./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor408715168 <...> DUID 00:04:6b:ce:5a:65:f9:02:43:bb:9d:7c:d4:47:65:e1:68:d7 forked to background, child pid 3184 [ 26.953805][ T3185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.959352][ T3185] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.234' (ECDSA) to the list of known hosts. execve("./syz-executor408715168", ["./syz-executor408715168"], 0x7ffe752ba4e0 /* 10 vars */) = 0 brk(NULL) = 0x555556487000 brk(0x555556487c40) = 0x555556487c40 arch_prctl(ARCH_SET_FS, 0x555556487300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor408715168", 4096) = 27 brk(0x5555564a8c40) = 0x5555564a8c40 brk(0x5555564a9000) = 0x5555564a9000 mprotect(0x7fe9381f1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3606 attached , child_tidptr=0x5555564875d0) = 3606 [pid 3606] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3606] setsid() = 1 [pid 3606] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3606] unshare(CLONE_NEWNS) = 0 [pid 3606] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3606] unshare(CLONE_NEWIPC) = 0 [pid 3606] unshare(CLONE_NEWCGROUP) = 0 [pid 3606] unshare(CLONE_NEWUTS) = 0 [pid 3606] unshare(CLONE_SYSVSEM) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "16777216", 8) = 8 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "536870912", 9) = 9 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "8192", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3606] close(3) = 0 [pid 3606] getpid() = 1 [pid 3606] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 0b e9 66 fa ff ff 48 8b 7c 24 08 e8 0b 2d d3 f9 e9 03 f8 ff ff [ 47.075261][ T3606] RSP: 0018:ffffc90002eef4c0 EFLAGS: 00010293 [ 47.081418][ T3606] RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 [ 47.089469][ T3606] RDX: ffff888022a59d80 RSI: ffffffff87f2cd44 RDI: 0000000000000003 [ 47.097521][ T3606] RBP: ffff888071b5d3c0 R08: 0000000000000001 R09: 000000000000ffff [ 47.105499][ T3606] R10: ffffffff87f2c7a7 R11: 00000000ffffffff R12: ffff888079f90000 [ 47.113524][ T3606] R13: ffff888071b5d474 R14: 0000000000000004 R15: ffff888071bbc400 [ 47.121573][ T3606] FS: 0000555556487300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 47.130569][ T3606] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.137163][ T3606] CR2: 00000000021bca68 CR3: 000000001d19f000 CR4: 00000000003506f0 [ 47.145215][ T3606] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.153263][ T3606] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.161273][ T3606] Call Trace: [ 47.164543][ T3606] [ 47.167536][ T3606] dev_hard_start_xmit+0x188/0x880 [ 47.172756][ T3606] __dev_queue_xmit+0x2b05/0x38f0 [ 47.177873][ T3606] ? __lock_acquire+0x163e/0x56c0 [ 47.182933][ T3606] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 47.188320][ T3606] ? __lock_acquire+0x163e/0x56c0 [ 47.193389][ T3606] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 47.199187][ T3606] ? skb_release_data+0x12f/0x810 [ 47.204236][ T3606] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 47.210540][ T3606] ? skb_headers_offset_update+0x125/0x250 [ 47.216366][ T3606] ? pskb_expand_head+0x55d/0x1070 [ 47.221553][ T3606] __bpf_redirect+0x838/0xe50 [ 47.226251][ T3606] ? skb_ensure_writable+0xdc/0x450 [ 47.231519][ T3606] bpf_clone_redirect+0x2ae/0x420 [ 47.236569][ T3606] bpf_prog_207b739f41707f89+0x56/0x5b [ 47.242106][ T3606] ? find_held_lock+0x2d/0x110 [ 47.246898][ T3606] ? bpf_test_timer_enter+0xa0/0x160 [ 47.252249][ T3606] ? lock_downgrade+0x6e0/0x6e0 [ 47.257342][ T3606] ? ktime_get+0x38a/0x470 [ 47.261768][ T3606] ? lockdep_hardirqs_on+0x79/0x100 [ 47.266960][ T3606] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 47.272755][ T3606] ? ktime_get+0x30b/0x470 [ 47.277275][ T3606] ? bpf_test_timer_enter+0xa0/0x160 [ 47.282593][ T3606] bpf_test_run+0x386/0x9d0 [ 47.287097][ T3606] ? bpf_test_timer_continue+0x420/0x420 [ 47.292808][ T3606] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 47.299155][ T3606] ? __phys_addr+0xc4/0x140 [ 47.303693][ T3606] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 47.310004][ T3606] ? eth_type_trans+0x29e/0x640 [ 47.314884][ T3606] ? __build_skb+0x50/0x60 [ 47.319389][ T3606] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 47.325667][ T3606] bpf_prog_test_run_skb+0xb5e/0x1e10 [ 47.331113][ T3606] ? bpf_prog_test_run_raw_tp+0x640/0x640 [ 47.336849][ T3606] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 47.343150][ T3606] ? __fget_light+0x20f/0x270 [ 47.347910][ T3606] ? bpf_prog_test_run_raw_tp+0x640/0x640 [ 47.353635][ T3606] ? __sys_bpf+0x1526/0x5700 [ 47.358292][ T3606] __sys_bpf+0x15c1/0x5700 [ 47.362724][ T3606] ? lock_release+0x780/0x780 [ 47.367470][ T3606] ? bpf_perf_link_attach+0x520/0x520 [ 47.372880][ T3606] ? rwlock_bug.part.0+0x90/0x90 [ 47.377884][ T3606] ? _raw_spin_lock_irq+0x41/0x50 [ 47.382930][ T3606] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 47.389261][ T3606] ? find_held_lock+0x2d/0x110 [ 47.394072][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40 [ 47.399378][ T3606] ? lockdep_hardirqs_on+0x79/0x100 [ 47.404604][ T3606] ? trace_hardirqs_on+0x38/0x1c0 [ 47.409693][ T3606] __x64_sys_bpf+0x75/0xb0 [ 47.414131][ T3606] do_syscall_64+0x35/0xb0 [ 47.418619][ T3606] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 47.424541][ T3606] RIP: 0033:0x7fe93817ca79 [ 47.429055][ T3606] Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 47.448740][ T3606] RSP: 002b:00007ffc6ea10bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 47.457257][ T3606] RAX: ffffffffffffffda RBX: 00007ffc6ea10be8 RCX: 00007fe93817ca79 [ 47.457257][ T3606] RAX: ffffffffffffffda RBX: 00007ffc6ea10be8 RCX: 00007fe93817ca79 [ 47.457287][ T3606] RDX: 0000000000000048 RSI: 0000000020000080 RDI: 000000000000000a [ 47.457303][ T3606] RBP: 0000000000000003 R08: bb1414ac00000000 R09: bb1414ac00000000 [ 47.457322][ T3606] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6ea10bf0 [ 47.457340][ T3606] R13: 00007ffc6ea10be4 R14: 0000000000000003 R15: 0000000000000000 [ 47.457376][ T3606] [ 47.457389][ T3606] Kernel panic - not syncing: panic_on_warn set ... [ 47.457401][ T3606] CPU: 0 PID: 3606 Comm: syz-executor408 Not tainted 5.18.0-syzkaller-04992-ge0491b11c131 #0 [ 47.457427][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 47.457441][ T3606] Call Trace: [ 47.457448][ T3606] [ 47.457458][ T3606] dump_stack_lvl+0xcd/0x134 [ 47.457490][ T3606] panic+0x2d7/0x636 [ 47.457513][ T3606] ? panic_print_sys_info.part.0+0x10b/0x10b [ 47.457550][ T3606] ? __warn.cold+0x1d9/0x2cd [ 47.457577][ T3606] ? ipgre_xmit+0x894/0x970 [ 47.457604][ T3606] __warn.cold+0x1ea/0x2cd [ 47.457628][ T3606] ? ipgre_xmit+0x894/0x970 [ 47.457653][ T3606] report_bug+0x1bc/0x210 [ 47.457682][ T3606] handle_bug+0x3c/0x60 [ 47.457708][ T3606] exc_invalid_op+0x14/0x40 [ 47.457734][ T3606] asm_exc_invalid_op+0x1b/0x20 [ 47.457758][ T3606] RIP: 0010:ipgre_xmit+0x894/0x970 [ 47.457783][ T3606] Code: 89 14 24 e8 0e 2d d3 f9 48 8b 14 24 e9 be f9 ff ff e8 20 2d d3 f9 e9 02 fa ff ff e8 06 2d d3 f9 e9 55 fa ff ff e8 1c e7 86 f9 <0f> 0b e9 66 fa ff ff 48 8b 7c 24 08 e8 0b 2d d3 f9 e9 03 f8 ff ff [ 47.457807][ T3606] RSP: 0018:ffffc90002eef4c0 EFLAGS: 00010293 [ 47.457828][ T3606] RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 [ 47.457843][ T3606] RDX: ffff888022a59d80 RSI: ffffffff87f2cd44 RDI: 0000000000000003 [ 47.457859][ T3606] RBP: ffff888071b5d3c0 R08: 0000000000000001 R09: 