./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2237633850 <...> [ 86.756317][ T24] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.49' (ED25519) to the list of known hosts. execve("./syz-executor2237633850", ["./syz-executor2237633850"], 0x7ffec497ec50 /* 10 vars */) = 0 brk(NULL) = 0x55558db88000 brk(0x55558db88d00) = 0x55558db88d00 arch_prctl(ARCH_SET_FS, 0x55558db88380) = 0 set_tid_address(0x55558db88650) = 5861 set_robust_list(0x55558db88660, 24) = 0 rseq(0x55558db88ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2237633850", 4096) = 28 getrandom("\x21\x25\xe9\x1e\x4a\x09\x68\x99", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558db88d00 brk(0x55558dba9d00) = 0x55558dba9d00 brk(0x55558dbaa000) = 0x55558dbaa000 mprotect(0x7f3361b75000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5862 attached [pid 5862] set_robust_list(0x55558db88660, 24 [pid 5861] <... clone resumed>, child_tidptr=0x55558db88650) = 5862 [pid 5862] <... set_robust_list resumed>) = 0 [pid 5862] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5862] setpgid(0, 0) = 0 [pid 5862] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5862] write(3, "1000", 4) = 4 [pid 5862] close(3) = 0 [pid 5862] write(1, "executing program\n", 18executing program ) = 18 [pid 5862] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3 [pid 5862] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x14\x00\x00\x00\x10\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0a\x28\x00\x00\x00\x00\x0a\x01\x01\x00\x00\x00\x00\x5e\x1a\xff\xd5\x02\x00\x00\x00\x09\x00\x01\x00\x73\x79\x7a\x30\x00\x00\x00\x00\x08\x00\x02\x40\x00\x00\x00\x03\x2c\x00\x00\x00\x03\x0a\x01\x03\x00\x00\xe6\xff\x00\x00\x00\x00\x02\x00\x00\x00\x09\x00\x01\x00\x73\x79\x7a\x30\x00\x00\x00\x00\x09\x00\x03\x00\x73\x79\x7a\x32"..., iov_len=124}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, MSG_PROBE) = 124 [ 88.267993][ T5862] ================================================================== [ 88.276077][ T5862] BUG: KASAN: slab-out-of-bounds in string+0x231/0x2b0 [ 88.282933][ T5862] Read of size 1 at addr ffff8880351d0448 by task syz-executor223/5862 [ 88.291155][ T5862] [ 88.293479][ T5862] CPU: 1 UID: 0 PID: 5862 Comm: syz-executor223 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 88.293492][ T5862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 88.293504][ T5862] Call Trace: [ 88.293511][ T5862] [ 88.293516][ T5862] dump_stack_lvl+0x189/0x250 [ 88.293533][ T5862] ? __kasan_check_byte+0x12/0x40 [ 88.293549][ T5862] ? __pfx_dump_stack_lvl+0x10/0x10 [ 88.293560][ T5862] ? lock_release+0x4b/0x3e0 [ 88.293571][ T5862] ? __virt_addr_valid+0x4a5/0x5c0 [ 88.293585][ T5862] print_report+0xca/0x230 [ 88.293594][ T5862] ? string+0x231/0x2b0 [ 88.293606][ T5862] kasan_report+0x118/0x150 [ 88.293617][ T5862] ? __kasan_check_byte+0x12/0x40 [ 88.293628][ T5862] ? string+0x231/0x2b0 [ 88.293641][ T5862] string+0x231/0x2b0 [ 88.293654][ T5862] vsnprintf+0x739/0xf00 [ 88.293668][ T5862] vprintk_store+0x3c7/0xd00 [ 88.293682][ T5862] ? __pfx_vprintk_store+0x10/0x10 [ 88.293693][ T5862] ? stack_trace_save+0x9c/0xe0 [ 88.293706][ T5862] ? __pfx_stack_trace_save+0x10/0x10 [ 88.293718][ T5862] ? __is_module_percpu_address+0x28/0x3f0 [ 88.293731][ T5862] ? __lock_acquire+0xab9/0xd20 [ 88.293742][ T5862] ? irqentry_exit+0x74/0x90 [ 88.293753][ T5862] ? is_printk_cpu_sync_owner+0x32/0x40 [ 88.293768][ T5862] vprintk_emit+0x21e/0x7a0 [ 88.293781][ T5862] ? __pfx_vprintk_emit+0x10/0x10 [ 88.293792][ T5862] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 88.293806][ T5862] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 88.293823][ T5862] _printk+0xcf/0x120 [ 88.293836][ T5862] ? __pfx____ratelimit+0x10/0x10 [ 88.293850][ T5862] ? __pfx__printk+0x10/0x10 [ 88.293863][ T5862] ? __flush_work+0xd2/0xbc0 [ 88.293880][ T5862] ? __flush_work+0xa5b/0xbc0 [ 88.293898][ T5862] nfacct_mt_checkentry+0xd2/0xe0 [ 88.293920][ T5862] xt_check_match+0x3d1/0xab0 [ 88.293940][ T5862] ? __pfx___flush_work+0x10/0x10 [ 88.293959][ T5862] ? __pfx_xt_check_match+0x10/0x10 [ 88.293999][ T5862] ? __pfx___might_resched+0x10/0x10 [ 88.294020][ T5862] ? nft_pernet+0x23/0x240 [ 88.294041][ T5862] ? nft_pernet+0x23/0x240 [ 88.294060][ T5862] ? nft_pernet+0x23/0x240 [ 88.294085][ T5862] __nft_match_init+0x63a/0x840 [ 88.294105][ T5862] ? __pfx___nft_match_init+0x10/0x10 [ 88.294135][ T5862] ? rcu_is_watching+0x15/0xb0 [ 88.294151][ T5862] ? trace_kmalloc+0x1f/0xd0 [ 88.294162][ T5862] ? nf_tables_newrule+0x1506/0x2890 [ 88.294176][ T5862] nf_tables_newrule+0x178c/0x2890 [ 88.294193][ T5862] ? __pfx_nf_tables_newrule+0x10/0x10 [ 88.294206][ T5862] ? nfnl_pernet+0x23/0x240 [ 88.294222][ T5862] ? __nla_parse+0x40/0x60 [ 88.294233][ T5862] nfnetlink_rcv+0x1132/0x2520 [ 88.294260][ T5862] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 88.294277][ T5862] ? __lock_acquire+0xab9/0xd20 [ 88.294295][ T5862] ? netlink_deliver_tap+0x2e/0x1b0 [ 88.294307][ T5862] ? netlink_deliver_tap+0x2e/0x1b0 [ 88.294319][ T5862] netlink_unicast+0x759/0x8e0 [ 88.294340][ T5862] netlink_sendmsg+0x805/0xb30 [ 88.294361][ T5862] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.294380][ T5862] ? aa_sock_msg_perm+0x94/0x160 [ 88.294403][ T5862] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 88.294425][ T5862] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.294444][ T5862] __sock_sendmsg+0x219/0x270 [ 88.294462][ T5862] ____sys_sendmsg+0x505/0x830 [ 88.294485][ T5862] ? __pfx_____sys_sendmsg+0x10/0x10 [ 88.294504][ T5862] ? import_iovec+0x74/0xa0 [ 88.294515][ T5862] ___sys_sendmsg+0x21f/0x2a0 [ 88.294528][ T5862] ? __pfx____sys_sendmsg+0x10/0x10 [ 88.294541][ T5862] ? do_raw_spin_lock+0x121/0x290 [ 88.294562][ T5862] __x64_sys_sendmsg+0x19b/0x260 [ 88.294574][ T5862] ? _raw_spin_unlock_irq+0x2e/0x50 [ 88.294588][ T5862] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 88.294604][ T5862] do_syscall_64+0xfa/0x3b0 [ 88.294614][ T5862] ? lockdep_hardirqs_on+0x9c/0x150 [ 88.294628][ T5862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.294638][ T5862] ? clear_bhb_loop+0x60/0xb0 [ 88.294649][ T5862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.294659][ T5862] RIP: 0033:0x7f3361b01cb9 [ 88.294674][ T5862] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 88.294687][ T5862] RSP: 002b:00007ffc7a1bdc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 88.294698][ T5862] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3361b01cb9 [ 88.294706][ T5862] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 88.294712][ T5862] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 88.294717][ T5862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.294723][ T5862] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 88.294732][ T5862] [ 88.294736][ T5862] [ 88.753093][ T5862] Allocated by task 5862: [ 88.757404][ T5862] kasan_save_track+0x3e/0x80 [ 88.762071][ T5862] __kasan_kmalloc+0x93/0xb0 [ 88.766645][ T5862] __kmalloc_noprof+0x27a/0x4f0 [ 88.771482][ T5862] nf_tables_newrule+0x1506/0x2890 [ 88.776585][ T5862] nfnetlink_rcv+0x1132/0x2520 [ 88.781342][ T5862] netlink_unicast+0x759/0x8e0 [ 88.786088][ T5862] netlink_sendmsg+0x805/0xb30 [ 88.790836][ T5862] __sock_sendmsg+0x219/0x270 [ 88.795508][ T5862] ____sys_sendmsg+0x505/0x830 [ 88.800258][ T5862] ___sys_sendmsg+0x21f/0x2a0 [ 88.804920][ T5862] __x64_sys_sendmsg+0x19b/0x260 [ 88.809848][ T5862] do_syscall_64+0xfa/0x3b0 [ 88.814340][ T5862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.820221][ T5862] [ 88.822533][ T5862] The buggy address belongs to the object at ffff8880351d0400 [ 88.822533][ T5862] which belongs to the cache kmalloc-cg-96 of size 96 [ 88.836654][ T5862] The buggy address is located 0 bytes to the right of [ 88.836654][ T5862] allocated 72-byte region [ffff8880351d0400, ffff8880351d0448) [ 88.851037][ T5862] [ 88.853354][ T5862] The buggy address belongs to the physical page: [ 88.859743][ T5862] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x351d0 [ 88.868500][ T5862] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 88.875601][ T5862] page_type: f5(slab) [ 88.879566][ T5862] raw: 00fff00000000000 ffff88801a449640 dead000000000122 0000000000000000 [ 88.888134][ T5862] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 88.896698][ T5862] page dumped because: kasan: bad access detected [ 88.903098][ T5862] page_owner tracks the page as allocated [ 88.908794][ T5862] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 20202663905, free_ts 0 [ 88.926664][ T5862] post_alloc_hook+0x240/0x2a0 [ 88.931417][ T5862] get_page_from_freelist+0x21e4/0x22c0 [ 88.936954][ T5862] __alloc_frozen_pages_noprof+0x181/0x370 [ 88.942748][ T5862] allocate_slab+0x65/0x3b0 [ 88.947241][ T5862] ___slab_alloc+0xbfc/0x1480 [ 88.951906][ T5862] __kmalloc_node_noprof+0x2fd/0x4e0 [ 88.957180][ T5862] alloc_bulk+0x33b/0x530 [ 88.961499][ T5862] bpf_mem_alloc_init+0x9e9/0xc60 [ 88.966508][ T5862] bpf_global_ma_init+0x1a/0x40 [ 88.971355][ T5862] do_one_initcall+0x233/0x820 [ 88.976107][ T5862] do_initcall_level+0x137/0x1f0 [ 88.981038][ T5862] do_initcalls+0x69/0xd0 [ 88.985353][ T5862] kernel_init_freeable+0x3d9/0x570 [ 88.990540][ T5862] kernel_init+0x1d/0x1d0 [ 88.994856][ T5862] ret_from_fork+0x3fc/0x770 [ 88.999429][ T5862] ret_from_fork_asm+0x1a/0x30 [ 89.004183][ T5862] page_owner free stack trace missing [ 89.009532][ T5862] [ 89.011845][ T5862] Memory state around the buggy address: [ 89.017463][ T5862] ffff8880351d0300: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 89.025506][ T5862] ffff8880351d0380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 89.033550][ T5862] >ffff8880351d0400: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 89.041596][ T5862] ^ [ 89.047991][ T5862] ffff8880351d0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 89.056038][ T5862] ffff8880351d0500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 89.064084][ T5862] ================================================================== [ 89.072133][ T5862] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 89.079321][ T5862] CPU: 1 UID: 0 PID: 5862 Comm: syz-executor223 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 89.091714][ T5862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 89.101761][ T5862] Call Trace: [ 89.105032][ T5862] [ 89.107955][ T5862] dump_stack_lvl+0x99/0x250 [ 89.112536][ T5862] ? __asan_memcpy+0x40/0x70 [ 89.117120][ T5862] ? __pfx_dump_stack_lvl+0x10/0x10 [ 89.122305][ T5862] ? __pfx__printk+0x10/0x10 [ 89.126888][ T5862] panic+0x2db/0x790 [ 89.130774][ T5862] ? __pfx_panic+0x10/0x10 [ 89.135179][ T5862] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 89.141063][ T5862] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 89.147381][ T5862] ? print_memory_metadata+0x314/0x400 [ 89.152844][ T5862] ? string+0x231/0x2b0 [ 89.157004][ T5862] check_panic_on_warn+0x89/0xb0 [ 89.161961][ T5862] ? string+0x231/0x2b0 [ 89.166135][ T5862] end_report+0x78/0x160 [ 89.170382][ T5862] kasan_report+0x129/0x150 [ 89.174879][ T5862] ? __kasan_check_byte+0x12/0x40 [ 89.179904][ T5862] ? string+0x231/0x2b0 [ 89.184063][ T5862] string+0x231/0x2b0 [ 89.188043][ T5862] vsnprintf+0x739/0xf00 [ 89.192279][ T5862] vprintk_store+0x3c7/0xd00 [ 89.196862][ T5862] ? __pfx_vprintk_store+0x10/0x10 [ 