./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2952498473 <...> Warning: Permanently added '10.128.0.116' (ED25519) to the list of known hosts. execve("./syz-executor2952498473", ["./syz-executor2952498473"], 0x7ffd39293c80 /* 10 vars */) = 0 brk(NULL) = 0x555589c12000 brk(0x555589c12d00) = 0x555589c12d00 arch_prctl(ARCH_SET_FS, 0x555589c12380) = 0 set_tid_address(0x555589c12650) = 5077 set_robust_list(0x555589c12660, 24) = 0 rseq(0x555589c12ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2952498473", 4096) = 28 getrandom("\x12\x71\x25\x2d\xd4\x6e\x50\x5f", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555589c12d00 brk(0x555589c33d00) = 0x555589c33d00 brk(0x555589c34000) = 0x555589c34000 mprotect(0x7fb44bdf9000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5078 attached [pid 5078] set_robust_list(0x555589c12660, 24 [pid 5077] <... clone resumed>, child_tidptr=0x555589c12650) = 5078 [pid 5078] <... set_robust_list resumed>) = 0 [pid 5078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5078] setpgid(0, 0) = 0 [pid 5078] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1000", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] write(1, "executing program\n", 18executing program ) = 18 [pid 5078] io_uring_setup(5226, {flags=0, sq_thread_cpu=0, sq_thread_idle=0, sq_entries=8192, cq_entries=16384, features=IORING_FEAT_SINGLE_MMAP|IORING_FEAT_NODROP|IORING_FEAT_SUBMIT_STABLE|IORING_FEAT_RW_CUR_POS|IORING_FEAT_CUR_PERSONALITY|IORING_FEAT_FAST_POLL|IORING_FEAT_POLL_32BITS|IORING_FEAT_SQPOLL_NONFIXED|IORING_FEAT_EXT_ARG|IORING_FEAT_NATIVE_WORKERS|IORING_FEAT_RSRC_TAGS|IORING_FEAT_CQE_SKIP|IORING_FEAT_LINKED_FILE|0x6000, sq_off={head=0, tail=4, ring_mask=16, ring_entries=24, flags=36, dropped=32, array=262208}, cq_off={head=8, tail=12, ring_mask=20, ring_entries=28, overflow=44, cqes=64, flags=40}}) = 3 [pid 5078] socketpair(AF_UNIX, SOCK_STREAM, 0, [4, 5]) = 0 [pid 5078] ioctl(5, SIOCGIFINDEX, {ifr_name="lo", ifr_ifindex=1}) = 0 [pid 5078] bind(-1, {sa_family=AF_BLUETOOTH, l2_psm=htobs(0 /* L2CAP_PSM_??? */), l2_bdaddr=00:00:00:00:00:00, l2_cid=htobs(L2CAP_CID_ATT), l2_bdaddr_type=BDADDR_BREDR}, 14) = -1 EBADF (Bad file descriptor) [pid 5078] io_uring_register(3, IORING_REGISTER_PERSONALITY, NULL, 0) = 1 [pid 5078] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5078] write(6, "3", 1) = 1 [pid 5078] io_uring_register(3, IORING_REGISTER_PBUF_RING, {ring_addr=NULL, ring_entries=4, bgid=0, pad=0x1}, 1) = 0 [pid 5078] exit_group(0) = ? [pid 5078] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5078, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5079 attached , child_tidptr=0x555589c12650) = 5079 [pid 5079] set_robust_list(0x555589c12660, 24) = 0 [pid 5079] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5079] setpgid(0, 0) = 0 [pid 5079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5079] write(3, "1000", 4) = 4 [pid 5079] close(3) = 0 [pid 5079] write(1, "executing program\n", 18executing program ) = 18 [pid 