./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1924423088 <...> Warning: Permanently added '10.128.1.95' (ECDSA) to the list of known hosts. execve("./syz-executor1924423088", ["./syz-executor1924423088"], 0x7fff7dff3150 /* 10 vars */) = 0 brk(NULL) = 0x555556c56000 brk(0x555556c56c40) = 0x555556c56c40 arch_prctl(ARCH_SET_FS, 0x555556c56300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1924423088", 4096) = 28 brk(0x555556c77c40) = 0x555556c77c40 brk(0x555556c78000) = 0x555556c78000 mprotect(0x7f1b6ec28000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0 sendto(3, NULL, 0, MSG_DONTROUTE|MSG_PROBE|MSG_EOR|MSG_SENDPAGE_NOTLAST|MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 setsockopt(3, SOL_TCP, TCP_ULP, [7564404], 4) = 0 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 bpf(BPF_MAP_UPDATE_ELEM, {map_fd=4, key=0x20000340, value=0x20000040, flags=BPF_ANY}, 32) = -1 EINVAL (Invalid argument) exit_group(0) = ? syzkaller login: [ 48.728447][ T3603] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 48.728447][ T3603] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 48.735998][ T3603] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN [ 48.736026][ T3603] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 48.736042][ T3603] CPU: 0 PID: 3603 Comm: syz-executor192 Not tainted 5.18.0-syzkaller-04953-g6c465408a770 #0 [ 48.736068][ T3603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 48.736081][ T3603] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 [ 48.736126][ T3603] Code: 02 00 0f 85 16 09 00 00 48 8b 85 f0 02 00 00 4d 8d 6c 24 14 4c 89 ea 48 c1 ea 03 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 02 4c 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 4f 07 00 00 [ 48.736148][ T3603] RSP: 0018:ffffc90002f1fb70 EFLAGS: 00010203 [ 48.736168][ T3603] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 48.736184][ T3603] RDX: 0000000000000002 RSI: ffffffff87fcf5c3 RDI: ffff888073958ef0 [ 48.736199][ T3603] RBP: ffff888073958c00 R08: 0000000000000001 R09: 00000000fffffff0 [ 48.736214][ T3603] R10: ffffffff87fcf851 R11: 0000000000000000 R12: 0000000000000000 [ 48.736228][ T3603] R13: 0000000000000014 R14: ffff88801c0d4108 R15: 0000000000000001 [ 48.736244][ T3603] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 48.736267][ T3603] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.736286][ T3603] CR2: 00000000005ded70 CR3: 000000007d88e000 CR4: 00000000003506f0 [ 48.736302][ T3603] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.736316][ T3603] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.736331][ T3603] Call Trace: [ 48.736337][ T3603] [ 48.736347][ T3603] ? wait_on_pending_writer+0x430/0x430 [ 48.736374][ T3603] ? __local_bh_enable_ip+0xa0/0x120 [ 48.736400][ T3603] tls_sk_proto_close+0x356/0xaf0 [ 48.736426][ T3603] ? wait_on_pending_writer+0x430/0x430 [ 48.736452][ T3603] ? down_write+0xde/0x150 [ 48.736479][ T3603] ? ip_mc_drop_socket+0x16/0x260 [ 48.736504][ T3603] ? locks_remove_file+0x2f7/0x570 [ 48.736535][ T3603] inet_release+0x12e/0x280 [ 48.736559][ T3603] __sock_release+0xcd/0x280 [ 48.736589][ T3603] sock_close+0x18/0x20 [ 48.736615][ T3603] __fput+0x277/0x9d0 [ 48.736639][ T3603] ? __sock_release+0x280/0x280 [ 48.736668][ T3603] task_work_run+0xdd/0x1a0 [ 48.736696][ T3603] do_exit+0xaff/0x2a00 [ 48.736729][ T3603] ? lock_downgrade+0x6e0/0x6e0 [ 48.736758][ T3603] ? mm_update_next_owner+0x7a0/0x7a0 [ 48.736787][ T3603] ? _raw_spin_unlock_irq+0x1f/0x40 [ 48.736812][ T3603] do_group_exit+0xd2/0x2f0 [ 48.736840][ T3603] __x64_sys_exit_group+0x3a/0x50 [ 48.736867][ T3603] do_syscall_64+0x35/0xb0 [ 48.736892][ T3603] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 48.736917][ T3603] RIP: 0033:0x7f1b6ebba7d9 [ 48.736934][ T3603] Code: Unable to access opcode bytes at RIP 0x7f1b6ebba7af. [ 48.736944][ T3603] RSP: 002b:00007ffd7eb4d468 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 48.736967][ T3603] RAX: ffffffffffffffda RBX: 00007f1b6ec2e270 RCX: 00007f1b6ebba7d9 [ 48.736983][ T3603] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 48.736998][ T3603] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 48.737012][ T3603] R10: 00007f1b6eb7e900 R11: 0000000000000246 R12: 00007f1b6ec2e270 [ 48.737028][ T3603] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 48.737048][ T3603] [ 48.737056][ T3603] Modules linked in: [ 48.737070][ T3603] ---[ end trace 0000000000000000 ]--- [ 48.737079][ T3603] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 [ 48.737104][ T3603] Code: 02 00 0f 85 16 09 00 00 48 8b 85 f0 02 00 00 4d 8d 6c 24 14 4c 89 ea 48 c1 ea 03 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 02 4c 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 4f 07 00 00 [ 48.737124][ T3603] RSP: 0018:ffffc90002f1fb70 EFLAGS: 00010203 [ 48.737141][ T3603] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 48.737155][ T3603] RDX: 0000000000000002 RSI: ffffffff87fcf5c3 RDI: ffff888073958ef0 [ 48.737170][ T3603] RBP: ffff888073958c00 R08: 0000000000000001 R09: 00000000fffffff0 [ 48.737184][ T3603] R10: ffffffff87fcf851 R11: 0000000000000000 R12: 0000000000000000 [ 48.737198][ T3603] R13: 0000000000000014 R14: ffff88801c0d4108 R15: 0000000000000001 [ 48.737213][ T3603] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 48.737234][ T3603] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.737249][ T3603] CR2: 00000000005ded70 CR3: 000000007d88e000 CR4: 00000000003506f0 [ 48.737264][ T3603] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.737276][ T3603] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.737292][ T3603] Kernel panic - not syncing: Fatal exception [ 48.753726][ T3603] Kernel Offset: disabled