./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3613046131 <...> DUID 00:04:e3:a1:4c:5b:a4:47:39:93:9a:5d:f6:69:14:97:a9:57 forked to background, child pid 4650 [ 35.140016][ T4651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 35.162565][ T4651] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.16' (ECDSA) to the list of known hosts. execve("./syz-executor3613046131", ["./syz-executor3613046131"], 0x7ffe49cc0ba0 /* 10 vars */) = 0 brk(NULL) = 0x555556909000 brk(0x555556909d00) = 0x555556909d00 arch_prctl(ARCH_SET_FS, 0x5555569093c0) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3613046131", 4096) = 28 brk(0x55555692ad00) = 0x55555692ad00 brk(0x55555692b000) = 0x55555692b000 mprotect(0x7f393b2ac000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 5077 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "5077", 4) = 4 close(3) = 0 chmod("/dev/raw-gadget", 0666) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f393b1f4b70, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f393b1f9580}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f393b1f4b70, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f393b1f9580}, NULL, 8) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5078 attached , child_tidptr=0x555556909690) = 5078 [pid 5078] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5078] setsid() = 1 [pid 5078] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5078] unshare(CLONE_NEWNS) = 0 [pid 5078] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5078] unshare(CLONE_NEWIPC) = 0 [pid 5078] unshare(CLONE_NEWCGROUP) = 0 [pid 5078] unshare(CLONE_NEWUTS) = 0 [pid 5078] unshare(CLONE_SYSVSEM) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "16777216", 8) = 8 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "536870912", 9) = 9 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "8192", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5078] close(3) = 0 [pid 5078] getpid() = 1 [pid 5078] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 59.735537][ T5078] dump_stack_lvl+0xd1/0x138 [ 59.740149][ T5078] print_report+0x15e/0x45d [ 59.744669][ T5078] ? __phys_addr+0xc8/0x140 [ 59.749187][ T5078] ? crc_itu_t+0xd2/0xe0 [ 59.753445][ T5078] kasan_report+0xc0/0xf0 [ 59.757787][ T5078] ? crc_itu_t+0xd2/0xe0 [ 59.762047][ T5078] crc_itu_t+0xd2/0xe0 [ 59.766129][ T5078] udf_finalize_lvid+0xe0/0x1d0 [ 59.770997][ T5078] ? udf_mount+0x40/0x40 [ 59.775253][ T5078] ? get_nr_dirty_inodes+0x11e/0x1b0 [ 59.780544][ T5078] udf_sync_fs+0xea/0x150 [ 59.784884][ T5078] ? udf_finalize_lvid+0x1d0/0x1d0 [ 59.790010][ T5078] sync_filesystem.part.0+0x75/0x1d0 [ 59.795310][ T5078] sync_filesystem+0x8f/0xc0 [ 59.799910][ T5078] generic_shutdown_super+0x74/0x410 [ 59.805212][ T5078] kill_block_super+0x9b/0xf0 [ 59.809913][ T5078] deactivate_locked_super+0x98/0x160 [ 59.815346][ T5078] deactivate_super+0xb1/0xd0 [ 59.820041][ T5078] cleanup_mnt+0x2ae/0x3d0 [ 59.824478][ T5078] task_work_run+0x16f/0x270 [ 59.829090][ T5078] ? task_work_cancel+0x30/0x30 [ 59.833960][ T5078] do_exit+0xb17/0x2a90 [ 59.838137][ T5078] ? lock_downgrade+0x6e0/0x6e0 [ 59.842997][ T5078] ? do_raw_spin_lock+0x124/0x2b0 [ 59.848027][ T5078] ? mm_update_next_owner+0x7b0/0x7b0 [ 59.853418][ T5078] ? rwlock_bug.part.0+0x90/0x90 [ 59.858363][ T5078] ? _raw_spin_unlock_irq+0x23/0x50 [ 59.863585][ T5078] do_group_exit+0xd4/0x2a0 [ 59.868107][ T5078] __x64_sys_exit_group+0x3e/0x50 [ 59.873134][ T5078] do_syscall_64+0x39/0xb0 [ 59.877558][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.883465][ T5078] RIP: 0033:0x7f393b241b39 [ 59.887880][ T5078] Code: Unable to access opcode bytes at 0x7f393b241b0f. [ 59.894890][ T5078] RSP: 002b:00007ffc4085ec28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 59.903309][ T5078] RAX: ffffffffffffffda RBX: 00007f393b2b2410 RCX: 00007f393b241b39 [ 59.911285][ T5078] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 59.919258][ T5078] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000047 [ 59.927233][ T5078] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007f393b2b2410 [ 59.935729][ T5078] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 59.943709][ T5078] [ 59.946730][ T5078] [ 59.949050][ T5078] The buggy address belongs to the physical page: [ 59.955454][ T5078] page:ffffea0001cc4700 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x7311c [ 59.965608][ T5078] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 59.972725][ T5078] raw: 00fff00000000000 ffffea0001cedf48 ffff8880b9842fa0 0000000000000000 [ 59.981315][ T5078] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 59.989890][ T5078] page dumped because: kasan: bad access detected [ 59.996293][ T5078] page_owner tracks the page as freed [ 60.001662][ T5078] page last allocated via order 