Warning: Permanently added '10.128.0.65' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[ 39.923137][ T27] audit: type=1400 audit(1647942580.279:75): avc: denied { execmem } for pid=3591 comm="syz-executor413" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[ 39.951883][ T27] audit: type=1400 audit(1647942580.279:76): avc: denied { create } for pid=3599 comm="syz-executor413" dev="anon_inodefs" ino=27472 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[ 39.978780][ T27] audit: type=1400 audit(1647942580.279:77): avc: denied { map } for pid=3599 comm="syz-executor413" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=27472 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
executing program
executing program
executing program
executing program
[ 40.029113][ T3618] ==================================================================
[ 40.030853][ T27] audit: type=1400 audit(1647942580.279:78): avc: denied { read write } for pid=3599 comm="syz-executor413" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=27472 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[ 40.037176][ T3618] BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650
[ 40.037208][ T3618] Read of size 8 at addr ffff888011e8a130 by task syz-executor413/3618
[ 40.037227][ T3618]
[ 40.037233][ T3618] CPU: 0 PID: 3618 Comm: syz-executor413 Tainted: G W 5.17.0-syzkaller-01402-g8565d64430f8 #0
[ 40.037258][ T3618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 40.037269][ T3618] Call Trace:
[ 40.037276][ T3618]
[ 40.037283][ T3618] dump_stack_lvl+0xcd/0x134
[ 40.037310][ T3618] print_address_description.constprop.0.cold+0x8d/0x303
[ 40.037343][ T3618] ? __wake_up_common+0x637/0x650
[ 40.037367][ T3618] ? __wake_up_common+0x637/0x650
[ 40.129410][ T3618] kasan_report.cold+0x83/0xdf
[ 40.134527][ T3618] ? spin_bug+0x100/0x100
[ 40.138858][ T3618] ? __wake_up_common+0x637/0x650
[ 40.143876][ T3618] __wake_up_common+0x637/0x650
[ 40.148722][ T3618] __wake_up_common_lock+0xd0/0x130
[ 40.153918][ T3618] ? __wake_up_common+0x650/0x650
[ 40.161898][ T3618] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 40.167997][ T3618] ? trace_hardirqs_on+0x5b/0x1c0
[ 40.173034][ T3618] ? _raw_spin_unlock_irqrestore+0x3d/0x70
[ 40.178834][ T3618] ? tty_port_close+0x120/0x170
[ 40.183684][ T3618] tty_release+0x657/0x1200
[ 40.188180][ T3618] __fput+0x286/0x9f0
[ 40.192154][ T3618] ? tty_release_struct+0xe0/0xe0
[ 40.197170][ T3618] task_work_run+0xdd/0x1a0
[ 40.201667][ T3618] do_exit+0xaff/0x29d0
[ 40.205817][ T3618] ? lock_downgrade+0x6e0/0x6e0
[ 40.210663][ T3618] ? restore_fpregs_from_fpstate+0xcc/0x1e0
[ 40.216550][ T3618] ? mm_update_next_owner+0x7a0/0x7a0
[ 40.221916][ T3618] do_group_exit+0xd2/0x2f0
[ 40.226412][ T3618] __x64_sys_exit_group+0x3a/0x50
[ 40.231430][ T3618] do_syscall_64+0x35/0xb0
[ 40.236189][ T3618] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 40.242079][ T3618] RIP: 0033:0x7f439a1fac69
[ 40.246480][ T3618] Code: Unable to access opcode bytes at RIP 0x7f439a1fac3f.
