./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1156794284 <...> Warning: Permanently added '10.128.1.121' (ED25519) to the list of known hosts. execve("./syz-executor1156794284", ["./syz-executor1156794284"], 0x7fff6da4d6e0 /* 10 vars */) = 0 brk(NULL) = 0x555555e33000 brk(0x555555e33d00) = 0x555555e33d00 arch_prctl(ARCH_SET_FS, 0x555555e33380) = 0 set_tid_address(0x555555e33650) = 295 set_robust_list(0x555555e33660, 24) = 0 rseq(0x555555e33ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1156794284", 4096) = 28 getrandom("\xc9\x3b\x7e\xc6\x60\xd8\x32\xac", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555e33d00 brk(0x555555e54d00) = 0x555555e54d00 brk(0x555555e55000) = 0x555555e55000 mprotect(0x7fec42339000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 296 ./strace-static-x86_64: Process 296 attached [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] set_robust_list(0x555555e33660, 24) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... clone resumed>, child_tidptr=0x555555e33650) = 297 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 298 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 299 [pid 295] <... clone resumed>, child_tidptr=0x555555e33650) = 300 ./strace-static-x86_64: Process 299 attached [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 297 attached [pid 299] set_robust_list(0x555555e33660, 24 [pid 295] <... clone resumed>, child_tidptr=0x555555e33650) = 301 [pid 299] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 301 attached [pid 301] set_robust_list(0x555555e33660, 24) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] set_robust_list(0x555555e33660, 24 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 302 [pid 299] <... prctl resumed>) = 0 ./strace-static-x86_64: Process 300 attached [pid 300] set_robust_list(0x555555e33660, 24) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] setpgid(0, 0 [pid 297] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 298 attached [pid 299] <... setpgid resumed>) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 303 ./strace-static-x86_64: Process 302 attached [pid 299] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 302] set_robust_list(0x555555e33660, 24) = 0 [pid 302] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 302] setpgid(0, 0) = 0 [pid 302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... openat resumed>) = 3 [pid 302] <... openat resumed>) = 3 [pid 302] write(3, "1000", 4) = 4 [pid 302] close(3) = 0 [pid 302] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 299] write(3, "1000", 4 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... write resumed>) = 4 [pid 299] close(3./strace-static-x86_64: Process 303 attached ) = 0 [pid 298] set_robust_list(0x555555e33660, 24./strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x555555e33660, 24) = 0 [pid 303] set_robust_list(0x555555e33660, 24 [pid 299] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 298] <... set_robust_list resumed>) = 0 [pid 303] <... set_robust_list resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 304 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] setpgid(0, 0) = 0 [pid 304] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 303] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 304] <... openat resumed>) = 3 [pid 304] write(3, "1000", 4) = 4 [pid 304] close(3) = 0 [ 23.040078][ T28] audit: type=1400 audit(1713756766.845:66): avc: denied { execmem } for pid=295 comm="syz-executor115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.067886][ T28] audit: type=1400 audit(1713756766.875:67): avc: denied { bpf } for pid=302 comm="syz-executor115" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 304] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 303] <... prctl resumed>) = 0 [pid 303] setpgid(0, 0 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 305 [pid 303] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 305 attached [pid 305] set_robust_list(0x555555e33660, 24) = 0 [pid 305] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 305] setpgid(0, 0) = 0 [pid 305] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1000", 4) = 4 [pid 305] close(3 [pid 303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 305] <... close resumed>) = 0 [pid 305] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 303] write(3, "1000", 4) = 4 [pid 303] close(3) = 0 [pid 303] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 305] <... bpf resumed>) = 3 [pid 304] <... bpf resumed>) = 3 [pid 305] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 305] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 303] <... bpf resumed>) = 3 [pid 299] <... bpf resumed>) = 3 [pid 305] <... bpf resumed>) = 5 [pid 305] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 304] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 305] <... bpf resumed>) = 0 [ 23.090918][ T28] audit: type=1400 audit(1713756766.875:68): avc: denied { prog_load } for pid=302 comm="syz-executor115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.112609][ T28] audit: type=1400 audit(1713756766.875:69): avc: denied { perfmon } for pid=302 comm="syz-executor115" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 305] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 304] <... bpf resumed>) = 4 [pid 303] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 302] <... bpf resumed>) = 3 [pid 299] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 305] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 305] exit_group(0) = ? [pid 299] <... bpf resumed>) = 4 [pid 304] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 303] <... bpf resumed>) = 4 [pid 302] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 299] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 304] <... bpf resumed>) = 5 [pid 303] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 304] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 299] <... bpf resumed>) = 5 [pid 304] <... bpf resumed>) = 0 [pid 303] <... bpf resumed>) = 5 [pid 299] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 304] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 303] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 299] <... bpf resumed>) = 0 [pid 304] <... bpf resumed>) = 6 [pid 303] <... bpf resumed>) = 0 [pid 299] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 304] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 303] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 299] <... bpf resumed>) = 6 [pid 303] <... bpf resumed>) = 6 [pid 303] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [ 23.139437][ T28] audit: type=1400 audit(1713756766.945:71): avc: denied { map_create } for pid=305 comm="syz-executor115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.164317][ T28] audit: type=1400 audit(1713756766.945:72): avc: denied { map_read map_write } for pid=305 comm="syz-executor115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [pid 299] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 304] <... bpf resumed>) = 7 [pid 303] <... bpf resumed>) = 7 [pid 305] +++ exited with 0 +++ [pid 302] <... bpf resumed>) = 4 [pid 299] <... bpf resumed>) = 7 [pid 302] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 299] exit_group(0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=305, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 302] <... bpf resumed>) = 5 [pid 299] <... exit_group resumed>) = ? [pid 304] exit_group(0 [pid 303] exit_group(0 [pid 302] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 304] <... exit_group resumed>) = ? [pid 303] <... exit_group resumed>) = ? [pid 302] <... bpf resumed>) = 0 [pid 299] +++ exited with 0 +++ [pid 302] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=299, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 302] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 302] <... bpf resumed>) = 7 [pid 296] <... restart_syscall resumed>) = 0 [pid 302] exit_group(0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 303] +++ exited with 0 +++ [pid 302] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 306 attached [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 306 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 307 ./strace-static-x86_64: Process 307 attached [pid 307] set_robust_list(0x555555e33660, 24) = 0 [pid 307] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 307] setpgid(0, 0) = 0 [pid 307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 307] write(3, "1000", 4) = 4 [pid 307] close(3) = 0 [pid 307] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 307] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=303, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 308 [pid 306] set_robust_list(0x555555e33660, 24) = 0 [pid 306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 306] setpgid(0, 0) = 0 [pid 306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 306] write(3, "1000", 4) = 4 [pid 306] close(3) = 0 [pid 306] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 304] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=304, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 309 [pid 306] <... bpf resumed>) = 3 [pid 306] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 308 attached [pid 308] set_robust_list(0x555555e33660, 24) = 0 [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 308] setpgid(0, 0) = 0 [pid 308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 308] write(3, "1000", 4) = 4 [pid 308] close(3) = 0 [pid 308] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 308] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 309 attached [pid 309] set_robust_list(0x555555e33660, 24) = 0 [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 309] setpgid(0, 0) = 0 [pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "1000", 4) = 4 [pid 309] close(3) = 0 [pid 309] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 23.184352][ T28] audit: type=1400 audit(1713756766.945:70): avc: denied { prog_run } for pid=302 comm="syz-executor115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.209434][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000102, exited with 00000101? [ 23.222302][ T304] BUG: scheduling while atomic: syz-executor115/304/0x00000002 [ 23.229733][ T304] Modules linked in: [ 23.234028][ T304] Preemption disabled at: [ 23.234039][ T304] [] up_write+0x27/0x1f0 [ 23.244499][ T304] CPU: 1 PID: 304 Comm: syz-executor115 Not tainted 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 23.254376][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 23.264299][ T304] Call Trace: [ 23.267446][ T304] [ 23.270177][ T304] dump_stack_lvl+0x151/0x1b7 [ 23.274686][ T304] ? up_write+0x27/0x1f0 [ 23.278761][ T304] ? up_write+0x27/0x1f0 [ 23.282840][ T304] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 23.288144][ T304] ? up_write+0x27/0x1f0 [ 23.292214][ T304] dump_stack+0x15/0x1b [ 23.296206][ T304] __schedule_bug+0x195/0x260 [ 23.300719][ T304] ? cpu_util_update_eff+0x10e0/0x10e0 [ 23.306017][ T304] ? sysvec_irq_work+0x52/0xb0 [ 23.310621][ T304] ? asm_sysvec_irq_work+0x1b/0x20 [ 23.315569][ T304] __schedule+0xcf7/0x1550 [ 23.319824][ T304] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 23.325196][ T304] ? __sched_text_start+0x8/0x8 [ 23.330076][ T304] ? startup_64+0x2/0x60 [ 23.334304][ T304] do_task_dead+0x99/0xa0 [ 23.338474][ T304] do_exit+0x202a/0x2b80 [ 23.342549][ T304] ? put_task_struct+0x80/0x80 [ 23.347146][ T304] ? __kasan_check_write+0x14/0x20 [ 23.352313][ T304] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 23.357264][ T304] ? _raw_spin_lock_irqsave+0x210/0x210 [ 23.362638][ T304] ? zap_other_threads+0x29c/0x2d0 [ 23.367590][ T304] do_group_exit+0x21a/0x2d0 [ 23.372045][ T304] __x64_sys_exit_group+0x3f/0x40 [ 23.376874][ T304] do_syscall_64+0x3d/0xb0 [ 23.381133][ T304] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 23.386856][ T304] RIP: 0033:0x7fec422c2ff9 [ 23.391107][ T304] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 23.397968][ T304] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 23.406208][ T304] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 23.414021][ T304] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 23.421855][ T304] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 23.429641][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [pid 309] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 307] <... bpf resumed>) = 4 [pid 307] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 306] <... bpf resumed>) = 4 [pid 302] +++ exited with 0 +++ [pid 307] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=302, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 309] <... bpf resumed>) = 4 [pid 308] <... bpf resumed>) = 4 [pid 307] <... bpf resumed>) = 0 [pid 306] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 309] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 308] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 307] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 306] <... bpf resumed>) = 5 [pid 301] <... restart_syscall resumed>) = 0 [pid 309] <... bpf resumed>) = 5 [pid 308] <... bpf resumed>) = 5 [pid 306] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 309] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 308] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 307] <... bpf resumed>) = 6 [pid 306] <... bpf resumed>) = 0 [pid 309] <... bpf resumed>) = 0 [pid 308] <... bpf resumed>) = 0 [pid 307] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 306] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 309] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 308] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 309] <... bpf resumed>) = 6 [pid 308] <... bpf resumed>) = 6 [pid 306] <... bpf resumed>) = 6 [pid 309] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 308] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 306] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 312 attached [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 312 [pid 312] set_robust_list(0x555555e33660, 24) = 0 [pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 312] setpgid(0, 0) = 0 [pid 312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 312] write(3, "1000", 4) = 4 [pid 312] close(3) = 0 [pid 312] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 312] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 307] <... bpf resumed>) = 7 [pid 307] exit_group(0 [pid 309] <... bpf resumed>) = 7 [pid 307] <... exit_group resumed>) = ? [pid 312] <... bpf resumed>) = 4 [pid 309] exit_group(0 [pid 308] <... bpf resumed>) = 7 [pid 306] <... bpf resumed>) = 7 [pid 312] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 309] <... exit_group resumed>) = ? [pid 308] exit_group(0 [pid 306] exit_group(0 [pid 312] <... bpf resumed>) = 5 [pid 309] +++ exited with 0 +++ [pid 308] <... exit_group resumed>) = ? [pid 306] <... exit_group resumed>) = ? [pid 312] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 308] +++ exited with 0 +++ [pid 306] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=309, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 312] <... bpf resumed>) = 0 [pid 312] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=308, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=306, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 312] <... bpf resumed>) = 6 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 312] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 313 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 314 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 315 [ 23.437452][ T304] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 23.445275][ T304] [ 23.465171][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 23.476822][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000104, exited with 00000103? [pid 312] exit_group(0) = ? ./strace-static-x86_64: Process 315 attached [pid 307] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=307, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 316 [pid 315] set_robust_list(0x555555e33660, 24) = 0 [pid 315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 315] setpgid(0, 0) = 0 [pid 315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ./strace-static-x86_64: Process 313 attached [pid 315] write(3, "1000", 4) = 4 [pid 313] set_robust_list(0x555555e33660, 24 [pid 315] close(3 [pid 313] <... set_robust_list resumed>) = 0 [pid 315] <... close resumed>) = 0 [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 315] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 313] <... prctl resumed>) = 0 [pid 313] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 316 attached [pid 313] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 316] set_robust_list(0x555555e33660, 24 [pid 313] <... openat resumed>) = 3 [pid 316] <... set_robust_list resumed>) = 0 [pid 313] write(3, "1000", 4 [pid 316] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] <... write resumed>) = 4 [pid 316] <... prctl resumed>) = 0 [pid 313] close(3 [pid 316] setpgid(0, 0 [pid 313] <... close resumed>) = 0 [pid 316] <... setpgid resumed>) = 0 [pid 313] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 316] write(3, "1000", 4) = 4 [pid 316] close(3) = 0 [ 23.489135][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000105, exited with 00000104? [ 23.501063][ T307] BUG: scheduling while atomic: syz-executor115/307/0x00000004 [ 23.508872][ T307] Modules linked in: [ 23.512838][ T307] Preemption disabled at: [ 23.512848][ T307] [] is_module_text_address+0x1f/0x360 [ 23.524508][ T307] CPU: 1 PID: 307 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 23.535880][ T307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 23.545769][ T307] Call Trace: [ 23.549164][ T307] [ 23.551941][ T307] dump_stack_lvl+0x151/0x1b7 [ 23.556460][ T307] ? is_module_text_address+0x1f/0x360 [ 23.561749][ T307] ? is_module_text_address+0x1f/0x360 [ 23.567054][ T307] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 23.572343][ T307] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 23.577980][ T307] ? is_module_text_address+0x1f/0x360 [ 23.583274][ T307] dump_stack+0x15/0x1b [ 23.587274][ T307] __schedule_bug+0x195/0x260 [ 23.591787][ T307] ? cpu_util_update_eff+0x10e0/0x10e0 [ 23.597207][ T307] __schedule+0xcf7/0x1550 [ 23.601563][ T307] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 23.606846][ T307] ? __sched_text_start+0x8/0x8 [ 23.611533][ T307] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 23.617000][ T307] do_task_dead+0x99/0xa0 [ 23.621165][ T307] do_exit+0x202a/0x2b80 [ 23.625246][ T307] ? put_task_struct+0x80/0x80 [ 23.629842][ T307] ? __kasan_check_write+0x14/0x20 [ 23.634801][ T307] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 23.640008][ T307] ? _raw_spin_lock_irqsave+0x210/0x210 [ 23.645386][ T307] ? zap_other_threads+0x29c/0x2d0 [ 23.650327][ T307] do_group_exit+0x21a/0x2d0 [ 23.654753][ T307] __x64_sys_exit_group+0x3f/0x40 [ 23.659612][ T307] do_syscall_64+0x3d/0xb0 [ 23.663877][ T307] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 23.669596][ T307] RIP: 0033:0x7fec422c2ff9 [ 23.673850][ T307] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 23.680717][ T307] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 316] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46./strace-static-x86_64: Process 314 attached [pid 314] set_robust_list(0x555555e33660, 24 [pid 315] <... bpf resumed>) = 3 [pid 313] <... bpf resumed>) = 3 [pid 316] <... bpf resumed>) = 3 [pid 314] <... set_robust_list resumed>) = 0 [pid 313] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 315] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 316] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 314] <... prctl resumed>) = 0 [pid 314] setpgid(0, 0 [pid 312] +++ exited with 0 +++ [pid 314] <... setpgid resumed>) = 0 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=312, si_uid=0, si_status=0, si_utime=0, si_stime=23} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1000", 4) = 4 [pid 314] close(3) = 0 [pid 314] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 301] <... restart_syscall resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 314] <... bpf resumed>) = 3 [pid 314] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 318 ./strace-static-x86_64: Process 318 attached [pid 318] set_robust_list(0x555555e33660, 24) = 0 [pid 318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 318] setpgid(0, 0) = 0 [pid 318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 318] write(3, "1000", 4) = 4 [pid 318] close(3) = 0 [pid 318] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 318] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 316] <... bpf resumed>) = 4 [pid 315] <... bpf resumed>) = 4 [pid 314] <... bpf resumed>) = 4 [pid 313] <... bpf resumed>) = 4 [pid 318] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 316] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 315] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 314] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 313] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 318] <... bpf resumed>) = 5 [pid 316] <... bpf resumed>) = 5 [pid 315] <... bpf resumed>) = 5 [pid 314] <... bpf resumed>) = 5 [pid 313] <... bpf resumed>) = 5 [pid 318] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 316] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 315] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 314] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 313] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 318] <... bpf resumed>) = 0 [pid 316] <... bpf resumed>) = 0 [pid 315] <... bpf resumed>) = 0 [pid 314] <... bpf resumed>) = 0 [pid 313] <... bpf resumed>) = 0 [pid 318] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 316] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 315] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 314] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 313] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 318] <... bpf resumed>) = 6 [pid 316] <... bpf resumed>) = 6 [pid 315] <... bpf resumed>) = 6 [pid 318] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 316] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 315] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 314] <... bpf resumed>) = 6 [pid 318] <... bpf resumed>) = 7 [pid 316] <... bpf resumed>) = 7 [pid 315] <... bpf resumed>) = 7 [pid 314] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 318] exit_group(0 [pid 316] exit_group(0 [pid 315] exit_group(0 [pid 314] <... bpf resumed>) = 7 [pid 313] <... bpf resumed>) = 6 [pid 318] <... exit_group resumed>) = ? [pid 316] <... exit_group resumed>) = ? [pid 315] <... exit_group resumed>) = ? [pid 314] exit_group(0 [pid 313] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 314] <... exit_group resumed>) = ? [pid 313] <... bpf resumed>) = 7 [pid 313] exit_group(0 [pid 316] +++ exited with 0 +++ [pid 313] <... exit_group resumed>) = ? [pid 315] +++ exited with 0 +++ [pid 313] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=316, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 23.688948][ T307] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 23.696763][ T307] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 23.704572][ T307] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 23.712384][ T307] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 23.720192][ T307] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 23.728099][ T307] [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=313, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=315, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 320 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 319 ./strace-static-x86_64: Process 320 attached [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 321 ./strace-static-x86_64: Process 319 attached [pid 320] set_robust_list(0x555555e33660, 24./strace-static-x86_64: Process 321 attached ) = 0 [pid 319] set_robust_list(0x555555e33660, 24 [pid 321] set_robust_list(0x555555e33660, 24 [pid 319] <... set_robust_list resumed>) = 0 [pid 321] <... set_robust_list resumed>) = 0 [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 321] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 319] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 320] <... prctl resumed>) = 0 [pid 321] <... prctl resumed>) = 0 [pid 321] setpgid(0, 0 [pid 320] setpgid(0, 0 [pid 321] <... setpgid resumed>) = 0 [pid 320] <... setpgid resumed>) = 0 [pid 321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 321] write(3, "1000", 4) = 4 [pid 320] <... openat resumed>) = 3 [pid 321] close(3 [pid 320] write(3, "1000", 4 [pid 321] <... close resumed>) = 0 [pid 319] <... prctl resumed>) = 0 [pid 321] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 320] <... write resumed>) = 4 [pid 320] close(3 [pid 319] setpgid(0, 0 [pid 320] <... close resumed>) = 0 [pid 320] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 319] <... setpgid resumed>) = 0 [pid 321] <... bpf resumed>) = 3 [pid 321] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 320] <... bpf resumed>) = 3 [pid 319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 320] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 319] <... openat resumed>) = 3 [pid 319] write(3, "1000", 4) = 4 [pid 319] close(3) = 0 [pid 319] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 319] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 314] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=314, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 318] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=318, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 298] <... restart_syscall resumed>) = 0 [pid 301] <... restart_syscall resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 322 attached ./strace-static-x86_64: Process 323 attached [pid 323] set_robust_list(0x555555e33660, 24 [pid 322] set_robust_list(0x555555e33660, 24 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 323 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 322 [pid 323] <... set_robust_list resumed>) = 0 [pid 322] <... set_robust_list resumed>) = 0 [pid 322] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 323] setpgid(0, 0) = 0 [pid 322] <... prctl resumed>) = 0 [pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 322] setpgid(0, 0) = 0 [pid 322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 323] <... openat resumed>) = 3 [pid 323] write(3, "1000", 4 [pid 322] <... openat resumed>) = 3 [pid 323] <... write resumed>) = 4 [pid 323] close(3) = 0 [pid 323] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 322] write(3, "1000", 4) = 4 [pid 322] close(3) = 0 [pid 322] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 323] <... bpf resumed>) = 3 [pid 323] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 322] <... bpf resumed>) = 3 [pid 322] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 321] <... bpf resumed>) = 4 [pid 320] <... bpf resumed>) = 4 [pid 321] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 319] <... bpf resumed>) = 4 [pid 323] <... bpf resumed>) = 4 [pid 322] <... bpf resumed>) = 4 [pid 321] <... bpf resumed>) = 5 [pid 320] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 319] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 322] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 321] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 322] <... bpf resumed>) = 5 [pid 321] <... bpf resumed>) = 0 [pid 322] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 321] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 319] <... bpf resumed>) = 5 [pid 323] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 322] <... bpf resumed>) = 0 [pid 321] <... bpf resumed>) = 6 [pid 320] <... bpf resumed>) = 5 [pid 319] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 322] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 321] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 323] <... bpf resumed>) = 5 [pid 322] <... bpf resumed>) = 6 [pid 321] <... bpf resumed>) = 7 [pid 320] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 319] <... bpf resumed>) = 0 [pid 322] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 321] exit_group(0 [pid 320] <... bpf resumed>) = 0 [pid 319] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 323] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 322] <... bpf resumed>) = 7 [pid 321] <... exit_group resumed>) = ? [ 23.829580][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 23.841062][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 23.848420][ T292] Modules linked in: [ 23.852072][ T292] Preemption disabled at: [ 23.852079][ T292] [] is_module_text_address+0x1f/0x360 [ 23.863493][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 23.874839][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 23.884733][ T292] Call Trace: [ 23.887859][ T292] [ 23.890638][ T292] dump_stack_lvl+0x151/0x1b7 [ 23.895149][ T292] ? is_module_text_address+0x1f/0x360 [ 23.900445][ T292] ? is_module_text_address+0x1f/0x360 [ 23.905740][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 23.911035][ T292] ? is_module_text_address+0x1f/0x360 [ 23.916329][ T292] dump_stack+0x15/0x1b [ 23.920328][ T292] __schedule_bug+0x195/0x260 [ 23.924841][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 23.930126][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 23.935695][ T292] __schedule+0xcf7/0x1550 [ 23.940023][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 23.945926][ T292] ? ____fput+0x15/0x20 [ 23.949916][ T292] ? __sched_text_start+0x8/0x8 [ 23.954603][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 23.960071][ T292] ? unlock_page_memcg+0x160/0x160 [ 23.965020][ T292] schedule+0xc3/0x180 [ 23.968934][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 23.973962][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 23.979378][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 23.984751][ T292] do_syscall_64+0x49/0xb0 [ 23.989010][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 23.994745][ T292] RIP: 0033:0x4e65f7 [ 23.998466][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 24.017910][ T292] RSP: 002b:00007fff6da4d1d8 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [pid 320] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 323] <... bpf resumed>) = 0 [pid 322] exit_group(0 [pid 321] +++ exited with 0 +++ [pid 320] <... bpf resumed>) = 6 [pid 319] <... bpf resumed>) = 6 [pid 323] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 322] <... exit_group resumed>) = ? [pid 323] <... bpf resumed>) = 6 [pid 320] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 319] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=321, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 323] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 322] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=322, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 324 ./strace-static-x86_64: Process 324 attached [pid 324] set_robust_list(0x555555e33660, 24) = 0 [pid 324] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 324] <... prctl resumed>) = 0 ./strace-static-x86_64: Process 325 attached [pid 325] set_robust_list(0x555555e33660, 24 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 325 [pid 325] <... set_robust_list resumed>) = 0 [pid 325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 325] setpgid(0, 0) = 0 [pid 325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 325] write(3, "1000", 4) = 4 [pid 325] close(3) = 0 [pid 325] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 324] setpgid(0, 0) = 0 [pid 324] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 325] <... bpf resumed>) = 3 [pid 325] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 324] <... openat resumed>) = 3 [pid 324] write(3, "1000", 4) = 4 [pid 324] close(3) = 0 [pid 324] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 324] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 320] <... bpf resumed>) = 7 [pid 325] <... bpf