0, migratetype Movable, gfp_mask 0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), pid 5078, tgid 5078 (syz-executor361), ts 59595563809, free_ts 59668716706 [ 60.019641][ T5078] get_page_from_freelist+0x11bb/0x2d50 [ 60.025208][ T5078] __alloc_pages+0x1cb/0x5c0 [ 60.029807][ T5078] __folio_alloc+0x16/0x40 [ 60.034233][ T5078] vma_alloc_folio+0x155/0x870 [ 60.039002][ T5078] do_wp_page+0x6f6/0x3360 [ 60.043428][ T5078] __handle_mm_fault+0x1fb6/0x3d10 [ 60.048554][ T5078] handle_mm_fault+0x1b6/0x850 [ 60.053331][ T5078] do_user_addr_fault+0x475/0x1210 [ 60.058450][ T5078] exc_page_fault+0x98/0x170 [ 60.063054][ T5078] asm_exc_page_fault+0x26/0x30 [ 60.067916][ T5078] page last free stack trace: [ 60.072581][ T5078] free_pcp_prepare+0x4d0/0x910 [ 60.077438][ T5078] free_unref_page_list+0x176/0xcd0 [ 60.082645][ T5078] release_pages+0xcb1/0x1330 [ 60.087330][ T5078] tlb_batch_pages_flush+0xa8/0x1a0 [ 60.092541][ T5078] tlb_finish_mmu+0x14b/0x7e0 [ 60.097225][ T5078] exit_mmap+0x202/0x7c0 [ 60.101472][ T5078] __mmput+0x128/0x4c0 [ 60.105543][ T5078] mmput+0x60/0x70 [ 60.109266][ T5078] do_exit+0x9ac/0x2a90 [ 60.113436][ T5078] do_group_exit+0xd4/0x2a0 [ 60.117952][ T5078] __x64_sys_exit_group+0x3e/0x50 [ 60.122977][ T5078] do_syscall_64+0x39/0xb0 [ 60.127399][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.133392][ T5078] [ 60.135709][ T5078] Memory state around the buggy address: [ 60.141335][ T5078] ffff88807311bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.149412][ T5078] ffff88807311bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.157495][ T5078] >ffff88807311c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.165556][ T5078] ^ [ 60.169620][ T5078] ffff88807311c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.177687][ T5078] ffff88807311c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 60.185758][ T5078] ================================================================== [ 60.224948][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 60.242468][ T5078] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.249700][ T5078] CPU: 1 PID: 5078 Comm: syz-executor361 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 [ 60.259616][ T5078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 60.269682][ T5078] Call Trace: [ 60.272975][ T5078] [ 60.275916][ T5078] dump_stack_lvl+0xd1/0x138 [ 60.280550][ T5078] panic+0x2cc/0x626 [ 60.284487][ T5078] ? panic_print_sys_info.part.0+0x112/0x112 [ 60.290516][ T5078] ? preempt_schedule_thunk+0x1a/0x20 [ 60.295929][ T5078] ? preempt_schedule_common+0x59/0xc0 [ 60.301425][ T5078] check_panic_on_warn.cold+0x19/0x35 [ 60.306835][ T5078] end_report.part.0+0x36/0x73 [ 60.311622][ T5078] ? crc_itu_t+0xd2/0xe0 [ 60.315889][ T5078] kasan_report.cold+0xa/0xf [ 60.320500][ T5078] ? crc_itu_t+0xd2/0xe0 [ 60.324772][ T5078] crc_itu_t+0xd2/0xe0 [ 60.328863][ T5078] udf_finalize_lvid+0xe0/0x1d0 [ 60.333742][ T5078] ? udf_mount+0x40/0x40 [ 60.338009][ T5078] ? get_nr_dirty_inodes+0x11e/0x1b0 [ 60.343326][ T5078] udf_sync_fs+0xea/0x150 [ 60.347685][ T5078] ? udf_finalize_lvid+0x1d0/0x1d0 [ 60.352821][ T5078] sync_filesystem.part.0+0x75/0x1d0 [ 60.358142][ T5078] sync_filesystem+0x8f/0xc0 [ 60.362766][ T5078] generic_shutdown_super+0x74/0x410 [ 60.368081][ T5078] kill_block_super+0x9b/0xf0 [ 60.372789][ T5078] deactivate_locked_super+0x98/0x160 [ 60.378196][ T5078] deactivate_super+0xb1/0xd0 [ 60.382908][ T5078] cleanup_mnt+0x2ae/0x3d0 [ 60.387351][ T5078] task_work_run+0x16f/0x270 [ 60.391971][ T5078] ? task_work_cancel+0x30/0x30 [ 60.396844][ T5078] do_exit+0xb17/0x2a90 [ 60.401031][ T5078] ? lock_downgrade+0x6e0/0x6e0 [ 60.405901][ T5078] ? do_raw_spin_lock+0x124/0x2b0 [ 60.410946][ T5078] ? mm_update_next_owner+0x7b0/0x7b0 [ 60.416345][ T5078] ? rwlock_bug.part.0+0x90/0x90 [ 60.421313][ T5078] ? _raw_spin_unlock_irq+0x23/0x50 [ 60.426542][ T5078] do_group_exit+0xd4/0x2a0 [ 60.431076][ T5078] __x64_sys_exit_group+0x3e/0x50 [ 60.436117][ T5078] do_syscall_64+0x39/0xb0 [ 60.440556][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.446483][ T5078] RIP: 0033:0x7f393b241b39 [ 60.450913][ T5078] Code: Unable to access opcode bytes at 0x7f393b241b0f. [ 60.457948][ T5078] RSP: 002b:00007ffc4085ec28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 60.466385][ T5078] RAX: ffffffffffffffda RBX: 00007f393b2b2410 RCX: 00007f393b241b39 [ 60.474374][ T5078] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 60.482361][ T5078] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000047 [ 60.490347][ T5078] R10: 000080001d00c0d0 R11: 0000000000000246 R12: 00007f393b2b2410 [ 60.498336][ T5078] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 60.506326][ T5078] [ 60.509497][ T5078] Kernel Offset: disabled [ 60.513815][ T5078] Rebooting in 86400 seconds..