./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1616473756
<...>
Warning: Permanently added '10.128.0.44' (ED25519) to the list of known hosts.
execve("./syz-executor1616473756", ["./syz-executor1616473756"], 0x7fff99c30810 /* 10 vars */) = 0
brk(NULL) = 0x555555f8a000
brk(0x555555f8ad00) = 0x555555f8ad00
arch_prctl(ARCH_SET_FS, 0x555555f8a380) = 0
set_tid_address(0x555555f8a650) = 5060
set_robust_list(0x555555f8a660, 24) = 0
rseq(0x555555f8aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1616473756", 4096) = 28
getrandom("\xf7\x4c\x1f\xed\xce\x99\x19\xe2", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555f8ad00
brk(0x555555fabd00) = 0x555555fabd00
brk(0x555555fac000) = 0x555555fac000
mprotect(0x7effab4bc000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5061 attached
, child_tidptr=0x555555f8a650) = 5061
[pid 5061] set_robust_list(0x555555f8a660, 24) = 0
[pid 5061] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5061] setpgid(0, 0) = 0
[pid 5061] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5061] write(3, "1000", 4) = 4
[pid 5061] close(3) = 0
[pid 5061] socket(AF_ALG, SOCK_SEQPACKET, 0) = 3
[pid 5061] bind(3, {sa_family=AF_ALG, salg_type="skcipher", salg_feat=0, salg_mask=0, salg_name="ecb(arc4)"}, 88) = 0
[pid 5061] setsockopt(3, SOL_ALG, ALG_SET_KEY, "\xad", 1) = 0
[pid 5061] accept4(3, NULL, NULL, SOCK_CLOEXEC|SOCK_NONBLOCK) = 4
[pid 5061] sendmmsg(4, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="yb", iov_len=2}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, msg_len=2}], 1, 0) = 1
[ 72.666965][ T5061] "syz-executor161" (5061) uses obsolete ecb(arc4) skcipher
[ 72.709685][ T5061] ==================================================================
[ 72.717760][ T5061] BUG: KASAN: slab-out-of-bounds in arc4_crypt+0x31c/0x4e0
[ 72.724965][ T5061] Read of size 4 at addr ffff888079f44ee0 by task syz-executor161/5061
[ 72.733184][ T5061]
[ 72.735491][ T5061] CPU: 1 PID: 5061 Comm: syz-executor161 Not tainted 6.7.0-rc5-next-20231215-syzkaller #0
[ 72.745366][ T5061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 72.755411][ T5061] Call Trace:
[ 72.758689][ T5061]
[ 72.761601][ T5061] dump_stack_lvl+0xd9/0x1b0
[ 72.766181][ T5061] print_report+0xc3/0x620
[ 72.770588][ T5061] ? __virt_addr_valid+0x5e/0x580
[ 72.775600][ T5061] ? __phys_addr+0xc6/0x140
[ 72.780093][ T5061] kasan_report+0xd9/0x110
[ 72.784493][ T5061] ? arc4_crypt+0x31c/0x4e0
[ 72.788992][ T5061] ? arc4_crypt+0x31c/0x4e0
[ 72.793506][ T5061] arc4_crypt+0x31c/0x4e0
[ 72.797831][ T5061] crypto_arc4_crypt+0x61/0x70
[ 72.802590][ T5061] crypto_lskcipher_crypt_sg+0x28c/0x460
[ 72.808208][ T5061] ? kasan_quarantine_put+0x102/0x230
[ 72.813594][ T5061] ? cast6_setkey+0x30/0x30
[ 72.818088][ T5061] ? crypto_lskcipher_decrypt+0x130/0x130
[ 72.823793][ T5061] ? kfree+0x129/0x370
[ 72.827874][ T5061] crypto_skcipher_decrypt+0xda/0x160
[ 72.833233][ T5061] skcipher_recvmsg+0xc2b/0x1040
[ 72.838167][ T5061] ? find_held_lock+0x2d/0x110
[ 72.842934][ T5061] ? algif_skcipher_export.part.0+0x200/0x200
[ 72.849009][ T5061] ? bpf_lsm_socket_recvmsg+0x9/0x10
[ 72.854298][ T5061] ? security_socket_recvmsg+0x92/0xc0
[ 72.859746][ T5061] ? algif_skcipher_export.part.0+0x200/0x200
[ 72.865807][ T5061] sock_recvmsg+0xe2/0x170
[ 72.870213][ T5061] ____sys_recvmsg+0x21f/0x5c0
[ 72.874972][ T5061] ? kernel_recvmsg+0x80/0x80
[ 72.879642][ T5061] ___sys_recvmsg+0x115/0x1a0
