./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor368743116 <...> Warning: Permanently added '10.128.0.94' (ED25519) to the list of known hosts. execve("./syz-executor368743116", ["./syz-executor368743116"], 0x7fff4371dfa0 /* 10 vars */) = 0 brk(NULL) = 0x55555557a000 brk(0x55555557ad00) = 0x55555557ad00 arch_prctl(ARCH_SET_FS, 0x55555557a380) = 0 set_tid_address(0x55555557a650) = 5061 set_robust_list(0x55555557a660, 24) = 0 rseq(0x55555557aca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor368743116", 4096) = 27 getrandom("\xdc\x12\x74\x0b\x7e\xb4\x30\x62", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555557ad00 brk(0x55555559bd00) = 0x55555559bd00 brk(0x55555559c000) = 0x55555559c000 mprotect(0x7f6a3c2e5000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555557a650) = 5062 ./strace-static-x86_64: Process 5062 attached [pid 5062] set_robust_list(0x55555557a660, 24) = 0 [pid 5062] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5062] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5062] setsid() = 1 [pid 5062] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5062] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5062] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5062] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5062] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5062] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5062] unshare(CLONE_NEWNS) = 0 [pid 5062] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5062] unshare(CLONE_NEWIPC) = 0 [pid 5062] unshare(CLONE_NEWCGROUP) = 0 [pid 5062] unshare(CLONE_NEWUTS) = 0 [pid 5062] unshare(CLONE_SYSVSEM) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "16777216", 8) = 8 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "536870912", 9) = 9 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "1024", 4) = 4 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "8192", 4) = 4 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "1024", 4) = 4 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "1024", 4) = 4 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5062] close(3) = 0 [pid 5062] getpid() = 1 [pid 5062] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 12]) = 0 [pid 5071] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x02\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5071] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5071] close(3) = 0 [pid 5071] close(4) = 0 [pid 5071] close(5) = 0 [pid 5071] close(6) = -1 EBADF (Bad file descriptor) [pid 5071] close(7) = -1 EBADF (Bad file descriptor) [pid 5071] close(8) = -1 EBADF (Bad file descriptor) [pid 5071] close(9) = -1 EBADF (Bad file descriptor) [pid 5071] close(10) = -1 EBADF (Bad file descriptor) [pid 5071] close(11) = -1 EBADF (Bad file descriptor) [pid 5071] close(12) = -1 EBADF (Bad file descriptor) [pid 5071] close(13) = -1 EBADF (Bad file descriptor) [pid 5071] close(14) = -1 EBADF (Bad file descriptor) [pid 5071] close(15) = -1 EBADF (Bad file descriptor) [pid 5071] close(16) = -1 EBADF (Bad file descriptor) [pid 5071] close(17) = -1 EBADF (Bad file descriptor) [pid 5071] close(18) = -1 EBADF (Bad file descriptor) [pid 5071] close(19) = -1 EBADF (Bad file descriptor) [ 76.376234][ T5071] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5071] close(20) = -1 EBADF (Bad file descriptor) [pid 5071] close(21) = -1 EBADF (Bad file descriptor) [pid 5071] close(22) = -1 EBADF (Bad file descriptor) [pid 5071] close(23) = -1 EBADF (Bad file descriptor) [pid 5071] close(24) = -1 EBADF (Bad file descriptor) [pid 5071] close(25) = -1 EBADF (Bad file descriptor) [pid 5071] close(26) = -1 EBADF (Bad file descriptor) [pid 5071] close(27) = -1 EBADF (Bad file descriptor) [pid 5071] close(28) = -1 EBADF (Bad file descriptor) [pid 5071] close(29) = -1 EBADF (Bad file descriptor) [pid 5071] exit_group(0) = ? [pid 5071] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555557a650) = 3 ./strace-static-x86_64: Process 5072 attached [pid 5072] set_robust_list(0x55555557a660, 24) = 0 [pid 5072] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5072] setpgid(0, 0) = 0 [pid 5072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5072] write(3, "1000", 4) = 4 [pid 5072] close(3) = 0 [pid 5072] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5072] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5072] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5072] getsockname(4, {sa_family=AF_NETLINK, nl_pid=3, nl_groups=00000000}, [20 => 12]) = 0 [pid 5072] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x03\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5072] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5072] close(3) = 0 [pid 5072] close(4) = 0 [pid 5072] close(5) = 0 [pid 5072] close(6) = -1 EBADF (Bad file descriptor) [pid 5072] close(7) = -1 EBADF (Bad file descriptor) [pid 5072] close(8) = -1 EBADF (Bad file descriptor) [pid 5072] close(9) = -1 EBADF (Bad file descriptor) [pid 5072] close(10) = -1 EBADF (Bad file descriptor) [pid 5072] close(11) = -1 EBADF (Bad file descriptor) [pid 5072] close(12) = -1 EBADF (Bad file descriptor) [ 76.557134][ T5072] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5072] close(13) = -1 EBADF (Bad file descriptor) [pid 5072] close(14) = -1 EBADF (Bad file descriptor) [pid 5072] close(15) = -1 EBADF (Bad file descriptor) [pid 5072] close(16) = -1 EBADF (Bad file descriptor) [pid 5072] close(17) = -1 EBADF (Bad file descriptor) [pid 5072] close(18) = -1 EBADF (Bad file descriptor) [pid 5072] close(19) = -1 EBADF (Bad file descriptor) [pid 5072] close(20) = -1 EBADF (Bad file descriptor) [pid 5072] close(21) = -1 EBADF (Bad file descriptor) [pid 5072] close(22) = -1 EBADF (Bad file descriptor) [pid 5072] close(23) = -1 EBADF (Bad file descriptor) [pid 5072] close(24) = -1 EBADF (Bad file descriptor) [pid 5072] close(25) = -1 EBADF (Bad file descriptor) [pid 5072] close(26) = -1 EBADF (Bad file descriptor) [pid 5072] close(27) = -1 EBADF (Bad file descriptor) [pid 5072] close(28) = -1 EBADF (Bad file descriptor) [pid 5072] close(29) = -1 EBADF (Bad file descriptor) [pid 5072] exit_group(0) = ? [pid 