resumed>) = 4 [pid 324] <... bpf resumed>) = 4 [pid 323] <... bpf resumed>) = 7 [pid 319] <... bpf resumed>) = 7 [pid 325] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 324] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 323] exit_group(0 [pid 320] exit_group(0 [pid 319] exit_group(0 [pid 325] <... bpf resumed>) = 5 [pid 324] <... bpf resumed>) = 5 [pid 323] <... exit_group resumed>) = ? [pid 320] <... exit_group resumed>) = ? [ 24.026150][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 24.033962][ T292] RDX: 00007fff6da4d1e0 RSI: 0000000000008910 RDI: 0000000000000003 [ 24.041773][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000d [ 24.049586][ T292] R10: 00000000005549d3 R11: 0000000000000286 R12: 00007fff6da4d240 [ 24.057395][ T292] R13: 00007fff6da4d1e0 R14: 0000000000427210 R15: 0000000000617180 [ 24.065213][ T292] [ 24.085171][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000102, exited with 00000101? [ 24.097851][ T320] BUG: scheduling while atomic: syz-executor115/320/0x00000002 [ 24.105388][ T320] Modules linked in: [ 24.109123][ T320] Preemption disabled at: [ 24.109133][ T320] [] up_write+0x27/0x1f0 [ 24.118915][ T320] CPU: 1 PID: 320 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 24.130278][ T320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 24.140171][ T320] Call Trace: [ 24.143295][ T320] [ 24.146074][ T320] dump_stack_lvl+0x151/0x1b7 [ 24.150589][ T320] ? up_write+0x27/0x1f0 [ 24.154666][ T320] ? up_write+0x27/0x1f0 [ 24.158742][ T320] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 24.164041][ T320] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 24.169687][ T320] ? up_write+0x27/0x1f0 [ 24.173758][ T320] dump_stack+0x15/0x1b [ 24.177749][ T320] __schedule_bug+0x195/0x260 [ 24.182266][ T320] ? cpu_util_update_eff+0x10e0/0x10e0 [ 24.187564][ T320] __schedule+0xcf7/0x1550 [ 24.191812][ T320] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 24.197108][ T320] ? __sched_text_start+0x8/0x8 [ 24.201792][ T320] ? asm_sysvec_reboot+0x12/0x20 [ 24.206569][ T320] do_task_dead+0x99/0xa0 [ 24.210732][ T320] do_exit+0x202a/0x2b80 [ 24.214814][ T320] ? put_task_struct+0x80/0x80 [ 24.219424][ T320] ? __kasan_check_write+0x14/0x20 [ 24.224367][ T320] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 24.229304][ T320] ? _raw_spin_lock_irqsave+0x210/0x210 [ 24.234699][ T320] ? zap_other_threads+0x29c/0x2d0 [ 24.239636][ T320] do_group_exit+0x21a/0x2d0 [ 24.244064][ T320] __x64_sys_exit_group+0x3f/0x40 [ 24.248920][ T320] do_syscall_64+0x3d/0xb0 [ 24.253173][ T320] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 24.258906][ T320] RIP: 0033:0x7fec422c2ff9 [ 24.263154][ T320] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 24.270010][ T320] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 24.278259][ T320] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [pid 319] <... exit_group resumed>) = ? [pid 325] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 324] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 323] +++ exited with 0 +++ [pid 325] <... bpf resumed>) = 0 [pid 324] <... bpf resumed>) = 0 [pid 325] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 324] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 325] <... bpf resumed>) = 6 [pid 324] <... bpf resumed>) = 6 [pid 320] +++ exited with 0 +++ [pid 319] +++ exited with 0 +++ [pid 325] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 324] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=323, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=319, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=320, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 325] <... bpf resumed>) = 7 [pid 324] <... bpf resumed>) = 7 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 324] exit_group(0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 324] <... exit_group resumed>) = ? [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 329 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 331 ./strace-static-x86_64: Process 331 attached [pid 331] set_robust_list(0x555555e33660, 24) = 0 [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 331] setpgid(0, 0) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 330 [pid 325] exit_group(0./strace-static-x86_64: Process 330 attached ) = ? [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 330] set_robust_list(0x555555e33660, 24./strace-static-x86_64: Process 329 attached ) = 0 [pid 330] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 329] set_robust_list(0x555555e33660, 24 [pid 331] <... openat resumed>) = 3 [pid 330] <... prctl resumed>) = 0 [pid 329] <... set_robust_list resumed>) = 0 [pid 331] write(3, "1000", 4 [pid 330] setpgid(0, 0 [pid 329] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 331] <... write resumed>) = 4 [pid 330] <... setpgid resumed>) = 0 [pid 329] <... prctl resumed>) = 0 [pid 330] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 331] close(3) = 0 [pid 331] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 330] write(3, "1000", 4 [pid 329] setpgid(0, 0 [pid 330] <... write resumed>) = 4 [pid 329] <... setpgid resumed>) = 0 [pid 330] close(3) = 0 [pid 329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 330] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 329] <... openat resumed>) = 3 [pid 329] write(3, "1000", 4) = 4 [pid 331] <... bpf resumed>) = 3 [pid 329] close(3) = 0 [pid 331] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 330] <... bpf resumed>) = 3 [pid 329] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 330] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 329] <... bpf resumed>) = 3 [pid 324] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=324, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 325] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=325, si_uid=0, si_status=0, si_utime=0, si_stime=21} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 329] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 332 attached ./strace-static-x86_64: Process 333 attached [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 332 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 333 [pid 332] set_robust_list(0x555555e33660, 24 [pid 333] set_robust_list(0x555555e33660, 24 [pid 332] <... set_robust_list resumed>) = 0 [pid 332] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 333] <... set_robust_list resumed>) = 0 [pid 332] <... prctl resumed>) = 0 [pid 332] setpgid(0, 0) = 0 [pid 332] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 333] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 332] <... openat resumed>) = 3 [pid 333] <... prctl resumed>) = 0 [pid 332] write(3, "1000", 4 [pid 333] setpgid(0, 0) = 0 [pid 332] <... write resumed>) = 4 [pid 332] close(3) = 0 [pid 332] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 333] write(3, "1000", 4) = 4 [pid 333] close(3) = 0 [pid 333] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 332] <... bpf resumed>) = 3 [pid 332] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 333] <... bpf resumed>) = 3 [pid 333] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 330] <... bpf resumed>) = 4 [pid 333] <... bpf resumed>) = 4 [pid 332] <... bpf resumed>) = 4 [pid 331] <... bpf resumed>) = 4 [pid 329] <... bpf resumed>) = 4 [pid 333] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 332] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 331] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 333] <... bpf resumed>) = 5 [pid 332] <... bpf resumed>) = 5 [pid 331] <... bpf resumed>) = 5 [pid 330] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 329] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 333] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 332] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 331] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 330] <... bpf resumed>) = 5 [pid 329] <... bpf resumed>) = 5 [pid 333] <... bpf resumed>) = 0 [pid 332] <... bpf resumed>) = 0 [pid 331] <... bpf resumed>) = 0 [pid 330] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 329] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 333] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 332] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 331] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 330] <... bpf resumed>) = 0 [pid 329] <... bpf resumed>) = 0 [pid 332] <... bpf resumed>) = 6 [pid 330] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 329] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 333] <... bpf resumed>) = 6 [pid 332] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 331] <... bpf resumed>) = 6 [pid 330] <... bpf resumed>) = 6 [pid 333] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 332] <... bpf resumed>) = 7 [pid 331] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 330] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 329] <... bpf resumed>) = 6 [pid 333] <... bpf resumed>) = 7 [pid 332] exit_group(0 [pid 331] <... bpf resumed>) = 7 [pid 330] <... bpf resumed>) = 7 [pid 329] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 333] exit_group(0 [pid 332] <... exit_group resumed>) = ? [pid 331] exit_group(0 [pid 330] exit_group(0 [pid 329] <... bpf resumed>) = 7 [ 24.286153][ T320] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 24.293965][ T320] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 24.301778][ T320] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 24.309590][ T320] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 24.317405][ T320] [pid 333] <... exit_group resumed>) = ? [pid 330] <... exit_group resumed>) = ? [pid 329] exit_group(0 [pid 330] +++ exited with 0 +++ [pid 329] <... exit_group resumed>) = ? [pid 329] +++ exited with 0 +++ [pid 331] <... exit_group resumed>) = ? [pid 331] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=331, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 334 ./strace-static-x86_64: Process 334 attached [pid 334] set_robust_list(0x555555e33660, 24) = 0 [pid 334] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 334] setpgid(0, 0) = 0 [pid 334] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 334] write(3, "1000", 4) = 4 [pid 334] close(3) = 0 [pid 334] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 332] +++ exited with 0 +++ [pid 334] <... bpf resumed>) = 3 [pid 334] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 334] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 334] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 334] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 334] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 334] exit_group(0) = ? [pid 334] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=334, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 335 ./strace-static-x86_64: Process 335 attached [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=330, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=329, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 335] set_robust_list(0x555555e33660, 24) = 0 [pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 301] <... restart_syscall resumed>) = 0 [pid 300] <... restart_syscall resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 337 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 336 [pid 335] <... prctl resumed>) = 0 [pid 335] setpgid(0, 0) = 0 [pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 335] write(3, "1000", 4) = 4 [pid 335] close(3) = 0 [pid 335] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 ./strace-static-x86_64: Process 336 attached [pid 335] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 336] set_robust_list(0x555555e33660, 24 [pid 335] <... bpf resumed>) = 4 [pid 336] <... set_robust_list resumed>) = 0 [pid 336] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 335] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 336] <... prctl resumed>) = 0 [pid 335] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 336] setpgid(0, 0 [pid 335] <... bpf resumed>) = 0 [pid 335] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 336] <... setpgid resumed>) = 0 [pid 336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 336] write(3, "1000", 4) = 4 [pid 336] close(3) = 0 [pid 336] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 335] <... bpf resumed>) = 6 [pid 335] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 335] exit_group(0) = ? [pid 336] <... bpf resumed>) = 3 [pid 336] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 336] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 336] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 336] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 335] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=335, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 336] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 296] <... restart_syscall resumed>) = 0 [ 24.362936][ C1] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000103, exited with 00000102? [ 24.374771][ T332] BUG: scheduling while atomic: syz-executor115/332/0x00000002 [ 24.382817][ T332] Modules linked in: [ 24.386704][ T332] Preemption disabled at: [ 24.386713][ T332] [] up_write+0x27/0x1f0 [ 24.397348][ T332] CPU: 1 PID: 332 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=332, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 338 [pid 298] <... restart_syscall resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 339 ./strace-static-x86_64: Process 338 attached [pid 338] set_robust_list(0x555555e33660, 24) = 0 [pid 338] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 338] setpgid(0, 0) = 0 [pid 338] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 338] write(3, "1000", 4) = 4 [pid 338] close(3) = 0 [pid 338] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 338] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 337 attached [ 24.408718][ T332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 24.418616][ T332] Call Trace: [ 24.421734][ T332] [ 24.424518][ T332] dump_stack_lvl+0x151/0x1b7 [ 24.429026][ T332] ? up_write+0x27/0x1f0 [ 24.433106][ T332] ? up_write+0x27/0x1f0 [ 24.437184][ T332] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 24.442481][ T332] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 24.448115][ T332] ? up_write+0x27/0x1f0 [ 24.452193][ T332] dump_stack+0x15/0x1b [ 24.456193][ T332] __schedule_bug+0x195/0x260 [ 24.460705][ T332] ? cpu_util_update_eff+0x10e0/0x10e0 [ 24.465997][ T332] __schedule+0xcf7/0x1550 [ 24.470264][ T332] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 24.475543][ T332] ? __sched_text_start+0x8/0x8 [ 24.480444][ T332] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 24.485915][ T332] do_task_dead+0x99/0xa0 [ 24.490074][ T332] do_exit+0x202a/0x2b80 [ 24.494170][ T332] ? put_task_struct+0x80/0x80 [ 24.498841][ T332] ? __kasan_check_write+0x14/0x20 [ 24.503786][ T332] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 24.508731][ T332] ? _raw_spin_lock_irqsave+0x210/0x210 [ 24.514122][ T332] ? zap_other_threads+0x29c/0x2d0 [ 24.519062][ T332] do_group_exit+0x21a/0x2d0 [ 24.523500][ T332] __x64_sys_exit_group+0x3f/0x40 [ 24.528348][ T332] do_syscall_64+0x3d/0xb0 [ 24.532607][ T332] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 24.538333][ T332] RIP: 0033:0x7fec422c2ff9 [ 24.542592][ T332] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 24.549501][ T332] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 337] set_robust_list(0x555555e33660, 24) = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 337] setpgid(0, 0) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 337] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 339 attached [pid 339] set_robust_list(0x555555e33660, 24) = 0 [pid 339] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 339] setpgid(0, 0) = 0 [pid 339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 339] write(3, "1000", 4) = 4 [pid 339] close(3) = 0 [pid 339] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 339] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 336] <... bpf resumed>) = 7 [pid 336] exit_group(0) = ? [pid 339] <... bpf resumed>) = 4 [pid 338] <... bpf resumed>) = 4 [pid 337] <... bpf resumed>) = 4 [pid 336] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=336, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 340 attached [pid 339] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 338] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 337] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 333] +++ exited with 0 +++ [pid 339] <... bpf resumed>) = 5 [pid 338] <... bpf resumed>) = 5 [pid 337] <... bpf resumed>) = 5 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 340 [pid 339] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=333, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 340] set_robust_list(0x555555e33660, 24 [pid 337] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 338] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 339] <... bpf resumed>) = 0 [pid 340] <... set_robust_list resumed>) = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 337] <... bpf resumed>) = 0 [pid 338] <... bpf resumed>) = 0 [pid 339] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 338] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 337] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 340] <... openat resumed>) = 3 [pid 339] <... bpf resumed>) = 6 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 338] <... bpf resumed>) = 6 [pid 337] <... bpf resumed>) = 6 ./strace-static-x86_64: Process 341 attached [pid 339] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 338] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 337] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 341] set_robust_list(0x555555e33660, 24 [pid 340] <... bpf resumed>) = 3 [pid 340] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 341] <... set_robust_list resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 341 [pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 341] setpgid(0, 0) = 0 [pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 341] write(3, "1000", 4) = 4 [pid 341] close(3) = 0 [pid 341] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 341] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 339] <... bpf resumed>) = 7 [pid 340] <... bpf resumed>) = 4 [pid 338] <... bpf resumed>) = 7 [pid 340] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 338] exit_group(0 [pid 337] <... bpf resumed>) = 7 [pid 341] <... bpf resumed>) = 4 [pid 340] <... bpf resumed>) = 5 [pid 339] exit_group(0 [pid 338] <... exit_group resumed>) = ? [pid 341] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 339] <... exit_group resumed>) = ? [ 24.557692][ T332] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 24.565496][ T332] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 24.573309][ T332] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 24.581216][ T332] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 24.589025][ T332] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 24.596848][ T332] [pid 337] exit_group(0 [pid 341] <... bpf resumed>) = 5 [pid 339] +++ exited with 0 +++ [pid 337] <... exit_group resumed>) = ? [pid 341] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 341] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 341] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 340] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 340] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 340] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=339, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 342 ./strace-static-x86_64: Process 342 attached [pid 342] set_robust_list(0x555555e33660, 24) = 0 [pid 342] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 342] setpgid(0, 0) = 0 [pid 342] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 342] write(3, "1000", 4) = 4 [pid 342] close(3) = 0 [pid 342] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 342] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 338] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=338, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 343 ./strace-static-x86_64: Process 343 attached [pid 343] set_robust_list(0x555555e33660, 24) = 0 [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 343] setpgid(0, 0) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 343] write(3, "1000", 4) = 4 [pid 343] close(3) = 0 [pid 343] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 24.635113][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 24.647465][ C1] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000104, exited with 00000103? [ 24.659913][ T338] BUG: scheduling while atomic: syz-executor115/338/0x00000003 [ 24.667351][ T338] Modules linked in: [ 24.671442][ T338] Preemption disabled at: [ 24.671453][ T338] [] free_unref_page+0x177/0x5c0 [ 24.681960][ T338] CPU: 1 PID: 338 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 24.693325][ T338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 24.703340][ T338] Call Trace: [ 24.706431][ T338] [ 24.709208][ T338] dump_stack_lvl+0x151/0x1b7 [ 24.713717][ T338] ? free_unref_page+0x177/0x5c0 [ 24.718489][ T338] ? free_unref_page+0x177/0x5c0 [ 24.723267][ T338] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 24.728563][ T338] ? free_unref_page+0x177/0x5c0 [ 24.733334][ T338] dump_stack+0x15/0x1b [ 24.737328][ T338] __schedule_bug+0x195/0x260 [ 24.741849][ T338] ? cpu_util_update_eff+0x10e0/0x10e0 [ 24.747135][ T338] ? sysvec_irq_work+0x52/0xb0 [ 24.751735][ T338] ? asm_sysvec_irq_work+0x1b/0x20 [ 24.756685][ T338] __schedule+0xcf7/0x1550 [ 24.760935][ T338] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 24.766318][ T338] ? __sched_text_start+0x8/0x8 [ 24.771005][ T338] ? startup_64+0x2/0x60 [ 24.775081][ T338] do_task_dead+0x99/0xa0 [ 24.779253][ T338] do_exit+0x202a/0x2b80 [ 24.783329][ T338] ? put_task_struct+0x80/0x80 [ 24.787926][ T338] ? __kasan_check_write+0x14/0x20 [ 24.792872][ T338] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 24.797825][ T338] ? _raw_spin_lock_irqsave+0x210/0x210 [ 24.803204][ T338] ? zap_other_threads+0x29c/0x2d0 [ 24.808159][ T338] do_group_exit+0x21a/0x2d0 [ 24.812666][ T338] __x64_sys_exit_group+0x3f/0x40 [ 24.817550][ T338] do_syscall_64+0x3d/0xb0 [ 24.821779][ T338] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 24.827502][ T338] RIP: 0033:0x7fec422c2ff9 [ 24.831754][ T338] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 24.838613][ T338] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 24.846859][ T338] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 24.854667][ T338] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 24.862481][ T338] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 24.870498][ T338] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 24.878300][ T338] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [pid 343] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 337] +++ exited with 0 +++ [pid 341] <... bpf resumed>) = 7 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 340] <... bpf resumed>) = 7 [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 343] <... bpf resumed>) = 4 [pid 342] <... bpf resumed>) = 4 [pid 343] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 342] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 341] exit_group(0 [pid 340] exit_group(0 [pid 301] <... restart_syscall resumed>) = 0 [pid 343] <... bpf resumed>) = 5 [pid 343] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 342] <... bpf resumed>) = 5 [pid 341] <... exit_group resumed>) = ? [pid 340] <... exit_group resumed>) = ? [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 342] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 343] <... bpf resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 345 [pid 342] <... bpf resumed>) = 0 [pid 342] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 342] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 343] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 343] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 345 attached [pid 345] set_robust_list(0x555555e33660, 24) = 0 [pid 345] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 345] setpgid(0, 0) = 0 [pid 341] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=341, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 345] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 346 [pid 345] <... openat resumed>) = 3 [pid 345] write(3, "1000", 4) = 4 [pid 345] close(3) = 0 [pid 345] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 345] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x555555e33660, 24) = 0 [pid 346] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 346] setpgid(0, 0) = 0 [pid 346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 346] write(3, "1000", 4) = 4 [pid 346] close(3) = 0 [pid 346] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 24.886119][ T338] [ 24.892849][ C0] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000103, exited with 00000102? [ 24.905009][ T341] BUG: scheduling while atomic: syz-executor115/341/0x00000002 [ 24.912592][ T341] Modules linked in: [ 24.916553][ T341] Preemption disabled at: [ 24.916563][ T341] [] up_write+0x27/0x1f0 [ 24.926409][ T341] CPU: 0 PID: 341 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 24.937742][ T341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 24.947642][ T341] Call Trace: [ 24.950766][ T341] [ 24.953543][ T341] dump_stack_lvl+0x151/0x1b7 [ 24.958064][ T341] ? up_write+0x27/0x1f0 [ 24.962134][ T341] ? up_write+0x27/0x1f0 [ 24.966212][ T341] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 24.971501][ T341] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 24.977152][ T341] ? up_write+0x27/0x1f0 [ 24.981222][ T341] dump_stack+0x15/0x1b [ 24.985216][ T341] __schedule_bug+0x195/0x260 [ 24.989733][ T341] ? cpu_util_update_eff+0x10e0/0x10e0 [ 24.995026][ T341] __schedule+0xcf7/0x1550 [ 24.999276][ T341] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 25.004571][ T341] ? __sched_text_start+0x8/0x8 [ 25.009256][ T341] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 25.014733][ T341] do_task_dead+0x99/0xa0 [ 25.018889][ T341] do_exit+0x202a/0x2b80 [ 25.022972][ T341] ? put_task_struct+0x80/0x80 [ 25.027569][ T341] ? __kasan_check_write+0x14/0x20 [ 25.032520][ T341] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 25.037463][ T341] ? _raw_spin_lock_irqsave+0x210/0x210 [ 25.042861][ T341] ? zap_other_threads+0x29c/0x2d0 [ 25.047807][ T341] do_group_exit+0x21a/0x2d0 [ 25.052226][ T341] __x64_sys_exit_group+0x3f/0x40 [ 25.057083][ T341] do_syscall_64+0x3d/0xb0 [ 25.061352][ T341] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 25.067060][ T341] RIP: 0033:0x7fec422c2ff9 [ 25.071314][ T341] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 25.078174][ T341] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 346] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 342] <... bpf resumed>) = 7 [pid 340] +++ exited with 0 +++ [pid 342] exit_group(0 [pid 343] <... bpf resumed>) = 7 [pid 342] <... exit_group resumed>) = ? [pid 346] <... bpf resumed>) = 4 [pid 345] <... bpf resumed>) = 4 [pid 343] exit_group(0 [pid 342] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 346] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 345] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 343] <... exit_group resumed>) = ? [pid 346] <... bpf resumed>) = 5 [pid 345] <... bpf resumed>) = 5 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=342, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 346] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 346] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 346] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 345] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 345] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 345] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [ 25.086421][ T341] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 25.094323][ T341] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 25.102125][ T341] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 25.110025][ T341] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 25.117834][ T341] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 25.125653][ T341] [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 347 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 348 ./strace-static-x86_64: Process 347 attached [pid 347] set_robust_list(0x555555e33660, 24) = 0 [pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 347] setpgid(0, 0) = 0 [pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 347] write(3, "1000", 4) = 4 [pid 347] close(3 [pid 346] <... bpf resumed>) = 7 [pid 345] <... bpf resumed>) = 7 [pid 346] exit_group(0 [pid 345] exit_group(0 [pid 346] <... exit_group resumed>) = ? [pid 345] <... exit_group resumed>) = ? [pid 343] +++ exited with 0 +++ [pid 346] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=346, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=343, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... restart_syscall resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 349 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 350 [pid 347] <... close resumed>) = 0 [pid 347] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 347] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 348 attached [pid 348] set_robust_list(0x555555e33660, 24) = 0 [pid 348] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 348] setpgid(0, 0) = 0 [pid 348] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 348] write(3, "1000", 4) = 4 [pid 348] close(3) = 0 [pid 348] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 348] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 349 attached [pid 349] set_robust_list(0x555555e33660, 24) = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 349] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 350 attached [pid 350] set_robust_list(0x555555e33660, 24) = 0 [pid 350] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 350] setpgid(0, 0) = 0 [pid 350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 350] write(3, "1000", 4) = 4 [pid 350] close(3) = 0 [pid 350] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 25.133695][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 25.147257][ T343] BUG: scheduling while atomic: syz-executor115/343/0x00000002 [ 25.154984][ T343] Modules linked in: [ 25.159047][ T343] Preemption disabled at: [ 25.159085][ T343] [] is_module_text_address+0x1f/0x360 [ 25.170601][ T343] CPU: 1 PID: 343 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 25.181967][ T343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 25.191862][ T343] Call Trace: [ 25.194987][ T343] [ 25.197763][ T343] dump_stack_lvl+0x151/0x1b7 [ 25.202272][ T343] ? is_module_text_address+0x1f/0x360 [ 25.207573][ T343] ? is_module_text_address+0x1f/0x360 [ 25.212863][ T343] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 25.218160][ T343] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 25.223800][ T343] ? is_module_text_address+0x1f/0x360 [ 25.229098][ T343] dump_stack+0x15/0x1b [ 25.233088][ T343] __schedule_bug+0x195/0x260 [ 25.237613][ T343] ? cpu_util_update_eff+0x10e0/0x10e0 [ 25.242897][ T343] __schedule+0xcf7/0x1550 [ 25.247151][ T343] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 25.252444][ T343] ? __sched_text_start+0x8/0x8 [ 25.257135][ T343] ? asm_exc_page_fault+0x22/0x30 [ 25.261990][ T343] do_task_dead+0x99/0xa0 [ 25.266157][ T343] do_exit+0x202a/0x2b80 [ 25.270263][ T343] ? put_task_struct+0x80/0x80 [ 25.274844][ T343] ? __kasan_check_write+0x14/0x20 [ 25.279796][ T343] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 25.284817][ T343] ? _raw_spin_lock_irqsave+0x210/0x210 [ 25.290194][ T343] ? zap_other_threads+0x29c/0x2d0 [ 25.295150][ T343] do_group_exit+0x21a/0x2d0 [ 25.299572][ T343] __x64_sys_exit_group+0x3f/0x40 [ 25.304440][ T343] do_syscall_64+0x3d/0xb0 [ 25.308685][ T343] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 25.314420][ T343] RIP: 0033:0x7fec422c2ff9 [ 25.318663][ T343] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 25.325528][ T343] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 350] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 345] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=345, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 351 ./strace-static-x86_64: Process 351 attached [pid 351] set_robust_list(0x555555e33660, 24) = 0 [pid 351] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 351] setpgid(0, 0) = 0 [pid 351] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 351] write(3, "1000", 4) = 4 [pid 351] close(3) = 0 [pid 351] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 351] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 348] <... bpf resumed>) = 4 [pid 347] <... bpf resumed>) = 4 [pid 348] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 347] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 350] <... bpf resumed>) = 4 [pid 349] <... bpf resumed>) = 4 [pid 348] <... bpf resumed>) = 5 [pid 347] <... bpf resumed>) = 5 [pid 351] <... bpf resumed>) = 4 [pid 350] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 349] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 348] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 347] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 351] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 350] <... bpf resumed>) = 5 [pid 349] <... bpf resumed>) = 5 [pid 348] <... bpf resumed>) = 0 [pid 347] <... bpf resumed>) = 0 [pid 348] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 347] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 351] <... bpf resumed>) = 5 [pid 350] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 349] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 350] <... bpf resumed>) = 0 [pid 349] <... bpf resumed>) = 0 [pid 348] <... bpf resumed>) = 6 [pid 350] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 349] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 351] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 348] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 347] <... bpf resumed>) = 6 [pid 351] <... bpf resumed>) = 0 [pid 350] <... bpf resumed>) = 6 [pid 348] <... bpf resumed>) = 7 [pid 347] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 351] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 350] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 349] <... bpf resumed>) = 6 [pid 348] exit_group(0 [pid 347] <... bpf resumed>) = 7 [pid 350] <... bpf resumed>) = 7 [pid 349] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 348] <... exit_group resumed>) = ? [pid 350] exit_group(0 [pid 349] <... bpf resumed>) = 7 [ 25.333771][ T343] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 25.341594][ T343] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 25.349397][ T343] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 25.357206][ T343] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 25.365016][ T343] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 25.372836][ T343] [pid 347] exit_group(0 [pid 350] <... exit_group resumed>) = ? [pid 349] exit_group(0 [pid 350] +++ exited with 0 +++ [pid 349] <... exit_group resumed>) = ? [pid 349] +++ exited with 0 +++ [pid 351] <... bpf resumed>) = 6 [pid 351] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 351] exit_group(0) = ? [pid 351] +++ exited with 0 +++ [pid 347] <... exit_group resumed>) = ? [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=351, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=349, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=350, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] <... restart_syscall resumed>) = 0 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 348] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=348, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] <... restart_syscall resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 296] <... restart_syscall resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 352 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 353 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 354 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 355 ./strace-static-x86_64: Process 355 attached [pid 355] set_robust_list(0x555555e33660, 24) = 0 [pid 355] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 355] setpgid(0, 0) = 0 [pid 355] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 353 attached [pid 353] set_robust_list(0x555555e33660, 24 [pid 355] <... openat resumed>) = 3 [pid 353] <... set_robust_list resumed>) = 0 [pid 355] write(3, "1000", 4 [pid 353] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 355] <... write resumed>) = 4 [pid 355] close(3) = 0 [pid 353] <... prctl resumed>) = 0 [pid 355] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 353] setpgid(0, 0) = 0 [pid 353] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 353] write(3, "1000", 4) = 4 [pid 353] close(3) = 0 [pid 353] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 355] <... bpf resumed>) = 3 [pid 353] <... bpf resumed>) = 3 [pid 353] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 355] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 352 attached [pid 352] set_robust_list(0x555555e33660, 24) = 0 [pid 352] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 352] setpgid(0, 0) = 0 [pid 352] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 352] write(3, "1000", 4) = 4 [pid 352] close(3) = 0 [pid 352] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 352] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 354 attached [pid 354] set_robust_list(0x555555e33660, 24) = 0 [pid 354] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 354] setpgid(0, 0) = 0 [pid 354] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 354] write(3, "1000", 4) = 4 [pid 354] close(3) = 0 [pid 354] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 25.402567][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000102, exited with 00000101? [ 25.415955][ T348] BUG: scheduling while atomic: syz-executor115/348/0x00000002 [ 25.423372][ T348] Modules linked in: [ 25.427601][ T348] Preemption disabled at: [ 25.427612][ T348] [] up_write+0x27/0x1f0 [ 25.437976][ T348] CPU: 1 PID: 348 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 25.449579][ T348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 25.459456][ T348] Call Trace: [ 25.462585][ T348] [ 25.465359][ T348] dump_stack_lvl+0x151/0x1b7 [ 25.469866][ T348] ? up_write+0x27/0x1f0 [ 25.473942][ T348] ? up_write+0x27/0x1f0 [ 25.478027][ T348] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 25.483322][ T348] ? up_write+0x27/0x1f0 [ 25.487410][ T348] dump_stack+0x15/0x1b [ 25.491388][ T348] __schedule_bug+0x195/0x260 [ 25.495902][ T348] ? cpu_util_update_eff+0x10e0/0x10e0 [ 25.501293][ T348] ? sysvec_irq_work+0x52/0xb0 [ 25.505893][ T348] ? asm_sysvec_irq_work+0x1b/0x20 [ 25.510847][ T348] __schedule+0xcf7/0x1550 [ 25.515085][ T348] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 25.520385][ T348] ? __sched_text_start+0x8/0x8 [ 25.525077][ T348] ? startup_64+0x2/0x60 [ 25.529144][ T348] do_task_dead+0x99/0xa0 [ 25.533311][ T348] do_exit+0x202a/0x2b80 [ 25.537402][ T348] ? put_task_struct+0x80/0x80 [ 25.541996][ T348] ? __kasan_check_write+0x14/0x20 [ 25.546940][ T348] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 25.551883][ T348] ? _raw_spin_lock_irqsave+0x210/0x210 [ 25.557266][ T348] ? zap_other_threads+0x29c/0x2d0 [ 25.562217][ T348] do_group_exit+0x21a/0x2d0 [ 25.566667][ T348] __x64_sys_exit_group+0x3f/0x40 [ 25.571515][ T348] do_syscall_64+0x3d/0xb0 [ 25.575753][ T348] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 25.581486][ T348] RIP: 0033:0x7fec422c2ff9 [ 25.585737][ T348] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 25.592595][ T348] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 354] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 355] <... bpf resumed>) = 4 [pid 354] <... bpf resumed>) = 4 [pid 353] <... bpf resumed>) = 4 [pid 352] <... bpf resumed>) = 4 [pid 347] +++ exited with 0 +++ [pid 355] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 354] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 353] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 352] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=347, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 355] <... bpf resumed>) = 5 [pid 354] <... bpf resumed>) = 5 [pid 353] <... bpf resumed>) = 5 [pid 352] <... bpf resumed>) = 5 [pid 355] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 354] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 353] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 352] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 355] <... bpf resumed>) = 0 [pid 354] <... bpf resumed>) = 0 [pid 353] <... bpf resumed>) = 0 [pid 352] <... bpf resumed>) = 0 [pid 355] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 354] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 353] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 352] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 355] <... bpf resumed>) = 6 [pid 354] <... bpf resumed>) = 6 [pid 355] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 354] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 353] <... bpf resumed>) = 6 [pid 353] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 352] <... bpf resumed>) = 6 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 352] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 356 attached [pid 356] set_robust_list(0x555555e33660, 24 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 356 [pid 356] <... set_robust_list resumed>) = 0 [pid 356] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 356] setpgid(0, 0) = 0 [pid 356] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 356] write(3, "1000", 4) = 4 [pid 356] close(3) = 0 [pid 356] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 356] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 355] <... bpf resumed>) = 7 [pid 356] <... bpf resumed>) = 4 [pid 355] exit_group(0 [pid 354] <... bpf resumed>) = 7 [pid 353] <... bpf resumed>) = 7 [pid 352] <... bpf resumed>) = 7 [pid 356] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 355] <... exit_group resumed>) = ? [pid 353] exit_group(0 [pid 352] exit_group(0 [pid 356] <... bpf resumed>) = 5 [pid 354] exit_group(0 [pid 355] +++ exited with 0 +++ [pid 354] <... exit_group resumed>) = ? [pid 356] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 353] <... exit_group resumed>) = ? [pid 352] <... exit_group resumed>) = ? [pid 356] <... bpf resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=355, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 356] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 356] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 357 attached , child_tidptr=0x555555e33650) = 357 [pid 357] set_robust_list(0x555555e33660, 24) = 0 [pid 357] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 357] setpgid(0, 0) = 0 [pid 357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 357] write(3, "1000", 4) = 4 [pid 357] close(3) = 0 [pid 357] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 25.601140][ T348] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 25.609088][ T348] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 25.616900][ T348] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 25.624716][ T348] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 25.632536][ T348] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 25.640353][ T348] [pid 357] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 354] +++ exited with 0 +++ [pid 353] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=353, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=354, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 358 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 359 ./strace-static-x86_64: Process 358 attached [pid 358] set_robust_list(0x555555e33660, 24) = 0 [pid 358] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 358] setpgid(0, 0) = 0 [pid 358] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 358] write(3, "1000", 4) = 4 [pid 358] close(3) = 0 [pid 358] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 358] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 359 attached [pid 359] set_robust_list(0x555555e33660, 24) = 0 [pid 359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 359] setpgid(0, 0) = 0 [pid 359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 359] write(3, "1000", 4) = 4 [pid 359] close(3) = 0 [pid 359] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 25.683162][ C1] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000104, exited with 00000103? [ 25.694383][ T24] BUG: workqueue leaked lock or atomic: kworker/1:0/0x00000001/24 [ 25.694383][ T24] last function: bpf_prog_free_deferred [ 25.708326][ T24] CPU: 1 PID: 24 Comm: kworker/1:0 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 25.719270][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 25.729647][ T24] Workqueue: events bpf_prog_free_deferred [ 25.735279][ T24] Call Trace: [ 25.738399][ T24] [ 25.741184][ T24] dump_stack_lvl+0x151/0x1b7 [ 25.745699][ T24] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 25.751075][ T24] ? bpf_prog_free_deferred+0x63e/0x750 [ 25.756456][ T24] dump_stack+0x15/0x1b [ 25.760445][ T24] process_one_work+0x94e/0xcb0 [ 25.765248][ T24] worker_thread+0xa60/0x1260 [ 25.769908][ T24] kthread+0x26d/0x300 [ 25.774069][ T24] ? worker_clr_flags+0x1a0/0x1a0 [ 25.778929][ T24] ? kthread_blkcg+0xd0/0xd0 [ 25.783443][ T24] ret_from_fork+0x1f/0x30 [ 25.787694][ T24] [ 25.790619][ T24] BUG: scheduling while atomic: kworker/1:0/24/0x00000002 [ 25.797926][ T24] Modules linked in: [ 25.801628][ T24] Preemption disabled at: [ 25.801638][ T24] [] free_vmap_area_noflush+0x226/0xa30 [ 25.812762][ T24] CPU: 1 PID: 24 Comm: kworker/1:0 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 25.823675][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 25.833742][ T24] Workqueue: 0x0 (events) [ 25.838080][ T24] Call Trace: [ 25.841205][ T24] [ 25.843985][ T24] dump_stack_lvl+0x151/0x1b7 [ 25.848587][ T24] ? free_vmap_area_noflush+0x226/0xa30 [ 25.853965][ T24] ? free_vmap_area_noflush+0x226/0xa30 [ 25.859350][ T24] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 25.864641][ T24] ? free_vmap_area_noflush+0x226/0xa30 [ 25.870020][ T24] dump_stack+0x15/0x1b [ 25.874010][ T24] __schedule_bug+0x195/0x260 [ 25.878527][ T24] ? cpu_util_update_eff+0x10e0/0x10e0 [pid 359] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 356] <... bpf resumed>) = 7 [pid 357] <... bpf resumed>) = 4 [pid 359] <... bpf resumed>) = 4 [pid 358] <... bpf resumed>) = 4 [pid 357] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 356] exit_group(0 [pid 352] +++ exited with 0 +++ [pid 359] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 358] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 356] <... exit_group resumed>) = ? [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=352, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 357] <... bpf resumed>) = 5 [pid 359] <... bpf resumed>) = 5 [pid 358] <... bpf resumed>) = 5 [pid 357] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 357] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 359] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 358] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 357] <... bpf resumed>) = 6 [pid 356] +++ exited with 0 +++ [pid 357] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 359] <... bpf resumed>) = 0 [pid 358] <... bpf resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=356, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 359] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 358] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 359] <... bpf resumed>) = 6 [pid 358] <... bpf resumed>) = 6 [pid 300] <... restart_syscall resumed>) = 0 [pid 359] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 361 attached [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 361 [pid 358] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 361] set_robust_list(0x555555e33660, 24) = 0 [pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 361] setpgid(0, 0) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 362 [pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 ./strace-static-x86_64: Process 362 attached [pid 361] write(3, "1000", 4) = 4 [pid 361] close(3) = 0 [pid 362] set_robust_list(0x555555e33660, 24 [pid 361] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 362] <... set_robust_list resumed>) = 0 [pid 362] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 362] setpgid(0, 0) = 0 [pid 362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 361] <... bpf resumed>) = 3 [pid 362] <... openat resumed>) = 3 [pid 361] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 362] write(3, "1000", 4) = 4 [pid 362] close(3) = 0 [pid 362] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 362] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 357] <... bpf resumed>) = 7 [pid 359] <... bpf resumed>) = 7 [pid 358] <... bpf resumed>) = 7 [pid 357] exit_group(0) = ? [pid 361] <... bpf resumed>) = 4 [pid 359] exit_group(0 [pid 358] exit_group(0 [pid 359] <... exit_group resumed>) = ? [pid 358] <... exit_group resumed>) = ? [pid 361] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 361] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 361] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 361] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 362] <... bpf resumed>) = 4 [pid 357] +++ exited with 0 +++ [pid 362] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 358] +++ exited with 0 +++ [pid 362] <... bpf resumed>) = 5 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=357, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=358, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 362] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 362] <... bpf resumed>) = 0 [ 25.883825][ T24] __schedule+0xcf7/0x1550 [ 25.888076][ T24] ? __sched_text_start+0x8/0x8 [ 25.892759][ T24] ? wq_worker_sleeping+0x64/0x290 [ 25.897708][ T24] schedule+0xc3/0x180 [ 25.901615][ T24] worker_thread+0xefa/0x1260 [ 25.906135][ T24] kthread+0x26d/0x300 [ 25.910035][ T24] ? worker_clr_flags+0x1a0/0x1a0 [ 25.914978][ T24] ? kthread_blkcg+0xd0/0xd0 [ 25.919403][ T24] ret_from_fork+0x1f/0x30 [ 25.923662][ T24] [pid 362] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 362] <... bpf resumed>) = 6 [pid 362] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 363 attached [pid 363] set_robust_list(0x555555e33660, 24) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 363 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 364 [pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 363] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x555555e33660, 24 [pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 364] <... set_robust_list resumed>) = 0 [pid 363] <... openat resumed>) = 3 [pid 364] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 363] write(3, "1000", 4 [pid 364] <... prctl resumed>) = 0 [pid 364] setpgid(0, 0) = 0 [pid 364] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 363] <... write resumed>) = 4 [pid 364] write(3, "1000", 4 [pid 363] close(3 [pid 364] <... write resumed>) = 4 [pid 363] <... close resumed>) = 0 [pid 364] close(3) = 0 [pid 364] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 363] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 364] <... bpf resumed>) = 3 [pid 363] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 364] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 362] <... bpf resumed>) = 7 [pid 361] <... bpf resumed>) = 7 [pid 359] +++ exited with 0 +++ [pid 363] <... bpf resumed>) = 4 [pid 362] exit_group(0) = ? [pid 361] exit_group(0 [pid 364] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 363] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 361] <... exit_group resumed>) = ? [pid 364] <... bpf resumed>) = 5 [pid 364] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=359, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 364] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 363] <... bpf resumed>) = 5 [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 363] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 363] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 364] <... bpf resumed>) = 6 [pid 364] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 363] <... bpf resumed>) = 6 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 365 [pid 363] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 365 attached [pid 365] set_robust_list(0x555555e33660, 24) = 0 [pid 365] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 365] setpgid(0, 0) = 0 [pid 365] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 365] write(3, "1000", 4) = 4 [pid 365] close(3) = 0 [pid 365] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 365] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 362] +++ exited with 0 +++ [pid 361] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=361, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=362, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 366 attached ./strace-static-x86_64: Process 367 attached [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 366 [pid 367] set_robust_list(0x555555e33660, 24 [pid 366] set_robust_list(0x555555e33660, 24 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 367 [pid 367] <... set_robust_list resumed>) = 0 [pid 366] <... set_robust_list resumed>) = 0 [pid 367] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 367] setpgid(0, 0) = 0 [pid 367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 367] write(3, "1000", 4) = 4 [pid 367] close(3) = 0 [pid 366] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 367] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 366] setpgid(0, 0) = 0 [pid 366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 367] <... bpf resumed>) = 3 [pid 365] <... bpf resumed>) = 4 [pid 364] <... bpf resumed>) = 7 [pid 363] <... bpf resumed>) = 7 [pid 365] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 364] exit_group(0 [pid 363] exit_group(0 [pid 365] <... bpf resumed>) = 5 [pid 364] <... exit_group resumed>) = ? [pid 363] <... exit_group resumed>) = ? [pid 367] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 366] write(3, "1000", 4 [pid 365] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 366] <... write resumed>) = 4 [pid 365] <... bpf resumed>) = 0 [pid 366] close(3 [pid 365] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 366] <... close resumed>) = 0 [pid 366] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 365] <... bpf resumed>) = 6 [pid 365] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 366] <... bpf resumed>) = 3 [pid 366] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 364] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=364, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 368 attached , child_tidptr=0x555555e33650) = 368 [pid 368] set_robust_list(0x555555e33660, 24) = 0 [pid 368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 368] setpgid(0, 0) = 0 [pid 368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 368] write(3, "1000", 4) = 4 [pid 368] close(3) = 0 [pid 368] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 368] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 367] <... bpf resumed>) = 4 [pid 363] +++ exited with 0 +++ [pid 365] <... bpf resumed>) = 7 [pid 366] <... bpf resumed>) = 4 [pid 368] <... bpf resumed>) = 4 [ 26.063663][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 26.075150][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 26.082404][ T292] Modules linked in: [ 26.086310][ T292] Preemption disabled at: [ 26.086318][ T292] [] is_module_text_address+0x1f/0x360 [ 26.097363][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 26.108717][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 26.118722][ T292] Call Trace: [ 26.121846][ T292] [ 26.124710][ T292] dump_stack_lvl+0x151/0x1b7 [ 26.129222][ T292] ? is_module_text_address+0x1f/0x360 [ 26.134515][ T292] ? is_module_text_address+0x1f/0x360 [ 26.139813][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 26.145107][ T292] ? is_module_text_address+0x1f/0x360 [ 26.150399][ T292] dump_stack+0x15/0x1b [ 26.154393][ T292] __schedule_bug+0x195/0x260 [ 26.158908][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 26.164198][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 26.169759][ T292] __schedule+0xcf7/0x1550 [ 26.174010][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 26.179910][ T292] ? ____fput+0x15/0x20 [ 26.184252][ T292] ? __sched_text_start+0x8/0x8 [ 26.188934][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 26.194404][ T292] ? unlock_page_memcg+0x160/0x160 [ 26.199352][ T292] schedule+0xc3/0x180 [ 26.203259][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 26.208398][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 26.213693][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 26.219072][ T292] do_syscall_64+0x49/0xb0 [ 26.223327][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 26.229051][ T292] RIP: 0033:0x4e65f7 [ 26.232786][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 26.252230][ T292] RSP: 002b:00007fff6da4d208 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [pid 367] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 366] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 365] exit_group(0 [pid 368] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 367] <... bpf resumed>) = 5 [pid 365] <... exit_group resumed>) = ? [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 367] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 366] <... bpf resumed>) = 5 [pid 365] +++ exited with 0 +++ [pid 367] <... bpf resumed>) = 0 [pid 366] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=365, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 368] <... bpf resumed>) = 5 [pid 367] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 298] <... restart_syscall resumed>) = 0 [pid 368] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 366] <... bpf resumed>) = 0 [pid 367] <... bpf resumed>) = 6 [pid 368] <... bpf resumed>) = 0 [pid 367] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 366] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 369 attached ./strace-static-x86_64: Process 370 attached [pid 368] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 366] <... bpf resumed>) = 6 [pid 370] set_robust_list(0x555555e33660, 24 [pid 369] set_robust_list(0x555555e33660, 24 [pid 368] <... bpf resumed>) = 6 [pid 366] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 370 [pid 368] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 369] <... set_robust_list resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 369 [pid 370] <... set_robust_list resumed>) = 0 [pid 369] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 370] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 369] <... prctl resumed>) = 0 [pid 369] setpgid(0, 0) = 0 [pid 369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 369] write(3, "1000", 4 [pid 370] <... prctl resumed>) = 0 [pid 369] <... write resumed>) = 4 [pid 369] close(3) = 0 [pid 370] setpgid(0, 0 [pid 369] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 370] <... setpgid resumed>) = 0 [pid 370] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 369] <... bpf resumed>) = 3 [pid 369] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 370] write(3, "1000", 4) = 4 [pid 370] close(3) = 0 [pid 370] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 370] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 367] <... bpf resumed>) = 7 [pid 368] <... bpf resumed>) = 7 [pid 366] <... bpf resumed>) = 7 [pid 367] exit_group(0 [pid 366] exit_group(0 [pid 369] <... bpf resumed>) = 4 [pid 368] exit_group(0 [pid 367] <... exit_group resumed>) = ? [pid 366] <... exit_group resumed>) = ? [pid 370] <... bpf resumed>) = 4 [pid 369] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 368] <... exit_group resumed>) = ? [pid 370] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 367] +++ exited with 0 +++ [pid 370] <... bpf resumed>) = 5 [pid 370] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=367, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 370] <... bpf resumed>) = 0 [pid 369] <... bpf resumed>) = 5 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 369] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 369] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144./strace-static-x86_64: Process 371 attached [pid 370] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 369] <... bpf resumed>) = 6 [pid 371] set_robust_list(0x555555e33660, 24 [pid 369] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 371 [pid 371] <... set_robust_list resumed>) = 0 [pid 370] <... bpf resumed>) = 6 [pid 370] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 371] setpgid(0, 0) = 0 [pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 371] write(3, "1000", 4) = 4 [pid 371] close(3) = 0 [pid 371] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 371] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 368] +++ exited with 0 +++ [pid 366] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=368, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=366, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 26.260474][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 26.268283][ T292] RDX: 00007fff6da4d210 RSI: 0000000000008910 RDI: 0000000000000003 [ 26.276095][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000c [ 26.283905][ T292] R10: 0000000000554612 R11: 0000000000000286 R12: 00007fff6da4d270 [ 26.291808][ T292] R13: 00007fff6da4d210 R14: 0000000000423160 R15: 0000000000617180 [ 26.299646][ T292] [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 372 attached [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 372 [pid 372] set_robust_list(0x555555e33660, 24) = 0 ./strace-static-x86_64: Process 373 attached [pid 372] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 373 [pid 372] <... prctl resumed>) = 0 [pid 373] set_robust_list(0x555555e33660, 24 [pid 372] setpgid(0, 0) = 0 [pid 373] <... set_robust_list resumed>) = 0 [pid 372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 373] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 372] <... openat resumed>) = 3 [pid 372] write(3, "1000", 4) = 4 [pid 373] <... prctl resumed>) = 0 [pid 372] close(3) = 0 [pid 373] setpgid(0, 0 [pid 372] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 373] <... setpgid resumed>) = 0 [pid 373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 373] write(3, "1000", 4) = 4 [pid 373] close(3) = 0 [pid 373] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 372] <... bpf resumed>) = 3 [pid 372] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 373] <... bpf resumed>) = 3 [pid 373] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 369] <... bpf resumed>) = 7 [pid 373] <... bpf resumed>) = 4 [pid 372] <... bpf resumed>) = 4 [pid 371] <... bpf resumed>) = 4 [pid 370] <... bpf resumed>) = 7 [pid 373] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 372] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 371] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 373] <... bpf resumed>) = 5 [pid 372] <... bpf resumed>) = 5 [pid 371] <... bpf resumed>) = 5 [pid 370] exit_group(0 [pid 369] exit_group(0 [pid 372] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 371] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 372] <... bpf resumed>) = 0 [pid 371] <... bpf resumed>) = 0 [pid 372] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 371] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 373] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 370] <... exit_group resumed>) = ? [pid 369] <... exit_group resumed>) = ? [pid 373] <... bpf