./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3117176781
<...>
Warning: Permanently added '10.128.1.23' (ED25519) to the list of known hosts.
execve("./syz-executor3117176781", ["./syz-executor3117176781"], 0x7ffccc9a66c0 /* 10 vars */) = 0
brk(NULL) = 0x555585178000
brk(0x555585178d00) = 0x555585178d00
arch_prctl(ARCH_SET_FS, 0x555585178380) = 0
set_tid_address(0x555585178650) = 5832
set_robust_list(0x555585178660, 24) = 0
rseq(0x555585178ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3117176781", 4096) = 28
getrandom("\xdc\x4f\xb0\x24\x7f\xc7\xf7\xca", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555585178d00
brk(0x555585199d00) = 0x555585199d00
brk(0x55558519a000) = 0x55558519a000
mprotect(0x7fd85512f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3
close(3) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5833 attached
, child_tidptr=0x555585178650) = 5833
[pid 5833] set_robust_list(0x555585178660, 24) = 0
[pid 5833] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5833] setpgid(0, 0) = 0
[pid 5833] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5833] write(3, "1000", 4) = 4
[pid 5833] close(3) = 0
executing program
[pid 5833] write(1, "executing program\n", 18) = 18
[pid 5833] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
[pid 5833] write(3, "4", 1) = 1
[ 58.792327][ T5833] FAULT_INJECTION: forcing a failure.
[ 58.792327][ T5833] name failslab, interval 1, probability 0, space 0, times 1
[ 58.805256][ T5833] CPU: 0 UID: 0 PID: 5833 Comm: syz-executor311 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
[ 58.805274][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 58.805284][ T5833] Call Trace:
[ 58.805288][ T5833]
[ 58.805292][ T5833] dump_stack_lvl+0x241/0x360
[ 58.805333][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10
[ 58.805343][ T5833] ? __pfx__printk+0x10/0x10
[ 58.805360][ T5833] ? kmem_cache_alloc_lru_noprof+0x4d/0x390
[ 58.805372][ T5833] ? __pfx___might_resched+0x10/0x10
[ 58.805386][ T5833] should_fail_ex+0x40a/0x550
[ 58.805407][ T5833] should_failslab+0xac/0x100
[ 58.805423][ T5833] ? __d_alloc+0x31/0x700
[ 58.805434][ T5833] kmem_cache_alloc_lru_noprof+0x75/0x390
[ 58.805447][ T5833] __d_alloc+0x31/0x700
[ 58.805460][ T5833] d_alloc_pseudo+0x1f/0xb0
[ 58.805472][ T5833] alloc_file_pseudo+0x123/0x290
[ 58.805484][ T5833] ? __pfx_alloc_file_pseudo+0x10/0x10
[ 58.805496][ T5833] ? _raw_spin_unlock+0x28/0x50
[ 58.805512][ T5833] ? alloc_fd+0x61a/0x690
[ 58.805524][ T5833] anon_inode_getfile_fmode+0xe4/0x1e0
[ 58.805542][ T5833] __se_sys_fanotify_init+0x7e9/0x970
[ 58.805556][ T5833] do_syscall_64+0xf3/0x230
[ 58.805566][ T5833] ? clear_bhb_loop+0x35/0x90
[ 58.805582][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 58.805595][ T5833] RIP: 0033:0x7fd8550c3669
[ 58.805608][ T5833] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 58.805619][ T5833] RSP: 002b:00007fff50fe9658 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
[ 58.805634][ T5833] RAX: ffffffffffffffda RBX: 00007fff50fe9670 RCX: 00007fd8550c3669
[ 58.805641][ T5833] RDX: 00007fd8550c28a0 RSI: 0000000000000000 RDI: 0000000000000008
[ 58.805648][ T5833] RBP: 0000000000000001 R08: 00007fff50fe93f7 R09: 00000000000000a0
[ 58.805654][ T5833] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
[ 58.805661][ T5833] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[ 58.805674][ T5833]
[ 58.805685][ T5833] ==================================================================