[ 72.884306][ T5061] ? copy_msghdr_from_user+0x160/0x160
[ 72.889749][ T5061] ? lock_sync+0x190/0x190
[ 72.894147][ T5061] ? ptrace_stop.part.0+0x44a/0x930
[ 72.899336][ T5061] ? __fget_light+0x172/0x200
[ 72.904000][ T5061] __sys_recvmsg+0x114/0x1e0
[ 72.908600][ T5061] ? __sys_recvmsg_sock+0x50/0x50
[ 72.913611][ T5061] ? ptrace_notify+0xf1/0x130
[ 72.918274][ T5061] ? syscall_trace_enter.constprop.0+0xad/0x1f0
[ 72.924505][ T5061] do_syscall_64+0x40/0x110
[ 72.928994][ T5061] entry_SYSCALL_64_after_hwframe+0x62/0x6a
[ 72.934881][ T5061] RIP: 0033:0x7effab449b79
[ 72.939279][ T5061] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 72.958870][ T5061] RSP: 002b:00007fff6c0657f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[ 72.967270][ T5061] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007effab449b79
[ 72.975227][ T5061] RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 0000000000000004
[ 72.983268][ T5061] RBP: 0000000000003a28 R08: 0000000000000000 R09: 0000000000000006
[ 72.991326][ T5061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 72.999278][ T5061] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[ 73.007237][ T5061]
[ 73.010239][ T5061]
[ 73.012542][ T5061] Allocated by task 78:
[ 73.016675][ T5061] kasan_save_stack+0x33/0x50
[ 73.021335][ T5061] kasan_set_track+0x24/0x30
[ 73.025909][ T5061] __kasan_kmalloc+0xa2/0xb0
[ 73.030482][ T5061] __kmalloc+0x1f9/0x440
[ 73.034710][ T5061] kobject_get_path+0xce/0x2b0
[ 73.039466][ T5061] kobject_uevent_env+0x26b/0x1800
[ 73.044573][ T5061] kset_register+0x1b6/0x2a0
[ 73.049148][ T5061] bus_register+0x1bf/0x6a0
[ 73.053635][ T5061] gpiolib_dev_init+0x1b/0x1c0
[ 73.058384][ T5061] do_one_initcall+0x128/0x680
[ 73.063149][ T5061] kernel_init_freeable+0x692/0xc30
[ 73.068330][ T5061] kernel_init+0x1c/0x2a0
[ 73.072637][ T5061] ret_from_fork+0x45/0x80
[ 73.077049][ T5061] ret_from_fork_asm+0x11/0x20
[ 73.081818][ T5061]
[ 73.084121][ T5061] Last potentially related work creation:
[ 73.089819][ T5061] kasan_save_stack+0x33/0x50
[ 73.094494][ T5061] kasan_set_track+0x24/0x30
[ 73.099068][ T5061] __kasan_kmalloc+0xa2/0xb0
[ 73.103640][ T5061] __kmalloc+0x1f9/0x440
[ 73.107870][ T5061] acpi_ns_internalize_name+0x149/0x220
[ 73.113401][ T5061] acpi_ns_get_node_unlocked+0x164/0x310
[ 73.119016][ T5061] acpi_ns_get_node+0x4c/0x70
[ 73.123679][ T5061] acpi_ns_evaluate+0x6eb/0xca0
[ 73.128514][ T5061] acpi_ut_evaluate_object+0xda/0x490
[ 73.133870][ T5061] acpi_ut_execute_HID+0x8e/0x3b0
[ 73.138876][ T5061] acpi_ns_get_device_callback+0x182/0x510
[ 73.144676][ T5061] acpi_ns_walk_namespace+0x3fe/0x5a0
[ 73.150058][ T5061] acpi_get_devices+0x135/0x160
[ 73.154895][ T5061] acpi_ec_dsdt_probe+0x4b/0x160
[ 73.159828][ T5061] acpi_init+0x2c5/0xb70
[ 73.164054][ T5061] do_one_initcall+0x128/0x680
[ 73.168809][ T5061] kernel_init_freeable+0x692/0xc30
[ 73.174029][ T5061] kernel_init+0x1c/0x2a0
[ 73.178341][ T5061] ret_from_fork+0x45/0x80
[ 73.182741][ T5061] ret_from_fork_asm+0x11/0x20
[ 73.187492][ T5061]
[ 73.189796][ T5061] Second to last potentially related work creation:
[ 73.196357][ T5061] kasan_save_stack+0x33/0x50
[ 73.201017][ T5061] kasan_set_track+0x24/0x30
[ 73.205590][ T5061] __kasan_slab_alloc+0x81/0x90
[ 73.210422][ T5061] kmem_cache_alloc+0x136/0x320
[ 73.215275][ T5061] acpi_ut_create_internal_object_dbg+0x7b/0x400
[ 73.221586][ T5061] acpi_ds_create_buffer_field+0x389/0x610
[ 73.227390][ T5061] acpi_ds_load2_end_op+0x5d8/0x1070