resumed>) = 0 [pid 372] <... bpf resumed>) = 6 [pid 371] <... bpf resumed>) = 6 [pid 372] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 371] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 372] <... bpf resumed>) = 7 [pid 371] <... bpf resumed>) = 7 [pid 372] exit_group(0 [pid 371] exit_group(0 [pid 372] <... exit_group resumed>) = ? [pid 371] <... exit_group resumed>) = ? [pid 373] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 372] +++ exited with 0 +++ [pid 370] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=372, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=370, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 374 attached [pid 373] <... bpf resumed>) = 6 [pid 296] <... restart_syscall resumed>) = 0 [pid 374] set_robust_list(0x555555e33660, 24 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 374 [pid 374] <... set_robust_list resumed>) = 0 [pid 373] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 369] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=369, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 375 ./strace-static-x86_64: Process 375 attached [pid 374] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 375] set_robust_list(0x555555e33660, 24) = 0 [pid 374] <... prctl resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 374] setpgid(0, 0 [pid 375] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 376 [pid 375] <... prctl resumed>) = 0 [pid 374] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 376 attached [pid 376] set_robust_list(0x555555e33660, 24) = 0 [pid 374] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 376] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 376] setpgid(0, 0) = 0 [pid 376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 376] write(3, "1000", 4) = 4 [pid 376] close(3) = 0 [pid 376] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 374] <... openat resumed>) = 3 [pid 375] setpgid(0, 0 [pid 374] write(3, "1000", 4 [pid 375] <... setpgid resumed>) = 0 [pid 374] <... write resumed>) = 4 [pid 374] close(3) = 0 [pid 375] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 374] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 375] <... openat resumed>) = 3 [pid 375] write(3, "1000", 4) = 4 [pid 375] close(3) = 0 [pid 376] <... bpf resumed>) = 3 [pid 375] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 376] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 374] <... bpf resumed>) = 3 [pid 374] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 375] <... bpf resumed>) = 3 [pid 375] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 371] +++ exited with 0 +++ [pid 376] <... bpf resumed>) = 4 [pid 373] <... bpf resumed>) = 7 [pid 376] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 375] <... bpf resumed>) = 4 [pid 374] <... bpf resumed>) = 4 [pid 373] exit_group(0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 376] <... bpf resumed>) = 5 [pid 373] <... exit_group resumed>) = ? [pid 374] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 375] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 374] <... bpf resumed>) = 5 [pid 375] <... bpf resumed>) = 5 [pid 374] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 375] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 374] <... bpf resumed>) = 0 [pid 375] <... bpf resumed>) = 0 [pid 374] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 375] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 374] <... bpf resumed>) = 6 [pid 375] <... bpf resumed>) = 6 [pid 374] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 375] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 374] <... bpf resumed>) = 7 [pid 375] <... bpf resumed>) = 7 [pid 373] +++ exited with 0 +++ [pid 375] exit_group(0) = ? [pid 375] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=375, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 377 [pid 374] exit_group(0) = ? [pid 374] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=374, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 376] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 297] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 378 [pid 376] <... bpf resumed>) = 0 [pid 376] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 376] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 376] exit_group(0) = ? [ 26.415966][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 26.428985][ T373] BUG: scheduling while atomic: syz-executor115/373/0x00000002 [ 26.436425][ T373] Modules linked in: [ 26.440770][ T373] Preemption disabled at: [ 26.440780][ T373] [] is_module_text_address+0x1f/0x360 [ 26.452260][ T373] CPU: 1 PID: 373 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 26.463627][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 26.473523][ T373] Call Trace: [ 26.476644][ T373] [ 26.479420][ T373] dump_stack_lvl+0x151/0x1b7 [ 26.483931][ T373] ? is_module_text_address+0x1f/0x360 [ 26.489230][ T373] ? is_module_text_address+0x1f/0x360 [ 26.494521][ T373] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 26.499815][ T373] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 26.505459][ T373] ? is_module_text_address+0x1f/0x360 [ 26.510752][ T373] dump_stack+0x15/0x1b [ 26.514744][ T373] __schedule_bug+0x195/0x260 [ 26.519261][ T373] ? cpu_util_update_eff+0x10e0/0x10e0 [ 26.524553][ T373] __schedule+0xcf7/0x1550 [ 26.528813][ T373] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 26.534108][ T373] ? __sched_text_start+0x8/0x8 [ 26.538840][ T373] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 26.544364][ T373] do_task_dead+0x99/0xa0 [ 26.548506][ T373] do_exit+0x202a/0x2b80 [ 26.552599][ T373] ? put_task_struct+0x80/0x80 [ 26.557188][ T373] ? __kasan_check_write+0x14/0x20 [ 26.562133][ T373] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 26.567078][ T373] ? _raw_spin_lock_irqsave+0x210/0x210 [ 26.572463][ T373] ? zap_other_threads+0x29c/0x2d0 [ 26.577411][ T373] do_group_exit+0x21a/0x2d0 [ 26.581842][ T373] __x64_sys_exit_group+0x3f/0x40 [ 26.586695][ T373] do_syscall_64+0x3d/0xb0 [ 26.590947][ T373] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 26.596685][ T373] RIP: 0033:0x7fec422c2ff9 [ 26.600935][ T373] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 26.607784][ T373] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 ./strace-static-x86_64: Process 378 attached [pid 378] set_robust_list(0x555555e33660, 24) = 0 [pid 378] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 378] setpgid(0, 0) = 0 [pid 378] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=373, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 378] <... openat resumed>) = 3 [pid 378] write(3, "1000", 4) = 4 [pid 378] close(3) = 0 [pid 378] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 379 ./strace-static-x86_64: Process 377 attached [pid 377] set_robust_list(0x555555e33660, 24) = 0 [pid 377] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 377] <... prctl resumed>) = 0 [pid 377] setpgid(0, 0) = 0 [pid 377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 380 ./strace-static-x86_64: Process 380 attached ./strace-static-x86_64: Process 379 attached [pid 380] set_robust_list(0x555555e33660, 24 [pid 379] set_robust_list(0x555555e33660, 24 [pid 380] <... set_robust_list resumed>) = 0 [pid 377] <... openat resumed>) = 3 [pid 380] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 379] <... set_robust_list resumed>) = 0 [pid 377] write(3, "1000", 4 [pid 379] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 380] <... prctl resumed>) = 0 [pid 377] <... write resumed>) = 4 [pid 380] setpgid(0, 0 [pid 379] <... prctl resumed>) = 0 [pid 380] <... setpgid resumed>) = 0 [pid 377] close(3) = 0 [pid 379] setpgid(0, 0 [pid 380] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 377] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 379] <... setpgid resumed>) = 0 [pid 380] <... openat resumed>) = 3 [pid 379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 380] write(3, "1000", 4 [pid 379] write(3, "1000", 4 [pid 380] <... write resumed>) = 4 [pid 379] <... write resumed>) = 4 [pid 380] close(3 [pid 379] close(3 [pid 380] <... close resumed>) = 0 [pid 379] <... close resumed>) = 0 [pid 380] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 379] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 380] <... bpf resumed>) = 3 [pid 380] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 379] <... bpf resumed>) = 3 [pid 379] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 378] <... bpf resumed>) = 3 [pid 378] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 377] <... bpf resumed>) = 3 [pid 377] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 376] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=376, si_uid=0, si_status=0, si_utime=0, si_stime=19} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 381 attached , child_tidptr=0x555555e33650) = 381 [pid 381] set_robust_list(0x555555e33660, 24) = 0 [pid 381] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 381] setpgid(0, 0) = 0 [pid 381] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 381] write(3, "1000", 4) = 4 [pid 381] close(3) = 0 [pid 381] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 26.616030][ T373] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 26.623845][ T373] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 26.631652][ T373] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 26.639552][ T373] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 26.647364][ T373] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 26.655186][ T373] [pid 381] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 380] <... bpf resumed>) = 4 [pid 380] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 379] <... bpf resumed>) = 4 [pid 381] <... bpf resumed>) = 4 [pid 380] <... bpf resumed>) = 5 [pid 379] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 378] <... bpf resumed>) = 4 [pid 377] <... bpf resumed>) = 4 [pid 380] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 379] <... bpf resumed>) = 5 [pid 377] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 381] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 380] <... bpf resumed>) = 0 [pid 379] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 378] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 377] <... bpf resumed>) = 5 [pid 381] <... bpf resumed>) = 5 [pid 380] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 379] <... bpf resumed>) = 0 [pid 378] <... bpf resumed>) = 5 [pid 381] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 377] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 381] <... bpf resumed>) = 0 [pid 380] <... bpf resumed>) = 6 [pid 379] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 378] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 377] <... bpf resumed>) = 0 [pid 381] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 380] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 378] <... bpf resumed>) = 0 [pid 377] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 381] <... bpf resumed>) = 6 [pid 380] <... bpf resumed>) = 7 [pid 379] <... bpf resumed>) = 6 [pid 378] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 377] <... bpf resumed>) = 6 [pid 381] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 380] exit_group(0 [pid 379] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 377] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 380] <... exit_group resumed>) = ? [pid 379] <... bpf resumed>) = 7 [pid 377] <... bpf resumed>) = 7 [pid 379] exit_group(0) = ? [pid 380] +++ exited with 0 +++ [pid 378] <... bpf resumed>) = 6 [pid 377] exit_group(0 [pid 378] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 377] <... exit_group resumed>) = ? [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=380, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 382 attached , child_tidptr=0x555555e33650) = 382 [pid 382] set_robust_list(0x555555e33660, 24) = 0 [pid 382] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 382] setpgid(0, 0) = 0 [pid 382] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 382] write(3, "1000", 4) = 4 [pid 382] close(3) = 0 [pid 382] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 382] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 381] <... bpf resumed>) = 7 [pid 381] exit_group(0) = ? [pid 379] +++ exited with 0 +++ [pid 378] <... bpf resumed>) = 7 [pid 377] +++ exited with 0 +++ [pid 382] <... bpf resumed>) = 4 [pid 378] exit_group(0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=377, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=379, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 382] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 378] <... exit_group resumed>) = ? [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 382] <... bpf resumed>) = 5 [pid 300] <... restart_syscall resumed>) = 0 [pid 382] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 382] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 383 attached [pid 382] <... bpf resumed>) = 6 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 383 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 383] set_robust_list(0x555555e33660, 24 [pid 382] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 384 attached [pid 383] <... set_robust_list resumed>) = 0 [pid 383] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 384 [pid 383] setpgid(0, 0) = 0 [pid 383] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 383] write(3, "1000", 4) = 4 [pid 383] close(3) = 0 [pid 383] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 384] set_robust_list(0x555555e33660, 24) = 0 [pid 384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 383] <... bpf resumed>) = 3 [pid 384] setpgid(0, 0 [pid 383] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 384] <... setpgid resumed>) = 0 [pid 384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 384] write(3, "1000", 4) = 4 [pid 384] close(3) = 0 [pid 384] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 384] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 381] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=381, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 385 ./strace-static-x86_64: Process 385 attached [pid 385] set_robust_list(0x555555e33660, 24) = 0 [pid 385] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 385] setpgid(0, 0) = 0 [pid 385] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 385] write(3, "1000", 4) = 4 [pid 385] close(3) = 0 [pid 385] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 385] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 378] +++ exited with 0 +++ [pid 385] <... bpf resumed>) = 4 [pid 384] <... bpf resumed>) = 4 [pid 383] <... bpf resumed>) = 4 [pid 382] <... bpf resumed>) = 7 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=378, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 385] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 384] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [ 26.774761][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 26.786186][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 26.794273][ T292] Modules linked in: [ 26.797979][ T292] Preemption disabled at: [ 26.797987][ T292] [] __dentry_kill+0x4c3/0x650 [ 26.808343][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 26.819680][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 26.829573][ T292] Call Trace: [ 26.832702][ T292] [ 26.835474][ T292] dump_stack_lvl+0x151/0x1b7 [ 26.839988][ T292] ? __dentry_kill+0x4c3/0x650 [ 26.844582][ T292] ? __dentry_kill+0x4c3/0x650 [ 26.849183][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 26.854481][ T292] ? __dentry_kill+0x4c3/0x650 [ 26.859078][ T292] dump_stack+0x15/0x1b [ 26.863070][ T292] __schedule_bug+0x195/0x260 [ 26.867592][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 26.872879][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 26.878439][ T292] __schedule+0xcf7/0x1550 [ 26.882693][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 26.888588][ T292] ? ____fput+0x15/0x20 [ 26.892581][ T292] ? __sched_text_start+0x8/0x8 [ 26.897284][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 26.902740][ T292] ? unlock_page_memcg+0x160/0x160 [ 26.907685][ T292] schedule+0xc3/0x180 [ 26.911589][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 26.916624][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 26.921927][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 26.927308][ T292] do_syscall_64+0x49/0xb0 [ 26.931553][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 26.937279][ T292] RIP: 0033:0x4e65f7 [ 26.941014][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 26.960459][ T292] RSP: 002b:00007fff6da4d208 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [pid 383] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 382] exit_group(0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 385] <... bpf resumed>) = 5 [pid 384] <... bpf resumed>) = 5 [pid 382] <... exit_group resumed>) = ? [pid 384] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 383] <... bpf resumed>) = 5 [pid 382] +++ exited with 0 +++ [pid 297] <... restart_syscall resumed>) = 0 [pid 383] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 384] <... bpf resumed>) = 0 [pid 383] <... bpf resumed>) = 0 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=382, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 385] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 384] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 383] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 385] <... bpf resumed>) = 0 [pid 384] <... bpf resumed>) = 6 [pid 385] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 384] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 383] <... bpf resumed>) = 6 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 387 attached [pid 383] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 387 ./strace-static-x86_64: Process 388 attached [pid 387] set_robust_list(0x555555e33660, 24 [pid 385] <... bpf resumed>) = 6 [pid 387] <... set_robust_list resumed>) = 0 [pid 385] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 388 [pid 387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 387] setpgid(0, 0) = 0 [pid 387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 387] write(3, "1000", 4) = 4 [pid 387] close(3) = 0 [pid 387] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 388] set_robust_list(0x555555e33660, 24) = 0 [pid 388] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 387] <... bpf resumed>) = 3 [pid 388] <... prctl resumed>) = 0 [pid 388] setpgid(0, 0) = 0 [pid 387] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 388] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 388] write(3, "1000", 4) = 4 [pid 388] close(3) = 0 [pid 388] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 388] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 384] <... bpf resumed>) = 7 [pid 385] <... bpf resumed>) = 7 [pid 383] <... bpf resumed>) = 7 [pid 388] <... bpf resumed>) = 4 [pid 384] exit_group(0 [pid 383] exit_group(0 [pid 385] exit_group(0 [pid 388] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 387] <... bpf resumed>) = 4 [pid 384] <... exit_group resumed>) = ? [pid 385] <... exit_group resumed>) = ? [pid 383] <... exit_group resumed>) = ? [pid 388] <... bpf resumed>) = 5 [pid 388] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 388] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 388] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 387] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 387] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 387] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 387] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 385] +++ exited with 0 +++ [pid 383] +++ exited with 0 +++ [pid 384] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=383, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=384, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=385, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... restart_syscall resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 390 attached ./strace-static-x86_64: Process 389 attached [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 390 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 389 [ 26.968926][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 26.976726][ T292] RDX: 00007fff6da4d210 RSI: 0000000000008910 RDI: 0000000000000003 [ 26.984537][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000c [ 26.992348][ T292] R10: 0000000000554612 R11: 0000000000000286 R12: 00007fff6da4d270 [ 27.000286][ T292] R13: 00007fff6da4d210 R14: 0000000000423160 R15: 0000000000617180 [ 27.008179][ T292] [pid 389] set_robust_list(0x555555e33660, 24 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 391 [pid 390] set_robust_list(0x555555e33660, 24) = 0 ./strace-static-x86_64: Process 391 attached [pid 389] <... set_robust_list resumed>) = 0 [pid 390] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 389] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 390] <... prctl resumed>) = 0 [pid 390] setpgid(0, 0 [pid 389] setpgid(0, 0 [pid 390] <... setpgid resumed>) = 0 [pid 389] <... setpgid resumed>) = 0 [pid 389] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 391] set_robust_list(0x555555e33660, 24 [pid 390] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 389] <... openat resumed>) = 3 [pid 389] write(3, "1000", 4) = 4 [pid 389] close(3 [pid 391] <... set_robust_list resumed>) = 0 [pid 390] <... openat resumed>) = 3 [pid 390] write(3, "1000", 4) = 4 [pid 389] <... close resumed>) = 0 [pid 391] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 390] close(3 [pid 391] <... prctl resumed>) = 0 [pid 390] <... close resumed>) = 0 [pid 389] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 391] setpgid(0, 0 [pid 390] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 391] <... setpgid resumed>) = 0 [pid 391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 390] <... bpf resumed>) = 3 [pid 389] <... bpf resumed>) = 3 [pid 391] write(3, "1000", 4 [pid 390] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 389] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 391] <... write resumed>) = 4 [pid 391] close(3) = 0 [pid 391] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 391] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 388] <... bpf resumed>) = 7 [pid 387] <... bpf resumed>) = 7 [pid 391] <... bpf resumed>) = 4 [pid 390] <... bpf resumed>) = 4 [pid 389] <... bpf resumed>) = 4 [pid 388] exit_group(0 [pid 387] exit_group(0 [pid 391] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 390] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 389] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 388] <... exit_group resumed>) = ? [pid 387] <... exit_group resumed>) = ? [pid 391] <... bpf resumed>) = 5 [pid 390] <... bpf resumed>) = 5 [pid 389] <... bpf resumed>) = 5 [pid 391] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 390] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 389] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 391] <... bpf resumed>) = 0 [pid 390] <... bpf resumed>) = 0 [pid 389] <... bpf resumed>) = 0 [pid 391] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 390] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 389] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 391] <... bpf resumed>) = 6 [pid 390] <... bpf resumed>) = 6 [pid 389] <... bpf resumed>) = 6 [pid 391] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 390] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 389] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 388] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=388, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 392 attached , child_tidptr=0x555555e33650) = 392 [pid 392] set_robust_list(0x555555e33660, 24) = 0 [pid 392] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 392] setpgid(0, 0) = 0 [pid 392] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 392] write(3, "1000", 4) = 4 [pid 392] close(3) = 0 [pid 392] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 392] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 390] <... bpf resumed>) = 7 [pid 391] <... bpf resumed>) = 7 [pid 389] <... bpf resumed>) = 7 [pid 392] <... bpf resumed>) = 4 [pid 392] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 391] exit_group(0 [pid 390] exit_group(0 [pid 389] exit_group(0 [pid 387] +++ exited with 0 +++ [pid 392] <... bpf resumed>) = 5 [pid 391] <... exit_group resumed>) = ? [pid 390] <... exit_group resumed>) = ? [pid 389] <... exit_group resumed>) = ? [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=387, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 392] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 391] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=391, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 392] <... bpf resumed>) = 0 [pid 392] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 392] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 393 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 394 ./strace-static-x86_64: Process 393 attached ./strace-static-x86_64: Process 394 attached [pid 394] set_robust_list(0x555555e33660, 24) = 0 [pid 394] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 394] setpgid(0, 0) = 0 [pid 394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 393] set_robust_list(0x555555e33660, 24) = 0 [pid 394] <... openat resumed>) = 3 [pid 394] write(3, "1000", 4 [pid 393] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 394] <... write resumed>) = 4 [pid 393] <... prctl resumed>) = 0 [pid 394] close(3) = 0 [pid 394] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 393] setpgid(0, 0) = 0 [pid 393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 393] write(3, "1000", 4) = 4 [pid 393] close(3 [pid 394] <... bpf resumed>) = 3 [pid 393] <... close resumed>) = 0 [pid 394] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 393] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 393] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 390] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=390, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 395 attached , child_tidptr=0x555555e33650) = 395 [pid 395] set_robust_list(0x555555e33660, 24) = 0 [pid 395] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 395] setpgid(0, 0) = 0 [pid 395] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 395] write(3, "1000", 4) = 4 [pid 395] close(3) = 0 [pid 395] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 395] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 392] <... bpf resumed>) = 7 [pid 389] +++ exited with 0 +++ [pid 394] <... bpf resumed>) = 4 [pid 393] <... bpf resumed>) = 4 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=389, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 394] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 393] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 394] <... bpf resumed>) = 5 [pid 393] <... bpf resumed>) = 5 [pid 394] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 393] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 396 attached [pid 395] <... bpf resumed>) = 4 [pid 394] <... bpf resumed>) = 0 [pid 393] <... bpf resumed>) = 0 [pid 392] exit_group(0 [pid 396] set_robust_list(0x555555e33660, 24 [pid 394] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 393] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 396 [pid 396] <... set_robust_list resumed>) = 0 [pid 395] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 394] <... bpf resumed>) = 6 [pid 392] <... exit_group resumed>) = ? [pid 393] <... bpf resumed>) = 6 [pid 396] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 395] <... bpf resumed>) = 5 [pid 394] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 393] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 396] <... prctl resumed>) = 0 [pid 394] <... bpf resumed>) = 7 [pid 393] <... bpf resumed>) = 7 [pid 396] setpgid(0, 0 [pid 394] exit_group(0 [pid 393] exit_group(0 [pid 396] <... setpgid resumed>) = 0 [pid 394] <... exit_group resumed>) = ? [pid 393] <... exit_group resumed>) = ? [pid 396] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 395] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 392] +++ exited with 0 +++ [pid 396] <... openat resumed>) = 3 [pid 395] <... bpf resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=392, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 396] write(3, "1000", 4) = 4 [pid 395] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 396] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 396] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46./strace-static-x86_64: Process 397 attached [pid 395] <... bpf resumed>) = 6 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 397 [pid 397] set_robust_list(0x555555e33660, 24 [pid 396] <... bpf resumed>) = 3 [pid 395] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 396] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 397] <... set_robust_list resumed>) = 0 [pid 397] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 397] setpgid(0, 0) = 0 [pid 397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 397] write(3, "1000", 4) = 4 [pid 397] close(3) = 0 [pid 397] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 397] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 394] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=394, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 398 ./strace-static-x86_64: Process 398 attached [pid 398] set_robust_list(0x555555e33660, 24) = 0 [pid 398] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 398] setpgid(0, 0) = 0 [pid 398] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 398] write(3, "1000", 4) = 4 [pid 398] close(3) = 0 [pid 398] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 398] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 393] +++ exited with 0 +++ [pid 396] <... bpf resumed>) = 4 [pid 396] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=393, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 398] <... bpf resumed>) = 4 [pid 397] <... bpf resumed>) = 4 [pid 396] <... bpf resumed>) = 5 [pid 395] <... bpf resumed>) = 7 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 398] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 397] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 396] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 395] exit_group(0./strace-static-x86_64: Process 399 attached [pid 398] <... bpf resumed>) = 5 [pid 397] <... bpf resumed>) = 5 [pid 396] <... bpf resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 399 [pid 398] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 397] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 396] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 399] set_robust_list(0x555555e33660, 24 [pid 398] <... bpf resumed>) = 0 [pid 397] <... bpf resumed>) = 0 [pid 395] <... exit_group resumed>) = ? [pid 398] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 397] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 396] <... bpf resumed>) = 6 [pid 398] <... bpf resumed>) = 6 [pid 397] <... bpf resumed>) = 6 [pid 396] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 398] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 397] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 396] <... bpf resumed>) = 7 [pid 396] exit_group(0) = ? [pid 399] <... set_robust_list resumed>) = 0 [pid 399] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 399] setpgid(0, 0) = 0 [pid 399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 399] write(3, "1000", 4) = 4 [pid 399] close(3) = 0 [pid 399] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 27.198430][ C1] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000104, exited with 00000103? [ 27.209610][ T300] BUG: scheduling while atomic: syz-executor115/300/0x00000002 [ 27.217210][ T300] Modules linked in: [ 27.220928][ T300] Preemption disabled at: [ 27.220938][ T300] [] schedule+0xbc/0x180 [ 27.230735][ T300] CPU: 1 PID: 300 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 27.242101][ T300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 27.252126][ T300] Call Trace: [ 27.255243][ T300] [ 27.258031][ T300] dump_stack_lvl+0x151/0x1b7 [ 27.262533][ T300] ? schedule+0xbc/0x180 [ 27.266619][ T300] ? schedule+0xbc/0x180 [ 27.270694][ T300] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 27.275990][ T300] ? schedule+0xbc/0x180 [ 27.280278][ T300] dump_stack+0x15/0x1b [ 27.284257][ T300] __schedule_bug+0x195/0x260 [ 27.288768][ T300] ? cpu_util_update_eff+0x10e0/0x10e0 [ 27.294076][ T300] ? finish_task_switch+0x2cd/0x7b0 [ 27.299107][ T300] __schedule+0xcf7/0x1550 [ 27.303354][ T300] ? __sched_text_start+0x8/0x8 [ 27.308034][ T300] ? __kasan_check_read+0x11/0x20 [ 27.312907][ T300] ? cgroup_update_frozen+0x15f/0x980 [ 27.318109][ T300] schedule+0xc3/0x180 [ 27.322011][ T300] ptrace_stop+0x54f/0x930 [ 27.326303][ T300] ptrace_notify+0x225/0x350 [ 27.330692][ T300] ? do_notify_parent+0xa20/0xa20 [ 27.335603][ T300] ? __se_sys_clock_nanosleep+0x323/0x3b0 [ 27.341117][ T300] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 27.346577][ T300] ? fpregs_restore_userregs+0x130/0x290 [ 27.352044][ T300] syscall_exit_to_user_mode+0xa2/0x140 [ 27.357420][ T300] do_syscall_64+0x49/0xb0 [ 27.361679][ T300] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 27.367405][ T300] RIP: 0033:0x7fec422ec483 [ 27.371657][ T300] Code: 00 00 00 00 00 66 90 83 ff 03 74 7b 83 ff 02 b8 fa ff ff ff 49 89 ca 0f 44 f8 80 3d fe 1b 05 00 00 74 14 b8 e6 00 00 00 0f 05 d8 c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 89 54 24 10 [ 27.391099][ T300] RSP: 002b:00007ffe5e1cada8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [pid 399] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 398] <... bpf resumed>) = 7 [pid 395] +++ exited with 0 +++ [pid 398] exit_group(0) = ? [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=395, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 400 ./strace-static-x86_64: Process 400 attached [pid 400] set_robust_list(0x555555e33660, 24) = 0 [pid 400] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 400] setpgid(0, 0) = 0 [ 27.399342][ T300] RAX: 0000000000000000 RBX: 000000000000018b RCX: 00007fec422ec483 [ 27.407159][ T300] RDX: 00007ffe5e1cadc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.414968][ T300] RBP: 00000000000f4240 R08: 00007ffe5e1f5080 R09: 00007ffe5e1f50b0 [ 27.422777][ T300] R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000069e8 [ 27.430592][ T300] R13: 00007ffe5e1cadfc R14: 00007ffe5e1cae10 R15: 00007ffe5e1cae00 [ 27.438405][ T300] [pid 400] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 400] write(3, "1000", 4) = 4 [pid 400] close(3) = 0 [pid 400] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 27.442820][ C0] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000103, exited with 00000102? [ 27.453991][ T83] BUG: scheduling while atomic: syslogd/83/0x00000002 [ 27.460530][ T83] Modules linked in: [ 27.464393][ T83] Preemption disabled at: [ 27.464401][ T83] [] is_module_text_address+0x1f/0x360 [ 27.475497][ T83] CPU: 0 PID: 83 Comm: syslogd Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 27.486154][ T83] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 27.496259][ T83] Call Trace: [ 27.499381][ T83] [ 27.502157][ T83] dump_stack_lvl+0x151/0x1b7 [ 27.506675][ T83] ? is_module_text_address+0x1f/0x360 [ 27.511967][ T83] ? is_module_text_address+0x1f/0x360 [ 27.517352][ T83] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 27.522637][ T83] ? fsnotify_perm+0x470/0x5d0 [ 27.527244][ T83] ? is_module_text_address+0x1f/0x360 [ 27.532533][ T83] dump_stack+0x15/0x1b [ 27.536530][ T83] __schedule_bug+0x195/0x260 [ 27.541057][ T83] ? cpu_util_update_eff+0x10e0/0x10e0 [ 27.546338][ T83] ? kernel_read+0x1f0/0x1f0 [ 27.550767][ T83] __schedule+0xcf7/0x1550 [ 27.555130][ T83] ? __kasan_check_read+0x11/0x20 [ 27.559991][ T83] ? __fdget_pos+0x204/0x390 [ 27.564521][ T83] ? __sched_text_start+0x8/0x8 [ 27.569221][ T83] ? ksys_read+0x24f/0x2c0 [ 27.573463][ T83] schedule+0xc3/0x180 [ 27.577366][ T83] exit_to_user_mode_loop+0x4e/0xa0 [ 27.582404][ T83] exit_to_user_mode_prepare+0x5a/0xa0 [ 27.587692][ T83] syscall_exit_to_user_mode+0x26/0x140 [ 27.593090][ T83] do_syscall_64+0x49/0xb0 [ 27.597327][ T83] ? sysvec_apic_timer_interrupt+0x55/0xc0 [ 27.602969][ T83] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 27.608697][ T83] RIP: 0033:0x7fbd16d43b6a [ 27.612954][ T83] Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83 [ 27.632398][ T83] RSP: 002b:00007ffef223c3d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 27.640797][ T83] RAX: 0000000000000058 RBX: 0000000000000002 RCX: 00007fbd16d43b6a [pid 400] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 397] <... bpf resumed>) = 7 [pid 397] exit_group(0) = ? [pid 399] <... bpf resumed>) = 4 [ 27.648607][ T83] RDX: 00000000000000ff RSI: 000055b3811b2300 RDI: 0000000000000000 [ 27.656510][ T83] RBP: 000055b3811b22c0 R08: 0000000000000001 R09: 0000000000000000 [ 27.664317][ T83] R10: 00007fbd16ee23a3 R11: 0000000000000246 R12: 000055b3811b2358 [ 27.672128][ T83] R13: 000055b3811b2300 R14: 0000000000000000 R15: 00007fbd16f20a80 [ 27.679949][ T83] [ 27.714300][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 27.725877][ T398] BUG: scheduling while atomic: syz-executor115/398/0x00000002 [ 27.733322][ T398] Modules linked in: [ 27.736989][ T398] Preemption disabled at: [ 27.737000][ T398] [] is_module_text_address+0x1f/0x360 [ 27.748054][ T398] CPU: 1 PID: 398 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 27.759374][ T398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 27.769270][ T398] Call Trace: [ 27.772398][ T398] [ 27.775385][ T398] dump_stack_lvl+0x151/0x1b7 [ 27.779896][ T398] ? is_module_text_address+0x1f/0x360 [ 27.785186][ T398] ? is_module_text_address+0x1f/0x360 [ 27.790483][ T398] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 27.795772][ T398] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 27.801414][ T398] ? is_module_text_address+0x1f/0x360 [ 27.806709][ T398] dump_stack+0x15/0x1b [ 27.810700][ T398] __schedule_bug+0x195/0x260 [ 27.815213][ T398] ? cpu_util_update_eff+0x10e0/0x10e0 [ 27.820514][ T398] __schedule+0xcf7/0x1550 [ 27.824763][ T398] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 27.830057][ T398] ? __sched_text_start+0x8/0x8 [ 27.834745][ T398] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 27.840213][ T398] do_task_dead+0x99/0xa0 [ 27.844378][ T398] do_exit+0x202a/0x2b80 [ 27.848461][ T398] ? put_task_struct+0x80/0x80 [ 27.853058][ T398] ? __kasan_check_write+0x14/0x20 [ 27.858000][ T398] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 27.862952][ T398] ? _raw_spin_lock_irqsave+0x210/0x210 [ 27.868330][ T398] ? zap_other_threads+0x29c/0x2d0 [ 27.873279][ T398] do_group_exit+0x21a/0x2d0 [ 27.877706][ T398] __x64_sys_exit_group+0x3f/0x40 [ 27.882564][ T398] do_syscall_64+0x3d/0xb0 [ 27.886817][ T398] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 27.892546][ T398] RIP: 0033:0x7fec422c2ff9 [ 27.896799][ T398] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 27.903657][ T398] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 399] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 400] <... bpf resumed>) = 4 [pid 399] <... bpf resumed>) = 5 [pid 396] +++ exited with 0 +++ [pid 399] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=396, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 399] <... bpf resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 399] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 298] <... restart_syscall resumed>) = 0 [pid 399] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 398] +++ exited with 0 +++ [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=398, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 402 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 403 ./strace-static-x86_64: Process 403 attached [pid 403] set_robust_list(0x555555e33660, 24) = 0 [pid 403] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 403] setpgid(0, 0) = 0 [pid 403] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 403] write(3, "1000", 4) = 4 [pid 403] close(3) = 0 [pid 403] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 400] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72./strace-static-x86_64: Process 402 attached ) = 5 [pid 403] <... bpf resumed>) = 3 [pid 402] set_robust_list(0x555555e33660, 24 [pid 400] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 402] <... set_robust_list resumed>) = 0 [pid 403] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 400] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 402] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 399] <... bpf resumed>) = 7 [pid 399] exit_group(0) = ? [pid 400] <... bpf resumed>) = 6 [pid 402] <... prctl resumed>) = 0 [pid 402] setpgid(0, 0 [pid 400] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 402] <... setpgid resumed>) = 0 [pid 402] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 402] write(3, "1000", 4) = 4 [pid 402] close(3) = 0 [pid 402] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 402] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 397] +++ exited with 0 +++ [pid 403] <... bpf resumed>) = 4 [pid 403] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=397, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 403] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 400] <... bpf resumed>) = 7 [pid 403] <... bpf resumed>) = 0 [pid 403] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 400] exit_group(0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 403] <... bpf resumed>) = 6 [pid 400] <... exit_group resumed>) = ? [pid 403] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 297] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 404 attached , child_tidptr=0x555555e33650) = 404 [pid 404] set_robust_list(0x555555e33660, 24) = 0 [pid 404] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 404] setpgid(0, 0) = 0 [pid 404] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 404] write(3, "1000", 4) = 4 [pid 404] close(3) = 0 [pid 404] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 404] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 403] <... bpf resumed>) = 7 [pid 402] <... bpf resumed>) = 4 [pid 403] exit_group(0 [pid 402] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 399] +++ exited with 0 +++ [pid 403] <... exit_group resumed>) = ? [pid 402] <... bpf resumed>) = 5 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=399, si_uid=0, si_status=0, si_utime=0, si_stime=23} --- [pid 402] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 402] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 301] <... restart_syscall resumed>) = 0 [ 27.911898][ T398] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 27.919713][ T398] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 27.927610][ T398] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 27.935421][ T398] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 27.943234][ T398] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 27.951056][ T398] [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 402] <... bpf resumed>) = 6 [pid 402] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 405 attached [pid 405] set_robust_list(0x555555e33660, 24 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 405 [pid 405] <... set_robust_list resumed>) = 0 [pid 405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 405] setpgid(0, 0) = 0 [pid 405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 405] write(3, "1000", 4) = 4 [pid 405] close(3) = 0 [pid 405] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 405] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 404] <... bpf resumed>) = 4 [pid 400] +++ exited with 0 +++ [pid 403] +++ exited with 0 +++ [pid 404] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=400, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=403, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 404] <... bpf resumed>) = 5 [pid 404] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 404] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144./strace-static-x86_64: Process 406 attached [pid 406] set_robust_list(0x555555e33660, 24 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 406 [pid 404] <... bpf resumed>) = 6 [pid 404] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 406] <... set_robust_list resumed>) = 0 [pid 406] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 408 attached [pid 406] setpgid(0, 0 [pid 408] set_robust_list(0x555555e33660, 24 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 408 [pid 408] <... set_robust_list resumed>) = 0 [pid 408] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 408] setpgid(0, 0) = 0 [pid 408] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 406] <... setpgid resumed>) = 0 [pid 408] <... openat resumed>) = 3 [pid 406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 408] write(3, "1000", 4) = 4 [pid 408] close(3) = 0 [pid 408] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 406] <... openat resumed>) = 3 [pid 406] write(3, "1000", 4) = 4 [pid 406] close(3) = 0 [pid 408] <... bpf resumed>) = 3 [pid 406] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 408] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 406] <... bpf resumed>) = 3 [pid 406] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 402] <... bpf resumed>) = 7 [pid 405] <... bpf resumed>) = 4 [pid 404] <... bpf resumed>) = 7 [pid 408] <... bpf resumed>) = 4 [pid 405] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 404] exit_group(0 [pid 402] exit_group(0 [ 28.034133][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 28.045554][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 28.053029][ T292] Modules linked in: [ 28.056739][ T292] Preemption disabled at: [ 28.056745][ T292] [] is_module_text_address+0x1f/0x360 [ 28.068016][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 28.079386][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 28.089288][ T292] Call Trace: [ 28.092398][ T292] [ 28.095172][ T292] dump_stack_lvl+0x151/0x1b7 [ 28.099682][ T292] ? is_module_text_address+0x1f/0x360 [ 28.104985][ T292] ? is_module_text_address+0x1f/0x360 [ 28.110274][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 28.115570][ T292] ? is_module_text_address+0x1f/0x360 [ 28.120871][ T292] dump_stack+0x15/0x1b [ 28.124857][ T292] __schedule_bug+0x195/0x260 [ 28.129367][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 28.134661][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 28.140306][ T292] __schedule+0xcf7/0x1550 [ 28.144556][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 28.150456][ T292] ? ____fput+0x15/0x20 [ 28.154449][ T292] ? __sched_text_start+0x8/0x8 [ 28.159135][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 28.164610][ T292] ? unlock_page_memcg+0x160/0x160 [ 28.169554][ T292] schedule+0xc3/0x180 [ 28.173459][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 28.178489][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 28.183788][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 28.189168][ T292] do_syscall_64+0x49/0xb0 [ 28.193418][ T292] ? sysvec_call_function_single+0x52/0xb0 [ 28.199062][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 28.204787][ T292] RIP: 0033:0x4e65f7 [ 28.208520][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [pid 408] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 406] <... bpf resumed>) = 4 [pid 405] <... bpf resumed>) = 5 [pid 404] <... exit_group resumed>) = ? [pid 402] <... exit_group resumed>) = ? [pid 408] <... bpf resumed>) = 5 [pid 406] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 405] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 404] +++ exited with 0 +++ [pid 408] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 406] <... bpf resumed>) = 5 [pid 408] <... bpf resumed>) = 0 [pid 406] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=404, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 408] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 406] <... bpf resumed>) = 0 [ 28.227962][ T292] RSP: 002b:00007fff6da4d208 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [ 28.236208][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 28.244018][ T292] RDX: 00007fff6da4d210 RSI: 0000000000008910 RDI: 0000000000000003 [ 28.251835][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000c [ 28.259642][ T292] R10: 0000000000554612 R11: 0000000000000286 R12: 00007fff6da4d270 [ 28.267454][ T292] R13: 00007fff6da4d210 R14: 0000000000423160 R15: 0000000000617180 [ 28.275268][ T292] [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 408] <... bpf resumed>) = 6 [pid 406] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 408] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 406] <... bpf resumed>) = 6 [pid 402] +++ exited with 0 +++ [pid 408] <... bpf resumed>) = 7 [pid 406] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=402, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 406] exit_group(0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 406] <... exit_group resumed>) = ? [pid 406] +++ exited with 0 +++ [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 409 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 410 ./strace-static-x86_64: Process 409 attached [pid 409] set_robust_list(0x555555e33660, 24) = 0 [pid 409] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 409] setpgid(0, 0) = 0 [pid 409] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 409] write(3, "1000", 4./strace-static-x86_64: Process 410 attached ) = 4 [pid 409] close(3 [pid 410] set_robust_list(0x555555e33660, 24 [pid 409] <... close resumed>) = 0 [pid 410] <... set_robust_list resumed>) = 0 [pid 409] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 410] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 410] setpgid(0, 0) = 0 [pid 410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 410] write(3, "1000", 4) = 4 [pid 410] close(3) = 0 [pid 410] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 408] exit_group(0 [pid 409] <... bpf resumed>) = 3 [pid 408] <... exit_group resumed>) = ? [pid 409] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 410] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 409] <... bpf resumed>) = 4 [pid 410] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [ 28.281845][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 28.294563][ T402] BUG: scheduling while atomic: syz-executor115/402/0x00000002 [ 28.301943][ T402] Modules linked in: [ 28.305716][ T402] Preemption disabled at: [ 28.305726][ T402] [] is_module_text_address+0x1f/0x360 [ 28.317566][ T402] CPU: 1 PID: 402 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 28.328931][ T402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 28.338826][ T402] Call Trace: [ 28.341948][ T402] [ 28.344726][ T402] dump_stack_lvl+0x151/0x1b7 [ 28.349240][ T402] ? is_module_text_address+0x1f/0x360 [ 28.354532][ T402] ? is_module_text_address+0x1f/0x360 [ 28.359833][ T402] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 28.365124][ T402] ? is_module_text_address+0x1f/0x360 [ 28.370416][ T402] dump_stack+0x15/0x1b [ 28.374407][ T402] __schedule_bug+0x195/0x260 [ 28.378941][ T402] ? cpu_util_update_eff+0x10e0/0x10e0 [ 28.384225][ T402] __schedule+0xcf7/0x1550 [ 28.388470][ T402] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 28.393768][ T402] ? __sched_text_start+0x8/0x8 [ 28.398454][ T402] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 28.403919][ T402] do_task_dead+0x99/0xa0 [ 28.408089][ T402] do_exit+0x202a/0x2b80 [ 28.412165][ T402] ? put_task_struct+0x80/0x80 [ 28.416763][ T402] ? __kasan_check_write+0x14/0x20 [ 28.421707][ T402] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 28.426657][ T402] ? _raw_spin_lock_irqsave+0x210/0x210 [ 28.432043][ T402] ? zap_other_threads+0x29c/0x2d0 [ 28.436986][ T402] do_group_exit+0x21a/0x2d0 [ 28.441413][ T402] __x64_sys_exit_group+0x3f/0x40 [ 28.446274][ T402] do_syscall_64+0x3d/0xb0 [ 28.450526][ T402] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 28.456254][ T402] RIP: 0033:0x7fec422c2ff9 [ 28.460506][ T402] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 28.467362][ T402] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 28.475609][ T402] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [pid 409] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 410] <... bpf resumed>) = 5 [pid 409] <... bpf resumed>) = 5 [pid 405] <... bpf resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=406, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 405] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 408] +++ exited with 0 +++ [pid 410] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 410] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 405] <... bpf resumed>) = 6 [pid 405] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=408, si_uid=0, si_status=0, si_utime=0, si_stime=18} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 411 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 410] <... bpf resumed>) = 6 [pid 410] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 411 attached [pid 411] set_robust_list(0x555555e33660, 24) = 0 [pid 411] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 412 [pid 411] <... prctl resumed>) = 0 [pid 411] setpgid(0, 0) = 0 [pid 411] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 409] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4./strace-static-x86_64: Process 412 attached [pid 411] <... openat resumed>) = 3 [pid 409] <... bpf resumed>) = 0 [pid 409] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 412] set_robust_list(0x555555e33660, 24 [pid 411] write(3, "1000", 4 [pid 412] <... set_robust_list resumed>) = 0 [pid 411] <... write resumed>) = 4 [pid 412] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 409] <... bpf resumed>) = 6 [pid 412] <... prctl resumed>) = 0 [pid 411] close(3 [pid 409] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 412] setpgid(0, 0) = 0 [pid 411] <... close resumed>) = 0 [pid 412] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 411] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 412] <... openat resumed>) = 3 [pid 412] write(3, "1000", 4) = 4 [pid 412] close(3) = 0 [pid 412] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 412] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 411] <... bpf resumed>) = 3 [pid 411] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 405] <... bpf resumed>) = 7 [pid 412] <... bpf resumed>) = 4 [pid 410] <... bpf resumed>) = 7 [pid 409] <... bpf resumed>) = 7 [pid 405] exit_group(0) = ? [pid 410] exit_group(0 [pid 409] exit_group(0 [pid 410] <... exit_group resumed>) = ? [pid 409] <... exit_group resumed>) = ? [pid 412] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 405] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=405, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 412] <... bpf resumed>) = 5 [pid 412] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [ 28.483421][ T402] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 28.491228][ T402] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 28.499044][ T402] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 28.506852][ T402] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 28.514776][ T402] [pid 412] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 301] <... restart_syscall resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 412] <... bpf resumed>) = 6 [pid 412] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 413 ./strace-static-x86_64: Process 413 attached [pid 413] set_robust_list(0x555555e33660, 24) = 0 [pid 413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 413] setpgid(0, 0) = 0 [pid 413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 413] write(3, "1000", 4) = 4 [pid 413] close(3) = 0 [pid 413] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 409] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=409, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 414 [pid 412] <... bpf resumed>) = 7 [pid 411] <... bpf resumed>) = 4 [pid 411] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 411] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 411] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 411] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 412] exit_group(0 [pid 411] <... bpf resumed>) = 7 [pid 412] <... exit_group resumed>) = ? [pid 411] exit_group(0) = ? [pid 411] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=411, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 415 ./strace-static-x86_64: Process 415 attached [pid 415] set_robust_list(0x555555e33660, 24) = 0 [pid 415] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 415] setpgid(0, 0) = 0 [pid 415] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 28.535353][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 28.547657][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000104, exited with 00000103? [ 28.559442][ T409] BUG: scheduling while atomic: syz-executor115/409/0x00000003 [ 28.567377][ T409] Modules linked in: [ 28.571526][ T409] Preemption disabled at: [ 28.571536][ T409] [] rwsem_write_trylock+0x93/0x290 [pid 415] write(3, "1000", 4) = 4 [pid 415] close(3) = 0 [ 28.583163][ T409] CPU: 1 PID: 409 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 28.594528][ T409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 28.604421][ T409] Call Trace: [ 28.607552][ T409] [ 28.610329][ T409] dump_stack_lvl+0x151/0x1b7 [ 28.614839][ T409] ? rwsem_write_trylock+0x93/0x290 [ 28.619875][ T409] ? rwsem_write_trylock+0x93/0x290 [ 28.624910][ T409] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 28.630202][ T409] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 28.635849][ T409] ? rwsem_write_trylock+0x93/0x290 [ 28.640875][ T409] dump_stack+0x15/0x1b [ 28.644962][ T409] __schedule_bug+0x195/0x260 [ 28.649469][ T409] ? cpu_util_update_eff+0x10e0/0x10e0 [ 28.654858][ T409] __schedule+0xcf7/0x1550 [ 28.659103][ T409] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 28.664396][ T409] ? __sched_text_start+0x8/0x8 [ 28.669092][ T409] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 28.674549][ T409] do_task_dead+0x99/0xa0 [ 28.678718][ T409] do_exit+0x202a/0x2b80 [ 28.682800][ T409] ? put_task_struct+0x80/0x80 [ 28.687396][ T409] ? __kasan_check_write+0x14/0x20 [ 28.692351][ T409] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 28.697332][ T409] ? _raw_spin_lock_irqsave+0x210/0x210 [ 28.702669][ T409] ? zap_other_threads+0x29c/0x2d0 [ 28.707618][ T409] do_group_exit+0x21a/0x2d0 [ 28.712051][ T409] __x64_sys_exit_group+0x3f/0x40 [ 28.716904][ T409] do_syscall_64+0x3d/0xb0 [ 28.721159][ T409] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 28.726887][ T409] RIP: 0033:0x7fec422c2ff9 [ 28.731140][ T409] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 28.737997][ T409] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 28.746242][ T409] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 28.754140][ T409] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 28.761951][ T409] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 28.769762][ T409] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 28.777572][ T409] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [pid 415] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46./strace-static-x86_64: Process 414 attached ) = 3 [pid 413] <... bpf resumed>) = 3 [pid 412] +++ exited with 0 +++ [pid 410] +++ exited with 0 +++ [pid 415] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 414] set_robust_list(0x555555e33660, 24 [pid 413] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 414] <... set_robust_list resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=412, si_uid=0, si_status=0, si_utime=0, si_stime=21} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=410, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 414] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 414] <... prctl resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 416 attached [pid 414] setpgid(0, 0./strace-static-x86_64: Process 417 attached [pid 416] set_robust_list(0x555555e33660, 24 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 416 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 417 [pid 416] <... set_robust_list resumed>) = 0 [pid 416] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 416] setpgid(0, 0) = 0 [pid 416] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 416] write(3, "1000", 4) = 4 [pid 416] close(3) = 0 [pid 416] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 417] set_robust_list(0x555555e33660, 24 [pid 414] <... setpgid resumed>) = 0 [pid 414] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 417] <... set_robust_list resumed>) = 0 [pid 416] <... bpf resumed>) = 3 [pid 417] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 416] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 414] <... openat resumed>) = 3 [pid 417] <... prctl resumed>) = 0 [pid 414] write(3, "1000", 4) = 4 [pid 414] close(3) = 0 [pid 414] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 417] setpgid(0, 0) = 0 [pid 417] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 414] <... bpf resumed>) = 3 [pid 414] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 417] <... openat resumed>) = 3 [pid 417] write(3, "1000", 4) = 4 [pid 417] close(3) = 0 [pid 417] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 417] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 415] <... bpf resumed>) = 4 [pid 416] <... bpf resumed>) = 4 [pid 415] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 413] <... bpf resumed>) = 4 [pid 417] <... bpf resumed>) = 4 [pid 416] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 414] <... bpf resumed>) = 4 [pid 417] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 416] <... bpf resumed>) = 5 [pid 415] <... bpf resumed>) = 5 [pid 413] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 417] <... bpf resumed>) = 5 [pid 416] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 415] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 414] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 417] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 416] <... bpf resumed>) = 0 [pid 415] <... bpf resumed>) = 0 [pid 414] <... bpf resumed>) = 5 [pid 413] <... bpf resumed>) = 5 [pid 416] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 415] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 414] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 413] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 417] <... bpf resumed>) = 0 [pid 416] <... bpf resumed>) = 6 [pid 413] <... bpf resumed>) = 0 [pid 414] <... bpf resumed>) = 0 [pid 417] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 416] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 415] <... bpf resumed>) = 6 [pid 414] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 413] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 417] <... bpf resumed>) = 6 [pid 416] <... bpf resumed>) = 7 [pid 415] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 417] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 416] exit_group(0 [pid 415] <... bpf resumed>) = 7 [pid 414] <... bpf resumed>) = 6 [pid 413] <... bpf resumed>) = 6 [pid 416] <... exit_group resumed>) = ? [pid 415] exit_group(0 [pid 414] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 413] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 417] <... bpf resumed>) = 7 [pid 414] <... bpf resumed>) = 7 [pid 414] exit_group(0) = ? [ 28.785390][ T409] [pid 417] exit_group(0 [pid 416] +++ exited with 0 +++ [pid 415] <... exit_group resumed>) = ? [pid 414] +++ exited with 0 +++ [pid 413] <... bpf resumed>) = 7 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=414, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=416, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 418 