./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3092959714 <...> Warning: Permanently added '10.128.1.10' (ECDSA) to the list of known hosts. execve("./syz-executor3092959714", ["./syz-executor3092959714"], 0x7ffe7ca46300 /* 10 vars */) = 0 brk(NULL) = 0x55555722a000 brk(0x55555722ac40) = 0x55555722ac40 arch_prctl(ARCH_SET_FS, 0x55555722a300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3092959714", 4096) = 28 brk(0x55555724bc40) = 0x55555724bc40 brk(0x55555724c000) = 0x55555724c000 mprotect(0x7f68ee912000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3609 attached , child_tidptr=0x55555722a5d0) = 3609 [pid 3609] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3609] setsid() = 1 [pid 3609] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3609] unshare(CLONE_NEWNS) = 0 [pid 3609] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3609] unshare(CLONE_NEWIPC) = 0 [pid 3609] unshare(CLONE_NEWCGROUP) = 0 [pid 3609] unshare(CLONE_NEWUTS) = 0 [pid 3609] unshare(CLONE_SYSVSEM) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "16777216", 8) = 8 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "536870912", 9) = 9 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "8192", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3609] close(3) = 0 [pid 3609] getpid() = 1 [pid 3609] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 54.050657][ T6] dump_stack_lvl+0xcd/0x134 [ 54.055265][ T6] print_report.cold+0x2ba/0x719 [ 54.060214][ T6] ? __list_add_valid+0x93/0xb0 [ 54.065072][ T6] kasan_report+0xb1/0x1e0 [ 54.069499][ T6] ? __list_add_valid+0x93/0xb0 [ 54.074362][ T6] __list_add_valid+0x93/0xb0 [ 54.079048][ T6] udl_get_urb_timeout+0x20e/0x550 [ 54.084185][ T6] ? udl_urb_completion+0x3e0/0x3e0 [ 54.089407][ T6] ? slab_free_freelist_hook+0x8b/0x1c0 [ 54.094957][ T6] ? udl_free_urb_list+0x136/0x250 [ 54.100168][ T6] ? kfree+0xe2/0x580 [ 54.104154][ T6] udl_free_urb_list+0x15f/0x250 [ 54.109099][ T6] ? _raw_spin_unlock_irq+0x1f/0x40 [ 54.114299][ T6] udl_drop_usb+0xd0/0x160 [ 54.118725][ T6] udl_usb_disconnect+0x3f/0x50 [ 54.123583][ T6] usb_unbind_interface+0x1d8/0x8e0 [ 54.128794][ T6] ? usb_unbind_device+0x1a0/0x1a0 [ 54.133931][ T6] device_remove+0x11f/0x170 [ 54.138581][ T6] device_release_driver_internal+0x4a1/0x700 [ 54.144659][ T6] ? put_device+0x1b/0x30 [ 54.148991][ T6] bus_remove_device+0x2e3/0x590 [ 54.153938][ T6] device_del+0x4f3/0xc80 [ 54.158272][ T6] ? usb_disconnect.cold+0x43/0x6ed [ 54.163480][ T6] ? __device_link_del+0x380/0x380 [ 54.168594][ T6] ? mutex_lock_io_nested+0x1190/0x1190 [ 54.174151][ T6] usb_disable_device+0x356/0x7a0 [ 54.179189][ T6] usb_disconnect.cold+0x259/0x6ed [ 54.184316][ T6] hub_event+0x1f86/0x4610 [ 54.188750][ T6] ? hub_port_debounce+0x3b0/0x3b0 [ 54.193872][ T6] ? lock_release+0x780/0x780 [ 