./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2786807901
<...>
Warning: Permanently added '10.128.10.21' (ED25519) to the list of known hosts.
execve("./syz-executor2786807901", ["./syz-executor2786807901"], 0x7ffcae528a10 /* 10 vars */) = 0
brk(NULL) = 0x555555a7c000
brk(0x555555a7cd00) = 0x555555a7cd00
arch_prctl(ARCH_SET_FS, 0x555555a7c380) = 0
set_tid_address(0x555555a7c650) = 5066
set_robust_list(0x555555a7c660, 24) = 0
rseq(0x555555a7cca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2786807901", 4096) = 28
getrandom("\x6c\x68\x92\x8d\x3f\xb6\xdf\x98", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555a7cd00
brk(0x555555a9dd00) = 0x555555a9dd00
brk(0x555555a9e000) = 0x555555a9e000
mprotect(0x7f0a94e8a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_PPPOX, SOCK_STREAM, 1) = 3
[ 74.592718][ T5066] ==================================================================
[ 74.600828][ T5066] BUG: KASAN: slab-out-of-bounds in dsa_user_changeupper+0x61a/0x6e0
[ 74.608953][ T5066] Read of size 8 at addr ffff888015ebecf0 by task syz-executor278/5066
[ 74.617210][ T5066]
[ 74.619541][ T5066] CPU: 1 PID: 5066 Comm: syz-executor278 Not tainted 6.7.0-rc6-syzkaller-01740-g9fb3dc1e9af2 #0
[ 74.629975][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 74.640038][ T5066] Call Trace:
[ 74.643308][ T5066]
[ 74.646223][ T5066] dump_stack_lvl+0xd9/0x1b0
[ 74.650808][ T5066] print_report+0xc4/0x620
[ 74.655241][ T5066] ? __virt_addr_valid+0x5e/0x2d0
[ 74.660257][ T5066] ? __phys_addr+0xc6/0x140
[ 74.664748][ T5066] kasan_report+0xda/0x110
[ 74.669154][ T5066] ? dsa_user_changeupper+0x61a/0x6e0
[ 74.674525][ T5066] ? dsa_user_changeupper+0x61a/0x6e0
[ 74.679913][ T5066] dsa_user_changeupper+0x61a/0x6e0
[ 74.685100][ T5066] dsa_user_netdevice_event+0xd04/0x3480
[ 74.690731][ T5066] ? packet_notifier+0x1b2/0x8c0
[ 74.695673][ T5066] ? reacquire_held_locks+0x4c0/0x4c0
[ 74.701052][ T5066] ? tls_dev_event+0xfe/0x1110
[ 74.705829][ T5066] ? dsa_user_change_conduit+0x7e0/0x7e0
[ 74.711469][ T5066] ? br_device_event+0x245/0x910
[ 74.716403][ T5066] ? br_switchdev_event+0x5b0/0x5b0
[ 74.721603][ T5066] ? packet_notifier+0x1b7/0x8c0
[ 74.726541][ T5066] notifier_call_chain+0xb6/0x3b0
[ 74.731558][ T5066] ? dsa_user_change_conduit+0x7e0/0x7e0
[ 74.737196][ T5066] call_netdevice_notifiers_info+0xbe/0x130
[ 74.743103][ T5066] __netdev_upper_dev_link+0x439/0x850
[ 74.748590][ T5066] ? __dev_change_net_namespace+0x12f0/0x12f0
[ 74.754668][ T5066] ? register_netdevice+0x189/0x1da0
[ 74.759953][ T5066] netdev_upper_dev_link+0x92/0xc0
[ 74.765058][ T5066] ? __netdev_upper_dev_link+0x850/0x850
[ 74.770697][ T5066] register_vlan_dev+0x396/0x940
[ 74.775650][ T5066] vlan_ioctl_handler+0x8dd/0xa70
[ 74.780694][ T5066] ? register_vlan_dev+0x940/0x940
[ 74.785813][ T5066] ? mutex_trylock+0x130/0x130
[ 74.790587][ T5066] ? register_vlan_dev+0x940/0x940
[ 74.795790][ T5066] sock_ioctl+0x4bd/0x6b0
[ 74.800117][ T5066] ? br_ioctl_call+0xb0/0xb0
[ 74.804788][ T5066] ? down_write_nested+0x50/0x50
[ 74.809725][ T5066] ? bpf_lsm_file_ioctl+0x9/0x10
[ 74.814660][ T5066] ? br_ioctl_call+0xb0/0xb0
[ 74.819248][ T5066] __x64_sys_ioctl+0x18f/0x210
[ 74.824004][ T5066] do_syscall_64+0x40/0x110
[ 74.828502][ T5066] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 74.834391][ T5066] RIP: 0033:0x7f0a94e172e9
[ 74.838790][ T5066] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 74.858487][ T5066] RSP: 002b:00007ffeda224968 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 74.866893][ T5066] RAX: ffffffffffffffda RBX: 00007ffeda224b38 RCX: 00007f0a94e172e9