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 419 ./strace-static-x86_64: Process 419 attached [pid 419] set_robust_list(0x555555e33660, 24) = 0 [pid 419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 419] setpgid(0, 0) = 0 [pid 419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 419] write(3, "1000", 4) = 4 [pid 419] close(3) = 0 [pid 419] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 419] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 419] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 419] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 419] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 419] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 419] exit_group(0) = ? [pid 419] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=419, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 420 [pid 417] <... exit_group resumed>) = ? [pid 415] +++ exited with 0 +++ ./strace-static-x86_64: Process 420 attached ./strace-static-x86_64: Process 418 attached [pid 413] exit_group(0 [pid 417] +++ exited with 0 +++ [pid 413] <... exit_group resumed>) = ? [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=415, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=417, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 421 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 422 [pid 418] set_robust_list(0x555555e33660, 24) = 0 [pid 418] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 418] setpgid(0, 0) = 0 [pid 418] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 418] write(3, "1000", 4) = 4 [pid 418] close(3) = 0 [pid 418] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 418] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 420] set_robust_list(0x555555e33660, 24) = 0 [pid 420] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 420] setpgid(0, 0) = 0 [pid 420] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 420] write(3, "1000", 4) = 4 [pid 420] close(3) = 0 [pid 420] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 420] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 421 attached [pid 421] set_robust_list(0x555555e33660, 24) = 0 [pid 421] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 421] setpgid(0, 0) = 0 [ 28.822826][ C0] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000103, exited with 00000102? [ 28.834654][ T415] BUG: scheduling while atomic: syz-executor115/415/0x00000002 [ 28.842026][ T415] Modules linked in: [ 28.845968][ T415] Preemption disabled at: [ 28.845978][ T415] [] is_module_text_address+0x1f/0x360 [ 28.857215][ T415] CPU: 0 PID: 415 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [pid 421] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 421] write(3, "1000", 4) = 4 [ 28.868585][ T415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 28.876252][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 28.878474][ T415] Call Trace: [ 28.878484][ T415] [ 28.878492][ T415] dump_stack_lvl+0x151/0x1b7 [ 28.878518][ T415] ? is_module_text_address+0x1f/0x360 [ 28.889914][ T421] BUG: scheduling while atomic: syz-executor115/421/0x00000002 [ 28.892968][ T415] ? is_module_text_address+0x1f/0x360 [ 28.892998][ T415] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 28.893022][ T415] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 28.893050][ T415] ? is_module_text_address+0x1f/0x360 [ 28.893078][ T415] dump_stack+0x15/0x1b [ 28.893105][ T415] __schedule_bug+0x195/0x260 [ 28.893127][ T415] ? cpu_util_update_eff+0x10e0/0x10e0 [ 28.895858][ T421] Modules linked in: [ 28.900374][ T415] __schedule+0xcf7/0x1550 [ 28.905684][ T421] Preemption disabled at: [ 28.913044][ T415] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 28.913074][ T415] ? __sched_text_start+0x8/0x8 [ 28.913107][ T415] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 28.918335][ T421] [] lockref_put_or_lock+0x296/0x340 [ 28.923720][ T415] do_task_dead+0x99/0xa0 [ 28.986915][ T415] do_exit+0x202a/0x2b80 [ 28.990988][ T415] ? put_task_struct+0x80/0x80 [ 28.995587][ T415] ? __kasan_check_write+0x14/0x20 [ 29.000529][ T415] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 29.005479][ T415] ? _raw_spin_lock_irqsave+0x210/0x210 [ 29.010858][ T415] ? zap_other_threads+0x29c/0x2d0 [ 29.015807][ T415] do_group_exit+0x21a/0x2d0 [ 29.020236][ T415] __x64_sys_exit_group+0x3f/0x40 [ 29.025094][ T415] do_syscall_64+0x3d/0xb0 [ 29.029345][ T415] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 29.035072][ T415] RIP: 0033:0x7fec422c2ff9 [ 29.039328][ T415] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 29.046183][ T415] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 29.054429][ T415] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 29.062240][ T415] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 29.070053][ T415] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 29.077880][ T415] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 29.085675][ T415] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 29.093492][ T415] [ 29.096351][ T421] CPU: 1 PID: 421 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 29.107721][ T421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.117614][ T421] Call Trace: [ 29.120740][ T421] [ 29.123518][ T421] dump_stack_lvl+0x151/0x1b7 [ 29.128029][ T421] ? lockref_put_or_lock+0x296/0x340 [ 29.133150][ T421] ? lockref_put_or_lock+0x296/0x340 [ 29.138272][ T421] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 29.143570][ T421] ? lockref_put_or_lock+0x296/0x340 [ 29.148688][ T421] dump_stack+0x15/0x1b [ 29.152678][ T421] __schedule_bug+0x195/0x260 [ 29.157191][ T421] ? cpu_util_update_eff+0x10e0/0x10e0 [ 29.162490][ T421] __schedule+0xcf7/0x1550 [ 29.166742][ T421] ? __kasan_check_write+0x14/0x20 [ 29.171692][ T421] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 29.176633][ T421] ? __sched_text_start+0x8/0x8 [ 29.181320][ T421] ? __kasan_check_read+0x11/0x20 [ 29.186187][ T421] ? cgroup_update_frozen+0x15f/0x980 [ 29.191389][ T421] schedule+0xc3/0x180 [ 29.195294][ T421] ptrace_stop+0x54f/0x930 [ 29.199551][ T421] ptrace_notify+0x225/0x350 [ 29.203972][ T421] ? do_notify_parent+0xa20/0xa20 [ 29.208839][ T421] syscall_exit_to_user_mode+0xa2/0x140 [ 29.214218][ T421] do_syscall_64+0x49/0xb0 [ 29.218469][ T421] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 29.224196][ T421] RIP: 0033:0x7fec422c41b0 [ 29.228452][ T421] Code: ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 80 3d d1 9e 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c [ 29.247893][ T421] RSP: 002b:00007ffe5e1ca8f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 29.256141][ T421] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fec422c41b0 [ 29.263946][ T421] RDX: 0000000000000004 RSI: 00007ffe5e1ca920 RDI: 0000000000000003 [pid 421] close(3) = 0 ./strace-static-x86_64: Process 422 attached [pid 420] <... bpf resumed>) = 4 [pid 418] <... bpf resumed>) = 4 [pid 413] +++ exited with 0 +++ [pid 422] set_robust_list(0x555555e33660, 24 [pid 421] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 420] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 418] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 422] <... set_robust_list resumed>) = 0 [pid 418] <... bpf resumed>) = 5 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=413, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 422] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 418] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 422] <... prctl resumed>) = 0 [pid 420] <... bpf resumed>) = 5 [pid 418] <... bpf resumed>) = 0 [pid 422] setpgid(0, 0 [pid 418] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 424 [pid 422] <... setpgid resumed>) = 0 [pid 422] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 420] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 418] <... bpf resumed>) = 6 ./strace-static-x86_64: Process 424 attached [pid 422] write(3, "1000", 4 [pid 421] <... bpf resumed>) = 3 [pid 420] <... bpf resumed>) = 0 [pid 418] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 422] <... write resumed>) = 4 [pid 421] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 422] close(3) = 0 [pid 421] <... bpf resumed>) = 4 [pid 422] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 424] set_robust_list(0x555555e33660, 24 [pid 420] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 424] <... set_robust_list resumed>) = 0 [pid 422] <... bpf resumed>) = 3 [pid 421] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 424] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 422] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 421] <... bpf resumed>) = 5 [pid 424] <... prctl resumed>) = 0 [pid 421] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 424] setpgid(0, 0 [pid 421] <... bpf resumed>) = 0 [pid 420] <... bpf resumed>) = 6 [pid 424] <... setpgid resumed>) = 0 [pid 421] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 420] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 421] <... bpf resumed>) = 6 [pid 421] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 424] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 424] write(3, "1000", 4) = 4 [pid 424] close(3) = 0 [pid 424] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 424] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 422] <... bpf resumed>) = 4 [pid 418] <... bpf resumed>) = 7 [pid 422] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 424] <... bpf resumed>) = 4 [pid 421] <... bpf resumed>) = 7 [pid 420] <... bpf resumed>) = 7 [pid 418] exit_group(0 [pid 424] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 422] <... bpf resumed>) = 5 [pid 421] exit_group(0 [pid 420] exit_group(0 [pid 418] <... exit_group resumed>) = ? [pid 424] <... bpf resumed>) = 5 [pid 422] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [ 29.271757][ T421] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 29.279570][ T421] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe5e1ca920 [ 29.287382][ T421] R13: 00007ffe5e1cadfc R14: 00007ffe5e1cae10 R15: 00007ffe5e1cae00 [ 29.295201][ T421] [pid 421] <... exit_group resumed>) = ? [pid 420] <... exit_group resumed>) = ? [pid 422] <... bpf resumed>) = 0 [pid 422] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 422] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 422] exit_group(0) = ? [pid 422] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=422, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 425 ./strace-static-x86_64: Process 425 attached [pid 425] set_robust_list(0x555555e33660, 24) = 0 [pid 425] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 425] setpgid(0, 0) = 0 [pid 425] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 421] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=421, si_uid=0, si_status=0, si_utime=0, si_stime=23} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 426 [pid 425] write(3, "1000", 4) = 4 [pid 425] close(3) = 0 [pid 425] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 425] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 420] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=420, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 425] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 297] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 427 [pid 425] <... bpf resumed>) = 5 [pid 425] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 425] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [ 29.317155][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 29.328583][ T418] BUG: scheduling while atomic: syz-executor115/418/0x00000002 [ 29.336529][ T418] Modules linked in: [ 29.340631][ T418] Preemption disabled at: [ 29.340642][ T418] [] is_module_text_address+0x1f/0x360 [ 29.352352][ T418] CPU: 1 PID: 418 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 29.363726][ T418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.373614][ T418] Call Trace: [ 29.376764][ T418] [ 29.379515][ T418] dump_stack_lvl+0x151/0x1b7 [ 29.384026][ T418] ? is_module_text_address+0x1f/0x360 [ 29.389321][ T418] ? is_module_text_address+0x1f/0x360 [ 29.394620][ T418] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 29.399912][ T418] ? is_module_text_address+0x1f/0x360 [ 29.405205][ T418] dump_stack+0x15/0x1b [ 29.409199][ T418] __schedule_bug+0x195/0x260 [ 29.413713][ T418] ? kernel_text_address+0xa9/0xe0 [ 29.418659][ T418] ? cpu_util_update_eff+0x10e0/0x10e0 [ 29.424041][ T418] ? __kernel_text_address+0xd/0x40 [ 29.429074][ T418] ? unwind_get_return_address+0x4d/0x90 [ 29.434542][ T418] __schedule+0xcf7/0x1550 [ 29.438795][ T418] ? stack_trace_save+0x113/0x1c0 [ 29.443655][ T418] ? __sched_text_start+0x8/0x8 [ 29.448341][ T418] ? __kasan_check_write+0x14/0x20 [ 29.453290][ T418] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 29.458237][ T418] ? _raw_spin_lock_irqsave+0x210/0x210 [ 29.463617][ T418] ? __stack_depot_save+0x36/0x480 [ 29.468564][ T418] schedule+0xc3/0x180 [ 29.472471][ T418] rwsem_down_write_slowpath+0xddf/0x20a0 [ 29.478028][ T418] ? ____kasan_slab_free+0x131/0x180 [ 29.483144][ T418] ? __kasan_slab_free+0x11/0x20 [ 29.487917][ T418] ? kmem_cache_free+0x291/0x510 [ 29.492700][ T418] ? down_write_killable+0x40/0x40 [ 29.497645][ T418] ? rwsem_write_trylock+0x15b/0x290 [ 29.502761][ T418] ? rwsem_mark_wake+0x6b0/0x6b0 [ 29.507535][ T418] ? unlink_anon_vmas+0x2b0/0x5b0 [ 29.512393][ T418] ? ____kasan_slab_free+0x13c/0x180 [ 29.517518][ T418] down_write+0x21/0x30 [ 29.521509][ T418] __put_anon_vma+0x93/0x1d0 [ 29.525935][ T418] unlink_anon_vmas+0x468/0x5b0 [ 29.530622][ T418] free_pgtables+0x4af/0x660 [ 29.535058][ T418] ? free_pgd_range+0xdb0/0xdb0 [ 29.539876][ T418] exit_mmap+0x415/0x940 [ 29.543978][ T418] ? vm_brk+0x30/0x30 [ 29.547770][ T418] ? kiocb_set_cancel_fn+0x1d0/0x1d0 [ 29.552889][ T418] ? uprobe_clear_state+0x2cd/0x320 [ 29.557922][ T418] __mmput+0x95/0x310 [ 29.561741][ T418] mmput+0x56/0x170 [ 29.565385][ T418] do_exit+0xb29/0x2b80 [ 29.569376][ T418] ? put_task_struct+0x80/0x80 [ 29.573975][ T418] ? __kasan_check_write+0x14/0x20 [ 29.578925][ T418] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 29.583869][ T418] ? _raw_spin_lock_irqsave+0x210/0x210 [ 29.589249][ T418] ? zap_other_threads+0x29c/0x2d0 [ 29.594199][ T418] do_group_exit+0x21a/0x2d0 [ 29.598628][ T418] __x64_sys_exit_group+0x3f/0x40 [ 29.603484][ T418] do_syscall_64+0x3d/0xb0 [ 29.607742][ T418] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 29.613465][ T418] RIP: 0033:0x7fec422c2ff9 [ 29.617717][ T418] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 29.624573][ T418] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 29.632824][ T418] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 29.640631][ T418] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 29.648443][ T418] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 29.656252][ T418] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [pid 425] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 426 attached ./strace-static-x86_64: Process 427 attached ) = 7 [pid 424] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 427] set_robust_list(0x555555e33660, 24) = 0 [pid 427] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 427] setpgid(0, 0) = 0 [pid 427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 427] write(3, "1000", 4) = 4 [pid 425] exit_group(0 [pid 427] close(3 [pid 426] set_robust_list(0x555555e33660, 24 [pid 424] <... bpf resumed>) = 0 [pid 427] <... close resumed>) = 0 [pid 425] <... exit_group resumed>) = ? [pid 427] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 426] <... set_robust_list resumed>) = 0 [pid 424] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 426] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 424] <... bpf resumed>) = 6 [pid 427] <... bpf resumed>) = 3 [pid 426] <... prctl resumed>) = 0 [pid 424] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 426] setpgid(0, 0) = 0 [pid 426] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 426] write(3, "1000", 4) = 4 [pid 426] close(3) = 0 [pid 426] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 426] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 427] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 425] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=425, si_uid=0, si_status=0, si_utime=0, si_stime=33} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 428 ./strace-static-x86_64: Process 428 attached [pid 428] set_robust_list(0x555555e33660, 24) = 0 [pid 428] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 428] setpgid(0, 0) = 0 [pid 428] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 428] write(3, "1000", 4) = 4 [pid 428] close(3) = 0 [pid 428] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 29.664063][ T418] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 29.671884][ T418] [ 29.682777][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000102, exited with 00000101? [ 29.695029][ T425] BUG: scheduling while atomic: syz-executor115/425/0x00000002 [ 29.703060][ T425] Modules linked in: [ 29.707155][ T425] Preemption disabled at: [ 29.707166][ T425] [] is_module_text_address+0x1f/0x360 [ 29.718550][ T425] CPU: 1 PID: 425 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 29.729915][ T425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.739751][ T425] Call Trace: [ 29.742895][ T425] [ 29.745767][ T425] dump_stack_lvl+0x151/0x1b7 [ 29.750276][ T425] ? is_module_text_address+0x1f/0x360 [ 29.755579][ T425] ? is_module_text_address+0x1f/0x360 [ 29.760869][ T425] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 29.766165][ T425] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 29.771812][ T425] ? is_module_text_address+0x1f/0x360 [ 29.777100][ T425] dump_stack+0x15/0x1b [ 29.781089][ T425] __schedule_bug+0x195/0x260 [ 29.785603][ T425] ? cpu_util_update_eff+0x10e0/0x10e0 [ 29.790940][ T425] __schedule+0xcf7/0x1550 [ 29.795155][ T425] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 29.800453][ T425] ? __sched_text_start+0x8/0x8 [ 29.805146][ T425] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 29.810600][ T425] do_task_dead+0x99/0xa0 [ 29.814907][ T425] do_exit+0x202a/0x2b80 [ 29.819012][ T425] ? put_task_struct+0x80/0x80 [ 29.823599][ T425] ? __kasan_check_write+0x14/0x20 [ 29.828548][ T425] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 29.833494][ T425] ? _raw_spin_lock_irqsave+0x210/0x210 [ 29.838875][ T425] ? zap_other_threads+0x29c/0x2d0 [ 29.843848][ T425] do_group_exit+0x21a/0x2d0 [ 29.848422][ T425] __x64_sys_exit_group+0x3f/0x40 [ 29.853282][ T425] do_syscall_64+0x3d/0xb0 [ 29.857532][ T425] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 29.863262][ T425] RIP: 0033:0x7fec422c2ff9 [ 29.867513][ T425] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 29.874371][ T425] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 29.882615][ T425] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 29.890427][ T425] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 29.898239][ T425] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 29.906051][ T425] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [pid 428] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 426] <... bpf resumed>) = 4 [pid 427] <... bpf resumed>) = 4 [pid 424] <... bpf resumed>) = 7 [pid 418] +++ exited with 0 +++ [pid 428] <... bpf resumed>) = 4 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=418, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 428] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 427] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 426] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 424] exit_group(0 [pid 428] <... bpf resumed>) = 5 [pid 427] <... bpf resumed>) = 5 [pid 426] <... bpf resumed>) = 5 [pid 424] <... exit_group resumed>) = ? [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 428] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 427] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 426] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 429 ./strace-static-x86_64: Process 429 attached [pid 428] <... bpf resumed>) = 0 [pid 427] <... bpf resumed>) = 0 [pid 426] <... bpf resumed>) = 0 [pid 429] set_robust_list(0x555555e33660, 24 [ 29.913860][ T425] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 29.921678][ T425] [ 29.931259][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 29.942879][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 29.950243][ T292] Modules linked in: [ 29.954161][ T292] Preemption disabled at: [ 29.954170][ T292] [] is_module_text_address+0x1f/0x360 [ 29.965222][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 29.976571][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 29.986455][ T292] Call Trace: [ 29.989581][ T292] [ 29.992356][ T292] dump_stack_lvl+0x151/0x1b7 [ 29.996872][ T292] ? is_module_text_address+0x1f/0x360 [ 30.002171][ T292] ? is_module_text_address+0x1f/0x360 [ 30.007546][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 30.012844][ T292] ? is_module_text_address+0x1f/0x360 [ 30.018134][ T292] dump_stack+0x15/0x1b [ 30.022127][ T292] __schedule_bug+0x195/0x260 [ 30.026641][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 30.031944][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 30.037492][ T292] __schedule+0xcf7/0x1550 [ 30.041744][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 30.047644][ T292] ? ____fput+0x15/0x20 [ 30.051639][ T292] ? __sched_text_start+0x8/0x8 [ 30.056323][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 30.061792][ T292] ? unlock_page_memcg+0x160/0x160 [ 30.066743][ T292] schedule+0xc3/0x180 [ 30.070646][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 30.075678][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 30.080972][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 30.086398][ T292] do_syscall_64+0x49/0xb0 [ 30.090607][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 30.096334][ T292] RIP: 0033:0x4e65f7 [ 30.100068][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [pid 428] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 427] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 426] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 429] <... set_robust_list resumed>) = 0 [pid 428] <... bpf resumed>) = 6 [ 30.119622][ T292] RSP: 002b:00007fff6da4d1d8 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [ 30.127871][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 30.135681][ T292] RDX: 00007fff6da4d1e0 RSI: 0000000000008910 RDI: 0000000000000003 [ 30.143491][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000d [ 30.151301][ T292] R10: 00000000005549d3 R11: 0000000000000286 R12: 00007fff6da4d240 [ 30.159122][ T292] R13: 00007fff6da4d1e0 R14: 0000000000427210 R15: 0000000000617180 [ 30.166932][ T292] [pid 429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 428] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 427] <... bpf resumed>) = 6 [pid 426] <... bpf resumed>) = 6 [pid 429] <... prctl resumed>) = 0 [pid 427] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 426] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 429] setpgid(0, 0) = 0 [pid 429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 429] write(3, "1000", 4) = 4 [pid 429] close(3) = 0 [pid 429] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 30.171652][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000102, exited with 00000101? [ 30.183122][ T83] BUG: scheduling while atomic: syslogd/83/0x00000002 [ 30.189627][ T83] Modules linked in: [ 30.193555][ T83] Preemption disabled at: [ 30.193565][ T83] [] is_module_text_address+0x1f/0x360 [ 30.204752][ T83] CPU: 1 PID: 83 Comm: syslogd Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 30.215315][ T83] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 30.225217][ T83] Call Trace: [ 30.228338][ T83] [ 30.231116][ T83] dump_stack_lvl+0x151/0x1b7 [ 30.235624][ T83] ? is_module_text_address+0x1f/0x360 [ 30.240920][ T83] ? is_module_text_address+0x1f/0x360 [ 30.246213][ T83] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 30.251514][ T83] ? fsnotify_perm+0x470/0x5d0 [ 30.256115][ T83] ? is_module_text_address+0x1f/0x360 [ 30.261406][ T83] dump_stack+0x15/0x1b [ 30.265396][ T83] __schedule_bug+0x195/0x260 [ 30.269911][ T83] ? cpu_util_update_eff+0x10e0/0x10e0 [ 30.275209][ T83] ? kernel_read+0x1f0/0x1f0 [ 30.279627][ T83] __schedule+0xcf7/0x1550 [ 30.283915][ T83] ? __kasan_check_read+0x11/0x20 [ 30.288742][ T83] ? __fdget_pos+0x204/0x390 [ 30.293167][ T83] ? __sched_text_start+0x8/0x8 [ 30.297857][ T83] ? ksys_read+0x24f/0x2c0 [ 30.302116][ T83] schedule+0xc3/0x180 [ 30.306020][ T83] exit_to_user_mode_loop+0x4e/0xa0 [ 30.311168][ T83] exit_to_user_mode_prepare+0x5a/0xa0 [ 30.316470][ T83] syscall_exit_to_user_mode+0x26/0x140 [ 30.321859][ T83] do_syscall_64+0x49/0xb0 [ 30.326136][ T83] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 30.331822][ T83] RIP: 0033:0x7fbd16d43b6a [ 30.336079][ T83] Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83 [ 30.355518][ T83] RSP: 002b:00007ffef223c3d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 30.363769][ T83] RAX: 000000000000004d RBX: 0000000000000002 RCX: 00007fbd16d43b6a [pid 429] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 424] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=424, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 431 ./strace-static-x86_64: Process 431 attached [pid 431] set_robust_list(0x555555e33660, 24) = 0 [pid 431] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 431] setpgid(0, 0) = 0 [pid 431] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 431] write(3, "1000", 4) = 4 [pid 431] close(3) = 0 [pid 431] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 30.371584][ T83] RDX: 00000000000000ff RSI: 000055b3811b2300 RDI: 0000000000000000 [ 30.379477][ T83] RBP: 000055b3811b22c0 R08: 0000000000000001 R09: 0000000000000000 [ 30.387286][ T83] R10: 00007fbd16ee23a3 R11: 0000000000000246 R12: 000055b3811b2339 [ 30.395096][ T83] R13: 000055b3811b2300 R14: 0000000000000000 R15: 00007fbd16f20a80 [ 30.402920][ T83] [pid 431] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 427] <... bpf resumed>) = 7 [pid 426] <... bpf resumed>) = 7 [pid 429] <... bpf resumed>) = 4 [pid 426] exit_group(0 [pid 431] <... bpf resumed>) = 4 [pid 429] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 428] <... bpf resumed>) = 7 [pid 427] exit_group(0 [pid 426] <... exit_group resumed>) = ? [pid 431] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 429] <... bpf resumed>) = 5 [pid 428] exit_group(0 [pid 427] <... exit_group resumed>) = ? [pid 431] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 429] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 428] <... exit_group resumed>) = ? [pid 426] +++ exited with 0 +++ [pid 431] <... bpf resumed>) = 0 [pid 429] <... bpf resumed>) = 0 [pid 429] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=426, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 431] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 429] <... bpf resumed>) = 6 [pid 300] <... restart_syscall resumed>) = 0 [pid 431] <... bpf resumed>) = 6 [pid 429] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 431] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 432 ./strace-static-x86_64: Process 432 attached [pid 432] set_robust_list(0x555555e33660, 24) = 0 [pid 432] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 432] setpgid(0, 0) = 0 [pid 432] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 432] write(3, "1000", 4) = 4 [pid 432] close(3) = 0 [pid 432] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 432] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 428] +++ exited with 0 +++ [pid 427] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=427, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=428, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 434 ./strace-static-x86_64: Process 433 attached [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 433 ./strace-static-x86_64: Process 434 attached [pid 433] set_robust_list(0x555555e33660, 24) = 0 [pid 433] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 433] setpgid(0, 0) = 0 [pid 433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 433] write(3, "1000", 4) = 4 [pid 433] close(3) = 0 [pid 433] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 434] set_robust_list(0x555555e33660, 24) = 0 [pid 434] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 433] <... bpf resumed>) = 3 [pid 434] setpgid(0, 0) = 0 [pid 433] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 434] write(3, "1000", 4) = 4 [pid 434] close(3) = 0 [pid 434] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 434] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 429] <... bpf resumed>) = 7 [pid 433] <... bpf resumed>) = 4 [pid 432] <... bpf resumed>) = 4 [pid 431] <... bpf resumed>) = 7 [pid 429] exit_group(0 [pid 432] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 429] <... exit_group resumed>) = ? [pid 434] <... bpf resumed>) = 4 [pid 433] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 432] <... bpf resumed>) = 5 [pid 431] exit_group(0 [ 30.413664][ T28] audit: type=1400 audit(1713756774.225:73): avc: denied { remove_name } for pid=83 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.436438][ T28] audit: type=1400 audit(1713756774.225:74): avc: denied { rename } for pid=83 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [pid 434] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 433] <... bpf resumed>) = 5 [pid 432] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 431] <... exit_group resumed>) = ? [pid 434] <... bpf resumed>) = 5 [pid 433] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 432] <... bpf resumed>) = 0 [pid 434] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 433] <... bpf resumed>) = 0 [pid 432] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 434] <... bpf resumed>) = 0 [pid 433] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 432] <... bpf resumed>) = 6 [pid 434] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 433] <... bpf resumed>) = 6 [pid 432] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 434] <... bpf resumed>) = 6 [pid 433] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 434] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 429] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=429, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 435 ./strace-static-x86_64: Process 435 attached [pid 435] set_robust_list(0x555555e33660, 24) = 0 [pid 435] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 435] setpgid(0, 0) = 0 [pid 435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 435] write(3, "1000", 4) = 4 [pid 435] close(3) = 0 [pid 435] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 30.495055][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 30.508237][ T429] BUG: scheduling while atomic: syz-executor115/429/0x00000002 [ 30.515654][ T429] Modules linked in: [ 30.520165][ T429] Preemption disabled at: [ 30.520174][ T429] [] is_module_text_address+0x1f/0x360 [ 30.531198][ T429] CPU: 1 PID: 429 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 30.542558][ T429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 30.552454][ T429] Call Trace: [ 30.555705][ T429] [ 30.558489][ T429] dump_stack_lvl+0x151/0x1b7 [ 30.563003][ T429] ? is_module_text_address+0x1f/0x360 [ 30.568287][ T429] ? is_module_text_address+0x1f/0x360 [ 30.573595][ T429] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 30.578967][ T429] ? is_module_text_address+0x1f/0x360 [ 30.584265][ T429] dump_stack+0x15/0x1b [ 30.588250][ T429] __schedule_bug+0x195/0x260 [ 30.592772][ T429] ? cpu_util_update_eff+0x10e0/0x10e0 [ 30.598057][ T429] ? sysvec_irq_work+0x52/0xb0 [ 30.602719][ T429] ? asm_sysvec_irq_work+0x1b/0x20 [ 30.607606][ T429] __schedule+0xcf7/0x1550 [ 30.611859][ T429] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 30.617159][ T429] ? __sched_text_start+0x8/0x8 [ 30.621847][ T429] ? startup_64+0x2/0x60 [ 30.625919][ T429] do_task_dead+0x99/0xa0 [ 30.630089][ T429] do_exit+0x202a/0x2b80 [ 30.634176][ T429] ? put_task_struct+0x80/0x80 [ 30.638942][ T429] ? __kasan_check_write+0x14/0x20 [ 30.643883][ T429] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 30.648833][ T429] ? _raw_spin_lock_irqsave+0x210/0x210 [ 30.654221][ T429] ? zap_other_threads+0x29c/0x2d0 [ 30.659170][ T429] do_group_exit+0x21a/0x2d0 [ 30.663594][ T429] __x64_sys_exit_group+0x3f/0x40 [ 30.668455][ T429] do_syscall_64+0x3d/0xb0 [ 30.672705][ T429] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 30.678428][ T429] RIP: 0033:0x7fec422c2ff9 [ 30.682687][ T429] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [pid 435] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 431] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=431, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 436 ./strace-static-x86_64: Process 436 attached [pid 436] set_robust_list(0x555555e33660, 24) = 0 [pid 436] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 436] setpgid(0, 0) = 0 [pid 436] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 436] write(3, "1000", 4) = 4 [pid 436] close(3) = 0 [pid 436] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 436] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 432] <... bpf resumed>) = 7 [pid 435] <... bpf resumed>) = 4 [pid 434] <... bpf resumed>) = 7 [pid 433] <... bpf resumed>) = 7 [pid 432] exit_group(0) = ? [pid 436] <... bpf resumed>) = 4 [pid 435] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 434] exit_group(0 [pid 433] exit_group(0 [ 30.689818][ T429] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 30.698069][ T429] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 30.705880][ T429] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 30.713686][ T429] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 30.721499][ T429] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 30.729313][ T429] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 30.737135][ T429] [pid 436] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 435] <... bpf resumed>) = 5 [pid 434] <... exit_group resumed>) = ? [pid 433] <... exit_group resumed>) = ? [pid 436] <... bpf resumed>) = 5 [pid 435] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 434] +++ exited with 0 +++ [pid 433] +++ exited with 0 +++ [pid 436] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 435] <... bpf resumed>) = 0 [pid 436] <... bpf resumed>) = 0 [pid 435] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 436] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 435] <... bpf resumed>) = 6 [pid 436] <... bpf resumed>) = 6 [pid 435] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 436] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 435] <... bpf resumed>) = 7 [pid 436] <... bpf resumed>) = 7 [pid 435] exit_group(0 [pid 436] exit_group(0 [pid 435] <... exit_group resumed>) = ? [pid 436] <... exit_group resumed>) = ? [pid 435] +++ exited with 0 +++ [pid 436] +++ exited with 0 +++ [pid 432] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=435, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=434, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=433, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=436, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=432, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 437 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 438 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 439 [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 440 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 441 ./strace-static-x86_64: Process 441 attached [pid 441] set_robust_list(0x555555e33660, 24) = 0 [pid 441] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 441] setpgid(0, 0) = 0 [pid 441] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 439 attached [pid 439] set_robust_list(0x555555e33660, 24 [pid 441] <... openat resumed>) = 3 [pid 439] <... set_robust_list resumed>) = 0 [pid 439] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 441] write(3, "1000", 4 [pid 439] setpgid(0, 0 [pid 441] <... write resumed>) = 4 [pid 441] close(3) = 0 [pid 439] <... setpgid resumed>) = 0 [pid 441] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [ 30.755528][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 30.768374][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000104, exited with 00000103? [ 30.780325][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000105, exited with 00000104? [ 30.792521][ T432] BUG: scheduling while atomic: syz-executor115/432/0x00000004 [ 30.800322][ T432] Modules linked in: [pid 439] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 439] write(3, "1000", 4) = 4 [pid 439] close(3 [pid 441] <... bpf resumed>) = 3 [pid 439] <... close resumed>) = 0 [pid 439] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 ./strace-static-x86_64: Process 437 attached [pid 437] set_robust_list(0x555555e33660, 24) = 0 [pid 441] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 439] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 437] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 30.804136][ T432] Preemption disabled at: [ 30.804146][ T432] [] is_module_text_address+0x1f/0x360 [ 30.816236][ T432] CPU: 1 PID: 432 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 30.827607][ T432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 30.837586][ T432] Call Trace: [ 30.840709][ T432] [ 30.843487][ T432] dump_stack_lvl+0x151/0x1b7 [ 30.847999][ T432] ? is_module_text_address+0x1f/0x360 [ 30.853294][ T432] ? is_module_text_address+0x1f/0x360 [ 30.858589][ T432] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 30.863904][ T432] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 30.869526][ T432] ? is_module_text_address+0x1f/0x360 [ 30.874825][ T432] dump_stack+0x15/0x1b [ 30.878816][ T432] __schedule_bug+0x195/0x260 [ 30.883329][ T432] ? cpu_util_update_eff+0x10e0/0x10e0 [ 30.888625][ T432] __schedule+0xcf7/0x1550 [ 30.892886][ T432] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 30.898171][ T432] ? __sched_text_start+0x8/0x8 [ 30.902854][ T432] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 30.908326][ T432] do_task_dead+0x99/0xa0 [ 30.912490][ T432] do_exit+0x202a/0x2b80 [ 30.916569][ T432] ? put_task_struct+0x80/0x80 [ 30.921168][ T432] ? __kasan_check_write+0x14/0x20 [ 30.926113][ T432] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 30.931061][ T432] ? _raw_spin_lock_irqsave+0x210/0x210 [ 30.936441][ T432] ? zap_other_threads+0x29c/0x2d0 [ 30.941391][ T432] do_group_exit+0x21a/0x2d0 [ 30.945907][ T432] __x64_sys_exit_group+0x3f/0x40 [ 30.950764][ T432] do_syscall_64+0x3d/0xb0 [ 30.955017][ T432] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 30.960746][ T432] RIP: 0033:0x7fec422c2ff9 [ 30.965000][ T432] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 30.971853][ T432] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 30.980191][ T432] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 30.987996][ T432] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 30.995815][ T432] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [pid 437] setpgid(0, 0 [pid 441] <... bpf resumed>) = 4 [pid 441] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 441] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 441] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 441] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16) = 7 [pid 441] exit_group(0) = ? [pid 439] <... bpf resumed>) = 4 [pid 437] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 440 attached ./strace-static-x86_64: Process 438 attached [pid 439] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 437] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 439] <... bpf resumed>) = 5 [pid 439] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 439] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 437] <... openat resumed>) = 3 [pid 439] <... bpf resumed>) = 6 [pid 437] write(3, "1000", 4) = 4 [pid 437] close(3) = 0 [pid 437] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 439] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 437] <... bpf resumed>) = 3 [pid 437] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 440] set_robust_list(0x555555e33660, 24) = 0 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 438] set_robust_list(0x555555e33660, 24) = 0 [pid 441] +++ exited with 0 +++ [pid 440] write(3, "1000", 4 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=441, si_uid=0, si_status=0, si_utime=0, si_stime=19} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 440] <... write resumed>) = 4 [pid 438] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 440] close(3) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 443 [pid 438] <... prctl resumed>) = 0 [pid 438] setpgid(0, 0 [pid 440] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 438] <... setpgid resumed>) = 0 [pid 438] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 438] write(3, "1000", 4) = 4 [pid 438] close(3) = 0 [pid 438] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 440] <... bpf resumed>) = 3 [pid 438] <... bpf resumed>) = 3 [pid 440] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 438] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16./strace-static-x86_64: Process 443 attached [pid 443] set_robust_list(0x555555e33660, 24) = 0 [pid 443] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 443] setpgid(0, 0) = 0 [pid 443] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 443] write(3, "1000", 4) = 4 [pid 443] close(3) = 0 [ 31.003623][ T432] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 31.011431][ T432] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 31.019251][ T432] [ 31.026057][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 31.038163][ T441] BUG: scheduling while atomic: syz-executor115/441/0x00000002 [ 31.045900][ T441] Modules linked in: [ 31.049761][ T441] Preemption disabled at: [pid 443] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 31.049772][ T441] [] is_module_text_address+0x1f/0x360 [ 31.061485][ T441] CPU: 1 PID: 441 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 31.072840][ T441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 31.082736][ T441] Call Trace: [ 31.085858][ T441] [ 31.088643][ T441] dump_stack_lvl+0x151/0x1b7 [ 31.093143][ T441] ? is_module_text_address+0x1f/0x360 [ 31.098439][ T441] ? is_module_text_address+0x1f/0x360 [ 31.103764][ T441] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 31.109030][ T441] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 31.114754][ T441] ? is_module_text_address+0x1f/0x360 [ 31.120142][ T441] dump_stack+0x15/0x1b [ 31.124128][ T441] __schedule_bug+0x195/0x260 [ 31.128643][ T441] ? cpu_util_update_eff+0x10e0/0x10e0 [ 31.133945][ T441] __schedule+0xcf7/0x1550 [ 31.138190][ T441] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 31.143491][ T441] ? __sched_text_start+0x8/0x8 [ 31.148176][ T441] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 31.153640][ T441] do_task_dead+0x99/0xa0 [ 31.157805][ T441] do_exit+0x202a/0x2b80 [ 31.161889][ T441] ? put_task_struct+0x80/0x80 [ 31.166485][ T441] ? __kasan_check_write+0x14/0x20 [ 31.171432][ T441] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 31.176384][ T441] ? _raw_spin_lock_irqsave+0x210/0x210 [ 31.181761][ T441] ? zap_other_threads+0x29c/0x2d0 [ 31.186707][ T441] do_group_exit+0x21a/0x2d0 [ 31.191133][ T441] __x64_sys_exit_group+0x3f/0x40 [ 31.195994][ T441] do_syscall_64+0x3d/0xb0 [ 31.200250][ T441] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 31.205982][ T441] RIP: 0033:0x7fec422c2ff9 [ 31.210231][ T441] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 31.217082][ T441] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 31.225425][ T441] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 31.233235][ T441] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 31.241056][ T441] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 31.248946][ T441] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [pid 443] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 439] <... bpf resumed>) = 7 [pid 440] <... bpf resumed>) = 4 [pid 438] <... bpf resumed>) = 4 [pid 437] <... bpf resumed>) = 4 [pid 437] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 443] <... bpf resumed>) = 4 [pid 440] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 439] exit_group(0 [pid 438] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 437] <... bpf resumed>) = 5 [pid 443] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 440] <... bpf resumed>) = 5 [pid 439] <... exit_group resumed>) = ? [pid 438] <... bpf resumed>) = 5 [pid 437] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 443] <... bpf resumed>) = 5 [pid 437] <... bpf resumed>) = 0 [ 31.256757][ T441] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 31.264575][ T441] [ 31.271952][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 31.283509][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 31.290790][ T292] Modules linked in: [ 31.294997][ T292] Preemption disabled at: [ 31.295006][ T292] [] is_module_text_address+0x1f/0x360 [ 31.306045][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 31.317483][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 31.327380][ T292] Call Trace: [ 31.330503][ T292] [ 31.333285][ T292] dump_stack_lvl+0x151/0x1b7 [ 31.337800][ T292] ? is_module_text_address+0x1f/0x360 [ 31.343086][ T292] ? is_module_text_address+0x1f/0x360 [ 31.348386][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 31.353686][ T292] ? is_module_text_address+0x1f/0x360 [ 31.358973][ T292] dump_stack+0x15/0x1b [ 31.362967][ T292] __schedule_bug+0x195/0x260 [ 31.367579][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 31.372855][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 31.378415][ T292] __schedule+0xcf7/0x1550 [ 31.382665][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 31.388568][ T292] ? ____fput+0x15/0x20 [ 31.392556][ T292] ? __sched_text_start+0x8/0x8 [ 31.397257][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 31.402716][ T292] ? unlock_page_memcg+0x160/0x160 [ 31.407665][ T292] schedule+0xc3/0x180 [ 31.411591][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 31.416601][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 31.421895][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 31.427277][ T292] do_syscall_64+0x49/0xb0 [ 31.431528][ T292] ? sysvec_apic_timer_interrupt+0x55/0xc0 [ 31.437172][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 31.442899][ T292] RIP: 0033:0x4e65f7 [ 31.446631][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 31.466077][ T292] RSP: 002b:00007fff6da4d1d8 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [ 31.474321][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 31.482135][ T292] RDX: 00007fff6da4d1e0 RSI: 0000000000008910 RDI: 0000000000000003 [ 31.489948][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000d [ 31.497755][ T292] R10: 00000000005549d3 R11: 0000000000000286 R12: 00007fff6da4d240 [pid 437] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 443] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 440] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 438] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 437] <... bpf resumed>) = 6 [pid 437] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 443] <... bpf resumed>) = 0 [pid 440] <... bpf resumed>) = 0 [pid 439] +++ exited with 0 +++ [pid 438] <... bpf resumed>) = 0 [pid 443] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 440] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 438] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=439, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 443] <... bpf resumed>) = 6 [pid 440] <... bpf resumed>) = 6 [pid 438] <... bpf resumed>) = 6 [pid 438] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 443] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 440] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 445 attached , child_tidptr=0x555555e33650) = 445 [pid 445] set_robust_list(0x555555e33660, 24) = 0 [pid 445] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 445] setpgid(0, 0) = 0 [pid 445] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 445] write(3, "1000", 4) = 4 [pid 445] close(3) = 0 [pid 445] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 445] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 437] <... bpf resumed>) = 7 [pid 437] exit_group(0 [pid 445] <... bpf resumed>) = 4 [pid 443] <... bpf resumed>) = 7 [pid 440] <... bpf resumed>) = 7 [pid 438] <... bpf resumed>) = 7 [pid 437] <... exit_group resumed>) = ? [pid 443] exit_group(0 [pid 440] exit_group(0 [pid 438] exit_group(0) = ? [pid 443] <... exit_group resumed>) = ? [pid 440] <... exit_group resumed>) = ? [pid 438] +++ exited with 0 +++ [pid 437] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=437, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=438, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 445] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 445] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 445] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 301] <... restart_syscall resumed>) = 0 [pid 300] <... restart_syscall resumed>) = 0 [pid 445] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 446 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 447 [pid 440] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=440, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 31.505650][ T292] R13: 00007fff6da4d1e0 R14: 0000000000427210 R15: 0000000000617180 [ 31.513469][ T292] [ 31.539207][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 31.551683][ T440] BUG: scheduling while atomic: syz-executor115/440/0x00000002 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 445] <... bpf resumed>) = 7 [pid 443] +++ exited with 0 +++ [pid 297] <... restart_syscall resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=443, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 448 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 449 [pid 445] exit_group(0) = ? ./strace-static-x86_64: Process 448 attached [pid 448] set_robust_list(0x555555e33660, 24) = 0 [pid 448] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 448] setpgid(0, 0) = 0 [pid 448] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 448] write(3, "1000", 4) = 4 [pid 448] close(3) = 0 ./strace-static-x86_64: Process 447 attached [pid 448] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 447] set_robust_list(0x555555e33660, 24) = 0 [pid 447] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 447] setpgid(0, 0) = 0 [pid 447] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 447] write(3, "1000", 4) = 4 [pid 447] close(3) = 0 [ 31.559351][ T440] Modules linked in: [ 31.563137][ T440] Preemption disabled at: [ 31.563146][ T440] [] is_module_text_address+0x1f/0x360 [ 31.574664][ T440] CPU: 1 PID: 440 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 31.586035][ T440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 31.595932][ T440] Call Trace: [ 31.599050][ T440] [ 31.601825][ T440] dump_stack_lvl+0x151/0x1b7 [ 31.606338][ T440] ? is_module_text_address+0x1f/0x360 [ 31.611633][ T440] ? is_module_text_address+0x1f/0x360 [ 31.616928][ T440] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 31.622224][ T440] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 31.627951][ T440] ? is_module_text_address+0x1f/0x360 [ 31.633344][ T440] dump_stack+0x15/0x1b [ 31.637509][ T440] __schedule_bug+0x195/0x260 [ 31.642020][ T440] ? cpu_util_update_eff+0x10e0/0x10e0 [ 31.647317][ T440] __schedule+0xcf7/0x1550 [ 31.651567][ T440] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 31.656865][ T440] ? __sched_text_start+0x8/0x8 [ 31.661548][ T440] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 31.667017][ T440] do_task_dead+0x99/0xa0 [ 31.671186][ T440] do_exit+0x202a/0x2b80 [ 31.675265][ T440] ? put_task_struct+0x80/0x80 [ 31.679862][ T440] ? __kasan_check_write+0x14/0x20 [ 31.684816][ T440] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 31.689757][ T440] ? _raw_spin_lock_irqsave+0x210/0x210 [ 31.695138][ T440] ? zap_other_threads+0x29c/0x2d0 [ 31.700086][ T440] do_group_exit+0x21a/0x2d0 [ 31.704511][ T440] __x64_sys_exit_group+0x3f/0x40 [ 31.709372][ T440] do_syscall_64+0x3d/0xb0 [ 31.713627][ T440] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 31.719354][ T440] RIP: 0033:0x7fec422c2ff9 [ 31.723610][ T440] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 31.730584][ T440] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 31.738831][ T440] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 31.746729][ T440] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [pid 447] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 448] <... bpf resumed>) = 3 [pid 447] <... bpf resumed>) = 3 [pid 448] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 447] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 445] +++ exited with 0 +++ ./strace-static-x86_64: Process 449 attached ./strace-static-x86_64: Process 446 attached [pid 449] set_robust_list(0x555555e33660, 24) = 0 [pid 449] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=445, si_uid=0, si_status=0, si_utime=0, si_stime=20} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 446] set_robust_list(0x555555e33660, 24 [pid 449] <... prctl resumed>) = 0 [pid 449] setpgid(0, 0) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 449] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 449] write(3, "1000", 4) = 4 [pid 449] close(3) = 0 [pid 449] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 446] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 450 attached [pid 446] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 450 [pid 449] <... bpf resumed>) = 3 [pid 450] set_robust_list(0x555555e33660, 24 [pid 449] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 446] <... prctl resumed>) = 0 [pid 446] setpgid(0, 0) = 0 [pid 446] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 446] write(3, "1000", 4) = 4 [pid 446] close(3 [pid 450] <... set_robust_list resumed>) = 0 [pid 446] <... close resumed>) = 0 [pid 446] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 450] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 446] <... bpf resumed>) = 3 [pid 450] setpgid(0, 0) = 0 [pid 450] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 446] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 450] <... openat resumed>) = 3 [pid 450] write(3, "1000", 4) = 4 [pid 450] close(3) = 0 [pid 450] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 450] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 447] <... bpf resumed>) = 4 [pid 447] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 449] <... bpf resumed>) = 4 [pid 448] <... bpf resumed>) = 4 [pid 447] <... bpf resumed>) = 5 [pid 449] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 448] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 447] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 450] <... bpf resumed>) = 4 [pid 449] <... bpf resumed>) = 5 [pid 448] <... bpf resumed>) = 5 [pid 447] <... bpf resumed>) = 0 [pid 446] <... bpf resumed>) = 4 [pid 449] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 448] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 447] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 450] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 449] <... bpf resumed>) = 0 [pid 448] <... bpf resumed>) = 0 [pid 446] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 450] <... bpf resumed>) = 5 [pid 449] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 448] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 447] <... bpf resumed>) = 6 [pid 449] <... bpf resumed>) = 6 [pid 448] <... bpf resumed>) = 6 [pid 447] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 446] <... bpf resumed>) = 5 [pid 449] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 448] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 449] <... bpf resumed>) = 7 [pid 448] <... bpf resumed>) = 7 [pid 447] <... bpf resumed>) = 7 [pid 449] exit_group(0 [pid 448] exit_group(0 [pid 446] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [ 31.754565][ T440] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 31.762354][ T440] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 31.770164][ T440] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 31.777981][ T440] [ 31.812836][ C1] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000103, exited with 00000102? [ 31.824776][ T447] BUG: scheduling while atomic: syz-executor115/447/0x00000002 [ 31.832356][ T447] Modules linked in: [ 31.836113][ T447] Preemption disabled at: [ 31.836124][ T447] [] is_module_text_address+0x1f/0x360 [ 31.847130][ T447] CPU: 1 PID: 447 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 31.858469][ T447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 31.868361][ T447] Call Trace: [ 31.871483][ T447] [ 31.874262][ T447] dump_stack_lvl+0x151/0x1b7 [ 31.878858][ T447] ? is_module_text_address+0x1f/0x360 [ 31.884154][ T447] ? is_module_text_address+0x1f/0x360 [ 31.889452][ T447] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 31.894747][ T447] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 31.900385][ T447] ? is_module_text_address+0x1f/0x360 [ 31.905688][ T447] dump_stack+0x15/0x1b [ 31.909676][ T447] __schedule_bug+0x195/0x260 [ 31.914188][ T447] ? cpu_util_update_eff+0x10e0/0x10e0 [ 31.919484][ T447] __schedule+0xcf7/0x1550 [ 31.923736][ T447] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 31.929032][ T447] ? __sched_text_start+0x8/0x8 [ 31.933715][ T447] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 31.939183][ T447] do_task_dead+0x99/0xa0 [ 31.943348][ T447] do_exit+0x202a/0x2b80 [ 31.947431][ T447] ? put_task_struct+0x80/0x80 [ 31.952028][ T447] ? __kasan_check_write+0x14/0x20 [ 31.956977][ T447] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 31.961922][ T447] ? _raw_spin_lock_irqsave+0x210/0x210 [ 31.967305][ T447] ? zap_other_threads+0x29c/0x2d0 [ 31.972265][ T447] do_group_exit+0x21a/0x2d0 [ 31.976682][ T447] __x64_sys_exit_group+0x3f/0x40 [ 31.981537][ T447] do_syscall_64+0x3d/0xb0 [ 31.985791][ T447] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 31.991518][ T447] RIP: 0033:0x7fec422c2ff9 [ 31.995772][ T447] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 32.002626][ T447] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 449] <... exit_group resumed>) = ? [pid 448] <... exit_group resumed>) = ? [pid 447] exit_group(0 [pid 449] +++ exited with 0 +++ [pid 448] +++ exited with 0 +++ [pid 450] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 447] <... exit_group resumed>) = ? [pid 446] <... bpf resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=448, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=449, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 451 [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 452 ./strace-static-x86_64: Process 452 attached [pid 452] set_robust_list(0x555555e33660, 24) = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 452] setpgid(0, 0) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 452] write(3, "1000", 4) = 4 [pid 452] close(3) = 0 [pid 452] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46./strace-static-x86_64: Process 451 attached [pid 451] set_robust_list(0x555555e33660, 24) = 0 [pid 451] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 451] setpgid(0, 0) = 0 [pid 451] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 451] write(3, "1000", 4) = 4 [pid 451] close(3) = 0 [pid 451] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 452] <... bpf resumed>) = 3 [pid 452] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 452] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 452] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 452] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144) = 6 [pid 451] <... bpf resumed>) = 3 [pid 451] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16) = 4 [pid 451] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 451] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 451] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 447] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=447, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 453 [pid 452] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16./strace-static-x86_64: Process 453 attached [pid 453] set_robust_list(0x555555e33660, 24) = 0 [pid 453] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 453] setpgid(0, 0) = 0 [pid 453] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 451] <... bpf resumed>) = 6 [pid 451] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 453] write(3, "1000", 4) = 4 [pid 453] close(3) = 0 [pid 453] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 452] <... bpf resumed>) = 7 [pid 451] <... bpf resumed>) = 7 [pid 450] <... bpf resumed>) = 0 [pid 446] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 453] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 451] exit_group(0 [pid 453] <... bpf resumed>) = 4 [pid 451] <... exit_group resumed>) = ? [pid 453] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 451] +++ exited with 0 +++ [pid 450] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 453] <... bpf resumed>) = 5 [pid 453] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=451, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 453] <... bpf resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 453] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 297] <... restart_syscall resumed>) = 0 [pid 452] exit_group(0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 452] <... exit_group resumed>) = ? [ 32.010871][ T447] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 32.018683][ T447] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 32.026494][ T447] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 32.034324][ T447] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 32.042116][ T447] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 32.049935][ T447] [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 454 [pid 452] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=21} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 455 ./strace-static-x86_64: Process 454 attached [pid 454] set_robust_list(0x555555e33660, 24) = 0 [pid 454] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 454] setpgid(0, 0) = 0 [pid 454] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 454] write(3, "1000", 4) = 4 [pid 454] close(3) = 0 [pid 454] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46./strace-static-x86_64: Process 455 attached [pid 455] set_robust_list(0x555555e33660, 24) = 0 [pid 455] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 455] setpgid(0, 0) = 0 [pid 455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 455] write(3, "1000", 4) = 4 [pid 455] close(3) = 0 [ 32.053749][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 32.065166][ T83] BUG: scheduling while atomic: syslogd/83/0x00000002 [ 32.072528][ T83] Modules linked in: [ 32.076789][ T83] Preemption disabled at: [ 32.076801][ T83] [] is_module_text_address+0x1f/0x360 [ 32.089020][ T83] CPU: 1 PID: 83 Comm: syslogd Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 32.099607][ T83] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.109496][ T83] Call Trace: [ 32.112619][ T83] [ 32.115397][ T83] dump_stack_lvl+0x151/0x1b7 [ 32.119914][ T83] ? is_module_text_address+0x1f/0x360 [ 32.125206][ T83] ? is_module_text_address+0x1f/0x360 [ 32.130504][ T83] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 32.135809][ T83] ? fsnotify_perm+0x470/0x5d0 [ 32.140501][ T83] ? is_module_text_address+0x1f/0x360 [ 32.145884][ T83] dump_stack+0x15/0x1b [ 32.149882][ T83] __schedule_bug+0x195/0x260 [ 32.154390][ T83] ? cpu_util_update_eff+0x10e0/0x10e0 [ 32.159689][ T83] ? kernel_read+0x1f0/0x1f0 [ 32.164196][ T83] __schedule+0xcf7/0x1550 [ 32.168450][ T83] ? __kasan_check_read+0x11/0x20 [ 32.173321][ T83] ? __fdget_pos+0x204/0x390 [ 