./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3539302217 <...> Warning: Permanently added '10.128.0.108' (ED25519) to the list of known hosts. execve("./syz-executor3539302217", ["./syz-executor3539302217"], 0x7ffdc8816380 /* 10 vars */) = 0 brk(NULL) = 0x55558cc6a000 brk(0x55558cc6ad00) = 0x55558cc6ad00 arch_prctl(ARCH_SET_FS, 0x55558cc6a380) = 0 set_tid_address(0x55558cc6a650) = 5838 set_robust_list(0x55558cc6a660, 24) = 0 rseq(0x55558cc6aca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3539302217", 4096) = 28 getrandom("\x16\x9b\xe1\x6a\xee\x04\x7c\xb1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558cc6ad00 brk(0x55558cc8bd00) = 0x55558cc8bd00 brk(0x55558cc8c000) = 0x55558cc8c000 mprotect(0x7fcf27f22000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5839 attached , child_tidptr=0x55558cc6a650) = 5839 [pid 5839] set_robust_list(0x55558cc6a660, 24) = 0 [pid 5839] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5839] getppid() = 0 [pid 5839] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5839] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5839] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5839] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5839] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5839] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5839] unshare(CLONE_NEWNS) = 0 [pid 5839] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5839] unshare(CLONE_NEWIPC) = 0 [pid 5839] unshare(CLONE_NEWCGROUP) = 0 [pid 5839] unshare(CLONE_NEWUTS) = 0 [pid 5839] unshare(CLONE_SYSVSEM) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "16777216", 8) = 8 [pid 5839] close(3) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "536870912", 9) = 9 [pid 5839] close(3) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "1024", 4) = 4 [pid 5839] close(3) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "8192", 4) = 4 [pid 5839] close(3) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "1024", 4) = 4 [pid 5839] close(3) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "1024", 4) = 4 [pid 5839] close(3) = 0 [pid 5839] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5839] close(3) = 0 [pid 5839] getpid() = 1 [pid 5839] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 105.288623][ T5839] dump_stack_lvl+0x189/0x250 [ 105.288642][ T5839] ? __virt_addr_valid+0x1c8/0x5c0 [ 105.288669][ T5839] ? rcu_is_watching+0x15/0xb0 [ 105.288683][ T5839] ? __kasan_check_byte+0x12/0x40 [ 105.288703][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10 [ 105.288730][ T5839] ? rcu_is_watching+0x15/0xb0 [ 105.288745][ T5839] ? lock_release+0x4b/0x3e0 [ 105.288767][ T5839] ? __virt_addr_valid+0x1c8/0x5c0 [ 105.288784][ T5839] ? __virt_addr_valid+0x4a5/0x5c0 [ 105.288802][ T5839] print_report+0xd2/0x2b0 [ 105.288822][ T5839] ? pause_parse_request+0x40/0x160 [ 105.288837][ T5839] kasan_report+0x118/0x150 [ 105.288853][ T5839] ? pause_parse_request+0x40/0x160 [ 105.288891][ T5839] ? __pfx_pause_parse_request+0x10/0x10 [ 105.288906][ T5839] pause_parse_request+0x40/0x160 [ 105.288928][ T5839] ? __pfx_pause_parse_request+0x10/0x10 [ 105.288943][ T5839] ethnl_default_set_doit+0x2be/0xa40 [ 105.288963][ T5839] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 105.288990][ T5839] genl_family_rcv_msg_doit+0x212/0x300 [ 105.289014][ T5839] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 105.289040][ T5839] ? bpf_lsm_capable+0x9/0x20 [ 105.289055][ T5839] ? security_capable+0x7e/0x2e0 [ 105.289073][ T5839] genl_rcv_msg+0x60e/0x790 [ 