54.198554][ T6] ? lock_downgrade+0x6e0/0x6e0 [ 54.203407][ T6] ? do_raw_spin_lock+0x120/0x2a0 [ 54.208442][ T6] process_one_work+0x991/0x1610 [ 54.213395][ T6] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 54.218776][ T6] ? rwlock_bug.part.0+0x90/0x90 [ 54.223721][ T6] ? _raw_spin_lock_irq+0x41/0x50 [ 54.228765][ T6] worker_thread+0x854/0x1080 [ 54.233474][ T6] ? process_one_work+0x1610/0x1610 [ 54.238686][ T6] kthread+0x2e4/0x3a0 [ 54.242772][ T6] ? kthread_complete_and_exit+0x40/0x40 [ 54.248414][ T6] ret_from_fork+0x1f/0x30 [ 54.252847][ T6] [ 54.255860][ T6] [ 54.258178][ T6] Allocated by task 6: [ 54.262325][ T6] kasan_save_stack+0x1e/0x40 [ 54.267039][ T6] __kasan_kmalloc+0xa9/0xd0 [ 54.271652][ T6] udl_init+0x736/0xc80 [ 54.275817][ T6] udl_usb_probe+0x4f/0x100 [ 54.280348][ T6] usb_probe_interface+0x30b/0x7f0 [ 54.285460][ T6] really_probe+0x249/0xb90 [ 54.289986][ T6] __driver_probe_device+0x1df/0x4d0 [ 54.295286][ T6] driver_probe_device+0x4c/0x1a0 [ 54.300321][ T6] __device_attach_driver+0x206/0x2e0 [ 54.305704][ T6] bus_for_each_drv+0x15f/0x1e0 [ 54.310560][ T6] __device_attach+0x1e4/0x530 [ 54.315337][ T6] bus_probe_device+0x1e4/0x290 [ 54.320192][ T6] device_add+0xbd5/0x1e90 [ 54.324607][ T6] usb_set_configuration+0x1019/0x1900 [ 54.330076][ T6] usb_generic_driver_probe+0xba/0x100 [ 54.335541][ T6] usb_probe_device+0xd4/0x2c0 [ 54.340315][ T6] really_probe+0x249/0xb90 [ 54.344828][ T6] __driver_probe_device+0x1df/0x4d0 [ 54.350120][ T6] driver_probe_device+0x4c/0x1a0 [ 54.355155][ T6] __device_attach_driver+0x206/0x2e0 [ 54.360534][ T6] bus_for_each_drv+0x15f/0x1e0 [ 54.365393][ T6] __device_attach+0x1e4/0x530 [ 54.370163][ T6] bus_probe_device+0x1e4/0x290 [ 54.375017][ T6] device_add+0xbd5/0x1e90 [ 54.379435][ T6] usb_new_device.cold+0x685/0x10ad [ 54.384640][ T6] hub_event+0x26c7/0x4610 [ 54.389061][ T6] process_one_work+0x991/0x1610 [ 54.394004][ T6] worker_thread+0x665/0x1080 [ 54.398686][ T6] kthread+0x2e4/0x3a0 [ 54.402759][ T6] ret_from_fork+0x1f/0x30 [ 54.407180][ T6] [ 54.409495][ T6] Freed by task 6: [ 54.413203][ T6] kasan_save_stack+0x1e/0x40 [ 54.417887][ T6] kasan_set_track+0x21/0x30 [ 54.422480][ T6] kasan_set_free_info+0x20/0x30 [ 54.427424][ T6] ____kasan_slab_free+0x166/0x1c0 [ 54.432540][ T6] slab_free_freelist_hook+0x8b/0x1c0 [ 54.437911][ T6] kfree+0xe2/0x580 [ 54.441717][ T6] udl_free_urb_list+0x136/0x250 [ 54.446660][ T6] udl_drop_usb+0xd0/0x160 [ 54.451082][ T6] udl_usb_disconnect+0x3f/0x50 [ 54.455935][ T6] usb_unbind_interface+0x1d8/0x8e0 [ 54.461143][ T6] device_remove+0x11f/0x170 [ 54.465737][ T6] device_release_driver_internal+0x4a1/0x700 [ 54.471813][ T6] bus_remove_device+0x2e3/0x590 [ 54.476755][ T6] device_del+0x4f3/0xc80 [ 54.481081][ T6] usb_disable_device+0x356/0x7a0 [ 54.486112][ T6] usb_disconnect.cold+0x259/0x6ed [ 54.491232][ T6] hub_event+0x1f86/0x4610 [ 54.495650][ T6] process_one_work+0x991/0x1610 [ 54.500592][ T6] worker_thread+0x854/0x1080 [ 54.505272][ T6] kthread+0x2e4/0x3a0 [ 54.509348][ T6] ret_from_fork+0x1f/0x30 [ 54.513770][ T6] [ 54.516083][ T6] The buggy address belongs to the object at ffff888070d97380 [ 54.516083][ T6] which belongs to the cache kmalloc-32 of size 32 [ 54.529955][ T6] The buggy address is located 8 bytes inside of [ 54.529955][ T6] 32-byte region [ffff888070d97380, ffff888070d973a0) [ 54.542962][ T6] [ 54.545281][ T6] The buggy address belongs to the physical page: [ 54.551684][ T6] page:ffffea0001c365c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70d97 [ 54.561831][ T6] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 54.569381][ T6] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888011841500 [ 54.577962][ T6] raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000 [ 54.586532][ T6] page dumped because: kasan: bad access detected [ 54.592932][ T6] page_owner tracks the page as allocated [ 54.598632][ T6] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 146, tgid 146 (kworker/0:2), ts 53794387211, free_ts 12784087250 [ 54.616688][ T6] get_page_from_freelist+0x109b/0x2ce0 [ 54.622246][ T6] __alloc_pages+0x1c7/0x510 [ 54.626845][ T6] alloc_pages+0x1a6/0x270 [ 54.631266][ T6] allocate_slab+0x27e/0x3d0 [ 54.635859][ T6] ___slab_alloc+0x7f1/0xe10 [ 54.640449][ T6] __slab_alloc.constprop.0+0x4d/0xa0 [ 54.645821][ T6] kmem_cache_alloc_trace+0x323/0x3e0 [ 54.651193][ T6] ref_tracker_alloc+0x14c/0x550 [ 54.656131][ T6] dst_init+0xe0/0x520 [ 54.660208][ T6] dst_alloc+0x16b/0x1f0 [ 54.664456][ T6] ip6_dst_alloc+0x2e/0x90 [ 54.668869][ T6] icmp6_dst_alloc+0x6d/0x680 [ 54.673549][ T6] ndisc_send_skb+0x10eb/0x1730 [ 54.678407][ T6] ndisc_send_rs+0x12e/0x6f0 [ 54.683004][ T6] addrconf_dad_completed+0x37a/0xd80 [ 54.688387][ T6] addrconf_dad_work+0x759/0x12d0 [ 54.693418][ T6] page last free stack trace: [ 54.698081][ T6] free_pcp_prepare+0x5e4/0xd20 [ 54.702951][ T6] free_unref_page+0x19/0x4d0 [ 54.707633][ T6] free_contig_range+0xb1/0x180 [ 54.712488][ T6] destroy_args+0xa8/0x646 [ 54.716912][ T6] debug_vm_pgtable+0x2945/0x29d6 [ 54.721943][ T6] do_one_initcall+0xfe/0x650 [ 54.726624][ T6] kernel_init_freeable+0x6ac/0x735 [ 54.731825][ T6] kernel_init+0x1a/0x1d0 [ 54.736155][ T6] ret_from_fork+0x1f/0x30 [ 54.740580][ T6] [ 54.742894][ T6] Memory state around the buggy address: [ 54.748512][ T6] ffff888070d97280: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 54.756567][ T6] ffff888070d97300: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 54.764619][ T6] >ffff888070d97380: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc [ 54.772672][ T6] ^ [ 54.776988][ T6] ffff888070d97400: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 