./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4083713450 <...> DUID 00:04:a3:03:08:15:93:78:e3:1f:4c:1c:fb:56:e6:f5:4b:05 forked to background, child pid 3190 [ 27.343647][ T3191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 27.349549][ T3191] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.155' (ECDSA) to the list of known hosts. execve("./syz-executor4083713450", ["./syz-executor4083713450"], 0x7ffd0c43cce0 /* 10 vars */) = 0 brk(NULL) = 0x555555bee000 brk(0x555555beec40) = 0x555555beec40 arch_prctl(ARCH_SET_FS, 0x555555bee300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x555555bee5d0) = 3618 set_robust_list(0x555555bee5e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f2d02e60510, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f2d02e60be0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f2d02e605b0, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f2d02e60be0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4083713450", 4096) = 28 brk(0x555555c0fc40) = 0x555555c0fc40 brk(0x555555c10000) = 0x555555c10000 mprotect(0x7f2d02f22000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555bee5d0) = 3619 ./strace-static-x86_64: Process 3619 attached [pid 3619] set_robust_list(0x555555bee5e0, 24) = 0 [pid 3619] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3619] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3619] setsid() = 1 [pid 3619] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3619] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3619] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3619] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3619] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3619] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3619] unshare(CLONE_NEWNS) = 0 [pid 3619] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3619] unshare(CLONE_NEWIPC) = 0 [pid 3619] unshare(CLONE_NEWCGROUP) = 0 [pid 3619] unshare(CLONE_NEWUTS) = 0 [pid 3619] unshare(CLONE_SYSVSEM) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "16777216", 8) = 8 [pid 3619] close(3) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "536870912", 9) = 9 [pid 3619] close(3) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "1024", 4) = 4 [pid 3619] close(3) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "8192", 4) = 4 [pid 3619] close(3) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "1024", 4) = 4 [pid 3619] close(3) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "1024", 4) = 4 [pid 3619] close(3) = 0 [pid 3619] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3619] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3619] close(3) = 0 [pid 3619] getpid() = 1 [pid 3619] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3621] set_robust_list(0x7f2d02e509e0, 24 [pid 3620] <... clone resumed>, parent_tid=[3], tls=0x7f2d02e50700, child_tidptr=0x7f2d02e509d0) = 3 [pid 3621] <... set_robust_list resumed>) = 0 [pid 3620] futex(0x7f2d02f284a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3620] futex(0x7f2d02f284ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3621] userfaultfd(UFFD_USER_MODE_ONLY|O_CLOEXEC) = 3 [pid 3621] futex(0x7f2d02f284ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3620] <... futex resumed>) = 0 [pid 3620] futex(0x7f2d02f284a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3620] futex(0x7f2d02f284ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3621] ioctl(3, UFFDIO_API, {api=0xaa, features=0 => features=UFFD_FEATURE_PAGEFAULT_FLAG_WP|UFFD_FEATURE_EVENT_FORK|UFFD_FEATURE_EVENT_REMAP|UFFD_FEATURE_EVENT_REMOVE|UFFD_FEATURE_MISSING_HUGETLBFS|UFFD_FEATURE_MISSING_SHMEM|UFFD_FEATURE_EVENT_UNMAP|UFFD_FEATURE_SIGBUS|UFFD_FEATURE_THREAD_ID|UFFD_FEATURE_MINOR_HUGETLBFS|UFFD_FEATURE_MINOR_SHMEM|0x800, ioctls=1<<_UFFDIO_REGISTER|1<<_UFFDIO_UNREGISTER|1<<_UFFDIO_API}) = 0 [pid 3621] futex(0x7f2d02f284ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3620] <... futex resumed>) = 0 [pid 