./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3617864395 <...> Warning: Permanently added '10.128.1.77' (ED25519) to the list of known hosts. execve("./syz-executor3617864395", ["./syz-executor3617864395"], 0x7ffc46f7a950 /* 10 vars */) = 0 brk(NULL) = 0x555555c33000 brk(0x555555c33d40) = 0x555555c33d40 arch_prctl(ARCH_SET_FS, 0x555555c333c0) = 0 set_tid_address(0x555555c33690) = 5067 set_robust_list(0x555555c336a0, 24) = 0 rseq(0x555555c33ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3617864395", 4096) = 28 getrandom("\x30\x58\x09\x42\x5e\x78\xf3\xbd", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555c33d40 brk(0x555555c54d40) = 0x555555c54d40 brk(0x555555c55000) = 0x555555c55000 mprotect(0x7fb2a2fda000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 futex(0x7fb2a2fe030c, FUTEX_WAKE_PRIVATE, 1000000) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7fb2a2f7cae0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fb2a2f6e160}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb2a2ef9000 mprotect(0x7fb2a2efa000, 131072, PROT_READ|PROT_WRITE) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb2a2f19990, parent_tid=0x7fb2a2f19990, exit_signal=0, stack=0x7fb2a2ef9000, stack_size=0x20300, tls=0x7fb2a2f196c0}./strace-static-x86_64: Process 5068 attached => {parent_tid=[5068]}, 88) = 5068 [pid 5068] rseq(0x7fb2a2f19fe0, 0x20, 0, 0x53053053 [pid 5067] rt_sigprocmask(SIG_SETMASK, [], [pid 5068] <... rseq resumed>) = 0 [pid 5067] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5068] set_robust_list(0x7fb2a2f199a0, 24 [pid 5067] futex(0x7fb2a2fe0308, FUTEX_WAKE_PRIVATE, 1000000 [pid 5068] <... set_robust_list resumed>) = 0 [pid 5067] <... futex resumed>) = 0 [pid 5068] rt_sigprocmask(SIG_SETMASK, [], [pid 5067] futex(0x7fb2a2fe030c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5068] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5068] openat(AT_FDCWD, "/dev/ptp0", O_RDONLY) = 3 [pid 5068] futex(0x7fb2a2fe030c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5068] futex(0x7fb2a2fe0308, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5067] <... futex resumed>) = 0 [pid 5067] futex(0x7fb2a2fe0308, FUTEX_WAKE_PRIVATE, 1000000 [pid 5068] <... futex resumed>) = 0 [pid 5067] <... futex resumed>) = 1 [pid 5068] read(3, [pid 5067] futex(0x7fb2a2fe030c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5067] futex(0x7fb2a2fe030c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 5067] futex(0x7fb2a2fe031c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5067] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb2a2ed8000 [pid 5067] mprotect(0x7fb2a2ed9000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5067] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5067] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb2a2ef8990, parent_tid=0x7fb2a2ef8990, exit_signal=0, stack=0x7fb2a2ed8000, stack_size=0x20300, tls=0x7fb2a2ef86c0}./strace-static-x86_64: Process 5069 attached => {parent_tid=[5069]}, 88) = 5069 [pid 5069] rseq(0x7fb2a2ef8fe0, 0x20, 0, 0x53053053) = 0 [pid 5069] set_robust_list(0x7fb2a2ef89a0, 24) = 0 [pid 5069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5067] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5069] futex(0x7fb2a2fe0318, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5067] futex(0x7fb2a2fe0318, FUTEX_WAKE_PRIVATE, 