[ 40.253829][ T3618] RSP: 002b:00007ffd9df32928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 40.262235][ T3618] RAX: ffffffffffffffda RBX: 00007f439a26f330 RCX: 00007f439a1fac69
[ 40.270198][ T3618] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 40.278159][ T3618] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000030000000
[ 40.286118][ T3618] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f439a26f330
[ 40.294100][ T3618] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 40.302060][ T3618]
[ 40.305063][ T3618]
[ 40.307373][ T3618] Allocated by task 3610:
[ 40.311681][ T3618] kasan_save_stack+0x1e/0x40
[ 40.316353][ T3618] __kasan_kmalloc+0xa6/0xd0
[ 40.320934][ T3618] kmem_cache_alloc_trace+0x1ea/0x4a0
[ 40.326296][ T3618] io_arm_poll_handler+0x39d/0x940
[ 40.331397][ T3618] io_queue_sqe_arm_apoll+0x6d/0x430
[ 40.336673][ T3618] io_submit_sqes+0x7dda/0x9310
[ 40.341517][ T3618] __do_sys_io_uring_enter+0x9f1/0x1520
[ 40.347053][ T3618] do_syscall_64+0x35/0xb0
[ 40.351463][ T3618] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 40.357349][ T3618]
[ 40.359656][ T3618] Freed by task 3610:
[ 40.363618][ T3618] kasan_save_stack+0x1e/0x40
[ 40.368286][ T3618] kasan_set_track+0x21/0x30
[ 40.372867][ T3618] kasan_set_free_info+0x20/0x30
[ 40.377797][ T3618] ____kasan_slab_free+0xff/0x140
[ 40.382817][ T3618] kfree+0xf8/0x2b0
[ 40.386613][ T3618] io_clean_op+0x20a/0xd90
[ 40.391015][ T3618] __io_req_complete_post+0x88c/0xc90
[ 40.396378][ T3618] io_req_complete_post+0x56/0x1d0
[ 40.401569][ T3618] io_apoll_task_func+0x1df/0x230
[ 40.406584][ T3618] tctx_task_work+0x1a2/0x1380
[ 40.411337][ T3618] task_work_run+0xdd/0x1a0
[ 40.415844][ T3618] do_exit+0xaff/0x29d0
[ 40.420006][ T3618] do_group_exit+0xd2/0x2f0
[ 40.424503][ T3618] __x64_sys_exit_group+0x3a/0x50
[ 40.429524][ T3618] do_syscall_64+0x35/0xb0
[ 40.433936][ T3618] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 40.439833][ T3618]
[ 40.442145][ T3618] The buggy address belongs to the object at ffff888011e8a100
[ 40.442145][ T3618] which belongs to the cache kmalloc-96 of size 96
[ 40.456012][ T3618] The buggy address is located 48 bytes inside of
[ 40.456012][ T3618] 96-byte region [ffff888011e8a100, ffff888011e8a160)
[ 40.469106][ T3618] The buggy address belongs to the page:
[ 40.474766][ T3618] page:ffffea000047a280 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888011e8a480 pfn:0x11e8a
[ 40.486219][ T3618] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 40.493766][ T3618] raw: 00fff00000000200 ffffea000079fc08 ffffea0001f1d088 ffff888010c40300
[ 40.502341][ T3618] raw: ffff888011e8a480 ffff888011e8a000 000000010000001e 0000000000000000
[ 40.510917][ T3618] page dumped because: kasan: bad access detected
[ 40.517311][ T3618] page_owner tracks the page as allocated
[ 40.523099][ T3618] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, ts 3360715486, free_ts 0
[ 40.539671][ T3618] get_page_from_freelist+0xa72/0x2f50
[ 40.545192][ T3618] __alloc_pages+0x1b2/0x500
[ 40.549789][ T3618] cache_grow_begin+0x75/0x390
[ 40.554547][ T3618] cache_alloc_refill+0x27f/0x380
[ 40.559567][ T3618] kmem_cache_alloc_trace+0x380/0x4a0
[ 40.564938][ T3618] hugetlbfs_init_fs_context+0x41/0x420
[ 40.570478][ T3618] alloc_fs_context+0x582/0xa00
[ 40.575339][ T3618] mount_one_hugetlbfs+0x1d/0x14d
[ 40.580363][ T3618] init_hugetlbfs_fs+0xd5/0x311
[ 40.585214][ T3618] do_one_initcall+0x103/0x650
[ 40.589976][ T3618] kernel_init_freeable+0x6b1/0x73a
[ 40.595169][ T3618] kernel_init+0x1a/0x1d0
[ 40.599498][ T3618] ret_from_fork+0x1f/0x30
[ 40.603911][ T3618] page_owner free stack trace missing
[ 40.609266][ T3618]
[ 40.611576][ T3618] Memory state around the buggy address:
[ 40.617193][ T3618] ffff888011e8a000: 00 00 00 00 00 00 00 00 00 05 fc fc fc fc fc fc
[ 40.625592][ T3618] ffff888011e8a080: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 40.633639][ T3618] >ffff888011e8a100: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 40.641682][ T3618] ^
[ 40.647293][ T3618] ffff888011e8a180: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
[ 40.655340][ T3618] ffff888011e8a200: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc
[ 40.663385][ T3618] ==================================================================
[ 40.671433][ T3618] Kernel panic - not syncing: panic_on_warn set ...