32.177735][ T83] ? __sched_text_start+0x8/0x8 [ 32.182423][ T83] ? ksys_read+0x24f/0x2c0 [ 32.186673][ T83] ? __sched_clock_gtod_offset+0x100/0x100 [ 32.192326][ T83] schedule+0xc3/0x180 [ 32.196222][ T83] exit_to_user_mode_loop+0x4e/0xa0 [ 32.201257][ T83] exit_to_user_mode_prepare+0x5a/0xa0 [ 32.206554][ T83] syscall_exit_to_user_mode+0x26/0x140 [ 32.211944][ T83] do_syscall_64+0x49/0xb0 [ 32.216182][ T83] ? sysvec_call_function_single+0x52/0xb0 [ 32.221830][ T83] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 32.227552][ T83] RIP: 0033:0x7fbd16d43b6a [ 32.231807][ T83] Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83 [ 32.251251][ T83] RSP: 002b:00007ffef223c3d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [pid 455] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 450] <... bpf resumed>) = 6 [pid 446] <... bpf resumed>) = 6 [pid 455] <... bpf resumed>) = 3 [pid 454] <... bpf resumed>) = 3 [pid 453] <... bpf resumed>) = 6 [pid 455] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 454] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 453] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 450] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 446] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 453] <... bpf resumed>) = 7 [pid 455] <... bpf resumed>) = 4 [pid 454] <... bpf resumed>) = 4 [pid 453] exit_group(0 [pid 455] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 454] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 450] <... bpf resumed>) = 7 [pid 446] <... bpf resumed>) = 7 [pid 455] <... bpf resumed>) = 5 [pid 454] <... bpf resumed>) = 5 [pid 453] <... exit_group resumed>) = ? [pid 455] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 454] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 450] exit_group(0 [pid 446] exit_group(0 [pid 455] <... bpf resumed>) = 0 [pid 455] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 454] <... bpf resumed>) = 0 [pid 453] +++ exited with 0 +++ [pid 450] <... exit_group resumed>) = ? [pid 446] <... exit_group resumed>) = ? [pid 455] <... bpf resumed>) = 6 [pid 454] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=453, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 455] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 454] <... bpf resumed>) = 6 [pid 454] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 457 ./strace-static-x86_64: Process 457 attached [pid 457] set_robust_list(0x555555e33660, 24) = 0 [pid 457] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 457] setpgid(0, 0) = 0 [pid 457] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 457] write(3, "1000", 4) = 4 [pid 457] close(3) = 0 [pid 457] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 457] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 450] +++ exited with 0 +++ [pid 446] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=446, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=450, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 301] <... restart_syscall resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 458 attached ./strace-static-x86_64: Process 459 attached [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 459 [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 458 [pid 459] set_robust_list(0x555555e33660, 24 [pid 458] set_robust_list(0x555555e33660, 24 [pid 459] <... set_robust_list resumed>) = 0 [pid 458] <... set_robust_list resumed>) = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 459] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 458] <... prctl resumed>) = 0 [pid 458] setpgid(0, 0) = 0 [pid 459] <... prctl resumed>) = 0 [pid 459] setpgid(0, 0) = 0 [pid 459] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 459] write(3, "1000", 4) = 4 [pid 459] close(3) = 0 [pid 459] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 458] <... openat resumed>) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 459] <... bpf resumed>) = 3 [pid 458] close(3 [pid 459] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 458] <... close resumed>) = 0 [pid 458] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 32.259498][ T83] RAX: 0000000000000044 RBX: 0000000000000002 RCX: 00007fbd16d43b6a [ 32.267306][ T83] RDX: 00000000000000ff RSI: 000055b3811b2300 RDI: 0000000000000000 [ 32.275122][ T83] RBP: 000055b3811b22c0 R08: 0000000000000001 R09: 0000000000000000 [ 32.282933][ T83] R10: 00007fbd16ee23a3 R11: 0000000000000246 R12: 000055b3811b236e [ 32.290738][ T83] R13: 000055b3811b2300 R14: 0000000000000000 R15: 00007fbd16f20a80 [ 32.298556][ T83] [pid 458] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 455] <... bpf resumed>) = 7 [pid 457] <... bpf resumed>) = 4 [pid 455] exit_group(0 [pid 454] <... bpf resumed>) = 7 [pid 457] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 455] <... exit_group resumed>) = ? [pid 459] <... bpf resumed>) = 4 [pid 458] <... bpf resumed>) = 4 [pid 457] <... bpf resumed>) = 5 [pid 454] exit_group(0 [pid 459] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 458] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 457] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 454] <... exit_group resumed>) = ? [pid 459] <... bpf resumed>) = 5 [pid 458] <... bpf resumed>) = 5 [pid 457] <... bpf resumed>) = 0 [pid 459] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 458] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 457] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 459] <... bpf resumed>) = 0 [pid 458] <... bpf resumed>) = 0 [pid 457] <... bpf resumed>) = 6 [pid 459] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 458] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 457] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 455] +++ exited with 0 +++ [pid 459] <... bpf resumed>) = 6 [pid 458] <... bpf resumed>) = 6 [pid 457] <... bpf resumed>) = 7 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=455, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 459] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 458] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 457] exit_group(0 [pid 454] +++ exited with 0 +++ [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 459] <... bpf resumed>) = 7 [pid 458] <... bpf resumed>) = 7 [pid 457] <... exit_group resumed>) = ? [pid 296] <... restart_syscall resumed>) = 0 [pid 459] exit_group(0 [pid 458] exit_group(0 [pid 457] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=454, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 459] <... exit_group resumed>) = ? [pid 458] <... exit_group resumed>) = ? [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=457, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 459] +++ exited with 0 +++ [pid 458] +++ exited with 0 +++ [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=459, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=458, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 460 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 461 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 462 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 463 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 464 ./strace-static-x86_64: Process 463 attached [pid 463] set_robust_list(0x555555e33660, 24) = 0 [pid 463] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 463] setpgid(0, 0./strace-static-x86_64: Process 461 attached ./strace-static-x86_64: Process 464 attached ./strace-static-x86_64: Process 462 attached ./strace-static-x86_64: Process 460 attached ) = 0 [pid 461] set_robust_list(0x555555e33660, 24 [pid 463] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 461] <... set_robust_list resumed>) = 0 [pid 461] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 463] <... openat resumed>) = 3 [pid 461] <... prctl resumed>) = 0 [pid 461] setpgid(0, 0) = 0 [pid 463] write(3, "1000", 4 [pid 461] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 463] <... write resumed>) = 4 [pid 461] <... openat resumed>) = 3 [pid 463] close(3 [pid 461] write(3, "1000", 4 [pid 460] set_robust_list(0x555555e33660, 24 [pid 463] <... close resumed>) = 0 [pid 461] <... write resumed>) = 4 [pid 460] <... set_robust_list resumed>) = 0 [pid 463] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 461] close(3 [ 32.354195][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 32.367129][ T455] BUG: scheduling while atomic: syz-executor115/455/0x00000002 [ 32.375541][ T455] Modules linked in: [ 32.379748][ T455] Preemption disabled at: [ 32.379759][ T455] [] rwsem_write_trylock+0x93/0x290 [ 32.391375][ T455] CPU: 1 PID: 455 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [pid 460] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 463] <... bpf resumed>) = 3 [pid 461] <... close resumed>) = 0 [pid 460] <... prctl resumed>) = 0 [pid 461] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 460] setpgid(0, 0 [pid 461] <... bpf resumed>) = 3 [pid 460] <... setpgid resumed>) = 0 [pid 461] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [ 32.402904][ T455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.412827][ T455] Call Trace: [ 32.415915][ T455] [ 32.418692][ T455] dump_stack_lvl+0x151/0x1b7 [ 32.423208][ T455] ? rwsem_write_trylock+0x93/0x290 [ 32.428240][ T455] ? rwsem_write_trylock+0x93/0x290 [ 32.433275][ T455] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 32.438713][ T455] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 32.444296][ T455] ? rwsem_write_trylock+0x93/0x290 [ 32.449330][ T455] dump_stack+0x15/0x1b [ 32.453324][ T455] __schedule_bug+0x195/0x260 [ 32.457836][ T455] ? cpu_util_update_eff+0x10e0/0x10e0 [ 32.463133][ T455] __schedule+0xcf7/0x1550 [ 32.467386][ T455] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 32.472688][ T455] ? __sched_text_start+0x8/0x8 [ 32.477364][ T455] ? _raw_write_lock_irqsave+0x160/0x1e0 [ 32.482991][ T455] do_task_dead+0x99/0xa0 [ 32.487153][ T455] do_exit+0x202a/0x2b80 [ 32.491234][ T455] ? put_task_struct+0x80/0x80 [ 32.495831][ T455] ? __kasan_check_write+0x14/0x20 [ 32.500860][ T455] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 32.505806][ T455] ? _raw_spin_lock_irqsave+0x210/0x210 [ 32.511189][ T455] ? zap_other_threads+0x29c/0x2d0 [ 32.516140][ T455] do_group_exit+0x21a/0x2d0 [ 32.520564][ T455] __x64_sys_exit_group+0x3f/0x40 [ 32.525425][ T455] do_syscall_64+0x3d/0xb0 [ 32.529717][ T455] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 32.535405][ T455] RIP: 0033:0x7fec422c2ff9 [ 32.539658][ T455] Code: Unable to access opcode bytes at 0x7fec422c2fcf. [ 32.546519][ T455] RSP: 002b:00007ffe5e1cad88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 460] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 463] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 460] <... openat resumed>) = 3 [pid 460] write(3, "1000", 4) = 4 [pid 460] close(3) = 0 [pid 460] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 464] set_robust_list(0x555555e33660, 24 [pid 462] set_robust_list(0x555555e33660, 24 [pid 464] <... set_robust_list resumed>) = 0 [pid 462] <... set_robust_list resumed>) = 0 [pid 463] <... bpf resumed>) = 4 [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 463] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 464] <... prctl resumed>) = 0 [pid 462] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 461] <... bpf resumed>) = 4 [pid 463] <... bpf resumed>) = 5 [pid 463] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 463] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 464] setpgid(0, 0 [pid 463] <... bpf resumed>) = 6 [pid 462] <... prctl resumed>) = 0 [pid 464] <... setpgid resumed>) = 0 [pid 463] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 462] setpgid(0, 0) = 0 [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 464] <... openat resumed>) = 3 [pid 461] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 464] write(3, "1000", 4 [pid 462] <... openat resumed>) = 3 [pid 461] <... bpf resumed>) = 5 [pid 461] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 461] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 462] write(3, "1000", 4 [pid 464] <... write resumed>) = 4 [pid 464] close(3 [pid 462] <... write resumed>) = 4 [pid 464] <... close resumed>) = 0 [pid 462] close(3 [pid 464] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 462] <... close resumed>) = 0 [pid 461] <... bpf resumed>) = 6 [pid 461] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 462] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 460] <... bpf resumed>) = 3 [pid 460] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 464] <... bpf resumed>) = 3 [pid 464] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 462] <... bpf resumed>) = 3 [pid 462] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 463] <... bpf resumed>) = 7 [pid 464] <... bpf resumed>) = 4 [pid 463] exit_group(0 [pid 462] <... bpf resumed>) = 4 [pid 461] <... bpf resumed>) = 7 [pid 460] <... bpf resumed>) = 4 [pid 464] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 462] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 461] exit_group(0 [pid 460] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 464] <... bpf resumed>) = 5 [pid 463] <... exit_group resumed>) = ? [pid 462] <... bpf resumed>) = 5 [pid 461] <... exit_group resumed>) = ? [pid 460] <... bpf resumed>) = 5 [pid 464] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 463] +++ exited with 0 +++ [pid 462] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 461] +++ exited with 0 +++ [pid 460] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 464] <... bpf resumed>) = 0 [pid 462] <... bpf resumed>) = 0 [pid 460] <... bpf resumed>) = 0 [pid 464] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 462] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 460] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=463, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 464] <... bpf resumed>) = 6 [pid 462] <... bpf resumed>) = 6 [pid 460] <... bpf resumed>) = 6 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 464] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 462] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 460] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=461, si_uid=0, si_status=0, si_utime=0, si_stime=18} --- [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 466 ./strace-static-x86_64: Process 466 attached [pid 466] set_robust_list(0x555555e33660, 24 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 466] <... set_robust_list resumed>) = 0 [pid 466] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 466] setpgid(0, 0) = 0 [pid 466] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 466] write(3, "1000", 4) = 4 [pid 466] close(3) = 0 [pid 466] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46./strace-static-x86_64: Process 467 attached [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 467 [pid 467] set_robust_list(0x555555e33660, 24 [pid 466] <... bpf resumed>) = 3 [pid 466] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 467] <... set_robust_list resumed>) = 0 [pid 467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 467] setpgid(0, 0) = 0 [pid 467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 467] write(3, "1000", 4) = 4 [pid 467] close(3) = 0 [pid 467] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 467] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 464] <... bpf resumed>) = 7 [pid 464] exit_group(0 [pid 462] <... bpf resumed>) = 7 [pid 460] <... bpf resumed>) = 7 [pid 464] <... exit_group resumed>) = ? [pid 466] <... bpf resumed>) = 4 [pid 462] exit_group(0 [pid 460] exit_group(0 [pid 467] <... bpf resumed>) = 4 [ 32.554760][ T455] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec422c2ff9 [ 32.562569][ T455] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 32.570381][ T455] RBP: 00007fec4233f2b0 R08: ffffffffffffffb8 R09: 00000000000000a0 [ 32.578191][ T455] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fec4233f2b0 [ 32.586006][ T455] R13: 0000000000000000 R14: 00007fec4233fd20 R15: 00007fec422941b0 [ 32.593910][ T455] [pid 466] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 464] +++ exited with 0 +++ [pid 462] <... exit_group resumed>) = ? [pid 467] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 460] <... exit_group resumed>) = ? [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 468 ./strace-static-x86_64: Process 468 attached [pid 468] set_robust_list(0x555555e33660, 24) = 0 [pid 468] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 468] setpgid(0, 0) = 0 [pid 468] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 468] write(3, "1000", 4) = 4 [pid 468] close(3) = 0 [pid 468] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 466] <... bpf resumed>) = 5 [pid 467] <... bpf resumed>) = 5 [pid 468] <... bpf resumed>) = 3 [pid 466] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 467] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4) = 0 [pid 467] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 466] <... bpf resumed>) = 0 [pid 466] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 468] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 467] <... bpf resumed>) = 6 [pid 467] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 466] <... bpf resumed>) = 6 [pid 466] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 462] +++ exited with 0 +++ [pid 460] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=462, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=460, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... restart_syscall resumed>) = 0 ./strace-static-x86_64: Process 469 attached [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 469 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 469] set_robust_list(0x555555e33660, 24) = 0 [pid 469] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 469] setpgid(0, 0) = 0 [pid 469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 470 attached [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 470 [pid 469] <... openat resumed>) = 3 [pid 470] set_robust_list(0x555555e33660, 24 [pid 469] write(3, "1000", 4 [pid 470] <... set_robust_list resumed>) = 0 [pid 470] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 469] <... write resumed>) = 4 [pid 469] close(3) = 0 [pid 470] <... prctl resumed>) = 0 [pid 469] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 470] setpgid(0, 0) = 0 [pid 470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 470] write(3, "1000", 4 [pid 469] <... bpf resumed>) = 3 [pid 470] <... write resumed>) = 4 [pid 469] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 470] close(3) = 0 [pid 470] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 470] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 467] <... bpf resumed>) = 7 [pid 470] <... bpf resumed>) = 4 [pid 469] <... bpf resumed>) = 4 [pid 468] <... bpf resumed>) = 4 [pid 467] exit_group(0 [pid 466] <... bpf resumed>) = 7 [pid 470] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 469] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 468] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 467] <... exit_group resumed>) = ? [pid 466] exit_group(0 [pid 470] <... bpf resumed>) = 5 [pid 469] <... bpf resumed>) = 5 [pid 468] <... bpf resumed>) = 5 [pid 469] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 468] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 466] <... exit_group resumed>) = ? [pid 470] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 469] <... bpf resumed>) = 0 [pid 468] <... bpf resumed>) = 0 [pid 470] <... bpf resumed>) = 0 [pid 469] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 468] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [ 32.679444][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000102, exited with 00000101? [ 32.691116][ T292] BUG: scheduling while atomic: strace-static-x/292/0x00000002 [ 32.698791][ T292] Modules linked in: [ 32.702501][ T292] Preemption disabled at: [ 32.702508][ T292] [] is_module_text_address+0x1f/0x360 [ 32.713798][ T292] CPU: 1 PID: 292 Comm: strace-static-x Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 32.725150][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 32.735039][ T292] Call Trace: [ 32.738166][ T292] [ 32.740941][ T292] dump_stack_lvl+0x151/0x1b7 [ 32.745456][ T292] ? is_module_text_address+0x1f/0x360 [ 32.750745][ T292] ? is_module_text_address+0x1f/0x360 [ 32.756053][ T292] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 32.761338][ T292] ? is_module_text_address+0x1f/0x360 [ 32.766636][ T292] dump_stack+0x15/0x1b [ 32.770624][ T292] __schedule_bug+0x195/0x260 [ 32.775138][ T292] ? cpu_util_update_eff+0x10e0/0x10e0 [ 32.780430][ T292] ? percpu_counter_add_batch+0x13d/0x160 [ 32.786083][ T292] __schedule+0xcf7/0x1550 [ 32.790332][ T292] ? blkcg_maybe_throttle_current+0x17d/0xa00 [ 32.796334][ T292] ? ____fput+0x15/0x20 [ 32.800340][ T292] ? __sched_text_start+0x8/0x8 [ 32.805024][ T292] ? __blkcg_punt_bio_submit+0x180/0x180 [ 32.810495][ T292] ? unlock_page_memcg+0x160/0x160 [ 32.815444][ T292] schedule+0xc3/0x180 [ 32.819351][ T292] exit_to_user_mode_loop+0x4e/0xa0 [ 32.824386][ T292] exit_to_user_mode_prepare+0x5a/0xa0 [ 32.829705][ T292] syscall_exit_to_user_mode+0x26/0x140 [ 32.835057][ T292] do_syscall_64+0x49/0xb0 [ 32.839307][ T292] ? sysvec_apic_timer_interrupt+0x55/0xc0 [ 32.844957][ T292] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 32.850677][ T292] RIP: 0033:0x4e65f7 [ 32.854413][ T292] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [pid 470] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 469] <... bpf resumed>) = 6 [pid 470] <... bpf resumed>) = 6 [pid 468] <... bpf resumed>) = 6 [pid 467] +++ exited with 0 +++ [pid 466] +++ exited with 0 +++ [pid 470] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 469] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 468] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=466, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 470] <... bpf resumed>) = 7 [pid 469] <... bpf resumed>) = 7 [pid 468] <... bpf resumed>) = 7 [pid 469] exit_group(0 [pid 468] exit_group(0 [pid 470] exit_group(0 [pid 469] <... exit_group resumed>) = ? [pid 468] <... exit_group resumed>) = ? [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=467, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 470] <... exit_group resumed>) = ? [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 471 attached [pid 468] +++ exited with 0 +++ [pid 471] set_robust_list(0x555555e33660, 24 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=468, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] <... clone resumed>, child_tidptr=0x555555e33650) = 471 [pid 471] <... set_robust_list resumed>) = 0 [pid 471] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 472 attached ) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... clone resumed>, child_tidptr=0x555555e33650) = 472 ./strace-static-x86_64: Process 473 attached [pid 471] setpgid(0, 0 [pid 472] set_robust_list(0x555555e33660, 24) = 0 [pid 473] set_robust_list(0x555555e33660, 24 [pid 471] <... setpgid resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555555e33650) = 473 [pid 472] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 472] setpgid(0, 0) = 0 [pid 472] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 473] <... set_robust_list resumed>) = 0 [pid 472] <... openat resumed>) = 3 [pid 471] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 473] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 472] write(3, "1000", 4 [pid 471] <... openat resumed>) = 3 [pid 473] <... prctl resumed>) = 0 [pid 471] write(3, "1000", 4 [pid 473] setpgid(0, 0 [pid 471] <... write resumed>) = 4 [pid 472] <... write resumed>) = 4 [pid 473] <... setpgid resumed>) = 0 [pid 471] close(3 [pid 473] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 471] <... close resumed>) = 0 [pid 473] <... openat resumed>) = 3 [pid 472] close(3 [pid 471] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 472] <... close resumed>) = 0 [pid 472] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 473] write(3, "1000", 4) = 4 [pid 473] close(3 [pid 472] <... bpf resumed>) = 3 [pid 472] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 471] <... bpf resumed>) = 3 [pid 473] <... close resumed>) = 0 [pid 471] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 473] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [pid 473] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 470] +++ exited with 0 +++ [pid 469] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=470, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=469, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... restart_syscall resumed>) = 0 [pid 300] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 474 attached [pid 297] <... clone resumed>, child_tidptr=0x555555e33650) = 474 [pid 474] set_robust_list(0x555555e33660, 24 [pid 300] <... clone resumed>, child_tidptr=0x555555e33650) = 475 [pid 474] <... set_robust_list resumed>) = 0 [pid 474] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 474] setpgid(0, 0) = 0 [pid 474] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 475 attached ) = 3 [pid 474] write(3, "1000", 4) = 4 [pid 474] close(3) = 0 [pid 474] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46 [pid 475] set_robust_list(0x555555e33660, 24) = 0 [pid 475] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 474] <... bpf resumed>) = 3 [pid 475] setpgid(0, 0) = 0 [pid 475] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 474] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 475] <... openat resumed>) = 3 [pid 475] write(3, "1000", 4) = 4 [pid 475] close(3) = 0 [pid 475] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20000480, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0}, 46) = 3 [ 32.873851][ T292] RSP: 002b:00007fff6da4d1d8 EFLAGS: 00000286 ORIG_RAX: 0000000000000003 [ 32.882096][ T292] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 00000000004e65f7 [ 32.889910][ T292] RDX: 00007fff6da4d1e0 RSI: 0000000000008910 RDI: 0000000000000003 [ 32.897720][ T292] RBP: 0000000000000003 R08: 00000000ffffffff R09: 000000000000000d [ 32.905531][ T292] R10: 00000000005549d3 R11: 0000000000000286 R12: 00007fff6da4d240 [ 32.913342][ T292] R13: 00007fff6da4d1e0 R14: 0000000000427210 R15: 0000000000617180 [ 32.921158][ T292] [pid 475] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kmem_cache_free", prog_fd=3}}, 16 [pid 472] <... bpf resumed>) = 4 [pid 475] <... bpf resumed>) = 4 [pid 474] <... bpf resumed>) = 4 [pid 473] <... bpf resumed>) = 4 [pid 472] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 471] <... bpf resumed>) = 4 [pid 475] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 474] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 473] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 472] <... bpf resumed>) = 5 [pid 471] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 475] <... bpf resumed>) = 5 [pid 474] <... bpf resumed>) = 5 [pid 473] <... bpf resumed>) = 5 [pid 472] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 471] <... bpf resumed>) = 5 [pid 475] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 474] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 473] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 472] <... bpf resumed>) = 0 [pid 471] bpf(BPF_MAP_FREEZE, {map_fd=5}, 4 [pid 475] <... bpf resumed>) = 0 [pid 474] <... bpf resumed>) = 0 [pid 473] <... bpf resumed>) = 0 [pid 472] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 471] <... bpf resumed>) = 0 [pid 475] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 474] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 473] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 472] <... bpf resumed>) = 6 [pid 471] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=24, insns=0x200001c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 475] <... bpf resumed>) = 6 [pid 474] <... bpf resumed>) = 6 [pid 473] <... bpf resumed>) = 6 [pid 472] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 471] <... bpf resumed>) = 6 [pid 475] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 474] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 473] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 474] <... bpf resumed>) = 7 [pid 472] <... bpf resumed>) = 7 [pid 471] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=6}}, 16 [pid 475] <... bpf resumed>) = 7 [pid 473] <... bpf resumed>) = 7 [pid 473] exit_group(0 [pid 472] exit_group(0 [pid 471] <... bpf resumed>) = 7 [pid 475] exit_group(0 [pid 474] exit_group(0 [pid 473] <... exit_group resumed>) = ? [pid 472] <... exit_group resumed>) = ? [pid 475] <... exit_group resumed>) = ? [pid 474] <... exit_group resumed>) = ? [pid 471] exit_group(0 [pid 473] +++ exited with 0 +++ [pid 472] +++ exited with 0 +++ [pid 471] <... exit_group resumed>) = ? [pid 475] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=473, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 476 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=475, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 477 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=472, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e33650) = 478 ./strace-static-x86_64: Process 476 attached [pid 476] set_robust_list(0x555555e33660, 24) = 0 [pid 476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 476] setpgid(0, 0) = 0 [pid 476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 474] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=474, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 32.972840][ C0] softirq: huh, entered softirq 9 RCU ffffffff8160c090 with preempt_count 00000103, exited with 00000102? [ 32.984315][ T474] BUG: scheduling while atomic: syz-executor115/474/0x00000002 [ 32.985416][ C1] softirq: huh, entered softirq 3 NET_RX ffffffff840adb50 with preempt_count 00000103, exited with 00000102? [ 32.991689][ T474] Modules linked in: [ 32.991701][ T474] Preemption disabled at: [ 33.003090][ T476] BUG: scheduling while atomic: syz-executor115/476/0x00000002 [ 33.003105][ T476] Modules linked in: [ 33.003114][ T476] Preemption disabled at: [ 33.003118][ T476] [] fd_install+0x59/0x250 [ 33.003155][ T476] CPU: 1 PID: 476 Comm: syz-executor115 Tainted: G W 6.1.75-syzkaller-00037-gdcb09569bbff #0 [ 33.003178][ T476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 33.003190][ T476] Call Trace: [ 33.003196][ T476] [ 33.003203][ T476] dump_stack_lvl+0x151/0x1b7 [ 33.006893][ T474] [] is_module_text_address+0x1f/0x360 [ 33.011059][ T476] ? fd_install+0x59/0x250 [ 33.074943][ T476] ? fd_install+0x59/0x250 [ 33.079195][ T476] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 33.084490][ T476] ? fd_install+0x59/0x250 [ 33.088740][ T476] dump_stack+0x15/0x1b [ 33.092735][ T476] __schedule_bug+0x195/0x260 [ 33.097246][ T476] ? cpu_util_update_eff+0x10e0/0x10e0 [ 33.102545][ T476] __schedule+0xcf7/0x1550 [ 33.106795][ T476] ? __kasan_check_write+0x14/0x20 [ 33.111739][ T476] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 33.116691][ T476] ? __sched_text_start+0x8/0x8 [ 33.121373][ T476] ? __kasan_check_read+0x11/0x20 [ 33.126236][ T476] ? cgroup_update_frozen+0x15f/0x980 [ 33.131531][ T476] schedule+0xc3/0x180 [ 33.135437][ T476] ptrace_stop+0x54f/0x930 [ 33.139691][ T476] ptrace_notify+0x225/0x350 [ 33.144119][ T476] ? do_notify_parent+0xa20/0xa20 [ 33.148973][ T476] ? __x64_sys_openat+0x243/0x290 [ 33.153836][ T476] ? __ia32_sys_open+0x270/0x270 [ 33.158606][ T476] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 33.164511][ T476] ? exit_to_user_mode_prepare+0x39/0xa0 [ 33.170104][ T476] syscall_exit_to_user_mode+0xa2/0x140 [ 33.175451][ T476] do_syscall_64+0x49/0xb0 [ 33.179715][ T476] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 33.185428][ T476] RIP: 0033:0x7fec422c3f51 [ 33.189683][ T476] Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 3a a1 07 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 93 00 00 00 48 8b 54 24 28 64 48 2b 14 25 [ 33.209124][ T476] RSP: 002b:00007ffe5e1ca880 EFLAGS: 00000202 ORIG_RAX: 0000000000000101