[ 59.014123][ T5833] BUG: KASAN: use-after-free in __put_unused_fd+0xdb/0x2a0
[ 59.021317][ T5833] Write of size 8 at addr ffff8880544622c8 by task syz-executor311/5833
[ 59.029628][ T5833]
[ 59.031941][ T5833] CPU: 0 UID: 0 PID: 5833 Comm: syz-executor311 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
[ 59.031954][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 59.031961][ T5833] Call Trace:
[ 59.031967][ T5833]
[ 59.031972][ T5833] dump_stack_lvl+0x241/0x360
[ 59.031988][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10
[ 59.031999][ T5833] ? __pfx__printk+0x10/0x10
[ 59.032015][ T5833] ? _printk+0xd5/0x120
[ 59.032029][ T5833] ? __virt_addr_valid+0x183/0x530
[ 59.032043][ T5833] ? __virt_addr_valid+0x183/0x530
[ 59.032057][ T5833] print_report+0x169/0x550
[ 59.032072][ T5833] ? __virt_addr_valid+0x183/0x530
[ 59.032086][ T5833] ? __virt_addr_valid+0x183/0x530
[ 59.032099][ T5833] ? __virt_addr_valid+0x45f/0x530
[ 59.032113][ T5833] ? __phys_addr+0xba/0x170
[ 59.032126][ T5833] ? __put_unused_fd+0xdb/0x2a0
[ 59.032136][ T5833] kasan_report+0x143/0x180
[ 59.032150][ T5833] ? __put_unused_fd+0xdb/0x2a0
[ 59.032161][ T5833] kasan_check_range+0x282/0x290
[ 59.032176][ T5833] __put_unused_fd+0xdb/0x2a0
[ 59.032186][ T5833] put_unused_fd+0x5c/0x70
[ 59.032195][ T5833] __se_sys_fanotify_init+0x800/0x970
[ 59.032208][ T5833] do_syscall_64+0xf3/0x230
[ 59.032219][ T5833] ? clear_bhb_loop+0x35/0x90
[ 59.032234][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 59.032248][ T5833] RIP: 0033:0x7fd8550c3669
[ 59.032258][ T5833] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 59.032266][ T5833] RSP: 002b:00007fff50fe9658 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
[ 59.032277][ T5833] RAX: ffffffffffffffda RBX: 00007fff50fe9670 RCX: 00007fd8550c3669
[ 59.032285][ T5833] RDX: 00007fd8550c28a0 RSI: 0000000000000000 RDI: 0000000000000008
[ 59.032292][ T5833] RBP: 0000000000000001 R08: 00007fff50fe93f7 R09: 00000000000000a0
[ 59.032299][ T5833] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
[ 59.032305][ T5833] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[ 59.032314][ T5833]
[ 59.032318][ T5833]
[ 59.238721][ T5833] The buggy address belongs to the physical page:
[ 59.245126][ T5833] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x54462
[ 59.253883][ T5833] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 59.260985][ T5833] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
[ 59.269556][ T5833] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 59.278119][ T5833] page dumped because: kasan: bad access detected
[ 59.284521][ T5833] page_owner tracks the page as freed
[ 59.289867][ T5833] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 1, tgid 1 (swapper/0), ts 15554574701, free_ts 16203410456
[ 59.305042][ T5833] post_alloc_hook+0x1f4/0x240
[ 59.309878][ T5833] split_free_pages+0xe1/0x2d0
[ 59.314642][ T5833] alloc_contig_range_noprof+0x10eb/0x1770
[ 59.320457][ T5833] alloc_contig_pages_noprof+0x4b3/0x5c0
[ 59.326084][ T5833] debug_vm_pgtable_alloc_huge_page+0xaf/0x100
[ 59.332226][ T5833] init_args+0x83b/0xb20
[ 59.336454][ T5833] debug_vm_pgtable+0xe0/0x550
[ 59.341201][ T5833] do_one_initcall+0x248/0x870
[ 59.345954][ T5833] do_initcall_level+0x157/0x210
[ 59.350875][ T5833] do_initcalls+0x3f/0x80
[ 59.355187][ T5833] kernel_init_freeable+0x435/0x5d0
[ 59.360395][ T5833] kernel_init+0x1d/0x2b0
[ 59.364710][ T5833] ret_from_fork+0x4b/0x80
[ 59.369112][ T5833] ret_from_fork_asm+0x1a/0x30
[ 59.373864][ T5833] page last free pid 1 tgid 1 stack trace:
[ 59.379653][ T5833] free_frozen_pages+0xe0d/0x10e0
[ 59.384663][ T5833] free_contig_range+0x14c/0x430
[ 59.389586][ T5833] destroy_args+0x92/0x910
[ 59.393988][ T5833] debug_vm_pgtable+0x4be/0x550
[ 59.398824][ T5833] do_one_initcall+0x248/0x870
[ 59.403573][ T5833] do_initcall_level+0x157/0x210
[ 59.408512][ T5833] do_initcalls+0x3f/0x80
[ 59.412823][ T5833] kernel_init_freeable+0x435/0x5d0
[ 59.418007][ T5833] kernel_init+0x1d/0x2b0
[ 59.422317][ T5833] ret_from_fork+0x4b/0x80
[ 59.426826][ T5833] ret_from_fork_asm+0x1a/0x30
[ 59.431589][ T5833]
[ 59.433896][ T5833] Memory state around the buggy address:
[ 59.439511][ T5833] ffff888054462180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 59.447556][ T5833] ffff888054462200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 59.455623][ T5833] >ffff888054462280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 59.463669][ T5833] ^
[ 59.470066][ T5833] ffff888054462300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 59.478111][ T5833] ffff888054462380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 59.486152][ T5833] ==================================================================
[ 59.494424][ T5833] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 59.501615][ T5833] CPU: 0 UID: 0 PID: 5833 Comm: syz-executor311 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
[ 59.512193][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[ 59.522243][ T5833] Call Trace:
[ 59.525514][ T5833]
[ 59.528439][ T5833] dump_stack_lvl+0x241/0x360
[ 59.533121][ T5833] ? __pfx_dump_stack_lvl+0x10/0x10
[ 59.538308][ T5833] ? __pfx__printk+0x10/0x10
[ 59.542892][ T5833] ? lock_release+0xbf/0xa30
[ 59.547474][ T5833] ? vscnprintf+0x5d/0x90
[ 59.551832][ T5833] panic+0x349/0x880
[ 59.555727][ T5833] ? check_panic_on_warn+0x21/0xb0
[ 59.560833][ T5833] ? __pfx_panic+0x10/0x10
[ 59.565242][ T5833] ? mark_lock+0x9a/0x360
[ 59.569564][ T5833] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 59.575448][ T5833] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 59.581330][ T5833] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 59.587650][ T5833] ? print_report+0x502/0x550
[ 59.592323][ T5833] check_panic_on_warn+0x86/0xb0
[ 59.597254][ T5833] ? __put_unused_fd+0xdb/0x2a0
[ 59.602096][ T5833] end_report+0x77/0x160
[ 59.606332][ T5833] kasan_report+0x154/0x180
[ 59.610829][ T5833] ? __put_unused_fd+0xdb/0x2a0
[ 59.615666][ T5833] kasan_check_range+0x282/0x290
[ 59.620596][ T5833] __put_unused_fd+0xdb/0x2a0
[ 59.625259][ T5833] put_unused_fd+0x5c/0x70
[ 59.629662][ T5833] __se_sys_fanotify_init+0x800/0x970
[ 59.635023][ T5833] do_syscall_64+0xf3/0x230
[ 59.639516][ T5833] ? clear_bhb_loop+0x35/0x90
[ 59.644183][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 59.650069][ T5833] RIP: 0033:0x7fd8550c3669
[ 59.654505][ T5833] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 59.674105][ T5833] RSP: 002b:00007fff50fe9658 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
[ 59.682510][ T5833] RAX: ffffffffffffffda RBX: 00007fff50fe9670 RCX: 00007fd8550c3669
[ 59.690471][ T5833] RDX: 00007fd8550c28a0 RSI: 0000000000000000 RDI: 0000000000000008
[ 59.698437][ T5833] RBP: 0000000000000001 R08: 00007fff50fe93f7 R09: 00000000000000a0
[ 59.706396][ T5833] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
[ 59.714353][ T5833] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[ 59.722320][ T5833]
[ 59.725583][ T5833] Kernel Offset: disabled
[ 59.729892][ T5833] Rebooting in 86400 seconds..