[ 40.678013][ T3618] CPU: 0 PID: 3618 Comm: syz-executor413 Tainted: G B W 5.17.0-syzkaller-01402-g8565d64430f8 #0
[ 40.689552][ T3618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 40.699603][ T3618] Call Trace:
[ 40.702872][ T3618]
[ 40.705792][ T3618] dump_stack_lvl+0xcd/0x134
[ 40.710384][ T3618] panic+0x2b0/0x6dd
[ 40.714276][ T3618] ? __warn_printk+0xf3/0xf3
[ 40.718866][ T3618] ? __wake_up_common+0x637/0x650
[ 40.723906][ T3618] ? __wake_up_common+0x637/0x650
[ 40.728922][ T3618] ? __wake_up_common+0x637/0x650
[ 40.734208][ T3618] end_report.cold+0x63/0x6f
[ 40.738794][ T3618] kasan_report.cold+0x71/0xdf
[ 40.743553][ T3618] ? spin_bug+0x100/0x100
[ 40.747875][ T3618] ? __wake_up_common+0x637/0x650
[ 40.752889][ T3618] __wake_up_common+0x637/0x650
[ 40.757746][ T3618] __wake_up_common_lock+0xd0/0x130
[ 40.762942][ T3618] ? __wake_up_common+0x650/0x650
[ 40.767958][ T3618] ? _raw_spin_unlock_irqrestore+0x50/0x70
[ 40.773756][ T3618] ? trace_hardirqs_on+0x5b/0x1c0
[ 40.778776][ T3618] ? _raw_spin_unlock_irqrestore+0x3d/0x70
[ 40.784575][ T3618] ? tty_port_close+0x120/0x170
[ 40.789426][ T3618] tty_release+0x657/0x1200
[ 40.793922][ T3618] __fput+0x286/0x9f0
[ 40.797906][ T3618] ? tty_release_struct+0xe0/0xe0
[ 40.802923][ T3618] task_work_run+0xdd/0x1a0
[ 40.807422][ T3618] do_exit+0xaff/0x29d0
[ 40.811578][ T3618] ? lock_downgrade+0x6e0/0x6e0
[ 40.816422][ T3618] ? restore_fpregs_from_fpstate+0xcc/0x1e0
[ 40.822308][ T3618] ? mm_update_next_owner+0x7a0/0x7a0
[ 40.827684][ T3618] do_group_exit+0xd2/0x2f0
[ 40.832180][ T3618] __x64_sys_exit_group+0x3a/0x50
[ 40.837202][ T3618] do_syscall_64+0x35/0xb0
[ 40.841612][ T3618] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 40.847498][ T3618] RIP: 0033:0x7f439a1fac69
[ 40.851902][ T3618] Code: Unable to access opcode bytes at RIP 0x7f439a1fac3f.
[ 40.859251][ T3618] RSP: 002b:00007ffd9df32928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 40.867653][ T3618] RAX: ffffffffffffffda RBX: 00007f439a26f330 RCX: 00007f439a1fac69
[ 40.875613][ T3618] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 40.883569][ T3618] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000030000000
[ 40.891527][ T3618] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f439a26f330
[ 40.899486][ T3618] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 40.907447][ T3618]
[ 40.910513][ T3618] Kernel Offset: disabled
[ 40.914819][ T3618] Rebooting in 86400 seconds..