3620] futex(0x7f2d02f284a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3620] futex(0x7f2d02f284ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3621] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4 [pid 3621] write(4, "4", 1) = 1 [pid 3621] read(3, [pid 3620] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 3620] futex(0x7f2d02f284bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3620] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f2d02e0f000 [pid 3620] mprotect(0x7f2d02e10000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 3620] clone(child_stack=0x7f2d02e2f3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 3622 attached , parent_tid=[4], tls=0x7f2d02e2f700, child_tidptr=0x7f2d02e2f9d0) = 4 [pid 3620] futex(0x7f2d02f284b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3620] futex(0x7f2d02f284bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3622] set_robust_list(0x7f2d02e2f9e0, 24) = 0 [pid 3622] ioctl(3, UFFDIO_REGISTER, {range={start=0x207aa000, len=0x3000}, mode=UFFDIO_REGISTER_MODE_MISSING, ioctls=1<<_UFFDIO_WAKE|1<<_UFFDIO_COPY|1<<_UFFDIO_ZEROPAGE}) = 0 [pid 3622] futex(0x7f2d02f284bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 3620] <... futex resumed>) = 0 [pid 3622] <... futex resumed>) = 1 [pid 3622] futex(0x7f2d02f284b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 3620] close(3) = 0 [pid 3620] close(4) = 0 [pid 3620] close(5) = -1 EBADF (Bad file descriptor) [pid 3620] close(6) = -1 EBADF (Bad file descriptor) [pid 3620] close(7) = -1 EBADF (Bad file descriptor) [pid 3620] close(8) = -1 EBADF (Bad file descriptor) [pid 3620] close(9) = -1 EBADF (Bad file descriptor) [pid 3620] close(10) = -1 EBADF (Bad file descriptor) [pid 3620] close(11) = -1 EBADF (Bad file descriptor) [pid 3620] close(12) = -1 EBADF (Bad file descriptor) [pid 3620] close(13) = -1 EBADF (Bad file descriptor) [pid 3620] close(14) = -1 EBADF (Bad file descriptor) [pid 3620] close(15) = -1 EBADF (Bad file descriptor) [pid 3620] close(16) = -1 EBADF (Bad file descriptor) [pid 3620] close(17) = -1 EBADF (Bad file descriptor) [pid 3620] close(18) = -1 EBADF (Bad file descriptor) [pid 3620] close(19) = -1 EBADF (Bad file descriptor) [pid 3620] close(20) = -1 EBADF (Bad file descriptor) [pid 3620] close(21) = -1 EBADF (Bad file descriptor) [pid 3620] close(22) = -1 EBADF (Bad file descriptor) [pid 3620] close(23) = -1 EBADF (Bad file descriptor) [pid 3620] close(24) = -1 EBADF (Bad file descriptor) [pid 3620] close(25) = -1 EBADF (Bad file descriptor) [pid 3620] close(26) = -1 EBADF (Bad file descriptor) [pid 3620] close(27) = -1 EBADF (Bad file descriptor) [pid 3620] close(28) = -1 EBADF (Bad file descriptor) [pid 3620] close(29) = -1 EBADF (Bad file descriptor) [pid 3620] exit_group(0) = ? [pid 3622] <... futex resumed>) = ? syzkaller login: [ 51.559212][ T3621] ================================================================== [ 51.559224][ T3621] BUG: KASAN: use-after-free in __vma_adjust+0x18ee/0x1900 [ 51.559254][ T3621] Read of size 8 at addr ffff88801fefe208 by task syz-executor408/3621 [ 51.559272][ T3621] [ 51.559277][ T3621] CPU: 0 PID: 3621 Comm: syz-executor408 Not tainted 5.19.0-rc1-next-20220610-syzkaller #0 [ 51.559297][ T3621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.559309][ T3621] Call Trace: [ 51.559314][ T3621] [ 51.559321][ T3621] dump_stack_lvl+0xcd/0x134 [ 51.559359][ T3621] print_address_description.constprop.0.cold+0xeb/0x495 [ 51.559385][ T3621] ? __vma_adjust+0x18ee/0x1900 [ 51.559406][ T3621] kasan_report.cold+0xf4/0x1c6 [ 51.559429][ T3621] ? __vma_adjust+0x18ee/0x1900 [ 51.559451][ T3621] __vma_adjust+0x18ee/0x1900 [ 51.559487][ T3621] ? vma_expand+0xc60/0xc60 [ 51.559509][ T3621] ? can_vma_merge_before+0x390/0x390 [ 51.559534][ T3621] vma_merge+0x590/0x870 [ 51.559557][ T3621] userfaultfd_release+0x4c5/0x670 [ 51.559583][ T3621] ? userfaultfd_event_wait_completion+0xbd0/0xbd0 [ 51.559611][ T3621] ? ima_file_free+0xb6/0x410 [ 51.559637][ T3621] __fput+0x277/0x9d0 [ 51.559658][ T3621] ? userfaultfd_event_wait_completion+0xbd0/0xbd0 [ 51.559682][ T3621] task_work_run+0xdd/0x1a0 [ 51.559726][ T3621] ptrace_notify+0x114/0x140 [ 51.559746][ T3621] syscall_exit_to_user_mode_prepare+0xdb/0x230 [ 51.559767][ T3621] syscall_exit_to_user_mode+0x9/0x50 [ 51.559786][ T3621] do_syscall_64+0x42/0xb0 [ 51.559811][ T3621] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 51.559835][ T3621] RIP: 0033:0x7f2d02e9ef59 [ 51.559852][ T3621] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 51.559871][ T3621] RSP: 002b:00007f2d02e502f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 51.559893][ T3621] RAX: fffffffffffffe00 RBX: 00007f2d02f284a8 RCX: 00007f2d02e9ef59 [ 51.559908][ T3621] RDX: 000000000000003c RSI: 0000000020000180 RDI: 0000000000000003 [ 51.559921][ T3621] RBP: 00007f2d02f284a0 R08: 0000000000000001 R09: 0000000000000034 [ 51.559932][ T3621] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2d02e50300 [ 51.559944][ T3621] R13: 0000000000000001 R14: 00007f2d02e50400 R15: 0000000000022000 [ 51.559962][ T3621] [ 51.559968][ T3621] [ 51.559971][ T3621] Allocated by task 3619: [ 51.559980][ T3621] kasan_save_stack+0x1e/0x40 [ 51.559999][ T3621] __kasan_slab_alloc+0x90/0xc0 [ 51.560011][ T3621] kmem_cache_alloc+0x204/0x3b0 [ 51.560029][ T3621] vm_area_dup+0x81/0x380 [ 51.560041][ T3621] dup_mmap+0x656/0x1090 [ 51.560053][ T3621] dup_mm+0x91/0x370 [ 51.560064][ T3621] copy_process+0x3c95/0x7080 [ 51.560076][ T3621] kernel_clone+0xe7/0xab0 [ 51.560089][ T3621] __do_sys_clone+0xba/0x100 [ 51.560101][ T3621] do_syscall_64+0x35/0xb0 [ 51.560115][ T3621] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 51.560128][ T3621] [ 51.560129][ T3621] Freed by task 3621: [ 51.560134][ T3621] kasan_save_stack+0x1e/0x40 [ 51.560144][ T3621] kasan_set_track+0x21/0x30 [ 51.560154][ T3621] kasan_set_free_info+0x20/0x30 [ 51.560167][ T3621] ____kasan_slab_free+0x166/0x1a0 [ 51.560177][ T3621] slab_free_freelist_hook+0x8b/0x1c0 [ 51.560194][ T3621] kmem_cache_free+0xdd/0x5a0 [ 51.560203][ T3621] __vma_adjust+0x9ab/0x1900 [ 51.560214][ T3621] vma_merge+0x590/0x870 [ 51.560224][ T3621] userfaultfd_release+0x4c5/0x670 [ 51.560234][ T3621] __fput+0x277/0x9d0 [ 51.560245][ T3621] task_work_run+0xdd/0x1a0 [ 51.560261][ T3621] ptrace_notify+0x114/0x140 [ 51.560271][ T3621] syscall_exit_to_user_mode_prepare+0xdb/0x230 [ 51.560283][ T3621] syscall_exit_to_user_mode+0x9/0x50 [ 51.560293][ T3621] do_syscall_64+0x42/0xb0 [ 51.560307][ T3621] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 51.560319][ T3621] [ 51.560321][ T3621] The buggy address belongs to the object at ffff88801fefe1b0 [ 51.560321][ T3621] which belongs to the cache vm_area_struct of size 152 [ 51.560330][ T3621] The buggy address is located 88 bytes inside of [ 51.560330][ T3621] 152-byte region [ffff88801fefe1b0, ffff88801fefe248) [ 51.560341][ T3621] [ 51.560342][ T3621] The buggy address belongs to the physical page: [ 51.560347][ T3621] page:ffffea00007fbf80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fefe [ 51.560360][ T3621] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 51.560377][ T3621] raw: 00fff00000000200 ffffea00009ed380 dead000000000003 ffff888140006b40 [ 51.560389][ T3621] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000 [ 51.560394][ T3621] page dumped because: kasan: bad access detected [ 51.560399][ T3621] page_owner tracks the page as allocated [ 51.560402][ T3621] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3327, tgid 3327 (rm), ts 28524505479, free_ts 28520297867 [ 51.560422][ T3621] get_page_from_freelist+0xa64/0x3d10 [ 51.560437][ T3621] __alloc_pages+0x1c7/0x510 [ 51.560449][ T3621] alloc_pages+0x1aa/0x310 [ 51.560465][ T3621] allocate_slab+0x26c/0x3c0 [ 51.560481][ T3621] ___slab_alloc+0x985/0xd90 [ 51.560498][ T3621] __slab_alloc.constprop.0+0x4d/0xa0 [ 51.560515][ T3621] kmem_cache_alloc+0x360/0x3b0 [ 51.560532][ T3621] vm_area_dup+0x81/0x380 [ 51.560547][ T3621] __split_vma+0x9f/0x530 [ 51.560558][ T3621] do_mas_align_munmap+0x2c0/0xf00 [ 51.560570][ T3621] do_mas_munmap+0x202/0x2c0 [ 51.560581][ T3621] mmap_region+0x219/0x1bf0 [ 51.560593][ T3621] do_mmap+0x825/0xf60 [ 51.560604][ T3621] vm_mmap_pgoff+0x1b7/0x290 [ 51.560620][ T3621] ksys_mmap_pgoff+0x40d/0x5a0 [ 51.560631][ T3621] do_syscall_64+0x35/0xb0 [ 51.560644][ T3621] page last free stack trace: [ 51.560647][ T3621] free_pcp_prepare+0x549/0xd20 [ 51.560658][ T3621] free_unref_page_list+0x184/0x1530 [ 51.560671][ T3621] release_pages+0xff1/0x2290 [ 51.560686][ T3621] tlb_batch_pages_flush+0xa8/0x1a0 [ 51.560699][ T3621] tlb_finish_mmu+0x147/0x7e0 [ 51.560711][ T3621] exit_mmap+0x217/0x750 [ 51.560723][ T3621] __mmput+0x128/0x4c0 [ 51.560733][ T3621] mmput+0x5c/0x70 [ 51.560744][ T3621] begin_new_exec+0xfbd/0x2e50 [ 51.560754][ T3621] load_elf_binary+0x15a3/0x4ec0 [ 51.560768][ T3621] bprm_execve+0x7ef/0x1970 [ 51.560786][ T3621] do_execveat_common+0x724/0x890 [ 51.560804][ T3621] __x64_sys_execve+0x8f/0xc0 [ 51.560813][ T3621] do_syscall_64+0x35/0xb0 [ 51.560827][ T3621] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 51.560839][ T3621] [ 51.560841][ T3621] Memory state around the buggy address: [ 51.560846][ T3621] ffff88801fefe100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 51.560853][ T3621] ffff88801fefe180: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 51.560861][ T3621] >ffff88801fefe200: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 51.560867][ T3621] ^ [ 51.560872][ T3621] ffff88801fefe280: fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 51.560879][ T3621] ffff88801fefe300: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 [ 51.560885][ T3621] ================================================================== [ 51.560890][ T3621] Kernel panic - not syncing: panic_on_warn set ... [ 52.251729][ T3621] CPU: 0 PID: 3621 Comm: syz-executor408 Not tainted 5.19.0-rc1-next-20220610-syzkaller #0 [ 52.261720][ T3621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.271812][ T3621] Call Trace: [ 52.275089][ T3621] [ 52.278011][ T3621] dump_stack_lvl+0xcd/0x134 [ 52.282603][ T3621] panic+0x2d7/0x636 [ 52.286503][ T3621] ? panic_print_sys_info.part.0+0x10b/0x10b [ 52.292487][ T3621] ? mark_held_locks+0x9f/0xe0 [ 52.297246][ T3621] ? __vma_adjust+0x18ee/0x1900 [ 52.302110][ T3621] ? __vma_adjust+0x18ee/0x1900 [ 52.306956][ T3621] end_report.part.0+0x3f/0x7c [ 52.311727][ T3621] kasan_report.cold+0x93/0x1c6 [ 52.316571][ T3621] ? __vma_adjust+0x18ee/0x1900 [ 52.321417][ T3621] __vma_adjust+0x18ee/0x1900 [ 52.326097][ T3621] ? vma_expand+0xc60/0xc60 [ 52.330619][ T3621] ? can_vma_merge_before+0x390/0x390 [ 52.336003][ T3621] vma_merge+0x590/0x870 [ 52.340332][ T3621] userfaultfd_release+0x4c5/0x670 [ 52.345468][ T3621] ? userfaultfd_event_wait_completion+0xbd0/0xbd0 [ 52.351974][ T3621] ? ima_file_free+0xb6/0x410 [ 52.356668][ T3621] __fput+0x277/0x9d0 [ 52.360643][ T3621] ? userfaultfd_event_wait_completion+0xbd0/0xbd0 [ 52.367146][ T3621] task_work_run+0xdd/0x1a0 [ 52.371654][ T3621] ptrace_notify+0x114/0x140 [ 52.376249][ T3621] syscall_exit_to_user_mode_prepare+0xdb/0x230 [ 52.382479][ T3621] syscall_exit_to_user_mode+0x9/0x50 [ 52.387930][ T3621] do_syscall_64+0x42/0xb0 [ 52.392339][ T3621] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 52.398220][ T3621] RIP: 0033:0x7f2d02e9ef59 [ 52.402629][ T3621] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 52.422250][ T3621] RSP: 002b:00007f2d02e502f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 52.430650][ T3621] RAX: fffffffffffffe00 RBX: 00007f2d02f284a8 RCX: 00007f2d02e9ef59 [ 52.438622][ T3621] RDX: 000000000000003c RSI: 0000000020000180 RDI: 0000000000000003 [ 52.446594][ T3621] RBP: 00007f2d02f284a0 R08: 0000000000000001 R09: 0000000000000034 [ 52.454572][ T3621] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2d02e50300 [ 52.462532][ T3621] R13: 0000000000000001 R14: 00007f2d02e50400 R15: 0000000000022000 [ 52.470531][ T3621] [ 52.473728][ T3621] Kernel Offset: disabled [ 52.478145][ T3621] Rebooting in 86400 seconds..