105.289096][ T5839] ? __pfx_genl_rcv_msg+0x10/0x10 [ 105.289116][ T5839] ? ref_tracker_free+0x63a/0x7d0 [ 105.289131][ T5839] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 105.289150][ T5839] ? __pfx_ref_tracker_free+0x10/0x10 [ 105.289168][ T5839] netlink_rcv_skb+0x205/0x470 [ 105.289185][ T5839] ? __pfx_genl_rcv_msg+0x10/0x10 [ 105.289206][ T5839] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 105.289228][ T5839] ? down_read+0x1ad/0x2e0 [ 105.289253][ T5839] genl_rcv+0x28/0x40 [ 105.289273][ T5839] netlink_unicast+0x758/0x8d0 [ 105.289292][ T5839] netlink_sendmsg+0x805/0xb30 [ 105.289312][ T5839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 105.289331][ T5839] ? aa_sock_msg_perm+0xf1/0x1d0 [ 105.289349][ T5839] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 105.289369][ T5839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 105.289386][ T5839] __sock_sendmsg+0x219/0x270 [ 105.289402][ T5839] ____sys_sendmsg+0x505/0x830 [ 105.289424][ T5839] ? __pfx_____sys_sendmsg+0x10/0x10 [ 105.289447][ T5839] ? import_iovec+0x74/0xa0 [ 105.289462][ T5839] ___sys_sendmsg+0x21f/0x2a0 [ 105.289483][ T5839] ? __pfx____sys_sendmsg+0x10/0x10 [ 105.289505][ T5839] ? do_raw_spin_lock+0x121/0x290 [ 105.289536][ T5839] __x64_sys_sendmsg+0x19b/0x260 [ 105.289556][ T5839] ? _raw_spin_unlock_irq+0x2e/0x50 [ 105.289570][ T5839] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 105.289594][ T5839] ? rcu_is_watching+0x15/0xb0 [ 105.289611][ T5839] do_syscall_64+0xfa/0x3b0 [ 105.289628][ T5839] ? lockdep_hardirqs_on+0x9c/0x150 [ 105.289642][ T5839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.289657][ T5839] ? clear_bhb_loop+0x60/0xb0 [ 105.289674][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.289689][ T5839] RIP: 0033:0x7fcf27ea9999 [ 105.289702][ T5839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 105.289715][ T5839] RSP: 002b:00007fff373992d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 105.289738][ T5839] RAX: ffffffffffffffda RBX: 00007fcf27ef74ad RCX: 00007fcf27ea9999 [ 105.289750][ T5839] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 105.289760][ T5839] RBP: 00007fcf27ef747d R08: 0000000000000000 R09: 0000555500000000 [ 105.289770][ T5839] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf27ef73e5 [ 105.289779][ T5839] R13: 0000000000000001 R14: 00007fff37399320 R15: 0000000000000003 [ 105.289794][ T5839] [ 105.289800][ T5839] [ 105.669029][ T5839] Allocated by task 5839: [ 105.673365][ T5839] kasan_save_track+0x3e/0x80 [ 105.678150][ T5839] __kasan_kmalloc+0x93/0xb0 [ 105.682745][ T5839] __kmalloc_noprof+0x27a/0x4f0 [ 105.687607][ T5839] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 105.693696][ T5839] genl_family_rcv_msg_doit+0xb8/0x300 [ 105.699187][ T5839] genl_rcv_msg+0x60e/0x790 [ 105.703729][ T5839] netlink_rcv_skb+0x205/0x470 [ 105.708498][ T5839] genl_rcv+0x28/0x40 [ 105.712492][ T5839] netlink_unicast+0x758/0x8d0 [ 105.717262][ T5839] netlink_sendmsg+0x805/0xb30 [ 105.722025][ T5839] __sock_sendmsg+0x219/0x270 [ 105.726719][ T5839] ____sys_sendmsg+0x505/0x830 [ 105.731488][ T5839] ___sys_sendmsg+0x21f/0x2a0 [ 105.736176][ T5839] __x64_sys_sendmsg+0x19b/0x260 [ 105.741114][ T5839] do_syscall_64+0xfa/0x3b0 [ 105.745618][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.751516][ T5839] [ 105.753838][ T5839] The buggy address belongs to the object at ffff888029c7bf00 [ 105.753838][ T5839] which belongs to the cache kmalloc-64 of size 64 [ 105.767739][ T5839] The buggy address is located 8 bytes to the right of [ 