54.785043][ T6] ffff888070d97480: 00 00 00 00 fc fc fc fc 00 00 00 fc fc fc fc fc [ 54.793095][ T6] ================================================================== [ 54.801141][ T6] Kernel panic - not syncing: panic_on_warn set ... [ 54.807714][ T6] CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted 6.0.0-rc1-next-20220818-syzkaller #0 [ 54.816990][ T6] kworker/0:0[6] cmdline: a [ 54.822175][ T6] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 54.832229][ T6] Workqueue: usb_hub_wq hub_event [ 54.837262][ T6] Call Trace: [ 54.840539][ T6] [ 54.843464][ T6] dump_stack_lvl+0xcd/0x134 [ 54.848083][ T6] panic+0x2c8/0x627 [ 54.851988][ T6] ? panic_print_sys_info.part.0+0x10b/0x10b [ 54.857981][ T6] ? print_report.cold+0x4f6/0x719 [ 54.863103][ T6] ? __list_add_valid+0x93/0xb0 [ 54.867967][ T6] end_report.part.0+0x3f/0x7c [ 54.872741][ T6] kasan_report.cold+0xa/0xf [ 54.877346][ T6] ? __list_add_valid+0x93/0xb0 [ 54.882204][ T6] __list_add_valid+0x93/0xb0 [ 54.886887][ T6] udl_get_urb_timeout+0x20e/0x550 [ 54.892006][ T6] ? udl_urb_completion+0x3e0/0x3e0 [ 54.897213][ T6] ? slab_free_freelist_hook+0x8b/0x1c0 [ 54.902762][ T6] ? udl_free_urb_list+0x136/0x250 [ 54.907881][ T6] ? kfree+0xe2/0x580 [ 54.911866][ T6] udl_free_urb_list+0x15f/0x250 [ 54.916811][ T6] ? _raw_spin_unlock_irq+0x1f/0x40 [ 54.922009][ T6] udl_drop_usb+0xd0/0x160 [ 54.926433][ T6] udl_usb_disconnect+0x3f/0x50 [ 54.931293][ T6] usb_unbind_interface+0x1d8/0x8e0 [ 54.936509][ T6] ? usb_unbind_device+0x1a0/0x1a0 [ 54.941633][ T6] device_remove+0x11f/0x170 [ 54.946232][ T6] device_release_driver_internal+0x4a1/0x700 [ 54.952318][ T6] ? put_device+0x1b/0x30 [ 54.956648][ T6] bus_remove_device+0x2e3/0x590 [ 54.961593][ T6] device_del+0x4f3/0xc80 [ 54.965923][ T6] ? usb_disconnect.cold+0x43/0x6ed [ 54.971130][ T6] ? __device_link_del+0x380/0x380 [ 54.976242][ T6] ? mutex_lock_io_nested+0x1190/0x1190 [ 54.981805][ T6] usb_disable_device+0x356/0x7a0 [ 54.986846][ T6] usb_disconnect.cold+0x259/0x6ed [ 54.991971][ T6] hub_event+0x1f86/0x4610 [ 54.996407][ T6] ? hub_port_debounce+0x3b0/0x3b0 [ 55.001522][ T6] ? lock_release+0x780/0x780 [ 55.006199][ T6] ? lock_downgrade+0x6e0/0x6e0 [ 55.011053][ T6] ? do_raw_spin_lock+0x120/0x2a0 [ 55.016087][ T6] process_one_work+0x991/0x1610 [ 55.021039][ T6] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 55.026420][ T6] ? rwlock_bug.part.0+0x90/0x90 [ 55.031361][ T6] ? _raw_spin_lock_irq+0x41/0x50 [ 55.036391][ T6] worker_thread+0x854/0x1080 [ 55.041079][ T6] ? process_one_work+0x1610/0x1610 [ 55.046287][ T6] kthread+0x2e4/0x3a0 [ 55.050363][ T6] ? kthread_complete_and_exit+0x40/0x40 [ 55.056020][ T6] ret_from_fork+0x1f/0x30 [ 55.060463][ T6] [ 55.063642][ T6] Kernel Offset: disabled [ 55.067980][ T6] Rebooting in 86400 seconds..