[ 73.232677][ T5061] acpi_ds_exec_end_op+0xbb7/0x1460
[ 73.237857][ T5061] acpi_ps_parse_loop+0x429/0x1ce0
[ 73.242953][ T5061] acpi_ps_parse_aml+0x3c1/0xca0
[ 73.247874][ T5061] acpi_ps_execute_table+0x37b/0x4c0
[ 73.253147][ T5061] acpi_ns_execute_table+0x3ee/0x550
[ 73.258416][ T5061] acpi_ns_load_table+0x5b/0x130
[ 73.263339][ T5061] acpi_tb_load_namespace+0x435/0x700
[ 73.268708][ T5061] acpi_load_tables+0x2c/0x110
[ 73.273464][ T5061] acpi_init+0x123/0xb70
[ 73.277694][ T5061] do_one_initcall+0x128/0x680
[ 73.282444][ T5061] kernel_init_freeable+0x692/0xc30
[ 73.287625][ T5061] kernel_init+0x1c/0x2a0
[ 73.291935][ T5061] ret_from_fork+0x45/0x80
[ 73.296339][ T5061] ret_from_fork_asm+0x11/0x20
[ 73.301087][ T5061]
[ 73.303388][ T5061] The buggy address belongs to the object at ffff888079f44800
[ 73.303388][ T5061] which belongs to the cache kmalloc-1k of size 1024
[ 73.317422][ T5061] The buggy address is located 1024 bytes to the right of
[ 73.317422][ T5061] allocated 736-byte region [ffff888079f44800, ffff888079f44ae0)
[ 73.332152][ T5061]
[ 73.334458][ T5061] The buggy address belongs to the physical page:
[ 73.340853][ T5061] page:ffffea0001e7d000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79f40
[ 73.351022][ T5061] head:ffffea0001e7d000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 73.359935][ T5061] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 73.368328][ T5061] page_type: 0xffffffff()
[ 73.372638][ T5061] raw: 00fff00000000840 ffff888013041dc0 0000000000000000 0000000000000001
[ 73.381204][ T5061] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 73.389762][ T5061] page dumped because: kasan: bad access detected
[ 73.396149][ T5061] page_owner tracks the page as allocated
[ 73.401842][ T5061] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4686, tgid 4686 (udevd), ts 39444184156, free_ts 23975115080
[ 73.422576][ T5061] post_alloc_hook+0x2d0/0x350
[ 73.427338][ T5061] get_page_from_freelist+0xa19/0x3740
[ 73.432828][ T5061] __alloc_pages+0x22e/0x2410
[ 73.437490][ T5061] alloc_pages_mpol+0x258/0x5f0
[ 73.442328][ T5061] new_slab+0x283/0x3c0
[ 73.446470][ T5061] ___slab_alloc+0x4ab/0x1990
[ 73.451133][ T5061] __slab_alloc.constprop.0+0x56/0xa0
[ 73.456511][ T5061] __kmalloc+0x3b4/0x440
[ 73.460749][ T5061] load_elf_phdrs+0x103/0x210
[ 73.465413][ T5061] load_elf_binary+0x14ca/0x4e10
[ 73.470337][ T5061] bprm_execve+0x7ef/0x1a80
[ 73.474825][ T5061] do_execveat_common.isra.0+0x679/0x8e0
[ 73.480447][ T5061] __x64_sys_execve+0x8c/0xb0
[ 73.485109][ T5061] do_syscall_64+0x40/0x110
[ 73.489599][ T5061] entry_SYSCALL_64_after_hwframe+0x62/0x6a
[ 73.495507][ T5061] page last free pid 1 tgid 1 stack trace:
[ 73.501298][ T5061] free_unref_page_prepare+0x51f/0xb10
[ 73.506768][ T5061] free_unref_page+0x33/0x3b0
[ 73.511432][ T5061] free_contig_range+0xb6/0x190
[ 73.516262][ T5061] destroy_args+0xa69/0xe40
[ 73.520785][ T5061] debug_vm_pgtable+0x16fc/0x3250
[ 73.525797][ T5061] do_one_initcall+0x128/0x680
[ 73.530554][ T5061] kernel_init_freeable+0x692/0xc30
[ 73.535744][ T5061] kernel_init+0x1c/0x2a0
[ 73.540074][ T5061] ret_from_fork+0x45/0x80
[ 73.544475][ T5061] ret_from_fork_asm+0x11/0x20
[ 73.549225][ T5061]
[ 73.551527][ T5061] Memory state around the buggy address:
[ 73.557140][ T5061] ffff888079f44d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.565182][ T5061] ffff888079f44e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.573223][ T5061] >ffff888079f44e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.581281][ T5061] ^
