ T6823] vfs_mkdir+0x419/0x690 [ 61.678276][ T6823] do_mkdirat+0x21e/0x280 [ 61.682981][ T6823] ? __ia32_sys_mknod+0xb0/0xb0 [ 61.687834][ T6823] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.693888][ T6823] ? do_syscall_64+0x21/0x7d0 [ 61.699706][ T6823] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 61.705696][ T6823] do_syscall_64+0xf6/0x7d0 [ 61.710212][ T6823] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 61.716352][ T6823] RIP: 0033:0x45bee7 [ 61.720261][ T6823] Code: 1f 40 00 b8 5a 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 7d c2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d c2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 61.740137][ T6823] RSP: 002b:00007ffce7152ac8 EFLAGS: 00000202 ORIG_RAX: 0000000000000053 [ 61.748725][ T6823] RAX: ffffffffffffffda RBX: 000000000000f030 RCX: 000000000045bee7 2020/06/13 01:35:33 building call list... [ 61.756739][ T6823] RDX: 00007ffce7152b13 RSI: 00000000000001ff RDI: 00007ffce7152b10 [ 61.764923][ T6823] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000003 [ 61.772997][ T6823] R10: 0000000000000064 R11: 0000000000000202 R12: 0000000000000003 [ 61.781173][ T6823] R13: 00007ffce7152b00 R14: 000000000000f02d R15: 00007ffce7152b10 [ 62.069703][ T342] tipc: TX() has been purged, node left! [ 62.593643][ T342] ================================================================== [ 62.602051][ T342] BUG: KASAN: use-after-free in afs_wake_up_async_call+0x7a7/0x880 [ 62.609944][ T342] Write of size 1 at addr ffff8880925059e4 by task kworker/u4:3/342 [ 62.617993][ T342] [ 62.623193][ T342] CPU: 1 PID: 342 Comm: kworker/u4:3 Not tainted 5.7.0-syzkaller #0 [ 62.631246][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.641305][ T342] Workqueue: netns cleanup_net [ 62.646062][ T342] Call Trace: [ 62.649441][ T342] dump_stack+0x188/0x20d [ 62.653793][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 62.659454][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 62.665025][ T342] ? afs_put_call+0xa70/0xa70 [ 62.669809][ T342] print_address_description.constprop.0.cold+0xd3/0x413 [ 62.676936][ T342] ? vprintk_func+0x97/0x1a6 [ 62.681531][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 62.687101][ T342] kasan_report.cold+0x1f/0x37 [ 62.692228][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 62.697776][ T342] afs_wake_up_async_call+0x7a7/0x880 [ 62.703150][ T342] ? do_raw_spin_lock+0x129/0x2e0 [ 62.708183][ T342] ? afs_close_socket+0x320/0x320 [ 62.713203][ T342] ? rwlock_bug.part.0+0x90/0x90 [ 62.718488][ T342] ? rcu_read_lock_held+0x9c/0xb0 [ 62.723896][ T342] ? rcu_read_lock_held_common+0xa0/0xa0 [ 62.729531][ T342] ? afs_close_socket+0x320/0x320 [ 62.734560][ T342] ? afs_put_call+0xa70/0xa70 [ 62.739237][ T342] rxrpc_notify_socket+0x1e5/0x5e0 [ 62.744822][ T342] ? afs_put_call+0xa70/0xa70 [ 62.749514][ T342] __rxrpc_set_call_completion.part.0+0x172/0x420 [ 62.756342][ T342] rxrpc_call_completed+0xca/0xf0 [ 62.761509][ T342] rxrpc_discard_prealloc+0x786/0xac0 [ 62.768818][ T342] ? lock_sock_nested+0x94/0x110 [ 62.773873][ T342] rxrpc_listen+0x147/0x360 [ 62.778579][ T342] afs_close_socket+0x95/0x320 [ 62.783445][ T342] ? afs_purge_servers+0x16d/0x300 [ 62.788601][ T342] ? afs_rx_discard_new_call+0x50/0x50 [ 62.794142][ T342] ? debug_smp_processor_id+0x2f/0x185 [ 62.799625][ T342] ? init_wait_var_entry+0x200/0x200 [ 62.804935][ T342] ? rcu_read_lock_held_common+0xa0/0xa0 [ 62.810681][ T342] afs_net_exit+0x1bc/0x310 [ 62.815380][ T342] ? afs_net_init+0xe30/0xe30 [ 62.820106][ T342] ops_exit_list.isra.0+0xa8/0x150 [ 62.826267][ T342] cleanup_net+0x511/0xa50 [ 62.830717][ T342] ? unregister_pernet_device+0x70/0x70 [ 62.836267][ T342] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 62.842259][ T342] process_one_work+0x965/0x16a0 [ 62.847227][ T342] ? lock_release+0x800/0x800 [ 62.852057][ T342] ? pwq_dec_nr_in_flight+0x310/0x310 [ 62.857447][ T342] ? rwlock_bug.part.0+0x90/0x90 [ 62.862670][ T342] worker_thread+0x96/0xe10 [ 62.867210][ T342] ? process_one_work+0x16a0/0x16a0 [ 62.872419][ T342] kthread+0x388/0x470 [ 62.876496][ T342] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 62.882213][ T342] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 62.888294][ T342] ret_from_fork+0x24/0x30 [ 62.892842][ T342] [ 62.895186][ T342] Allocated by task 6823: [ 62.899515][ T342] save_stack+0x1b/0x40 [ 62.903672][ T342] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 62.909305][ T342] kmem_cache_alloc_trace+0x153/0x7d0 [ 62.914679][ T342] afs_alloc_call+0x55/0x640 [ 62.919277][ T342] afs_charge_preallocation+0xe9/0x2d0 [ 62.925080][ T342] afs_open_socket+0x292/0x360 [ 62.929930][ T342] afs_net_init+0xa6c/0xe30 [ 62.934471][ T342] ops_init+0xaf/0x420 [ 62.938693][ T342] setup_net+0x2de/0x860 [ 62.942978][ T342] copy_net_ns+0x293/0x590 [ 62.947589][ T342] create_new_namespaces+0x3fb/0xb30 [ 62.952875][ T342] unshare_nsproxy_namespaces+0xbd/0x1f0 [ 62.958504][ T342] ksys_unshare+0x43d/0x8e0 [ 62.963009][ T342] __x64_sys_unshare+0x2d/0x40 [ 62.967774][ T342] do_syscall_64+0xf6/0x7d0 [ 62.972374][ T342] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 62.978282][ T342] [ 62.980608][ T342] Freed by task 342: [ 62.984512][ T342] save_stack+0x1b/0x40 [ 62.988679][ T342] __kasan_slab_free+0xf7/0x140 [ 62.993527][ T342] kfree+0x109/0x2b0 [ 62.997428][ T342] afs_put_call+0x59b/0xa70 [ 63.001980][ T342] rxrpc_discard_prealloc+0x769/0xac0 [ 63.007353][ T342] rxrpc_listen+0x147/0x360 [ 63.011855][ T342] afs_close_socket+0x95/0x320 [ 63.016616][ T342] afs_net_exit+0x1bc/0x310 [ 63.022418][ T342] ops_exit_list.isra.0+0xa8/0x150 [ 63.027525][ T342] cleanup_net+0x511/0xa50 [ 63.031970][ T342] process_one_work+0x965/0x16a0 [ 63.036913][ T342] worker_thread+0x96/0xe10 [ 63.041417][ T342] kthread+0x388/0x470 [ 63.045490][ T342] ret_from_fork+0x24/0x30 [ 63.049978][ T342] [ 63.052313][ T342] The buggy address belongs to the object at ffff888092505800 [ 63.052313][ T342] which belongs to the cache kmalloc-1k of size 1024 [ 63.066365][ T342] The buggy address is located 484 bytes inside of [ 63.066365][ T342] 1024-byte region [ffff888092505800, ffff888092505c00) [ 63.079717][ T342] The buggy address belongs to the page: [ 63.085357][ T342] page:ffffea0002494140 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 63.094465][ T342] flags: 0xfffe0000000200(slab) [ 63.099323][ T342] raw: 00fffe0000000200 ffffea0002a40ec8 ffffea0002a5a708 ffff8880aa000c40 [ 63.107908][ T342] raw: 0000000000000000 ffff888092505000 0000000100000002 0000000000000000 [ 63.116489][ T342] page dumped because: kasan: bad access detected [ 63.122992][ T342] [ 63.125348][ T342] Memory state around the buggy address: [ 63.131067][ T342] ffff888092505880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.139233][ T342] ffff888092505900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.147297][ T342] >ffff888092505980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.155355][ T342] ^ [ 63.162637][ T342] ffff888092505a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.170697][ T342] ffff888092505a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 63.178750][ T342] ================================================================== [ 63.186812][ T342] Disabling lock debugging due to kernel taint [ 63.193091][ T342] Kernel panic - not syncing: panic_on_warn set ... [ 63.199673][ T342] CPU: 1 PID: 342 Comm: kworker/u4:3 Tainted: G B 5.7.0-syzkaller #0 [ 63.209022][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.219080][ T342] Workqueue: netns cleanup_net [ 63.223851][ T342] Call Trace: [ 63.227143][ T342] dump_stack+0x188/0x20d [ 63.231492][ T342] ? afs_wake_up_async_call+0x6b0/0x880 [ 63.237485][ T342] ? afs_put_call+0xa70/0xa70 [ 63.242203][ T342] panic+0x2e3/0x75c [ 63.246125][ T342] ? add_taint.cold+0x16/0x16 [ 63.250820][ T342] ? retint_kernel+0x2b/0x2b [ 63.255406][ T342] ? trace_hardirqs_on+0x55/0x230 [ 63.260513][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 63.266064][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 63.271608][ T342] ? afs_put_call+0xa70/0xa70 [ 63.276352][ T342] end_report+0x4d/0x53 [ 63.281041][ T342] kasan_report.cold+0xd/0x37 [ 63.285725][ T342] ? afs_wake_up_async_call+0x7a7/0x880 [ 63.291272][ T342] afs_wake_up_async_call+0x7a7/0x880 [ 63.297118][ T342] ? do_raw_spin_lock+0x129/0x2e0 [ 63.302144][ T342] ? afs_close_socket+0x320/0x320 [ 63.307207][ T342] ? rwlock_bug.part.0+0x90/0x90 [ 63.312670][ T342] ? rcu_read_lock_held+0x9c/0xb0 [ 63.317694][ T342] ? rcu_read_lock_held_common+0xa0/0xa0 [ 63.323358][ T342] ? afs_close_socket+0x320/0x320 [ 63.328381][ T342] ? afs_put_call+0xa70/0xa70 [ 63.333091][ T342] rxrpc_notify_socket+0x1e5/0x5e0 [ 63.338302][ T342] ? afs_put_call+0xa70/0xa70 [ 63.342986][ T342] __rxrpc_set_call_completion.part.0+0x172/0x420 [ 63.349414][ T342] rxrpc_call_completed+0xca/0xf0 [ 63.354449][ T342] rxrpc_discard_prealloc+0x786/0xac0 [ 63.359829][ T342] ? lock_sock_nested+0x94/0x110 [ 63.364778][ T342] rxrpc_listen+0x147/0x360 [ 63.369301][ T342] afs_close_socket+0x95/0x320 [ 63.374088][ T342] ? afs_purge_servers+0x16d/0x300 [ 63.379209][ T342] ? afs_rx_discard_new_call+0x50/0x50 [ 63.384732][ T342] ? debug_smp_processor_id+0x2f/0x185 [ 63.390210][ T342] ? init_wait_var_entry+0x200/0x200 [ 63.395510][ T342] ? rcu_read_lock_held_common+0xa0/0xa0 [ 63.401186][ T342] afs_net_exit+0x1bc/0x310 [ 63.405765][ T342] ? afs_net_init+0xe30/0xe30 [ 63.410546][ T342] ops_exit_list.isra.0+0xa8/0x150 [ 63.415683][ T342] cleanup_net+0x511/0xa50 [ 63.420206][ T342] ? unregister_pernet_device+0x70/0x70 [ 63.425758][ T342] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 63.431789][ T342] process_one_work+0x965/0x16a0 [ 63.436753][ T342] ? lock_release+0x800/0x800 [ 63.441558][ T342] ? pwq_dec_nr_in_flight+0x310/0x310 [ 63.446964][ T342] ? rwlock_bug.part.0+0x90/0x90 [ 63.451948][ T342] worker_thread+0x96/0xe10 [ 63.456468][ T342] ? process_one_work+0x16a0/0x16a0 [ 63.461662][ T342] kthread+0x388/0x470 [ 63.465707][ T342] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 63.471514][ T342] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 63.477213][ T342] ret_from_fork+0x24/0x30 [ 63.483508][ T342] Kernel Offset: disabled [ 63.487901][ T342] Rebooting in 86400 seconds..