5072] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5062] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5073 attached , child_tidptr=0x55555557a650) = 4 [pid 5073] set_robust_list(0x55555557a660, 24) = 0 [pid 5073] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5073] setpgid(0, 0) = 0 [pid 5073] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5073] write(3, "1000", 4) = 4 [pid 5073] close(3) = 0 [pid 5073] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5073] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5073] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5073] getsockname(4, {sa_family=AF_NETLINK, nl_pid=4, nl_groups=00000000}, [20 => 12]) = 0 [pid 5073] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x04\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5073] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5073] close(3) = 0 [pid 5073] close(4) = 0 [ 76.766204][ T5073] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [ 76.780090][ T5073] gretap0: entered promiscuous mode [pid 5073] close(5) = 0 [pid 5073] close(6) = -1 EBADF (Bad file descriptor) [pid 5073] close(7) = -1 EBADF (Bad file descriptor) [pid 5073] close(8) = -1 EBADF (Bad file descriptor) [pid 5073] close(9) = -1 EBADF (Bad file descriptor) [pid 5073] close(10) = -1 EBADF (Bad file descriptor) [pid 5073] close(11) = -1 EBADF (Bad file descriptor) [pid 5073] close(12) = -1 EBADF (Bad file descriptor) [pid 5073] close(13) = -1 EBADF (Bad file descriptor) [pid 5073] close(14) = -1 EBADF (Bad file descriptor) [pid 5073] close(15) = -1 EBADF (Bad file descriptor) [pid 5073] close(16) = -1 EBADF (Bad file descriptor) [pid 5073] close(17) = -1 EBADF (Bad file descriptor) [pid 5073] close(18) = -1 EBADF (Bad file descriptor) [pid 5073] close(19) = -1 EBADF (Bad file descriptor) [pid 5073] close(20) = -1 EBADF (Bad file descriptor) [pid 5073] close(21) = -1 EBADF (Bad file descriptor) [pid 5073] close(22) = -1 EBADF (Bad file descriptor) [pid 5073] close(23) = -1 EBADF (Bad file descriptor) [pid 5073] close(24) = -1 EBADF (Bad file descriptor) [pid 5073] close(25) = -1 EBADF (Bad file descriptor) [pid 5073] close(26) = -1 EBADF (Bad file descriptor) [pid 5073] close(27) = -1 EBADF (Bad file descriptor) [pid 5073] close(28) = -1 EBADF (Bad file descriptor) [pid 5073] close(29) = -1 EBADF (Bad file descriptor) [pid 5073] exit_group(0) = ? [pid 5073] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5062] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555557a650) = 5 ./strace-static-x86_64: Process 5074 attached [pid 5074] set_robust_list(0x55555557a660, 24) = 0 [pid 5074] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5074] setpgid(0, 0) = 0 [pid 5074] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1000", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5074] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5074] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5074] getsockname(4, {sa_family=AF_NETLINK, nl_pid=5, nl_groups=00000000}, [20 => 12]) = 0 [pid 5074] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x05\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5074] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5074] close(3) = 0 [pid 5074] close(4) = 0 [pid 5074] close(5) = 0 [ 76.994521][ T5074] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [ 77.008500][ T5074] erspan0: entered promiscuous mode [pid 5074] close(6) = -1 EBADF (Bad file descriptor) [pid 5074] close(7) = -1 EBADF (Bad file descriptor) [pid 5074] close(8) = -1 EBADF (Bad file descriptor) [pid 5074] close(9) = -1 EBADF (Bad file descriptor) [pid 5074] close(10) = -1 EBADF (Bad file descriptor) [pid 5074] close(11) = -1 EBADF (Bad file descriptor) [pid 5074] close(12) = -1 EBADF (Bad file descriptor) [pid 5074] close(13) = -1 EBADF (Bad file descriptor) [pid 5074] close(14) = -1 EBADF (Bad file descriptor) [pid 5074] close(15) = -1 EBADF (Bad file descriptor) [pid 5074] close(16) = -1 EBADF (Bad file descriptor) [pid 5074] close(17) = -1 EBADF (Bad file descriptor) [pid 5074] close(18) = -1 EBADF (Bad file descriptor) [pid 5074] close(19) = -1 EBADF (Bad file descriptor) [pid 5074] close(20) = -1 EBADF (Bad file descriptor) [pid 5074] close(21) = -1 EBADF (Bad file descriptor) [pid 5074] close(22) = -1 EBADF (Bad file descriptor) [pid 5074] close(23) = -1 EBADF (Bad file descriptor) [pid 5074] close(24) = -1 EBADF (Bad file descriptor) [pid 5074] close(25) = -1 EBADF (Bad file descriptor) [pid 5074] close(26) = -1 EBADF (Bad file descriptor) [pid 5074] close(27) = -1 EBADF (Bad file descriptor) [pid 5074] close(28) = -1 EBADF (Bad file descriptor) [pid 5074] close(29) = -1 EBADF (Bad file descriptor) [pid 5074] exit_group(0) = ? [pid 5074] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5075 attached , child_tidptr=0x55555557a650) = 6 [pid 5075] set_robust_list(0x55555557a660, 24) = 0 [pid 5075] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5075] setpgid(0, 0) = 0 [pid 5075] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5075] write(3, "1000", 4) = 4 [pid 5075] close(3) = 0 [pid 5075] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5075] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5075] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5075] getsockname(4, {sa_family=AF_NETLINK, nl_pid=6, nl_groups=00000000}, [20 => 12]) = 0 [pid 5075] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x06\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5075] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5075] close(3) = 0 [pid 5075] close(4) = 0 [pid 5075] close(5) = 0 [pid 5075] close(6) = -1 EBADF (Bad file descriptor) [pid 5075] close(7) = -1 EBADF (Bad file descriptor) [pid 5075] close(8) = -1 EBADF (Bad file descriptor) [pid 5075] close(9) = -1 EBADF (Bad file descriptor) [ 77.232101][ T5075] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5075] close(10) = -1 EBADF (Bad file descriptor) [pid 5075] close(11) = -1 EBADF (Bad file descriptor) [pid 5075] close(12) = -1 EBADF (Bad file descriptor) [pid 5075] close(13) = -1 EBADF (Bad file descriptor) [pid 5075] close(14) = -1 EBADF (Bad file descriptor) [pid 5075] close(15) = -1 EBADF (Bad file descriptor) [pid 5075] close(16) = -1 EBADF (Bad file descriptor) [pid 5075] close(17) = -1 EBADF (Bad file descriptor) [pid 5075] close(18) = -1 EBADF (Bad file descriptor) [pid 5075] close(19) = -1 EBADF (Bad file descriptor) [pid 5075] close(20) = -1 EBADF (Bad file descriptor) [pid 5075] close(21) = -1 EBADF (Bad file descriptor) [pid 5075] close(22) = -1 EBADF (Bad file descriptor) [pid 5075] close(23) = -1 EBADF (Bad file descriptor) [pid 5075] close(24) = -1 EBADF (Bad file descriptor) [pid 5075] close(25) = -1 EBADF (Bad file descriptor) [pid 5075] close(26) = -1 EBADF (Bad file descriptor) [pid 5075] close(27) = -1 EBADF (Bad file descriptor) [pid 5075] close(28) = -1 EBADF (Bad file descriptor) [pid 5075] close(29) = -1 EBADF (Bad file descriptor) [pid 5075] exit_group(0) = ? [pid 5075] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5076 attached , child_tidptr=0x55555557a650) = 7 [pid 5076] set_robust_list(0x55555557a660, 24) = 0 [pid 5076] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5076] setpgid(0, 0) = 0 [pid 5076] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1000", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5076] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5076] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5076] getsockname(4, {sa_family=AF_NETLINK, nl_pid=7, nl_groups=00000000}, [20 => 12]) = 0 [pid 5076] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x07\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5076] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5076] close(3) = 0 [pid 5076] close(4) = 0 [pid 5076] close(5) = 0 [pid 5076] close(6) = -1 EBADF (Bad file descriptor) [pid 5076] close(7) = -1 EBADF (Bad file descriptor) [pid 5076] close(8) = -1 EBADF (Bad file descriptor) [pid 5076] close(9) = -1 EBADF (Bad file descriptor) [pid 5076] close(10) = -1 EBADF (Bad file descriptor) [pid 5076] close(11) = -1 EBADF (Bad file descriptor) [pid 5076] close(12) = -1 EBADF (Bad file descriptor) [pid 5076] close(13) = -1 EBADF (Bad file descriptor) [pid 5076] close(14) = -1 EBADF (Bad file descriptor) [pid 5076] close(15) = -1 EBADF (Bad file descriptor) [pid 5076] close(16) = -1 EBADF (Bad file descriptor) [pid 5076] close(17) = -1 EBADF (Bad file descriptor) [pid 5076] close(18) = -1 EBADF (Bad file descriptor) [ 77.419628][ T5076] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5076] close(19) = -1 EBADF (Bad file descriptor) [pid 5076] close(20) = -1 EBADF (Bad file descriptor) [pid 5076] close(21) = -1 EBADF (Bad file descriptor) [pid 5076] close(22) = -1 EBADF (Bad file descriptor) [pid 5076] close(23) = -1 EBADF (Bad file descriptor) [pid 5076] close(24) = -1 EBADF (Bad file descriptor) [pid 5076] close(25) = -1 EBADF (Bad file descriptor) [pid 5076] close(26) = -1 EBADF (Bad file descriptor) [pid 5076] close(27) = -1 EBADF (Bad file descriptor) [pid 5076] close(28) = -1 EBADF (Bad file descriptor) [pid 5076] close(29) = -1 EBADF (Bad file descriptor) [pid 5076] exit_group(0) = ? [pid 5076] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=7, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5077 attached [pid 5077] set_robust_list(0x55555557a660, 24) = 0 [pid 5077] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5062] <... clone resumed>, child_tidptr=0x55555557a650) = 8 [pid 5077] <... prctl resumed>) = 0 [pid 5077] setpgid(0, 0) = 0 [pid 5077] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5077] write(3, "1000", 4) = 4 [pid 5077] close(3) = 0 [pid 5077] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5077] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5077] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5077] getsockname(4, {sa_family=AF_NETLINK, nl_pid=8, nl_groups=00000000}, [20 => 12]) = 0 [pid 5077] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x08\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5077] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5077] close(3) = 0 [pid 5077] close(4) = 0 [pid 5077] close(5) = 0 [pid 5077] close(6) = -1 EBADF (Bad file descriptor) [pid 5077] close(7) = -1 EBADF (Bad file descriptor) [pid 5077] close(8) = -1 EBADF (Bad file descriptor) [pid 5077] close(9) = -1 EBADF (Bad file descriptor) [pid 5077] close(10) = -1 EBADF (Bad file descriptor) [pid 5077] close(11) = -1 EBADF (Bad file descriptor) [ 77.598962][ T5077] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5077] close(12) = -1 EBADF (Bad file descriptor) [pid 5077] close(13) = -1 EBADF (Bad file descriptor) [pid 5077] close(14) = -1 EBADF (Bad file descriptor) [pid 5077] close(15) = -1 EBADF (Bad file descriptor) [pid 5077] close(16) = -1 EBADF (Bad file descriptor) [pid 5077] close(17) = -1 EBADF (Bad file descriptor) [pid 5077] close(18) = -1 EBADF (Bad file descriptor) [pid 5077] close(19) = -1 EBADF (Bad file descriptor) [pid 5077] close(20) = -1 EBADF (Bad file descriptor) [pid 5077] close(21) = -1 EBADF (Bad file descriptor) [pid 5077] close(22) = -1 EBADF (Bad file descriptor) [pid 5077] close(23) = -1 EBADF (Bad file descriptor) [pid 5077] close(24) = -1 EBADF (Bad file descriptor) [pid 5077] close(25) = -1 EBADF (Bad file descriptor) [pid 5077] close(26) = -1 EBADF (Bad file descriptor) [pid 5077] close(27) = -1 EBADF (Bad file descriptor) [pid 5077] close(28) = -1 EBADF (Bad file descriptor) [pid 5077] close(29) = -1 EBADF (Bad file descriptor) [pid 5077] exit_group(0) = ? [pid 5077] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555557a650) = 9 ./strace-static-x86_64: Process 5078 attached [pid 5078] set_robust_list(0x55555557a660, 24) = 0 [pid 5078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5078] setpgid(0, 0) = 0 [pid 5078] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1000", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5078] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5078] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5078] getsockname(4, {sa_family=AF_NETLINK, nl_pid=9, nl_groups=00000000}, [20 => 12]) = 0 [pid 5078] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x09\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5078] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5078] close(3) = 0 [pid 5078] close(4) = 0 [pid 5078] close(5) = 0 [pid 5078] close(6) = -1 EBADF (Bad file descriptor) [pid 5078] close(7) = -1 EBADF (Bad file descriptor) [pid 5078] close(8) = -1 EBADF (Bad file descriptor) [ 77.778820][ T5078] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5078] close(9) = -1 EBADF (Bad file descriptor) [pid 5078] close(10) = -1 EBADF (Bad file descriptor) [pid 5078] close(11) = -1 EBADF (Bad file descriptor) [pid 5078] close(12) = -1 EBADF (Bad file descriptor) [pid 5078] close(13) = -1 EBADF (Bad file descriptor) [pid 5078] close(14) = -1 EBADF (Bad file descriptor) [pid 5078] close(15) = -1 EBADF (Bad file descriptor) [pid 5078] close(16) = -1 EBADF (Bad file descriptor) [pid 5078] close(17) = -1 EBADF (Bad file descriptor) [pid 5078] close(18) = -1 EBADF (Bad file descriptor) [pid 5078] close(19) = -1 EBADF (Bad file descriptor) [pid 5078] close(20) = -1 EBADF (Bad file descriptor) [pid 5078] close(21) = -1 EBADF (Bad file descriptor) [pid 5078] close(22) = -1 EBADF (Bad file descriptor) [pid 5078] close(23) = -1 EBADF (Bad file descriptor) [pid 5078] close(24) = -1 EBADF (Bad file descriptor) [pid 5078] close(25) = -1 EBADF (Bad file descriptor) [pid 5078] close(26) = -1 EBADF (Bad file descriptor) [pid 5078] close(27) = -1 EBADF (Bad file descriptor) [pid 5078] close(28) = -1 EBADF (Bad file descriptor) [pid 5078] close(29) = -1 EBADF (Bad file descriptor) [pid 5078] exit_group(0) = ? [pid 5078] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=9, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555557a650) = 10 ./strace-static-x86_64: Process 5079 attached [pid 5079] set_robust_list(0x55555557a660, 24) = 0 [pid 5079] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5079] setpgid(0, 0) = 0 [pid 5079] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5079] write(3, "1000", 4) = 4 [pid 5079] close(3) = 0 [pid 5079] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5079] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5079] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5079] getsockname(4, {sa_family=AF_NETLINK, nl_pid=10, nl_groups=00000000}, [20 => 12]) = 0 [pid 5079] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x0a\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5079] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5079] close(3) = 0 [pid 5079] close(4) = 0 [pid 5079] close(5) = 0 [pid 5079] close(6) = -1 EBADF (Bad file descriptor) [pid 5079] close(7) = -1 EBADF (Bad file descriptor) [pid 5079] close(8) = -1 EBADF (Bad file descriptor) [pid 5079] close(9) = -1 EBADF (Bad file descriptor) [pid 5079] close(10) = -1 EBADF (Bad file descriptor) [pid 5079] close(11) = -1 EBADF (Bad file descriptor) [ 77.967422][ T5079] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [pid 5079] close(12) = -1 EBADF (Bad file descriptor) [pid 5079] close(13) = -1 EBADF (Bad file descriptor) [pid 5079] close(14) = -1 EBADF (Bad file descriptor) [pid 5079] close(15) = -1 EBADF (Bad file descriptor) [pid 5079] close(16) = -1 EBADF (Bad file descriptor) [pid 5079] close(17) = -1 EBADF (Bad file descriptor) [pid 5079] close(18) = -1 EBADF (Bad file descriptor) [pid 5079] close(19) = -1 EBADF (Bad file descriptor) [pid 5079] close(20) = -1 EBADF (Bad file descriptor) [pid 5079] close(21) = -1 EBADF (Bad file descriptor) [pid 5079] close(22) = -1 EBADF (Bad file descriptor) [pid 5079] close(23) = -1 EBADF (Bad file descriptor) [pid 5079] close(24) = -1 EBADF (Bad file descriptor) [pid 5079] close(25) = -1 EBADF (Bad file descriptor) [pid 5079] close(26) = -1 EBADF (Bad file descriptor) [pid 5079] close(27) = -1 EBADF (Bad file descriptor) [pid 5079] close(28) = -1 EBADF (Bad file descriptor) [pid 5079] close(29) = -1 EBADF (Bad file descriptor) [pid 5079] exit_group(0) = ? [pid 5079] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5062] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5080 attached , child_tidptr=0x55555557a650) = 11 [pid 5080] set_robust_list(0x55555557a660, 24) = 0 [pid 5080] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5080] setpgid(0, 0) = 0 [pid 5080] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5080] write(3, "1000", 4) = 4 [pid 5080] close(3) = 0 [pid 5080] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5080] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5080] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5080] getsockname(4, {sa_family=AF_NETLINK, nl_pid=11, nl_groups=00000000}, [20 => 12]) = 0 [pid 5080] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x0b\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5080] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5080] close(3) = 0 [pid 5080] close(4) = 0 [pid 5080] close(5) = 0 [pid 5080] close(6) = -1 EBADF (Bad file descriptor) [pid 5080] close(7) = -1 EBADF (Bad file descriptor) [pid 5080] close(8) = -1 EBADF (Bad file descriptor) [ 78.177352][ T5080] netlink: 8 bytes leftover after parsing attributes in process `syz-executor368'. [ 78.190393][ T5080] ip6gretap0: entered promiscuous mode [pid 5080] close(9) = -1 EBADF (Bad file descriptor) [pid 5080] close(10) = -1 EBADF (Bad file descriptor) [pid 5080] close(11) = -1 EBADF (Bad file descriptor) [pid 5080] close(12) = -1 EBADF (Bad file descriptor) [pid 5080] close(13) = -1 EBADF (Bad file descriptor) [pid 5080] close(14) = -1 EBADF (Bad file descriptor) [pid 5080] close(15) = -1 EBADF (Bad file descriptor) [pid 5080] close(16) = -1 EBADF (Bad file descriptor) [pid 5080] close(17) = -1 EBADF (Bad file descriptor) [pid 5080] close(18) = -1 EBADF (Bad file descriptor) [pid 5080] close(19) = -1 EBADF (Bad file descriptor) [pid 5080] close(20) = -1 EBADF (Bad file descriptor) [pid 5080] close(21) = -1 EBADF (Bad file descriptor) [pid 5080] close(22) = -1 EBADF (Bad file descriptor) [pid 5080] close(23) = -1 EBADF (Bad file descriptor) [pid 5080] close(24) = -1 EBADF (Bad file descriptor) [pid 5080] close(25) = -1 EBADF (Bad file descriptor) [pid 5080] close(26) = -1 EBADF (Bad file descriptor) [pid 5080] close(27) = -1 EBADF (Bad file descriptor) [pid 5080] close(28) = -1 EBADF (Bad file descriptor) [pid 5080] close(29) = -1 EBADF (Bad file descriptor) [pid 5080] exit_group(0) = ? [pid 