000000000000ffff [ 47.457875][ T3606] R10: ffffffff87f2c7a7 R11: 00000000ffffffff R12: ffff888079f90000 [ 47.457892][ T3606] R13: ffff888071b5d474 R14: 0000000000000004 R15: ffff888071bbc400 [ 47.457914][ T3606] ? ipgre_xmit+0x2f7/0x970 [ 47.457941][ T3606] ? ipgre_xmit+0x894/0x970 [ 47.457977][ T3606] dev_hard_start_xmit+0x188/0x880 [ 47.458021][ T3606] __dev_queue_xmit+0x2b05/0x38f0 [ 47.458055][ T3606] ? __lock_acquire+0x163e/0x56c0 [ 47.458088][ T3606] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 47.458116][ T3606] ? __lock_acquire+0x163e/0x56c0 [ 47.458154][ T3606] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 47.458180][ T3606] ? skb_release_data+0x12f/0x810 [ 47.458208][ T3606] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 47.458235][ T3606] ? skb_headers_offset_update+0x125/0x250 [ 47.458267][ T3606] ? pskb_expand_head+0x55d/0x1070 [ 47.458299][ T3606] __bpf_redirect+0x838/0xe50 [ 47.458328][ T3606] ? skb_ensure_writable+0xdc/0x450 [ 47.458358][ T3606] bpf_clone_redirect+0x2ae/0x420 [ 47.458393][ T3606] bpf_prog_207b739f41707f89+0x56/0x5b [ 47.458430][ T3606] ? find_held_lock+0x2d/0x110 [ 47.458462][ T3606] ? bpf_test_timer_enter+0xa0/0x160 [ 47.458488][ T3606] ? lock_downgrade+0x6e0/0x6e0 [ 47.458525][ T3606] ? ktime_get+0x38a/0x470 [ 47.458554][ T3606] ? lockdep_hardirqs_on+0x79/0x100 [ 47.458583][ T3606] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 47.458608][ T3606] ? ktime_get+0x30b/0x470 [ 47.458642][ T3606] ? bpf_test_timer_enter+0xa0/0x160 [ 47.458668][ T3606] bpf_test_run+0x386/0x9d0 [ 47.458704][ T3606] ? bpf_test_timer_continue+0x420/0x420 [ 47.458734][ T3606] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 47.458761][ T3606] ? __phys_addr+0xc4/0x140 [ 47.458792][ T3606] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 47.458820][ T3606] ? eth_type_trans+0x29e/0x640 [ 47.458849][ T3606] ? __build_skb+0x50/0x60 [ 47.458872][ T3606] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 47.458903][ T3606] bpf_prog_test_run_skb+0xb5e/0x1e10 [ 47.458942][ T3606] ? bpf_prog_test_run_raw_tp+0x640/0x640 [ 47.458974][ T3606] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 47.459010][ T3606] ? __fget_light+0x20f/0x270 [ 47.459038][ T3606] ? bpf_prog_test_run_raw_tp+0x640/0x640 [ 47.459065][ T3606] ? __sys_bpf+0x1526/0x5700 [ 47.459095][ T3606] __sys_bpf+0x15c1/0x5700 [ 47.459121][ T3606] ? lock_release+0x780/0x780 [ 47.459153][ T3606] ? bpf_perf_link_attach+0x520/0x520 [ 47.459183][ T3606] ? rwlock_bug.part.0+0x90/0x90 [ 47.459212][ T3606] ? _raw_spin_lock_irq+0x41/0x50 [ 47.459246][ T3606] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 47.459279][ T3606] ? find_held_lock+0x2d/0x110 [ 47.459325][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40 [ 47.459355][ T3606] ? lockdep_hardirqs_on+0x79/0x100 [ 47.459385][ T3606] ? trace_hardirqs_on+0x38/0x1c0 [ 47.459415][ T3606] __x64_sys_bpf+0x75/0xb0 [ 47.459445][ T3606] do_syscall_64+0x35/0xb0 [ 47.459470][ T3606] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 47.459496][ T3606] RIP: 0033:0x7fe93817ca79 [ 47.459516][ T3606] Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 47.459539][ T3606] RSP: 002b:00007ffc6ea10bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 47.459564][ T3606] RAX: ffffffffffffffda RBX: 00007ffc6ea10be8 RCX: 00007fe93817ca79 [ 47.459582][ T3606] RDX: 0000000000000048 RSI: 0000000020000080 RDI: 000000000000000a [ 47.459597][ T3606] RBP: 0000000000000003 R08: bb1414ac00000000 R09: bb1414ac00000000 [ 47.459614][ T3606] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6ea10bf0 [ 47.459630][ T3606] R13: 00007ffc6ea10be4 R14: 0000000000000003 R15: 0000000000000000 [ 47.459663][ T3606] [ 47.465434][ T3606] Kernel Offset: disabled