5079] io_uring_setup(5226, {flags=0, sq_thread_cpu=0, sq_thread_idle=0, sq_entries=8192, cq_entries=16384, features=IORING_FEAT_SINGLE_MMAP|IORING_FEAT_NODROP|IORING_FEAT_SUBMIT_STABLE|IORING_FEAT_RW_CUR_POS|IORING_FEAT_CUR_PERSONALITY|IORING_FEAT_FAST_POLL|IORING_FEAT_POLL_32BITS|IORING_FEAT_SQPOLL_NONFIXED|IORING_FEAT_EXT_ARG|IORING_FEAT_NATIVE_WORKERS|IORING_FEAT_RSRC_TAGS|IORING_FEAT_CQE_SKIP|IORING_FEAT_LINKED_FILE|0x6000, sq_off={head=0, tail=4, ring_mask=16, ring_entries=24, flags=36, dropped=32, array=262208}, cq_off={head=8, tail=12, ring_mask=20, ring_entries=28, overflow=44, cqes=64, flags=40}}) = 3 [pid 5079] socketpair(AF_UNIX, SOCK_STREAM, 0, [4, 5]) = 0 [pid 5079] ioctl(5, SIOCGIFINDEX, {ifr_name="lo", ifr_ifindex=1}) = 0 [pid 5079] bind(-1, {sa_family=AF_BLUETOOTH, l2_psm=htobs(0 /* L2CAP_PSM_??? */), l2_bdaddr=00:00:00:00:00:00, l2_cid=htobs(L2CAP_CID_ATT), l2_bdaddr_type=BDADDR_BREDR}, 14) = -1 EBADF (Bad file descriptor) [pid 5079] io_uring_register(3, IORING_REGISTER_PERSONALITY, NULL, 0) = 1 [pid 5079] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5079] write(6, "3", 1) = 1 [pid 5079] io_uring_register(3, IORING_REGISTER_PBUF_RING, {ring_addr=NULL, ring_entries=4, bgid=0, pad=0x1}, 1) = 0 [pid 5079] exit_group(0) = ? [pid 5079] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5079, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 71.274343][ T35] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 71.286961][ T35] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 71.295369][ T35] CPU: 1 PID: 35 Comm: kworker/u8:2 Not tainted 6.10.0-syzkaller-01155-gd67978318827 #0 [ 71.305105][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 71.315165][ T35] Workqueue: iou_exit io_ring_exit_work clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5080 attached , child_tidptr=0x555589c12650) = 5080 [pid 5080] set_robust_list(0x555589c12660, 24) = 0 [pid 5080] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5080] setpgid(0, 0) = 0 [pid 5080] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 71.320755][ T35] RIP: 0010:__io_remove_buffers+0xac/0x700 [ 71.326572][ T35] Code: 42 80 3c 28 00 74 08 48 89 df e8 5f 02 5b fd 4d 89 fe 48 89 6c 24 40 48 89 5c 24 18 48 8b 1b 48 83 c3 0e 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3b 05 00 00 44 0f b7 3b 49 8d 7c 24 16 [ 71.346202][ T35] RSP: 0018:ffffc90000ab7840 EFLAGS: 00010246 [ 71.352272][ T35] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff888017a8da00 [ 71.360234][ T35] RDX: ffff888017a8da00 RSI: 0000000000000001 RDI: 0000000000000000 [pid 5080] write(3, "1000", 4) = 4 [pid 5080] close(3executing program ) = 0 [pid 5080] write(1, "executing program\n", 18) = 18 [pid 5080] io_uring_setup(5226, {flags=0, sq_thread_cpu=0, sq_thread_idle=0, sq_entries=8192, cq_entries=16384, features=IORING_FEAT_SINGLE_MMAP|IORING_FEAT_NODROP|IORING_FEAT_SUBMIT_STABLE|IORING_FEAT_RW_CUR_POS|IORING_FEAT_CUR_PERSONALITY|IORING_FEAT_FAST_POLL|IORING_FEAT_POLL_32BITS|IORING_FEAT_SQPOLL_NONFIXED|IORING_FEAT_EXT_ARG|IORING_FEAT_NATIVE_WORKERS|IORING_FEAT_RSRC_TAGS|IORING_FEAT_CQE_SKIP|IORING_FEAT_LINKED_FILE|0x6000, sq_off={head=0, tail=4, ring_mask=16, ring_entries=24, flags=36, dropped=32, array=262208}, cq_off={head=8, tail=12, ring_mask=20, ring_entries=28, overflow=44, cqes=64, flags=40}}) = 