[ 73.588453][ T5061] ffff888079f44f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.596494][ T5061] ffff888079f44f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.604551][ T5061] ==================================================================
[ 73.613952][ T5061] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.621149][ T5061] CPU: 1 PID: 5061 Comm: syz-executor161 Not tainted 6.7.0-rc5-next-20231215-syzkaller #0
[ 73.631031][ T5061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 73.641079][ T5061] Call Trace:
[ 73.644352][ T5061]
[ 73.647275][ T5061] dump_stack_lvl+0xd9/0x1b0
[ 73.651866][ T5061] panic+0x6dc/0x790
[ 73.655764][ T5061] ? panic_smp_self_stop+0xa0/0xa0
[ 73.660877][ T5061] ? preempt_schedule_thunk+0x1a/0x30
[ 73.666252][ T5061] ? preempt_schedule_common+0x44/0xc0
[ 73.671712][ T5061] ? check_panic_on_warn+0x1f/0xb0
[ 73.676825][ T5061] check_panic_on_warn+0xab/0xb0
[ 73.681764][ T5061] end_report+0x117/0x160
[ 73.686089][ T5061] kasan_report+0xe9/0x110
[ 73.690501][ T5061] ? arc4_crypt+0x31c/0x4e0
[ 73.695011][ T5061] ? arc4_crypt+0x31c/0x4e0
[ 73.699516][ T5061] arc4_crypt+0x31c/0x4e0
[ 73.703861][ T5061] crypto_arc4_crypt+0x61/0x70
[ 73.708636][ T5061] crypto_lskcipher_crypt_sg+0x28c/0x460
[ 73.714262][ T5061] ? kasan_quarantine_put+0x102/0x230
[ 73.719634][ T5061] ? cast6_setkey+0x30/0x30
[ 73.724142][ T5061] ? crypto_lskcipher_decrypt+0x130/0x130
[ 73.729858][ T5061] ? kfree+0x129/0x370
[ 73.733935][ T5061] crypto_skcipher_decrypt+0xda/0x160
[ 73.739304][ T5061] skcipher_recvmsg+0xc2b/0x1040
[ 73.744247][ T5061] ? find_held_lock+0x2d/0x110
[ 73.749015][ T5061] ? algif_skcipher_export.part.0+0x200/0x200
[ 73.755092][ T5061] ? bpf_lsm_socket_recvmsg+0x9/0x10
[ 73.760382][ T5061] ? security_socket_recvmsg+0x92/0xc0
[ 73.765839][ T5061] ? algif_skcipher_export.part.0+0x200/0x200
[ 73.771911][ T5061] sock_recvmsg+0xe2/0x170
[ 73.776333][ T5061] ____sys_recvmsg+0x21f/0x5c0
[ 73.781101][ T5061] ? kernel_recvmsg+0x80/0x80
[ 73.785790][ T5061] ___sys_recvmsg+0x115/0x1a0
[ 73.790463][ T5061] ? copy_msghdr_from_user+0x160/0x160
[ 73.795921][ T5061] ? lock_sync+0x190/0x190
[ 73.800328][ T5061] ? ptrace_stop.part.0+0x44a/0x930
[ 73.805536][ T5061] ? __fget_light+0x172/0x200
[ 73.810215][ T5061] __sys_recvmsg+0x114/0x1e0
[ 73.814799][ T5061] ? __sys_recvmsg_sock+0x50/0x50
[ 73.819824][ T5061] ? ptrace_notify+0xf1/0x130
[ 73.824497][ T5061] ? syscall_trace_enter.constprop.0+0xad/0x1f0
[ 73.830745][ T5061] do_syscall_64+0x40/0x110
[ 73.835246][ T5061] entry_SYSCALL_64_after_hwframe+0x62/0x6a
[ 73.841143][ T5061] RIP: 0033:0x7effab449b79
[ 73.845552][ T5061] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 73.865152][ T5061] RSP: 002b:00007fff6c0657f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[ 73.873557][ T5061] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007effab449b79
[ 73.881524][ T5061] RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 0000000000000004
[ 73.889486][ T5061] RBP: 0000000000003a28 R08: 0000000000000000 R09: 0000000000000006
[ 73.897451][ T5061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 73.905418][ T5061] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[ 73.913389][ T5061]
[ 73.916569][ T5061] Kernel Offset: disabled
[ 73.920876][ T5061] Rebooting in 86400 seconds..