./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2578519941 <...> DUID 00:04:e3:a1:4c:5b:a4:47:39:93:9a:5d:f6:69:14:97:a9:57 forked to background, child pid 3185 [ 22.488492][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 22.500430][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.10.3' (ECDSA) to the list of known hosts. execve("./syz-executor2578519941", ["./syz-executor2578519941"], 0x7ffcab1f0460 /* 10 vars */) = 0 brk(NULL) = 0x555557117000 brk(0x555557117d00) = 0x555557117d00 arch_prctl(ARCH_SET_FS, 0x5555571173c0) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2578519941", 4096) = 28 brk(0x555557138d00) = 0x555557138d00 brk(0x555557139000) = 0x555557139000 mprotect(0x7f5a9d544000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f5a9d499000, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f5a9d499660}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f5a9d499000, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f5a9d499660}, NULL, 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557117690) = 3608 ./strace-static-x86_64: Process 3608 attached [pid 3608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3608] setpgid(0, 0) = 0 [pid 3608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3608] write(3, "1000", 4) = 4 [pid 3608] close(3) = 0 [pid 3608] openat(AT_FDCWD, "/dev/fb0", O_RDONLY|O_TRUNC|O_NONBLOCK) = 3 [pid 3608] mmap(0x20000000, 8388608, PROT_EXEC|PROT_SEM|0x800000, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0x20000000 [pid 3608] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000240} --- syzkaller login: [ 41.943265][ T3608] ------------[ cut here ]------------ [ 41.949062][ T3608] kernel BUG at mm/memory.c:2226! [ 41.954217][ T3608] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 41.960266][ T3608] CPU: 0 PID: 3608 Comm: syz-executor257 Not tainted 6.0.0-rc2-next-20220826-syzkaller #0 [ 41.970135][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 41.980173][ T3608] RIP: 0010:vmf_insert_pfn_prot+0x248/0x460 [ 41.986071][ T3608] Code: 0f 0b e8 4b a5 c6 ff 4d 89 f7 bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 27 a2 c6 ff 49 83 ff 20 0f 85 a5 fe ff ff e8 28 a5 c6 ff <0f> 0b 49 be ff ff ff ff ff ff 0f 00 e8 17 a5 c6 ff 4d 21 ee 4c 89 [ 42.005661][ T3608] RSP: 0018:ffffc90003bef8e8 EFLAGS: 00010293 [ 42.011712][ T3608] RAX: 0000000000000000 RBX: 1ffff9200077df1f RCX: 0000000000000000 [ 42.019675][ T3608] RDX: ffff888016e0ba80 RSI: ffffffff81b55e38 RDI: 0000000000000007 [ 42.027629][ T3608] RBP: ffff88801c8bb1b0 R08: 0000000000000007 R09: 0000000000000020 [ 42.035604][ T3608] R10: 0000000000000020 R11: 000000000008c07c R12: 0000000020000000 [ 42.043903][ T3608] R13: 000000000001d56e R14: 000000000c040474 R15: 0000000000000020 [ 42.051858][ T3608] FS: 00005555571173c0(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 42.060772][ T3608] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.067339][ T3608] CR2: 0000000020000240 CR3: 0000000070c12000 CR4: 00000000003506f0 [ 42.075296][ T3608] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.083262][ T3608] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.091221][ T3608] Call Trace: [ 42.094488][ T3608] [ 42.097424][ T3608] ? insert_pfn+0x680/0x680 [ 42.101918][ T3608] drm_gem_shmem_fault+0x1dd/0x290 [ 42.107021][ T3608] __do_fault+0x107/0x600 [ 42.111337][ T3608] __handle_mm_fault+0x2184/0x3a40 [ 42.116468][ T3608] ? vm_iomap_memory+0x180/0x180 [ 42.121395][ T3608] ? lock_release+0x780/0x780 [ 42.126068][ T3608] handle_mm_fault+0x1c8/0x780 [ 42.130821][ T3608] do_user_addr_fault+0x475/0x1210 [ 42.135930][ T3608] ? rcu_read_lock_sched_held+0xd/0x70 [ 42.141391][ T3608] exc_page_fault+0x94/0x170 [ 42.145978][ T3608] asm_exc_page_fault+0x22/0x30 [ 42.150819][ T3608] RIP: 0010:strncpy_from_user+0x1bd/0x3c0 [ 42.156535][ T3608] Code: ed 08 4d 89 74 1d 00 bf 07 00 00 00 48 83 c3 08 48 89 ee e8 f5 7c 5b fd 48 83 fd 07 0f 86 c0 01 00 00 e8 f6 7f 5b fd 45 31 ff <49> 8b 04 1c 31 ff 44 89 fe 49 89 c6 e8 b2 7c 5b fd 45 85 ff 0f 84 [ 42.176148][ T3608] RSP: 0018:ffffc90003befd08 EFLAGS: 00050246 [ 42.182200][ T3608] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 42.190154][ T3608] RDX: ffff888016e0ba80 RSI: ffffffff8420836a RDI: 0000000000000007 [ 42.198111][ T3608] RBP: 0000000000000fe0 R08: 0000000000000007 R09: 0000000000000007 [ 42.206075][ T3608] R10: 0000000000000fe0 R11: 0000000000000000 R12: 0000000020000240 [ 42.214045][ T3608] R13: ffff88807bf1e620 R14: ffff88807bf1e620 R15: 0000000000000000 [ 42.222009][ T3608] ? strncpy_from_user+0x1ba/0x3c0 [ 42.227119][ T3608] ? strncpy_from_user+0x1ba/0x3c0 [ 42.232221][ T3608] getname_flags.part.0+0x95/0x4f0 [ 42.237335][ T3608] getname+0x8e/0xd0 [ 42.241231][ T3608] do_sys_openat2+0xf5/0x4c0 [ 42.245810][ T3608] ? ptrace_stop.part.0+0x746/0xa80 [ 42.251012][ T3608] ? build_open_flags+0x6f0/0x6f0 [ 42.256021][ T3608] ? lock_release+0x560/0x780 [ 42.260684][ T3608] ? ptrace_notify+0xfa/0x140 [ 42.265349][ T3608] ? lock_downgrade+0x6e0/0x6e0 [ 42.270196][ T3608] __x64_sys_openat+0x13f/0x1f0 [ 42.275045][ T3608] ? __ia32_sys_open+0x1c0/0x1c0 [ 42.279998][ T3608] ? _raw_spin_unlock_irq+0x2a/0x40 [ 42.285184][ T3608] ? ptrace_notify+0xfa/0x140 [ 42.289850][ T3608] do_syscall_64+0x35/0xb0 [ 42.294258][ T3608] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.300158][ T3608] RIP: 0033:0x7f5a9d4d70f9 [ 42.304567][ T3608] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 42.324172][ T3608] RSP: 002b:00007ffea5a84cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 42.332586][ T3608] RAX: ffffffffffffffda RBX: 00007ffea5a84cf8 RCX: 00007f5a9d4d70f9 [ 42.340548][ T3608] RDX: 000000000000275a RSI: 0000000020000240 RDI: 00000000ffffff9c [ 42.348765][ T3608] RBP: 0000000000000000 R08: 0000000000000000 R09: 431bde82d7b634db [ 42.356719][ T3608] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5a9d49a980 [ 42.364676][ T3608] R13: 431bde82d7b634db R14: 00007ffea5a84cf0 R15: 0000000000000000 [ 42.372636][ T3608] [ 42.375636][ T3608] Modules linked in: [ 42.380100][ T3608] ---[ end trace 0000000000000000 ]--- [ 42.385575][ T3608] RIP: 0010:vmf_insert_pfn_prot+0x248/0x460 [ 42.391551][ T3608] Code: 0f 0b e8 4b a5 c6 ff 4d 89 f7 bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 27 a2 c6 ff 49 83 ff 20 0f 85 a5 fe ff ff e8 28 a5 c6 ff <0f> 0b 49 be ff ff ff ff ff ff 0f 00 e8 17 a5 c6 ff 4d 21 ee 4c 89 [ 42.411186][ T3608] RSP: 0018:ffffc90003bef8e8 EFLAGS: 00010293 [ 42.417254][ T3608] RAX: 0000000000000000 RBX: 1ffff9200077df1f RCX: 0000000000000000 [ 42.425247][ T3608] RDX: ffff888016e0ba80 RSI: ffffffff81b55e38 RDI: 0000000000000007 [ 42.433236][ T3608] RBP: ffff88801c8bb1b0 R08: 0000000000000007 R09: 0000000000000020 [ 42.441238][ T3608] R10: 0000000000000020 R11: 000000000008c07c R12: 0000000020000000 [ 42.449246][ T3608] R13: 000000000001d56e R14: 000000000c040474 R15: 0000000000000020 [ 42.457216][ T3608] FS: 00005555571173c0(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 42.466161][ T3608] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.472793][ T3608] CR2: 00007f5a9d49894b CR3: 0000000070c12000 CR4: 00000000003506e0 [ 42.480794][ T3608] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.488821][ T3608] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.496794][ T3608] Kernel panic - not syncing: Fatal exception [ 42.502904][ T3608] Kernel Offset: disabled [ 42.507219][ T3608] Rebooting in 86400 seconds..