3 [pid 5080] socketpair(AF_UNIX, SOCK_STREAM, 0, [4, 5]) = 0 [pid 5080] ioctl(5, SIOCGIFINDEX, {ifr_name="lo", ifr_ifindex=1}) = 0 [ 71.368205][ T35] RBP: 1ffff110052be8e4 R08: ffffffff849ddaa4 R09: 1ffff110052be8e3 [ 71.376189][ T35] R10: dffffc0000000000 R11: ffffed10052be8e4 R12: ffff8880295f4700 [ 71.384160][ T35] R13: dffffc0000000000 R14: ffff8880295f4720 R15: ffff8880295f4720 [ 71.392121][ T35] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 [ 71.401058][ T35] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.407639][ T35] CR2: 0000555589c12650 CR3: 000000000e132000 CR4: 00000000003506f0 [ 71.415608][ T35] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [pid 5080] bind(-1, {sa_family=AF_BLUETOOTH, l2_psm=htobs(0 /* L2CAP_PSM_??? */), l2_bdaddr=00:00:00:00:00:00, l2_cid=htobs(L2CAP_CID_ATT), l2_bdaddr_type=BDADDR_BREDR}, 14) = -1 EBADF (Bad file descriptor) [pid 5080] io_uring_register(3, IORING_REGISTER_PERSONALITY, NULL, 0) = 1 [pid 5080] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5080] write(6, "3", 1) = 1 [pid 5080] io_uring_register(3, IORING_REGISTER_PBUF_RING, {ring_addr=NULL, ring_entries=4, bgid=0, pad=0x1}, 1) = 0 [pid 5080] exit_group(0) = ? [ 71.423588][ T35] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.431577][ T35] Call Trace: [ 71.434863][ T35] [ 71.437784][ T35] ? __die_body+0x88/0xe0 [ 71.442116][ T35] ? die_addr+0x108/0x140 [ 71.446447][ T35] ? exc_general_protection+0x3dd/0x5d0 [ 71.452013][ T35] ? asm_exc_general_protection+0x26/0x30 [ 71.457763][ T35] ? __io_remove_buffers+0x64/0x700 [ 71.463005][ T35] ? __io_remove_buffers+0xac/0x700 [ 71.468215][ T35] io_destroy_buffers+0x14e/0x490 [pid 5080] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5080, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted clone ...>) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5081 attached , child_tidptr=0x555589c12650) = 5081 [pid 5081] set_robust_list(0x555589c12660, 24) = 0 [ 71.473244][ T35] ? lockdep_hardirqs_on+0x99/0x150 [ 71.478457][ T35] ? __pfx_io_destroy_buffers+0x10/0x10 [ 71.484014][ T35] ? io_futex_cache_free+0x1e3/0x240 [ 71.489289][ T35] io_ring_ctx_free+0xa00/0x1070 [ 71.494315][ T35] io_ring_exit_work+0x80f/0x8a0 [ 71.499257][ T35] ? __pfx_io_ring_exit_work+0x10/0x10 [ 71.504709][ T35] ? __pfx_io_tctx_exit_cb+0x10/0x10 [ 71.510006][ T35] ? process_scheduled_works+0x945/0x1830 [ 71.515753][ T35] process_scheduled_works+0xa2c/0x1830 [pid 5081] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5081] setpgid(0, 0) = 0 [pid 5081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5081] write(3, "1000", 4) = 4 [pid 5081] close(3) = 0 [pid 5081] write(1, "executing program\n", 18executing program ) = 18 [pid 5081] io_uring_setup(5226, {flags=0, sq_thread_cpu=0, sq_thread_idle=0, sq_entries=8192, cq_entries=16384, features=IORING_FEAT_SINGLE_MMAP|IORING_FEAT_NODROP|IORING_FEAT_SUBMIT_STABLE|IORING_FEAT_RW_CUR_POS|IORING_FEAT_CUR_PERSONALITY|IORING_FEAT_FAST_POLL|IORING_FEAT_POLL_32BITS|IORING_FEAT_SQPOLL_NONFIXED|IORING_FEAT_EXT_ARG|IORING_FEAT_NATIVE_WORKERS|IORING_FEAT_RSRC_TAGS|IORING_FEAT_CQE_SKIP|IORING_FEAT_LINKED_FILE|0x6000, sq_off={head=0, tail=4, ring_mask=16, ring_entries=24, flags=36, dropped=32, array=262208}, cq_off={head=8, tail=12, ring_mask=20, ring_entries=28, overflow=44, cqes=64, flags=40}}) = 