./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3137604026 <...> DUID 00:04:c2:14:a9:3f:3d:94:29:63:70:45:79:7c:3d:d2:41:a3 forked to background, child pid 3182 [ 26.398811][ T3183] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.402500][ T3183] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.245' (ECDSA) to the list of known hosts. execve("./syz-executor3137604026", ["./syz-executor3137604026"], 0x7ffd9ba8c360 /* 10 vars */) = 0 brk(NULL) = 0x555556c6b000 brk(0x555556c6bc40) = 0x555556c6bc40 arch_prctl(ARCH_SET_FS, 0x555556c6b300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3137604026", 4096) = 28 brk(0x555556c8cc40) = 0x555556c8cc40 brk(0x555556c8d000) = 0x555556c8d000 mprotect(0x7fd7f126c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0 sendto(3, NULL, 0, MSG_DONTROUTE|MSG_PROBE|MSG_EOR|MSG_SENDPAGE_NOTLAST|MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 setsockopt(3, SOL_TCP, TCP_ULP, [7564404], 4) = 0 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 bpf(BPF_MAP_UPDATE_ELEM, {map_fd=4, key=0x20000340, value=0x20000040, flags=BPF_ANY}, 32) = -1 EINVAL (Invalid argument) exit_group(0) = ? syzkaller login: [ 44.085095][ T3603] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 44.105219][ T3603] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN [ 44.117023][ T3603] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 44.125422][ T3603] CPU: 0 PID: 3603 Comm: syz-executor313 Not tainted 5.18.0-syzkaller-03023-g7e062cda7d90 #0 [ 44.135559][ T3603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 44.145597][ T3603] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 [ 44.151498][ T3603] Code: 02 00 0f 85 16 09 00 00 48 8b 85 f0 02 00 00 4d 8d 6c 24 14 4c 89 ea 48 c1 ea 03 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 02 4c 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 4f 07 00 00 [ 44.171114][ T3603] RSP: 0018:ffffc9000309fb70 EFLAGS: 00010203 [ 44.177166][ T3603] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 44.185127][ T3603] RDX: 0000000000000002 RSI: ffffffff87fcf5b3 RDI: ffff888024898ef0 [ 44.193086][ T3603] RBP: ffff888024898c00 R08: 0000000000000001 R09: 00000000fffffff0 [ 44.201041][ T3603] R10: ffffffff87fcf841 R11: 0000000000000000 R12: 0000000000000000 [ 44.208995][ T3603] R13: 0000000000000014 R14: ffff88801a422d08 R15: 0000000000000001 [ 44.216949][ T3603] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 44.225863][ T3603] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.232430][ T3603] CR2: 00007fd7f1242ae8 CR3: 0000000019a21000 CR4: 00000000003506f0 [ 44.240386][ T3603] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 44.248348][ T3603] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 44.256311][ T3603] Call Trace: [ 44.259590][ T3603] [ 44.262525][ T3603] ? wait_on_pending_writer+0x430/0x430 [ 44.268070][ T3603] ? __local_bh_enable_ip+0xa0/0x120 [ 44.273343][ T3603] tls_sk_proto_close+0x356/0xaf0 [ 44.278357][ T3603] ? wait_on_pending_writer+0x430/0x430 [ 44.283891][ T3603] ? down_write+0xde/0x150 [ 44.288296][ T3603] ? ip_mc_drop_socket+0x16/0x260 [ 44.293304][ T3603] ? locks_remove_file+0x2f7/0x570 [ 44.298404][ T3603] inet_release+0x12e/0x280 [ 44.302900][ T3603] __sock_release+0xcd/0x280 [ 44.307479][ T3603] sock_close+0x18/0x20 [ 44.311621][ T3603] __fput+0x277/0x9d0 [ 44.315592][ T3603] ? __sock_release+0x280/0x280 [ 44.320432][ T3603] task_work_run+0xdd/0x1a0 [ 44.324927][ T3603] do_exit+0xaff/0x2a00 [ 44.329073][ T3603] ? lock_downgrade+0x6e0/0x6e0 [ 44.334257][ T3603] ? mm_update_next_owner+0x7a0/0x7a0 [ 44.339626][ T3603] ? _raw_spin_unlock_irq+0x1f/0x40 [ 44.344812][ T3603] do_group_exit+0xd2/0x2f0 [ 44.349449][ T3603] __x64_sys_exit_group+0x3a/0x50 [ 44.354460][ T3603] do_syscall_64+0x35/0xb0 [ 44.358870][ T3603] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 44.364752][ T3603] RIP: 0033:0x7fd7f11fe7d9 [ 44.369675][ T3603] Code: Unable to access opcode bytes at RIP 0x7fd7f11fe7af. [ 44.377020][ T3603] RSP: 002b:00007fff49a6b158 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 44.385421][ T3603] RAX: ffffffffffffffda RBX: 00007fd7f1272270 RCX: 00007fd7f11fe7d9 [ 44.393380][ T3603] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 44.401351][ T3603] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 44.409324][ T3603] R10: 00007fd7f11c2900 R11: 0000000000000246 R12: 00007fd7f1272270 [ 44.417292][ T3603] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 44.425260][ T3603] [ 44.428266][ T3603] Modules linked in: [ 44.433119][ T3603] ---[ end trace 0000000000000000 ]--- [ 44.433177][ T3603] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 [ 44.434032][ T3603] Code: 02 00 0f 85 16 09 00 00 48 8b 85 f0 02 00 00 4d 8d 6c 24 14 4c 89 ea 48 c1 ea 03 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 02 4c 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 4f 07 00 00 [ 44.434097][ T3603] RSP: 0018:ffffc9000309fb70 EFLAGS: 00010203 [ 44.434117][ T3603] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 44.434209][ T3603] RDX: 0000000000000002 RSI: ffffffff87fcf5b3 RDI: ffff888024898ef0 [ 44.434225][ T3603] RBP: ffff888024898c00 R08: 0000000000000001 R09: 00000000fffffff0 [ 44.434413][ T3603] R10: ffffffff87fcf841 R11: 0000000000000000 R12: 0000000000000000 [ 44.434429][ T3603] R13: 0000000000000014 R14: ffff88801a422d08 R15: 0000000000000001 [ 44.434445][ T3603] FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 [ 44.434469][ T3603] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.434485][ T3603] CR2: 00000000200018c0 CR3: 0000000023042000 CR4: 00000000003506e0 [ 44.434501][ T3603] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 44.434515][ T3603] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 44.434531][ T3603] Kernel panic - not syncing: Fatal exception [ 44.556789][ T3603] Kernel Offset: disabled [ 44.561105][ T3603] Rebooting in 86400 seconds..