5080] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555557a650) = 12 ./strace-static-x86_64: Process 5081 attached [pid 5081] set_robust_list(0x55555557a660, 24) = 0 [pid 5081] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5081] setpgid(0, 0) = 0 [pid 5081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5081] write(3, "1000", 4) = 4 [pid 5081] close(3) = 0 [pid 5081] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5081] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5081] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5081] getsockname(4, {sa_family=AF_NETLINK, nl_pid=12, nl_groups=00000000}, [20 => 12]) = 0 [pid 5081] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x0c\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5081] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5081] close(3) = 0 [pid 5081] close(4) = 0 [pid 5081] close(5) = 0 [ 78.425801][ T5081] bridge0: entered promiscuous mode [pid 5081] close(6) = -1 EBADF (Bad file descriptor) [pid 5081] close(7) = -1 EBADF (Bad file descriptor) [pid 5081] close(8) = -1 EBADF (Bad file descriptor) [pid 5081] close(9) = -1 EBADF (Bad file descriptor) [pid 5081] close(10) = -1 EBADF (Bad file descriptor) [pid 5081] close(11) = -1 EBADF (Bad file descriptor) [pid 5081] close(12) = -1 EBADF (Bad file descriptor) [pid 5081] close(13) = -1 EBADF (Bad file descriptor) [pid 5081] close(14) = -1 EBADF (Bad file descriptor) [pid 5081] close(15) = -1 EBADF (Bad file descriptor) [pid 5081] close(16) = -1 EBADF (Bad file descriptor) [pid 5081] close(17) = -1 EBADF (Bad file descriptor) [pid 5081] close(18) = -1 EBADF (Bad file descriptor) [pid 5081] close(19) = -1 EBADF (Bad file descriptor) [pid 5081] close(20) = -1 EBADF (Bad file descriptor) [pid 5081] close(21) = -1 EBADF (Bad file descriptor) [pid 5081] close(22) = -1 EBADF (Bad file descriptor) [pid 5081] close(23) = -1 EBADF (Bad file descriptor) [pid 5081] close(24) = -1 EBADF (Bad file descriptor) [pid 5081] close(25) = -1 EBADF (Bad file descriptor) [pid 5081] close(26) = -1 EBADF (Bad file descriptor) [pid 5081] close(27) = -1 EBADF (Bad file descriptor) [pid 5081] close(28) = -1 EBADF (Bad file descriptor) [pid 5081] close(29) = -1 EBADF (Bad file descriptor) [pid 5081] exit_group(0) = ? [pid 5081] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5062] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5082 attached [pid 5082] set_robust_list(0x55555557a660, 24 [pid 5062] <... clone resumed>, child_tidptr=0x55555557a650) = 13 [pid 5082] <... set_robust_list resumed>) = 0 [pid 5082] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5082] setpgid(0, 0) = 0 [pid 5082] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1000", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5082] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5082] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5082] getsockname(4, {sa_family=AF_NETLINK, nl_pid=13, nl_groups=00000000}, [20 => 12]) = 0 [pid 5082] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x0d\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5082] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5082] close(3) = 0 [pid 5082] close(4) = 0 [pid 5082] close(5) = 0 [pid 5082] close(6) = -1 EBADF (Bad file descriptor) [pid 5082] close(7) = -1 EBADF (Bad file descriptor) [pid 5082] close(8) = -1 EBADF (Bad file descriptor) [pid 5082] close(9) = -1 EBADF (Bad file descriptor) [pid 5082] close(10) = -1 EBADF (Bad file descriptor) [pid 5082] close(11) = -1 EBADF (Bad file descriptor) [pid 5082] close(12) = -1 EBADF (Bad file descriptor) [pid 5082] close(13) = -1 EBADF (Bad file descriptor) [pid 5082] close(14) = -1 EBADF (Bad file descriptor) [pid 5082] close(15) = -1 EBADF (Bad file descriptor) [pid 5082] close(16) = -1 EBADF (Bad file descriptor) [pid 5082] close(17) = -1 EBADF (Bad file descriptor) [pid 5082] close(18) = -1 EBADF (Bad file descriptor) [pid 5082] close(19) = -1 EBADF (Bad file descriptor) [pid 5082] close(20) = -1 EBADF (Bad file descriptor) [pid 5082] close(21) = -1 EBADF (Bad file descriptor) [pid 5082] close(22) = -1 EBADF (Bad file descriptor) [pid 5082] close(23) = -1 EBADF (Bad file descriptor) [pid 5082] close(24) = -1 EBADF (Bad file descriptor) [pid 5082] close(25) = -1 EBADF (Bad file descriptor) [pid 5082] close(26) = -1 EBADF (Bad file descriptor) [pid 5082] close(27) = -1 EBADF (Bad file descriptor) [pid 5082] close(28) = -1 EBADF (Bad file descriptor) [pid 5082] close(29) = -1 EBADF (Bad file descriptor) [pid 5082] exit_group(0) = ? [pid 5082] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=13, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5083 attached [pid 5083] set_robust_list(0x55555557a660, 24) = 0 [pid 5083] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5062] <... clone resumed>, child_tidptr=0x55555557a650) = 14 [pid 5083] <... prctl resumed>) = 0 [pid 5083] setpgid(0, 0) = 0 [pid 5083] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5083] write(3, "1000", 4) = 4 [pid 5083] close(3) = 0 [pid 5083] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5083] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5083] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5083] getsockname(4, {sa_family=AF_NETLINK, nl_pid=14, nl_groups=00000000}, [20 => 12]) = 0 [pid 5083] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x0e\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5083] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5083] close(3) = 0 [pid 5083] close(4) = 0 [pid 5083] close(5) = 0 [ 78.835630][ T5083] bond_slave_0: entered promiscuous mode [ 78.841538][ T5083] bond_slave_1: entered promiscuous mode [ 78.849022][ T5083] 8021q: adding VLAN 0 to HW filter on device macvlan6 [pid 5083] close(6) = -1 EBADF (Bad file descriptor) [pid 5083] close(7) = -1 EBADF (Bad file descriptor) [pid 5083] close(8) = -1 EBADF (Bad file descriptor) [pid 5083] close(9) = -1 EBADF (Bad file descriptor) [pid 5083] close(10) = -1 EBADF (Bad file descriptor) [pid 5083] close(11) = -1 EBADF (Bad file descriptor) [pid 5083] close(12) = -1 EBADF (Bad file descriptor) [pid 5083] close(13) = -1 EBADF (Bad file descriptor) [pid 5083] close(14) = -1 EBADF (Bad file descriptor) [pid 