3 [ 71.521325][ T35] ? __pfx_process_scheduled_works+0x10/0x10 [ 71.527298][ T35] ? assign_work+0x364/0x3d0 [ 71.531883][ T35] worker_thread+0x86d/0xd40 [ 71.536477][ T35] ? __kthread_parkme+0x169/0x1d0 [ 71.541512][ T35] ? __pfx_worker_thread+0x10/0x10 [ 71.546640][ T35] kthread+0x2f0/0x390 [ 71.550716][ T35] ? __pfx_worker_thread+0x10/0x10 [ 71.555824][ T35] ? __pfx_kthread+0x10/0x10 [ 71.560423][ T35] ret_from_fork+0x4b/0x80 [ 71.564929][ T35] ? __pfx_kthread+0x10/0x10 [ 71.569527][ T35] ret_from_fork_asm+0x1a/0x30 [pid 5081] socketpair(AF_UNIX, SOCK_STREAM, 0, [4, 5]) = 0 [pid 5081] ioctl(5, SIOCGIFINDEX, {ifr_name="lo", ifr_ifindex=1}) = 0 [pid 5081] bind(-1, {sa_family=AF_BLUETOOTH, l2_psm=htobs(0 /* L2CAP_PSM_??? */), l2_bdaddr=00:00:00:00:00:00, l2_cid=htobs(L2CAP_CID_ATT), l2_bdaddr_type=BDADDR_BREDR}, 14) = -1 EBADF (Bad file descriptor) [pid 5081] io_uring_register(3, IORING_REGISTER_PERSONALITY, NULL, 0) = 1 [pid 5081] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [ 71.574289][ T35] [ 71.577306][ T35] Modules linked in: [ 71.581525][ T35] ---[ end trace 0000000000000000 ]--- [ 71.587025][ T35] RIP: 0010:__io_remove_buffers+0xac/0x700 [ 71.592842][ T35] Code: 42 80 3c 28 00 74 08 48 89 df e8 5f 02 5b fd 4d 89 fe 48 89 6c 24 40 48 89 5c 24 18 48 8b 1b 48 83 c3 0e 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3b 05 00 00 44 0f b7 3b 49 8d 7c 24 16 [ 71.612467][ T35] RSP: 0018:ffffc90000ab7840 EFLAGS: 00010246 [pid 5081] write(6, "3", 1) = 1 [pid 5081] io_uring_register(3, IORING_REGISTER_PBUF_RING, {ring_addr=NULL, ring_entries=4, bgid=0, pad=0x1}, 1) = 0 [pid 5081] exit_group(0) = ? [pid 5081] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5081, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 71.618565][ T35] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff888017a8da00 [ 71.626589][ T35] RDX: ffff888017a8da00 RSI: 0000000000000001 RDI: 0000000000000000 [ 71.634751][ T35] RBP: 1ffff110052be8e4 R08: ffffffff849ddaa4 R09: 1ffff110052be8e3 [ 71.642733][ T35] R10: dffffc0000000000 R11: ffffed10052be8e4 R12: ffff8880295f4700 [ 71.650757][ T35] R13: dffffc0000000000 R14: ffff8880295f4720 R15: ffff8880295f4720 [ 71.658760][ T35] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 [ 71.664082][ T65] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#2] PREEMPT SMP KASAN PTI [ 71.667734][ T35] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.680239][ T65] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 71.680257][ T65] CPU: 0 PID: 65 Comm: kworker/u8:5 Tainted: G D 6.10.0-syzkaller-01155-gd67978318827 #0 [ 71.686835][ T35] CR2: 0000555589c12650 CR3: 000000000e132000 CR4: 00000000003506f0 [ 71.695198][ T65] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 71.695211][ T65] Workqueue: iou_exit io_ring_exit_work [ 71.706811][ T35] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.714353][ T65] [ 