[ 74.874855][ T5066] RDX: 0000000020000380 RSI: 0000000000008982 RDI: 0000000000000003
[ 74.882899][ T5066] RBP: 00007f0a94e8a610 R08: 0000000000000000 R09: 00007ffeda224b38
[ 74.890852][ T5066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 74.898894][ T5066] R13: 00007ffeda224b28 R14: 0000000000000001 R15: 0000000000000001
[ 74.906955][ T5066]
[ 74.909959][ T5066]
[ 74.912279][ T5066] Allocated by task 1:
[ 74.916325][ T5066] kasan_save_stack+0x33/0x50
[ 74.921000][ T5066] kasan_set_track+0x25/0x30
[ 74.925577][ T5066] __kasan_kmalloc+0xa2/0xb0
[ 74.930157][ T5066] __kmalloc_node+0x5c/0x90
[ 74.934646][ T5066] kvmalloc_node+0x99/0x1a0
[ 74.939153][ T5066] alloc_netdev_mqs+0xb3/0x1360
[ 74.944017][ T5066] dummy_init_module+0xcf/0x1b0
[ 74.948866][ T5066] do_one_initcall+0x11c/0x650
[ 74.953624][ T5066] kernel_init_freeable+0x687/0xc10
[ 74.958826][ T5066] kernel_init+0x1c/0x2a0
[ 74.963173][ T5066] ret_from_fork+0x45/0x80
[ 74.967642][ T5066] ret_from_fork_asm+0x11/0x20
[ 74.972418][ T5066]
[ 74.974724][ T5066] The buggy address belongs to the object at ffff888015ebe000
[ 74.974724][ T5066] which belongs to the cache kmalloc-cg-4k of size 4096
[ 74.989023][ T5066] The buggy address is located 3312 bytes inside of
[ 74.989023][ T5066] allocated 3319-byte region [ffff888015ebe000, ffff888015ebecf7)
[ 75.003328][ T5066]
[ 75.005651][ T5066] The buggy address belongs to the physical page:
[ 75.012055][ T5066] page:ffffea000057ae00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15eb8
[ 75.022279][ T5066] head:ffffea000057ae00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 75.031189][ T5066] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 75.039147][ T5066] page_type: 0xffffffff()
[ 75.043458][ T5066] raw: 00fff00000000840 ffff88801304f500 dead000000000122 0000000000000000
[ 75.052025][ T5066] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
[ 75.060597][ T5066] page dumped because: kasan: bad access detected
[ 75.067007][ T5066] page_owner tracks the page as allocated
[ 75.072708][ T5066] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4608693968, free_ts 0
[ 75.094056][ T5066] post_alloc_hook+0x2d0/0x350
[ 75.098838][ T5066] get_page_from_freelist+0xa28/0x3730
[ 75.104299][ T5066] __alloc_pages+0x22e/0x2420
[ 75.108969][ T5066] alloc_pages_mpol+0x258/0x5f0
[ 75.113814][ T5066] new_slab+0x283/0x3c0
[ 75.118151][ T5066] ___slab_alloc+0x979/0x1500
[ 75.122818][ T5066] __slab_alloc.constprop.0+0x56/0xa0
[ 75.128183][ T5066] __kmem_cache_alloc_node+0x131/0x310
[ 75.133635][ T5066] __kmalloc_node+0x4c/0x90
[ 75.138126][ T5066] kvmalloc_node+0x99/0x1a0
[ 75.142616][ T5066] alloc_netdev_mqs+0xb3/0x1360
[ 75.147450][ T5066] loopback_net_init+0x38/0x170
[ 75.152284][ T5066] ops_init+0xb9/0x650
[ 75.156333][ T5066] register_pernet_operations+0x34b/0x820
[ 75.162038][ T5066] register_pernet_device+0x29/0x70
[ 75.167217][ T5066] net_dev_init+0x7b1/0xaa0
[ 75.171704][ T5066] page_owner free stack trace missing
[ 75.177048][ T5066]
[ 75.179367][ T5066] Memory state around the buggy address:
[ 75.184976][ T5066] ffff888015ebeb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 75.193020][ T5066] ffff888015ebec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 75.201060][ T5066] >ffff888015ebec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 fc
[ 75.209102][ T5066] ^