89.201989][ T5862] ? stack_trace_save+0x9c/0xe0 [ 89.206857][ T5862] ? __pfx_stack_trace_save+0x10/0x10 [ 89.212231][ T5862] ? __is_module_percpu_address+0x28/0x3f0 [ 89.218065][ T5862] ? __lock_acquire+0xab9/0xd20 [ 89.222917][ T5862] ? irqentry_exit+0x74/0x90 [ 89.227503][ T5862] ? is_printk_cpu_sync_owner+0x32/0x40 [ 89.233050][ T5862] vprintk_emit+0x21e/0x7a0 [ 89.237550][ T5862] ? __pfx_vprintk_emit+0x10/0x10 [ 89.242565][ T5862] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 89.248454][ T5862] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 89.254781][ T5862] _printk+0xcf/0x120 [ 89.258754][ T5862] ? __pfx____ratelimit+0x10/0x10 [ 89.263771][ T5862] ? __pfx__printk+0x10/0x10 [ 89.268351][ T5862] ? __flush_work+0xd2/0xbc0 [ 89.272930][ T5862] ? __flush_work+0xa5b/0xbc0 [ 89.277607][ T5862] nfacct_mt_checkentry+0xd2/0xe0 [ 89.282622][ T5862] xt_check_match+0x3d1/0xab0 [ 89.287292][ T5862] ? __pfx___flush_work+0x10/0x10 [ 89.292309][ T5862] ? __pfx_xt_check_match+0x10/0x10 [ 89.297498][ T5862] ? __pfx___might_resched+0x10/0x10 [ 89.302773][ T5862] ? nft_pernet+0x23/0x240 [ 89.307179][ T5862] ? nft_pernet+0x23/0x240 [ 89.311584][ T5862] ? nft_pernet+0x23/0x240 [ 89.315994][ T5862] __nft_match_init+0x63a/0x840 [ 89.320835][ T5862] ? __pfx___nft_match_init+0x10/0x10 [ 89.326203][ T5862] ? rcu_is_watching+0x15/0xb0 [ 89.330969][ T5862] ? trace_kmalloc+0x1f/0xd0 [ 89.335546][ T5862] ? nf_tables_newrule+0x1506/0x2890 [ 89.340822][ T5862] nf_tables_newrule+0x178c/0x2890 [ 89.345980][ T5862] ? __pfx_nf_tables_newrule+0x10/0x10 [ 89.351441][ T5862] ? nfnl_pernet+0x23/0x240 [ 89.355947][ T5862] ? __nla_parse+0x40/0x60 [ 89.360361][ T5862] nfnetlink_rcv+0x1132/0x2520 [ 89.365136][ T5862] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 89.370253][ T5862] ? __lock_acquire+0xab9/0xd20 [ 89.375107][ T5862] ? netlink_deliver_tap+0x2e/0x1b0 [ 89.380293][ T5862] ? netlink_deliver_tap+0x2e/0x1b0 [ 89.385480][ T5862] netlink_unicast+0x759/0x8e0 [ 89.390246][ T5862] netlink_sendmsg+0x805/0xb30 [ 89.395003][ T5862] ? __pfx_netlink_sendmsg+0x10/0x10 [ 89.400278][ T5862] ? aa_sock_msg_perm+0x94/0x160 [ 89.405209][ T5862] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 89.410484][ T5862] ? __pfx_netlink_sendmsg+0x10/0x10 [ 89.415756][ T5862] __sock_sendmsg+0x219/0x270 [ 89.420418][ T5862] ____sys_sendmsg+0x505/0x830 [ 89.425176][ T5862] ? __pfx_____sys_sendmsg+0x10/0x10 [ 89.430452][ T5862] ? import_iovec+0x74/0xa0 [ 89.434952][ T5862] ___sys_sendmsg+0x21f/0x2a0 [ 89.439617][ T5862] ? __pfx____sys_sendmsg+0x10/0x10 [ 89.444891][ T5862] ? do_raw_spin_lock+0x121/0x290 [ 89.449922][ T5862] __x64_sys_sendmsg+0x19b/0x260 [ 89.454849][ T5862] ? _raw_spin_unlock_irq+0x2e/0x50 [ 89.460038][ T5862] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 89.465494][ T5862] do_syscall_64+0xfa/0x3b0 [ 89.469984][ T5862] ? lockdep_hardirqs_on+0x9c/0x150 [ 89.475175][ T5862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.481228][ T5862] ? clear_bhb_loop+0x60/0xb0 [ 89.485892][ T5862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.491770][ T5862] RIP: 0033:0x7f3361b01cb9 [ 89.496174][ T5862] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 89.515770][ T5862] RSP: 002b:00007ffc7a1bdc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 89.524193][ T5862] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3361b01cb9 [ 89.532162][ T5862] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 89.540152][ T5862] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 89.548121][ T5862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.556115][ T5862] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 89.564104][ T5862] [ 89.567390][ T5862] Kernel Offset: disabled [ 89.571711][ T5862] Rebooting in 86400 seconds..