71.714361][ T65] RIP: 0010:__io_remove_buffers+0xac/0x700 [ 71.714391][ T65] Code: 42 80 3c 28 00 74 08 48 89 df e8 5f 02 5b fd 4d 89 fe 48 89 6c 24 40 48 89 5c 24 18 48 8b 1b 48 83 c3 0e 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3b 05 00 00 44 0f b7 3b 49 8d 7c 24 16 [ 71.714406][ T65] RSP: 0018:ffffc900020bf840 EFLAGS: 00010246 [ 71.714422][ T65] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff888017b65a00 [ 71.714434][ T65] RDX: ffff888017b65a00 RSI: 0000000000000001 RDI: 0000000000000000 [ 71.714446][ T65] RBP: 1ffff11003d3d7a4 R08: ffffffff849ddaa4 R09: 1ffff11003d3d7a3 [ 71.795524][ T65] R10: dffffc0000000000 R11: ffffed1003d3d7a4 R12: ffff88801e9ebd00 [ 71.803486][ T65] R13: dffffc0000000000 R14: ffff88801e9ebd20 R15: ffff88801e9ebd20 [ 71.811456][ T65] FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 [ 71.820367][ T65] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.826937][ T65] CR2: 00007fb44be001d0 CR3: 00000000227ee000 CR4: 00000000003506f0 [ 71.834900][ T65] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.842875][ T65] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.850845][ T65] Call Trace: [ 71.854117][ T65] [ 71.857031][ T65] ? __die_body+0x88/0xe0 [ 71.861370][ T65] ? die_addr+0x108/0x140 [ 71.865695][ T65] ? exc_general_protection+0x3dd/0x5d0 [ 71.871240][ T65] ? asm_exc_general_protection+0x26/0x30 [ 71.876979][ T65] ? __io_remove_buffers+0x64/0x700 [ 71.882170][ T65] ? __io_remove_buffers+0xac/0x700 [ 71.887362][ T65] io_destroy_buffers+0x14e/0x490 [ 71.892378][ T65] ? __pfx_io_destroy_buffers+0x10/0x10 [ 71.897910][ T65] ? io_futex_cache_free+0x1e3/0x240 [ 71.903183][ T65] io_ring_ctx_free+0xa00/0x1070 [ 71.908109][ T65] io_ring_exit_work+0x80f/0x8a0 [ 71.913036][ T65] ? __pfx_io_ring_exit_work+0x10/0x10 [ 71.918508][ T65] ? debug_object_deactivate+0x2d5/0x390 [ 71.924133][ T65] ? __pfx_io_tctx_exit_cb+0x10/0x10 [ 71.929412][ T65] ? rcu_is_watching+0x15/0xb0 [ 71.934172][ T65] ? process_scheduled_works+0x945/0x1830 [ 71.939874][ T65] process_scheduled_works+0xa2c/0x1830 [ 71.945447][ T65] ? __pfx_process_scheduled_works+0x10/0x10 [ 71.951416][ T65] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 71.956949][ T65] ? assign_work+0x364/0x3d0 [ 71.961526][ T65] worker_thread+0x86d/0xd40 [ 71.966110][ T65] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 71.971998][ T65] ? __kthread_parkme+0x169/0x1d0 [ 71.977013][ T65] ? __pfx_worker_thread+0x10/0x10 [ 71.982110][ T65] kthread+0x2f0/0x390 [ 71.986175][ T65] ? __pfx_worker_thread+0x10/0x10 [ 71.991275][ T65] ? __pfx_kthread+0x10/0x10 [ 71.995872][ T65] ret_from_fork+0x4b/0x80 [ 72.000290][ T65] ? __pfx_kthread+0x10/0x10 [ 72.004894][ T65] ret_from_fork_asm+0x1a/0x30 [ 72.009661][ T65] [ 72.012669][ T65] Modules linked in: [ 72.016613][ T11] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#3] PREEMPT SMP KASAN PTI [ 72.029210][ T11] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 72.037613][ T11] CPU: 1 PID: 11 Comm: kworker/u8:0 Tainted: G D 6.10.0-syzkaller-01155-gd67978318827 #0 [ 72.048796][ T11] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 72.058846][ T11] Workqueue: iou_exit io_ring_exit_work [ 72.064398][ T11] RIP: 0010:__io_remove_buffers+0xac/0x700 [ 72.070202][ T11] Code: 42 80 3c 28 00 74 08 48 89 df e8 5f 02 5b fd 4d 89 fe 48 89 6c 24 40 48 89 5c 24 18 48 8b 1b 48 83 c3 0e 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3b 05 00 00 44 0f b7 3b 49 8d 7c 24 16 [ 72.089885][ T11] RSP: 0018:ffffc90000107840 EFLAGS: 00010246 [ 72.095946][ T11] RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff8880176b3c00 [ 72.103913][ T11] RDX: ffff8880176b3c00 RSI: 0000000000000001 RDI: 0000000000000000 [ 72.111872][ T11] RBP: 1ffff11003d3d6f4 R08: ffffffff849ddaa4 R09: 1ffff11003d3d6f3 [ 72.119831][ T11] R10: dffffc0000000000 R11: ffffed1003d3d6f4 R12: ffff88801e9eb780 [ 72.127792][ T11] R13: dffffc0000000000 R14: ffff88801e9eb7a0 R15: ffff88801e9eb7a0 [ 72.135757][ T11] FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 [ 72.144681][ T11] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.151257][ T11] CR2: 0000555589c12650 CR3: 0000000015ece000 CR4: 00000000003506f0 [ 72.159218][ T11] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 72.167178][ T11] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 72.175138][ T11] Call Trace: [ 72.178408][ T11] [ 72.181329][ T11] ? __die_body+0x88/0xe0 [ 72.185665][ T11] ? die_addr+0x108/0x140 [ 72.189998][ T11] ? exc_general_protection+0x3dd/0x5d0 [ 72.195554][ T11] ? asm_exc_general_protection+0x26/0x30 [ 72.201274][ T11] ? __io_remove_buffers+0x64/0x700 [ 72.206476][ T11] ? __io_remove_buffers+0xac/0x700 [ 72.211708][ T11] io_destroy_buffers+0x14e/0x490 [ 72.216742][ T11] ? __pfx_io_destroy_buffers+0x10/0x10 [ 72.222288][ T11] ? io_futex_cache_free+0x1e3/0x240 [ 72.227565][ T11] io_ring_ctx_free+0xa00/0x1070 [ 72.232504][ T11] io_ring_exit_work+0x80f/0x8a0 [ 72.237463][ T11] ? __pfx_io_ring_exit_work+0x10/0x10 [ 72.242919][ T11] ? debug_object_deactivate+0x2d5/0x390 [ 72.248554][ T11] ? __pfx_io_tctx_exit_cb+0x10/0x10 [ 72.253870][ T11] ? rcu_is_watching+0x15/0xb0 [ 72.258739][ T11] ? process_scheduled_works+0x945/0x1830 [ 72.264450][ T11] process_scheduled_works+0xa2c/0x1830 [ 72.269999][ T11] ? __pfx_process_scheduled_works+0x10/0x10 [ 72.275975][ T11] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 72.281521][ T11] ? assign_work+0x364/0x3d0 [ 72.286110][ T11] worker_thread+0x86d/0xd40 [ 72.290706][ T11] ? __kthread_parkme+0x169/0x1d0 [ 72.295729][ T11] ? __pfx_worker_thread+0x10/0x10 [ 72.300838][ T11] kthread+0x2f0/0x390 [ 72.304903][ T11] ? __pfx_worker_thread+0x10/0x10 [ 72.310027][ T11] ? __pfx_kthread+0x10/0x10 [ 72.314617][ T11] ret_from_fork+0x4b/0x80 [ 72.319027][ T11] ? __pfx_kthread+0x10/0x10 [ 72.323613][ T11] ret_from_fork_asm+0x1a/0x30 restart_syscall(<... resuming interrupted clone ...>) = 0 [ 72.328378][ T11] [ 72.331382][ T11] Modules linked in: [ 72.338415][ T35] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 72.339644][ T1035] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#4] PREEMPT SMP KASAN PTI [ 72.349164][ T35] Kernel panic - not syncing: Fatal exception [ 72.359890][ T35] Kernel Offset: disabled [ 72.370260][ T35] Rebooting in 86400 seconds..