105.767739][ T5839] allocated 40-byte region [ffff888029c7bf00, ffff888029c7bf28) [ 105.782198][ T5839] [ 105.784526][ T5839] The buggy address belongs to the physical page: [ 105.790948][ T5839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29c7b [ 105.799707][ T5839] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 105.806818][ T5839] page_type: f5(slab) [ 105.810801][ T5839] raw: 00fff00000000000 ffff88801a8418c0 ffffea0000b42580 dead000000000004 [ 105.819380][ T5839] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 105.827952][ T5839] page dumped because: kasan: bad access detected [ 105.834360][ T5839] page_owner tracks the page as allocated [ 105.840068][ T5839] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (init), ts 31276588330, free_ts 31251188708 [ 105.858122][ T5839] post_alloc_hook+0x240/0x2a0 [ 105.862887][ T5839] get_page_from_freelist+0x21e4/0x22c0 [ 105.868430][ T5839] __alloc_frozen_pages_noprof+0x181/0x370 [ 105.874239][ T5839] alloc_pages_mpol+0x232/0x4a0 [ 105.879088][ T5839] allocate_slab+0x8a/0x370 [ 105.883598][ T5839] ___slab_alloc+0xbeb/0x1410 [ 105.888287][ T5839] __kmalloc_noprof+0x305/0x4f0 [ 105.893168][ T5839] ima_write_template_field_data+0x47/0x490 [ 105.899074][ T5839] ima_eventdigest_init_common+0x2a1/0x3a0 [ 105.904971][ T5839] ima_alloc_init_template+0x30d/0x6f0 [ 105.910435][ T5839] ima_store_measurement+0x1b7/0x640 [ 105.915726][ T5839] process_measurement+0x11eb/0x1a40 [ 105.921013][ T5839] ima_file_check+0xd7/0x120 [ 105.925611][ T5839] security_file_post_open+0xbb/0x290 [ 105.930976][ T5839] path_openat+0x2f26/0x3830 [ 105.935564][ T5839] do_filp_open+0x1fa/0x410 [ 105.940066][ T5839] page last free pid 23 tgid 23 stack trace: [ 105.946036][ T5839] __free_frozen_pages+0xb80/0xd80 [ 105.951152][ T5839] __tlb_remove_table+0x2d2/0x3b0 [ 105.956183][ T5839] tlb_remove_table_rcu+0x85/0x100 [ 105.961380][ T5839] rcu_core+0xca8/0x1710 [ 105.965626][ T5839] handle_softirqs+0x286/0x870 [ 105.970382][ T5839] run_ksoftirqd+0x9b/0x100 [ 105.974885][ T5839] smpboot_thread_fn+0x542/0xa60 [ 105.979815][ T5839] kthread+0x711/0x8a0 [ 105.983884][ T5839] ret_from_fork+0x3fc/0x770 [ 105.988474][ T5839] ret_from_fork_asm+0x1a/0x30 [ 105.993241][ T5839] [ 105.995566][ T5839] Memory state around the buggy address: [ 106.001188][ T5839] ffff888029c7be00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 106.009249][ T5839] ffff888029c7be80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 106.017310][ T5839] >ffff888029c7bf00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 106.025372][ T5839] ^ [ 106.031000][ T5839] ffff888029c7bf80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 106.039057][ T5839] ffff888029c7c000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 106.047110][ T5839] ================================================================== [ 106.063623][ T5839] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 106.070858][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: syz-executor353 Not tainted 6.16.0-rc3-next-20250626-syzkaller #0 PREEMPT(full) [ 106.082772][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 106.092842][ T5839] Call Trace: [ 106.096114][ T5839] [ 106.099033][ T5839] dump_stack_lvl+0x99/0x250 [ 106.103637][ T5839] ? __asan_memcpy+0x40/0x70 [ 106.108220][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10 [ 106.113404][ T5839] ? __pfx__printk+0x10/0x10 [ 106.118001][ T5839] panic+0x2db/0x790 [ 106.121884][ T5839] ? __pfx_panic+0x10/0x10 [ 106.126289][ T5839] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 106.132166][ T5839] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 106.138481][ T5839] ? print_memory_metadata+0x314/0x400 [ 106.143931][ T5839] ? pause_parse_request+0x40/0x160 [ 106.149121][ T5839] check_panic_on_warn+0x89/0xb0 [ 106.154049][ T5839] ? pause_parse_request+0x40/0x160 [ 106.159235][ T5839] end_report+0x78/0x160 [ 106.163462][ T5839] kasan_report+0x129/0x150 [ 106.168039][ T5839] ? pause_parse_request+0x40/0x160 [ 106.173225][ T5839] ? __pfx_pause_parse_request+0x10/0x10 [ 106.178847][ T5839] pause_parse_request+0x40/0x160 [ 106.183861][ T5839] ? __pfx_pause_parse_request+0x10/0x10 [ 106.189580][ T5839] ethnl_default_set_doit+0x2be/0xa40 [ 106.194945][ T5839] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 106.201268][ T5839] genl_family_rcv_msg_doit+0x212/0x300 [ 106.206810][ T5839] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 106.212875][ T5839] ? bpf_lsm_capable+0x9/0x20 [ 106.217575][ T5839] ? security_capable+0x7e/0x2e0 [ 106.222542][ T5839] genl_rcv_msg+0x60e/0x790 [ 106.227157][ T5839] ? __pfx_genl_rcv_msg+0x10/0x10 [ 106.232191][ T5839] ? ref_tracker_free+0x63a/0x7d0 [ 106.237212][ T5839] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 106.243109][ T5839] ? __pfx_ref_tracker_free+0x10/0x10 [ 106.248563][ T5839] netlink_rcv_skb+0x205/0x470 [ 106.253340][ T5839] ? __pfx_genl_rcv_msg+0x10/0x10 [ 106.258385][ T5839] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 106.263681][ T5839] ? down_read+0x1ad/0x2e0 [ 106.268123][ T5839] genl_rcv+0x28/0x40 [ 106.272126][ T5839] netlink_unicast+0x758/0x8d0 [ 106.276902][ T5839] netlink_sendmsg+0x805/0xb30 [ 106.281668][ T5839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.286953][ T5839] ? aa_sock_msg_perm+0xf1/0x1d0 [ 106.291897][ T5839] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 106.297178][ T5839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.302456][ T5839] __sock_sendmsg+0x219/0x270 [ 106.307222][ T5839] ____sys_sendmsg+0x505/0x830 [ 106.311986][ T5839] ? __pfx_____sys_sendmsg+0x10/0x10 [ 106.317269][ T5839] ? import_iovec+0x74/0xa0 [ 106.321774][ T5839] ___sys_sendmsg+0x21f/0x2a0 [ 106.326452][ T5839] ? __pfx____sys_sendmsg+0x10/0x10 [ 106.331657][ T5839] ? do_raw_spin_lock+0x121/0x290 [ 106.336696][ T5839] __x64_sys_sendmsg+0x19b/0x260 [ 106.341764][ T5839] ? _raw_spin_unlock_irq+0x2e/0x50 [ 106.346975][ T5839] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 106.352463][ T5839] ? rcu_is_watching+0x15/0xb0 [ 106.357243][ T5839] do_syscall_64+0xfa/0x3b0 [ 106.361755][ T5839] ? lockdep_hardirqs_on+0x9c/0x150 [ 106.366953][ T5839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.373027][ T5839] ? clear_bhb_loop+0x60/0xb0 [ 106.377739][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.383660][ T5839] RIP: 0033:0x7fcf27ea9999 [ 106.388083][ T5839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 106.407703][ T5839] RSP: 002b:00007fff373992d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 106.416202][ T5839] RAX: ffffffffffffffda RBX: 00007fcf27ef74ad RCX: 00007fcf27ea9999 [ 106.424168][ T5839] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 106.432150][ T5839] RBP: 00007fcf27ef747d R08: 0000000000000000 R09: 0000555500000000 [ 106.440113][ T5839] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcf27ef73e5 [ 106.448085][ T5839] R13: 0000000000000001 R14: 00007fff37399320 R15: 0000000000000003 [ 106.456059][ T5839] [ 106.459231][ T5839] Kernel Offset: disabled [ 106.463558][ T5839] Rebooting in 86400 seconds..