1000000 [pid 5069] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5067] <... futex resumed>) = 0 [pid 5069] read(3, [pid 5067] futex(0x7fb2a2fe031c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5069] <... read resumed>0x20000000, 38) = -1 EINVAL (Invalid argument) [pid 5069] futex(0x7fb2a2fe031c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5067] <... futex resumed>) = 0 [pid 5069] futex(0x7fb2a2fe0318, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5067] exit_group(0) = ? [pid 5069] <... futex resumed>) = ? [pid 5069] +++ exited with 0 +++ [ 88.268476][ T5068] ================================================================== [ 88.276567][ T5068] BUG: KASAN: slab-use-after-free in ptp_read+0x7c4/0x830 [ 88.283693][ T5068] Read of size 4 at addr ffff88801f0d9004 by task syz-executor361/5068 [ 88.291922][ T5068] [ 88.294250][ T5068] CPU: 1 PID: 5068 Comm: syz-executor361 Not tainted 6.6.0-syzkaller-06824-g8bc9e6515183 #0 [ 88.304307][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 88.314351][ T5068] Call Trace: [ 88.317624][ T5068] [ 88.320545][ T5068] dump_stack_lvl+0xd9/0x1b0 [ 88.325145][ T5068] print_report+0xc4/0x620 [ 88.329576][ T5068] ? __virt_addr_valid+0x5e/0x2d0 [ 88.334606][ T5068] ? __phys_addr+0xc6/0x140 [ 88.339129][ T5068] kasan_report+0xda/0x110 [ 88.343547][ T5068] ? ptp_read+0x7c4/0x830 [ 88.347869][ T5068] ? ptp_read+0x7c4/0x830 [ 88.352194][ T5068] ptp_read+0x7c4/0x830 [ 88.356360][ T5068] ? ptp_poll+0x1b0/0x1b0 [ 88.360681][ T5068] ? cpuacct_percpu_seq_show+0x10/0x10 [ 88.366148][ T5068] ? fsnotify_perm.part.0+0x23c/0x5c0 [ 88.371534][ T5068] ? fsnotify_perm.part.0+0x247/0x5c0 [ 88.376924][ T5068] ? apparmor_file_permission+0x21f/0x4f0 [ 88.382672][ T5068] ? ptp_poll+0x1b0/0x1b0 [ 88.387003][ T5068] posix_clock_read+0x138/0x1b0 [ 88.391873][ T5068] ? posix_clock_compat_ioctl+0x30/0x30 [ 88.397436][ T5068] vfs_read+0x1ce/0x8f0 [ 88.401602][ T5068] ? kernel_read+0x1b0/0x1b0 [ 88.406204][ T5068] ? ptrace_stop.part.0+0x61a/0x900 [ 88.411422][ T5068] ? __fget_files+0x1c6/0x340 [ 88.416117][ T5068] ? __fget_light+0xe6/0x260 [ 88.420725][ T5068] ksys_read+0x12f/0x250 [ 88.424979][ T5068] ? vfs_write+0xdf0/0xdf0 [ 88.429405][ T5068] ? lockdep_hardirqs_on+0x7d/0x100 [ 88.434611][ T5068] ? _raw_spin_unlock_irq+0x2e/0x50 [ 88.439823][ T5068] ? ptrace_notify+0xf4/0x130 [ 88.444504][ T5068] do_syscall_64+0x3f/0x110 [ 88.449010][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 88.454915][ T5068] RIP: 0033:0x7fb2a2f56c39 [ 88.459330][ T5068] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 88.478941][ T5068] RSP: 002b:00007fb2a2f19238 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 88.487358][ T5068] RAX: ffffffffffffffda RBX: 00007fb2a2fe0308 RCX: 00007fb2a2f56c39 [ 88.495327][ T5068] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 88.503295][ T5068] RBP: 00007fb2a2fe0300 R08: 00007fb2a2f196c0 R09: 00007fb2a2f196c0 [ 88.511263][ T5068] R10: 00007fb2a2f196c0 R11: 0000000000000246 R12: 7074702f7665642f [ 88.519234][ T5068] R13: 0000000000000000 R14: 00007ffef1cac960 R15: 00007ffef1caca48 [ 88.527211][ T5068] [ 88.530226][ T5068] [ 88.532544][ T5068] Allocated by task 5068: [ 88.536861][ T5068] kasan_save_stack+0x33/0x50 [ 88.541545][ T5068] kasan_set_track+0x25/0x30 [ 88.546136][ T5068] __kasan_kmalloc+0xa2/0xb0 [ 88.550726][ T5068] ptp_open+0xe3/0x4f0 [ 88.554805][ T5068] posix_clock_open+0x17e/0x240 [ 88.559665][ T5068] chrdev_open+0x26d/0x6e0 [ 88.564082][ T5068] do_dentry_open+0x8d4/0x18d0 [ 88.568846][ T5068] path_openat+0x1d4e/0x2c40 [ 88.573432][ T5068] do_filp_open+0x1de/0x430 [ 88.577944][ T5068] do_sys_openat2+0x176/0x1e0 [ 88.582633][ T5068] __x64_sys_openat+0x175/0x210 [ 88.587486][ T5068] do_syscall_64+0x3f/0x110 [ 88.591989][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 88.597904][ T5068] [ 88.600224][ T5068] Freed by task 5069: [ 88.604196][ T5068] kasan_save_stack+0x33/0x50 [ 88.608874][ T5068] kasan_set_track+0x25/0x30 [ 88.613468][ T5068] kasan_save_free_info+0x2b/0x40 [ 88.618500][ T5068] ____kasan_slab_free+0x15b/0x1b0 [ 88.623624][ T5068] slab_free_freelist_hook+0x114/0x1e0 [ 88.629099][ T5068] __kmem_cache_free+0xb8/0x2d0 [ 88.633955][ T5068] ptp_release+0x204/0x2b0 [ 88.638373][ T5068] ptp_read+0xf6/0x830 [ 88.642443][ T5068] posix_clock_read+0x138/0x1b0 [ 88.647305][ T5068] vfs_read+0x1ce/0x8f0 [ 88.651467][ T5068] ksys_read+0x12f/0x250 [ 88.655717][ T5068] do_syscall_64+0x3f/0x110 [ 88.660219][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 88.666117][ T5068] [ 88.668435][ T5068] The buggy address belongs to the object at ffff88801f0d8000 [ 88.668435][ T5068] which belongs to the cache kmalloc-8k of size 8192 [ 88.682481][ T5068] The buggy address is located 4100 bytes inside of [ 88.682481][ T5068] freed 8192-byte region [ffff88801f0d8000, ffff88801f0da000) [ 88.696488][ T5068] [ 88.698804][ T5068] The buggy address belongs to the physical page: [ 88.705206][ T5068] page:ffffea00007c3600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f0d8 [ 88.715358][ T5068] head:ffffea00007c3600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 88.724286][ T5068] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 88.732259][ T5068] page_type: 0xffffffff() [ 88.736588][ T5068] raw: 00fff00000000840 ffff888013042280 dead000000000100 dead000000000122 [ 88.745174][ T5068] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 88.753750][ T5068] page dumped because: kasan: bad access detected [ 88.760152][ T5068] page_owner tracks the page as allocated [ 88.765857][ T5068] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 59, tgid 59 (kworker/u4:4), ts 12205615871, free_ts 0 [ 88.786008][ T5068] post_alloc_hook+0x2cf/0x340 [ 88.790778][ T5068] get_page_from_freelist+0xee0/0x2f20 [ 88.796243][ T5068] __alloc_pages+0x1d0/0x4a0 [ 88.800837][ T5068] alloc_pages+0x1a9/0x270 [ 88.805252][ T5068] allocate_slab+0x251/0x380 [ 88.809842][ T5068] ___slab_alloc+0x8c7/0x1580 [ 88.814518][ T5068] __slab_alloc.constprop.0+0x56/0xa0 [ 88.819889][ T5068] __kmem_cache_alloc_node+0x131/0x330 [ 88.825348][ T5068] __kmalloc_node+0x52/0x110 [ 88.829940][ T5068] kvmalloc_node+0x6f/0x1a0 [ 88.834442][ T5068] sbitmap_init_node+0x1c8/0x680 [ 88.839390][ T5068] scsi_realloc_sdev_budget_map+0x4d4/0x620 [ 88.845289][ T5068] scsi_alloc_sdev+0x9a9/0xd10 [ 88.850058][ T5068] scsi_probe_and_add_lun+0x170d/0x27d0 [ 88.855611][ T5068] __scsi_scan_target+0x255/0xef0 [ 88.860643][ T5068] scsi_scan_channel+0x149/0x1e0 [ 88.865590][ T5068] page_owner free stack trace missing [ 88.870945][ T5068] [ 88.873260][ T5068] Memory state around the buggy address: [ 88.878882][ T5068] ffff88801f0d8f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 88.886943][ T5068] ffff88801f0d8f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 88.895000][ T5068] >ffff88801f0d9000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 88.903056][ T5068] ^ [ 88.907115][ T5068] ffff88801f0d9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 88.915170][ T5068] ffff88801f0d9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 88.923223][ T5068] ================================================================== [ 88.931651][ T5068] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 88.938868][ T5068] CPU: 0 PID: 5068 Comm: syz-executor361 Not tainted 6.6.0-syzkaller-06824-g8bc9e6515183 #0 [ 88.948947][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 88.959007][ T5068] Call Trace: [ 88.962279][ T5068] [ 88.965201][ T5068] dump_stack_lvl+0xd9/0x1b0 [ 88.969800][ T5068] panic+0x6a6/0x750 [ 88.973693][ T5068] ? panic_smp_self_stop+0xa0/0xa0 [ 88.978804][ T5068] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 88.984960][ T5068] ? preempt_schedule_thunk+0x1a/0x30 [ 88.990335][ T5068] ? preempt_schedule_common+0x45/0xc0 [ 88.995791][ T5068] ? check_panic_on_warn+0x1f/0xb0 [ 89.000909][ T5068] check_panic_on_warn+0xab/0xb0 [ 89.005845][ T5068] end_report+0x108/0x150 [ 89.010170][ T5068] kasan_report+0xea/0x110 [ 89.014584][ T5068] ? ptp_read+0x7c4/0x830 [ 89.018906][ T5068] ? ptp_read+0x7c4/0x830 [ 89.023247][ T5068] ptp_read+0x7c4/0x830 [ 89.027418][ T5068] ? ptp_poll+0x1b0/0x1b0 [ 89.031741][ T5068] ? cpuacct_percpu_seq_show+0x10/0x10 [ 89.037201][ T5068] ? fsnotify_perm.part.0+0x23c/0x5c0 [ 89.042579][ T5068] ? fsnotify_perm.part.0+0x247/0x5c0 [ 89.047950][ T5068] ? apparmor_file_permission+0x21f/0x4f0 [ 89.053666][ T5068] ? ptp_poll+0x1b0/0x1b0 [ 89.057985][ T5068] posix_clock_read+0x138/0x1b0 [ 89.062845][ T5068] ? posix_clock_compat_ioctl+0x30/0x30 [ 89.068391][ T5068] vfs_read+0x1ce/0x8f0 [ 89.072569][ T5068] ? kernel_read+0x1b0/0x1b0 [ 89.077158][ T5068] ? ptrace_stop.part.0+0x61a/0x900 [ 89.082354][ T5068] ? __fget_files+0x1c6/0x340 [ 89.087035][ T5068] ? __fget_light+0xe6/0x260 [ 89.091626][ T5068] ksys_read+0x12f/0x250 [ 89.095871][ T5068] ? vfs_write+0xdf0/0xdf0 [ 89.100287][ T5068] ? lockdep_hardirqs_on+0x7d/0x100 [ 89.105487][ T5068] ? _raw_spin_unlock_irq+0x2e/0x50 [ 89.110693][ T5068] ? ptrace_notify+0xf4/0x130 [ 89.115369][ T5068] do_syscall_64+0x3f/0x110 [ 89.119865][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 89.125757][ T5068] RIP: 0033:0x7fb2a2f56c39 [ 89.130161][ T5068] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 89.149761][ T5068] RSP: 002b:00007fb2a2f19238 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 89.158167][ T5068] RAX: ffffffffffffffda RBX: 00007fb2a2fe0308 RCX: 00007fb2a2f56c39 [ 89.166131][ T5068] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 89.174094][ T5068] RBP: 00007fb2a2fe0300 R08: 00007fb2a2f196c0 R09: 00007fb2a2f196c0 [ 89.182071][ T5068] R10: 00007fb2a2f196c0 R11: 0000000000000246 R12: 7074702f7665642f [ 89.190045][ T5068] R13: 0000000000000000 R14: 00007ffef1cac960 R15: 00007ffef1caca48 [ 89.198032][ T5068] [ 89.201344][ T5068] Kernel Offset: disabled [ 89.205661][ T5068] Rebooting in 86400 seconds..