[ 75.216794][ T5066] ffff888015ebed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 75.224836][ T5066] ffff888015ebed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 75.232890][ T5066] ==================================================================
[ 75.241876][ T5066] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.249076][ T5066] CPU: 1 PID: 5066 Comm: syz-executor278 Not tainted 6.7.0-rc6-syzkaller-01740-g9fb3dc1e9af2 #0
[ 75.259488][ T5066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 75.269538][ T5066] Call Trace:
[ 75.272813][ T5066]
[ 75.275760][ T5066] dump_stack_lvl+0xd9/0x1b0
[ 75.280372][ T5066] panic+0x6dc/0x790
[ 75.284291][ T5066] ? panic_smp_self_stop+0xa0/0xa0
[ 75.289424][ T5066] ? preempt_schedule_thunk+0x1a/0x30
[ 75.294820][ T5066] ? preempt_schedule_common+0x45/0xc0
[ 75.300290][ T5066] ? check_panic_on_warn+0x1f/0xb0
[ 75.305409][ T5066] check_panic_on_warn+0xab/0xb0
[ 75.310354][ T5066] end_report+0x108/0x150
[ 75.314699][ T5066] kasan_report+0xea/0x110
[ 75.319143][ T5066] ? dsa_user_changeupper+0x61a/0x6e0
[ 75.324524][ T5066] ? dsa_user_changeupper+0x61a/0x6e0
[ 75.330001][ T5066] dsa_user_changeupper+0x61a/0x6e0
[ 75.335204][ T5066] dsa_user_netdevice_event+0xd04/0x3480
[ 75.340846][ T5066] ? packet_notifier+0x1b2/0x8c0
[ 75.345801][ T5066] ? reacquire_held_locks+0x4c0/0x4c0
[ 75.351236][ T5066] ? tls_dev_event+0xfe/0x1110
[ 75.356007][ T5066] ? dsa_user_change_conduit+0x7e0/0x7e0
[ 75.361646][ T5066] ? br_device_event+0x245/0x910
[ 75.366585][ T5066] ? br_switchdev_event+0x5b0/0x5b0
[ 75.371782][ T5066] ? packet_notifier+0x1b7/0x8c0
[ 75.376731][ T5066] notifier_call_chain+0xb6/0x3b0
[ 75.381767][ T5066] ? dsa_user_change_conduit+0x7e0/0x7e0
[ 75.387408][ T5066] call_netdevice_notifiers_info+0xbe/0x130
[ 75.393305][ T5066] __netdev_upper_dev_link+0x439/0x850
[ 75.398771][ T5066] ? __dev_change_net_namespace+0x12f0/0x12f0
[ 75.404851][ T5066] ? register_netdevice+0x189/0x1da0
[ 75.410144][ T5066] netdev_upper_dev_link+0x92/0xc0
[ 75.415259][ T5066] ? __netdev_upper_dev_link+0x850/0x850
[ 75.420897][ T5066] register_vlan_dev+0x396/0x940
[ 75.425843][ T5066] vlan_ioctl_handler+0x8dd/0xa70
[ 75.430868][ T5066] ? register_vlan_dev+0x940/0x940
[ 75.435978][ T5066] ? mutex_trylock+0x130/0x130
[ 75.440749][ T5066] ? register_vlan_dev+0x940/0x940
[ 75.445861][ T5066] sock_ioctl+0x4bd/0x6b0
[ 75.450199][ T5066] ? br_ioctl_call+0xb0/0xb0
[ 75.454794][ T5066] ? down_write_nested+0x50/0x50
[ 75.459740][ T5066] ? bpf_lsm_file_ioctl+0x9/0x10
[ 75.464679][ T5066] ? br_ioctl_call+0xb0/0xb0
[ 75.469274][ T5066] __x64_sys_ioctl+0x18f/0x210
[ 75.474039][ T5066] do_syscall_64+0x40/0x110
[ 75.478557][ T5066] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 75.484477][ T5066] RIP: 0033:0x7f0a94e172e9
[ 75.488888][ T5066] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 75.508501][ T5066] RSP: 002b:00007ffeda224968 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 75.517001][ T5066] RAX: ffffffffffffffda RBX: 00007ffeda224b38 RCX: 00007f0a94e172e9
[ 75.524977][ T5066] RDX: 0000000020000380 RSI: 0000000000008982 RDI: 0000000000000003
[ 75.532942][ T5066] RBP: 00007f0a94e8a610 R08: 0000000000000000 R09: 00007ffeda224b38
[ 75.540907][ T5066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 75.548872][ T5066] R13: 00007ffeda224b28 R14: 0000000000000001 R15: 0000000000000001
[ 75.556983][ T5066]
[ 75.560075][ T5066] Kernel Offset: disabled
[ 75.564415][ T5066] Rebooting in 86400 seconds..