5083] close(15) = -1 EBADF (Bad file descriptor) [pid 5083] close(16) = -1 EBADF (Bad file descriptor) [pid 5083] close(17) = -1 EBADF (Bad file descriptor) [pid 5083] close(18) = -1 EBADF (Bad file descriptor) [pid 5083] close(19) = -1 EBADF (Bad file descriptor) [pid 5083] close(20) = -1 EBADF (Bad file descriptor) [pid 5083] close(21) = -1 EBADF (Bad file descriptor) [pid 5083] close(22) = -1 EBADF (Bad file descriptor) [pid 5083] close(23) = -1 EBADF (Bad file descriptor) [pid 5083] close(24) = -1 EBADF (Bad file descriptor) [pid 5083] close(25) = -1 EBADF (Bad file descriptor) [pid 5083] close(26) = -1 EBADF (Bad file descriptor) [pid 5083] close(27) = -1 EBADF (Bad file descriptor) [pid 5083] close(28) = -1 EBADF (Bad file descriptor) [pid 5083] close(29) = -1 EBADF (Bad file descriptor) [pid 5083] exit_group(0) = ? [pid 5083] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=14, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5084 attached , child_tidptr=0x55555557a650) = 15 [pid 5084] set_robust_list(0x55555557a660, 24) = 0 [pid 5084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5084] setpgid(0, 0) = 0 [pid 5084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1000", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5084] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5084] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5084] getsockname(4, {sa_family=AF_NETLINK, nl_pid=15, nl_groups=00000000}, [20 => 12]) = 0 [pid 5084] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x44\x00\x00\x00\x10\x00\x13\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x14\x00\x12\x80\x0c\x00\x01\x00\x6d\x61\x63\x76\x6c\x61\x6e\x00\x04\x00\x02\x80\x08\x00\x05\x00\x0f\x00\x00\x00\xff\xff\xff\xff\xd3\x8c\x7a\x3d", iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 68 [pid 5084] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5084] close(3) = 0 [pid 5084] close(4) = 0 [pid 5084] close(5) = 0 [pid 5084] close(6) = -1 EBADF (Bad file descriptor) [pid 5084] close(7) = -1 EBADF (Bad file descriptor) [ 79.056684][ T5084] team_slave_0: entered promiscuous mode [ 79.062528][ T5084] team_slave_1: entered promiscuous mode [ 79.069649][ T5084] 8021q: adding VLAN 0 to HW filter on device macvlan7 [pid 5084] close(8) = -1 EBADF (Bad file descriptor) [pid 5084] close(9) = -1 EBADF (Bad file descriptor) [pid 5084] close(10) = -1 EBADF (Bad file descriptor) [pid 5084] close(11) = -1 EBADF (Bad file descriptor) [pid 5084] close(12) = -1 EBADF (Bad file descriptor) [pid 5084] close(13) = -1 EBADF (Bad file descriptor) [pid 5084] close(14) = -1 EBADF (Bad file descriptor) [pid 5084] close(15) = -1 EBADF (Bad file descriptor) [pid 5084] close(16) = -1 EBADF (Bad file descriptor) [pid 5084] close(17) = -1 EBADF (Bad file descriptor) [pid 5084] close(18) = -1 EBADF (Bad file descriptor) [pid 5084] close(19) = -1 EBADF (Bad file descriptor) [pid 5084] close(20) = -1 EBADF (Bad file descriptor) [pid 5084] close(21) = -1 EBADF (Bad file descriptor) [pid 5084] close(22) = -1 EBADF (Bad file descriptor) [pid 5084] close(23) = -1 EBADF (Bad file descriptor) [pid 5084] close(24) = -1 EBADF (Bad file descriptor) [pid 5084] close(25) = -1 EBADF (Bad file descriptor) [pid 5084] close(26) = -1 EBADF (Bad file descriptor) [pid 5084] close(27) = -1 EBADF (Bad file descriptor) [pid 5084] close(28) = -1 EBADF (Bad file descriptor) [pid 5084] close(29) = -1 EBADF (Bad file descriptor) [pid 5084] exit_group(0) = ? [pid 5084] +++ exited with 0 +++ [pid 5062] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=15, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5062] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5085 attached , child_tidptr=0x55555557a650) = 16 [pid 5085] set_robust_list(0x55555557a660, 24) = 0 [pid 5085] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5085] setpgid(0, 0) = 0 [pid 5085] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5085] write(3, "1000", 4) = 4 [pid 5085] close(3) = 0 [pid 5085] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 5085] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 4 [pid 5085] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 5085] getsockname(4, {sa_family=AF_NETLINK, nl_pid=16, nl_groups=00000000}, [20 => 12]) = 0 [ 79.276609][ T5085] ================================================================== [ 79.284811][ T5085] BUG: KASAN: slab-out-of-bounds in dsa_user_changeupper+0x61a/0x6e0 [ 79.293775][ T5085] Read of size 8 at addr ffff8880230dec90 by task syz-executor368/5085 [ 79.302032][ T5085] [ 79.304431][ T5085] CPU: 0 PID: 5085 Comm: syz-executor368 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0 [ 79.315013][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 79.325085][ T5085] Call Trace: [ 79.328406][ T5085] [ 79.331332][ T5085] dump_stack_lvl+0xd9/0x1b0 [ 79.335930][ T5085] print_report+0xc4/0x620 [ 79.340367][ T5085] ? __virt_addr_valid+0x5e/0x580 [ 79.345409][ T5085] ? __phys_addr+0xc6/0x140 [ 79.349912][ T5085] kasan_report+0xda/0x110 [ 79.354327][ T5085] ? dsa_user_changeupper+0x61a/0x6e0 [ 79.359692][ T5085] ? dsa_user_changeupper+0x61a/0x6e0 [ 79.365076][ T5085] dsa_user_changeupper+0x61a/0x6e0 [ 79.371616][ T5085] dsa_user_netdevice_event+0xd04/0x3480 [ 79.377259][ T5085] ? rcu_is_watching+0x12/0xb0 [ 79.382211][ T5085] ? lock_release+0x4bf/0x690 [ 79.386997][ T5085] ? packet_notifier+0x1b2/0x8c0 [ 79.391979][ T5085] ? reacquire_held_locks+0x4c0/0x4c0 [ 79.397453][ T5085] ? tls_dev_event+0xfe/0x1110 [ 79.402235][ T5085] ? dsa_user_change_conduit+0x7e0/0x7e0 [ 79.407886][ T5085] ? tun_device_event+0x74/0x1260 [ 79.412930][ T5085] ? br_device_event+0x245/0x910 [ 79.417885][ T5085] ? br_switchdev_event+0x5b0/0x5b0 [ 79.423802][ T5085] ? packet_notifier+0x1b7/0x8c0 [ 79.428856][ T5085] notifier_call_chain+0xb6/0x3b0 [ 79.434192][ T5085] ? dsa_user_change_conduit+0x7e0/0x7e0 [ 79.440033][ T5085] call_netdevice_notifiers_info+0xbe/0x130 [ 79.446152][ T5085] __netdev_upper_dev_link+0x439/0x850 [ 79.452167][ T5085] ? ndisc_netdev_event+0xa1/0x580 [ 79.457361][ T5085] ? __dev_change_net_namespace+0x12f0/0x12f0 [ 79.463446][ T5085] ? call_netdevice_notifiers_info+0xc5/0x130 [ 79.469516][ T5085] ? register_netdevice+0x189/0x1da0 [ 79.474808][ T5085] netdev_upper_dev_link+0x92/0xc0 [ 79.479936][ T5085] ? __netdev_upper_dev_link+0x850/0x850 [ 79.485584][ T5085] ? rtnl_is_locked+0x15/0x20 [ 79.490260][ T5085] ? netdev_is_rx_handler_busy+0x83/0x160 [ 79.495988][ T5085] macvlan_common_newlink+0x111e/0x1a10 [ 79.501542][ T5085] ? macvlan_compute_filter+0x3b0/0x3b0 [ 79.507091][ T5085] ? rtnl_create_link+0xa4f/0xfb0 [ 79.512118][ T5085] ? macvlan_common_newlink+0x1a10/0x1a10 [ 79.517843][ T5085] __rtnl_newlink+0x118a/0x1940 [ 79.522705][ T5085] ? rtnl_link_unregister+0x260/0x260 [ 79.528096][ T5085] rtnl_newlink+0x67/0xa0 [ 79.532462][ T5085] ? __rtnl_newlink+0x1940/0x1940 [ 79.537516][ T5085] rtnetlink_rcv_msg+0x3c7/0xe00 [ 79.542485][ T5085] ? rtnl_fill_vf+0x490/0x490 [ 79.547174][ T5085] netlink_rcv_skb+0x16b/0x440 [ 79.552024][ T5085] ? rtnl_fill_vf+0x490/0x490 [ 79.556704][ T5085] ? netlink_ack+0x1380/0x1380 [ 79.561472][ T5085] ? netlink_deliver_tap+0x1a0/0xd00 [ 79.566765][ T5085] netlink_unicast+0x53b/0x810 [ 79.572418][ T5085] ? netlink_attachskb+0x880/0x880 [ 79.577543][ T5085] ? __phys_addr_symbol+0x30/0x70 [ 79.582594][ T5085] ? __check_object_size+0x323/0x730 [ 79.587906][ T5085] netlink_sendmsg+0x8b7/0xd70 [ 79.592674][ T5085] ? netlink_unicast+0x810/0x810 [ 79.597620][ T5085] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 79.602938][ T5085] ? netlink_unicast+0x810/0x810 [ 79.607960][ T5085] __sock_sendmsg+0xd5/0x180 [ 79.612554][ T5085] ____sys_sendmsg+0x6ac/0x940 [ 79.617343][ T5085] ? copy_msghdr_from_user+0x10b/0x160 [ 79.622906][ T5085] ? kernel_sendmsg+0x50/0x50 [ 79.628849][ T5085] ? finish_task_switch.isra.0+0x219/0xca0 [ 79.634690][ T5085] ? __switch_to+0x75d/0x1380 [ 79.639555][ T5085] ___sys_sendmsg+0x135/0x1d0 [ 79.644802][ T5085] ? do_recvmmsg+0x740/0x740 [ 79.649537][ T5085] ? lock_sync+0x190/0x190 [ 79.654045][ T5085] ? ptrace_stop.part.0+0x457/0x950 [ 79.659354][ T5085] ? __fget_light+0x173/0x200 [ 79.664055][ T5085] __sys_sendmsg+0x117/0x1e0 [ 79.668672][ T5085] ? __sys_sendmsg_sock+0x30/0x30 [ 79.673739][ T5085] ? ptrace_notify+0xf4/0x130 [ 79.678698][ T5085] ? _raw_spin_unlock_irq+0x2e/0x50 [ 79.685383][ T5085] ? ptrace_notify+0xf4/0x130 [ 79.690063][ T5085] do_syscall_64+0xd3/0x250 [ 79.694691][ T5085] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 79.701000][ T5085] RIP: 0033:0x7f6a3c26cb69 [ 79.705415][ T5085] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 79.725108][ T5085] RSP: 002b:00007fffc49e72b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.734912][ T5085] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f6a3c26cb69 [ 79.742900][ T5085] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 [ 79.750887][ T5085] RBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000 [ 79.758861][ T5085] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffc49e7310 [ 79.766829][ T5085] R13: 0000000000013467 R14: 00007fffc49e72dc R15: 0000000000000003 [ 79.774823][ T5085] [ 79.777841][ T5085] [ 79.780159][ T5085] Allocated by task 5062: [ 79.784492][ T5085] kasan_save_stack+0x33/0x50 [ 79.789197][ T5085] kasan_save_track+0x14/0x30 [ 79.793903][ T5085] __kasan_kmalloc+0xa2/0xb0 [ 79.798502][ T5085] __kmalloc_node+0x21b/0x460 [ 79.803275][ T5085] kvmalloc_node+0x99/0x1a0 [ 79.807785][ T5085] alloc_netdev_mqs+0xb3/0x12a0 [ 79.812633][ T5085] rtnl_create_link+0xc82/0xfb0 [ 79.817483][ T5085] __rtnl_newlink+0x10a1/0x1940 [ 79.822333][ T5085] rtnl_newlink+0x67/0xa0 [ 79.826665][ T5085] rtnetlink_rcv_msg+0x3c7/0xe00 [ 79.834678][ T5085] netlink_rcv_skb+0x16b/0x440 [ 79.839985][ T5085] netlink_unicast+0x53b/0x810 [ 79.844750][ T5085] netlink_sendmsg+0x8b7/0xd70 [ 79.849520][ T5085] __sock_sendmsg+0xd5/0x180 [ 79.854132][ T5085] __sys_sendto+0x225/0x310 [ 79.858649][ T5085] __x64_sys_sendto+0xe0/0x1b0 [ 79.863415][ T5085] do_syscall_64+0xd3/0x250 [ 79.867924][ T5085] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 79.873824][ T5085] [ 79.876162][ T5085] The buggy address belongs to the object at ffff8880230de000 [ 79.876162][ T5085] which belongs to the cache kmalloc-cg-4k of size 4096 [ 79.890478][ T5085] The buggy address is located 3216 bytes inside of [ 79.890478][ T5085] allocated 3223-byte region [ffff8880230de000, ffff8880230dec97) [ 79.904808][ T5085] [ 79.907145][ T5085] The buggy address belongs to the physical page: [ 79.913560][ T5085] page:ffffea00008c3600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x230d8 [ 79.923949][ T5085] head:ffffea00008c3600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 79.933558][ T5085] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 79.942752][ T5085] page_type: 0xffffffff() [ 79.947211][ T5085] raw: 00fff00000000840 ffff88801304f500 0000000000000000 0000000000000001 [ 79.955804][ T5085] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 79.964400][ T5085] page dumped because: kasan: bad access detected [ 79.970808][ T5085] page_owner tracks the page as allocated [ 79.976525][ T5085] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4525, tgid 4525 (udevd), ts 35662326073, free_ts 35648097089 [ 79.997280][ T5085] post_alloc_hook+0x2d0/0x350 [ 80.002053][ T5085] get_page_from_freelist+0xa28/0x3780 [ 80.007515][ T5085] __alloc_pages+0x22f/0x2440 [ 80.012185][ T5085] new_slab+0xcc/0x3a0 [ 80.016252][ T5085] ___slab_alloc+0x4af/0x19a0 [ 80.020928][ T5085] __slab_alloc.constprop.0+0x56/0xa0 [ 80.026303][ T5085] __kmalloc_node+0x35d/0x460 [ 80.030980][ T5085] kvmalloc_node+0x99/0x1a0 [ 80.035486][ T5085] seq_read_iter+0x80b/0x1280 [ 80.040337][ T5085] kernfs_fop_read_iter+0x410/0x580 [ 80.045540][ T5085] vfs_read+0x4d4/0x8f0 [ 80.049701][ T5085] ksys_read+0x12f/0x250 [ 80.053951][ T5085] do_syscall_64+0xd3/0x250 [ 80.058453][ T5085] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 80.064356][ T5085] page last free pid 4528 tgid 4528 stack trace: [ 80.070673][ T5085] free_unref_page_prepare+0x51f/0xb10 [ 80.076140][ T5085] free_unref_page+0x33/0x3c0 [ 80.080828][ T5085] __put_partials+0x14c/0x160 [ 80.085508][ T5085] qlist_free_all+0x58/0x150 [ 80.090119][ T5085] kasan_quarantine_reduce+0x18e/0x1d0 [ 80.095600][ T5085] __kasan_slab_alloc+0x65/0x90 [ 80.100451][ T5085] __kmalloc+0x1bd/0x440 [ 80.104695][ T5085] tomoyo_realpath_from_path+0xb9/0x710 [ 80.110244][ T5085] tomoyo_path_perm+0x26f/0x450 [ 80.115092][ T5085] security_inode_getattr+0xf1/0x150 [ 80.120377][ T5085] vfs_fstat+0x4f/0xc0 [ 80.124441][ T5085] vfs_fstatat+0x130/0x140 [ 80.128868][ T5085] __do_sys_newfstatat+0x98/0x110 [ 80.133997][ T5085] do_syscall_64+0xd3/0x250 [ 80.139565][ T5085] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 80.145559][ T5085] [ 80.147883][ T5085] Memory state around the buggy address: [ 80.153522][ T5085] ffff8880230deb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.161585][ T5085] ffff8880230dec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 80.169639][ T5085] >ffff8880230dec80: 00 00 07 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.177690][ T5085] ^ [ 80.182280][ T5085] ffff8880230ded00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.190334][ T5085] ffff8880230ded80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 80.198386][ T5085] ================================================================== [ 80.208874][ T5085] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 80.216090][ T5085] CPU: 1 PID: 5085 Comm: syz-executor368 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0 [ 80.226179][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 80.236511][ T5085] Call Trace: [ 80.239787][ T5085] [ 80.242711][ T5085] dump_stack_lvl+0xd9/0x1b0 [ 80.247318][ T5085] panic+0x6dc/0x790 [ 80.251282][ T5085] ? panic_smp_self_stop+0xa0/0xa0 [ 80.256424][ T5085] ? rcu_is_watching+0x12/0xb0 [ 80.261208][ T5085] ? trace_irq_enable.constprop.0+0xd0/0x100 [ 80.267195][ T5085] ? preempt_schedule_thunk+0x1a/0x30 [ 80.272572][ T5085] ? preempt_schedule_common+0x45/0xc0 [ 80.278032][ T5085] ? check_panic_on_warn+0x1f/0xb0 [ 80.283234][ T5085] check_panic_on_warn+0xab/0xb0 [ 80.288180][ T5085] end_report+0x108/0x150 [ 80.292513][ T5085] kasan_report+0xea/0x110 [ 80.296929][ T5085] ? dsa_user_changeupper+0x61a/0x6e0 [ 80.302310][ T5085] ? dsa_user_changeupper+0x61a/0x6e0 [ 80.307686][ T5085] dsa_user_changeupper+0x61a/0x6e0 [ 80.312893][ T5085] dsa_user_netdevice_event+0xd04/0x3480 [ 80.318531][ T5085] ? rcu_is_watching+0x12/0xb0 [ 80.323301][ T5085] ? lock_release+0x4bf/0x690 [ 80.331221][ T5085] ? packet_notifier+0x1b2/0x8c0 [ 80.336362][ T5085] ? reacquire_held_locks+0x4c0/0x4c0 [ 80.341751][ T5085] ? tls_dev_event+0xfe/0x1110 [ 80.346520][ T5085] ? dsa_user_change_conduit+0x7e0/0x7e0 [ 80.352172][ T5085] ? tun_device_event+0x74/0x1260 [ 80.357244][ T5085] ? br_device_event+0x245/0x910 [ 80.362218][ T5085] ? br_switchdev_event+0x5b0/0x5b0 [ 80.367442][ T5085] ? packet_notifier+0x1b7/0x8c0 [ 80.372744][ T5085] notifier_call_chain+0xb6/0x3b0 [ 80.377783][ T5085] ? dsa_user_change_conduit+0x7e0/0x7e0 [ 80.383425][ T5085] call_netdevice_notifiers_info+0xbe/0x130 [ 80.389321][ T5085] __netdev_upper_dev_link+0x439/0x850 [ 80.394786][ T5085] ? ndisc_netdev_event+0xa1/0x580 [ 80.399921][ T5085] ? __dev_change_net_namespace+0x12f0/0x12f0 [ 80.406002][ T5085] ? call_netdevice_notifiers_info+0xc5/0x130 [ 80.412070][ T5085] ? register_netdevice+0x189/0x1da0 [ 80.417365][ T5085] netdev_upper_dev_link+0x92/0xc0 [ 80.422480][ T5085] ? __netdev_upper_dev_link+0x850/0x850 [ 80.428935][ T5085] ? rtnl_is_locked+0x15/0x20 [ 80.433900][ T5085] ? netdev_is_rx_handler_busy+0x83/0x160 [ 80.439662][ T5085] macvlan_common_newlink+0x111e/0x1a10 [ 80.445322][ T5085] ? macvlan_compute_filter+0x3b0/0x3b0 [ 80.451158][ T5085] ? rtnl_create_link+0xa4f/0xfb0 [ 80.456188][ T5085] ? macvlan_common_newlink+0x1a10/0x1a10 [ 80.461911][ T5085] __rtnl_newlink+0x118a/0x1940 [ 80.466772][ T5085] ? rtnl_link_unregister+0x260/0x260 [ 80.472344][ T5085] rtnl_newlink+0x67/0xa0 [ 80.476681][ T5085] ? __rtnl_newlink+0x1940/0x1940 [ 80.481797][ T5085] rtnetlink_rcv_msg+0x3c7/0xe00 [ 80.486740][ T5085] ? rtnl_fill_vf+0x490/0x490 [ 80.491427][ T5085] netlink_rcv_skb+0x16b/0x440 [ 80.496188][ T5085] ? rtnl_fill_vf+0x490/0x490 [ 80.500869][ T5085] ? netlink_ack+0x1380/0x1380 [ 80.505637][ T5085] ? netlink_deliver_tap+0x1a0/0xd00 [ 80.510930][ T5085] netlink_unicast+0x53b/0x810 [ 80.515692][ T5085] ? netlink_attachskb+0x880/0x880 [ 80.520804][ T5085] ? __phys_addr_symbol+0x30/0x70 [ 80.525830][ T5085] ? __check_object_size+0x323/0x730 [ 80.531179][ T5085] netlink_sendmsg+0x8b7/0xd70 [ 80.539156][ T5085] ? netlink_unicast+0x810/0x810 [ 80.544088][ T5085] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 80.549377][ T5085] ? netlink_unicast+0x810/0x810 [ 80.554395][ T5085] __sock_sendmsg+0xd5/0x180 [ 80.558991][ T5085] ____sys_sendmsg+0x6ac/0x940 [ 80.563843][ T5085] ? copy_msghdr_from_user+0x10b/0x160 [ 80.569305][ T5085] ? kernel_sendmsg+0x50/0x50 [ 80.574528][ T5085] ? finish_task_switch.isra.0+0x219/0xca0 [ 80.580719][ T5085] ? __switch_to+0x75d/0x1380 [ 80.585499][ T5085] ___sys_sendmsg+0x135/0x1d0 [ 80.590186][ T5085] ? do_recvmmsg+0x740/0x740 [ 80.594908][ T5085] ? lock_sync+0x190/0x190 [ 80.599452][ T5085] ? ptrace_stop.part.0+0x457/0x950 [ 80.604748][ T5085] ? __fget_light+0x173/0x200 [ 80.609441][ T5085] __sys_sendmsg+0x117/0x1e0 [ 80.614127][ T5085] ? __sys_sendmsg_sock+0x30/0x30 [ 80.619325][ T5085] ? ptrace_notify+0xf4/0x130 [ 80.624004][ T5085] ? _raw_spin_unlock_irq+0x2e/0x50 [ 80.629293][ T5085] ? ptrace_notify+0xf4/0x130 [ 80.634079][ T5085] do_syscall_64+0xd3/0x250 [ 80.639408][ T5085] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 80.645432][ T5085] RIP: 0033:0x7f6a3c26cb69 [ 80.649840][ T5085] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 80.669876][ T5085] RSP: 002b:00007fffc49e72b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 80.678284][ T5085] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f6a3c26cb69 [ 80.686248][ T5085] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 [ 80.694251][ T5085] RBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000 [ 80.702337][ T5085] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffc49e7310 [ 80.710302][ T5085] R13: 0000000000013467 R14: 00007fffc49e72dc R15: 0000000000000003 [ 80.718279][ T5085] [ 80.721487][ T5085] Kernel Offset: disabled [ 80.725903][ T5085] Rebooting in 86400 seconds..