./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor89902309 <...> DUID 00:04:e3:38:52:80:67:3f:e9:c9:a2:47:22:a3:59:23:7d:1e forked to background, child pid 3184 [ 19.783085][ T3185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 19.801178][ T3185] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.80' (ECDSA) to the list of known hosts. execve("./syz-executor89902309", ["./syz-executor89902309"], 0x7fff3dc5c090 /* 10 vars */) = 0 brk(NULL) = 0x555556ba8000 brk(0x555556ba8c40) = 0x555556ba8c40 arch_prctl(ARCH_SET_FS, 0x555556ba8300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor89902309", 4096) = 26 brk(0x555556bc9c40) = 0x555556bc9c40 brk(0x555556bca000) = 0x555556bca000 mprotect(0x7fb6973ea000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ba85d0) = 3606 ./strace-static-x86_64: Process 3606 attached [pid 3606] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3606] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3606] setsid() = 1 [pid 3606] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3606] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3606] unshare(CLONE_NEWNS) = 0 [pid 3606] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3606] unshare(CLONE_NEWIPC) = 0 [pid 3606] unshare(CLONE_NEWCGROUP) = 0 [pid 3606] unshare(CLONE_NEWUTS) = 0 [pid 3606] unshare(CLONE_SYSVSEM) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "16777216", 8) = 8 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "536870912", 9) = 9 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "8192", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024", 4) = 4 [pid 3606] close(3) = 0 [pid 3606] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3606] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3606] close(3) = 0 [pid 3606] getpid() = 1 [pid 3606] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 39.815272][ T3606] dump_stack_lvl+0x1b1/0x28e [ 39.819945][ T3606] ? fortify_panic+0x13/0x13 [ 39.824525][ T3606] ? _printk+0xc0/0x100 [ 39.828695][ T3606] ? __wake_up_klogd+0xd6/0x100 [ 39.833542][ T3606] ? __wake_up_klogd+0xcd/0x100 [ 39.838392][ T3606] ? panic+0x710/0x710 [ 39.842455][ T3606] ? _printk+0xc0/0x100 [ 39.846607][ T3606] print_address_description+0x65/0x4b0 [ 39.852146][ T3606] print_report+0x108/0x1f0 [ 39.856648][ T3606] ? read_lock_is_recursive+0x10/0x10 [ 39.862017][ T3606] ? nilfs_test_metadata_dirty+0x39/0x210 [ 39.867735][ T3606] kasan_report+0xc3/0xf0 [ 39.872064][ T3606] ? do_raw_spin_lock+0x148/0x360 [ 39.877085][ T3606] ? nilfs_test_metadata_dirty+0x39/0x210 [ 39.882798][ T3606] nilfs_test_metadata_dirty+0x39/0x210 [ 39.888345][ T3606] nilfs_segctor_confirm+0x78/0x2d0 [ 39.893551][ T3606] nilfs_detach_log_writer+0x4c1/0xbd0 [ 39.899016][ T3606] ? __might_sleep+0xc0/0xc0 [ 39.903611][ T3606] ? nilfs_attach_log_writer+0x8f0/0x8f0 [ 39.909240][ T3606] ? hook_sb_delete+0x988/0xab0 [ 39.914097][ T3606] ? wake_bit_function+0x240/0x240 [ 39.919204][ T3606] ? hook_inode_free_security+0xa0/0xa0 [ 39.924740][ T3606] ? clear_inode+0x150/0x150 [ 39.929337][ T3606] ? nilfs_free_inode+0x70/0x70 [ 39.934208][ T3606] nilfs_put_super+0x4b/0x150 [ 39.938894][ T3606] ? nilfs_free_inode+0x70/0x70 [ 39.943754][ T3606] generic_shutdown_super+0x130/0x310 [ 39.949126][ T3606] kill_block_super+0x79/0xd0 [ 39.953800][ T3606] deactivate_locked_super+0xa7/0xf0 [ 39.959078][ T3606] cleanup_mnt+0x4ce/0x560 [ 39.963506][ T3606] task_work_run+0x146/0x1c0 [ 39.968097][ T3606] do_exit+0x6b2/0x2280 [ 39.972259][ T3606] ? __lock_acquire+0x1f60/0x1f60 [ 39.977457][ T3606] ? ptrace_notify+0x245/0x340 [ 39.982216][ T3606] ? mm_update_next_owner+0x6d0/0x6d0 [ 39.987584][ T3606] ? print_irqtrace_events+0x220/0x220 [ 39.993039][ T3606] do_group_exit+0x1fd/0x2b0 [ 39.997622][ T3606] __x64_sys_exit_group+0x3b/0x40 [ 40.002639][ T3606] do_syscall_64+0x3d/0xb0 [ 40.007052][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.012940][ T3606] RIP: 0033:0x7fb697378bc9 [ 40.017350][ T3606] Code: Unable to access opcode bytes at 0x7fb697378b9f. [ 40.024354][ T3606] RSP: 002b:00007ffc8e794e08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 40.032772][ T3606] RAX: ffffffffffffffda RBX: 00007fb6973f0330 RCX: 00007fb697378bc9 [ 40.040734][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 40.048785][ T3606] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007fb6973eae40 [ 40.056749][ T3606] R10: 00007ffc8e794d20 R11: 0000000000000246 R12: 00007fb6973f0330 [ 40.064712][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 40.072680][ T3606] [ 40.075708][ T3606] [ 40.078022][ T3606] Allocated by task 3606: [ 40.082338][ T3606] ____kasan_kmalloc+0xcd/0x100 [ 40.087185][ T3606] kmem_cache_alloc_trace+0x97/0x310 [ 40.092462][ T3606] nilfs_find_or_create_root+0x142/0x4f0 [ 40.098087][ T3606] nilfs_attach_checkpoint+0xcd/0x4a0 [ 40.103455][ T3606] nilfs_fill_super+0x2e8/0x5d0 [ 40.108304][ T3606] nilfs_mount+0x613/0x9b0 [ 40.112713][ T3606] legacy_get_tree+0xea/0x180 [ 40.117381][ T3606] vfs_get_tree+0x88/0x270 [ 40.121784][ T3606] do_new_mount+0x289/0xad0 [ 40.126275][ T3606] __se_sys_mount+0x2d3/0x3c0 [ 40.130944][ T3606] do_syscall_64+0x3d/0xb0 [ 40.135349][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.141245][ T3606] [ 40.143557][ T3606] Freed by task 3606: [ 40.147525][ T3606] kasan_set_track+0x3d/0x60 [ 40.152105][ T3606] kasan_set_free_info+0x1f/0x40 [ 40.157035][ T3606] ____kasan_slab_free+0xd8/0x120 [ 40.162049][ T3606] slab_free_freelist_hook+0x12e/0x1a0 [ 40.167526][ T3606] kfree+0xda/0x210 [ 40.171590][ T3606] nilfs_evict_inode+0xe5/0x3d0 [ 40.176432][ T3606] evict+0x2a4/0x620 [ 40.180316][ T3606] evict_inodes+0x658/0x700 [ 40.184814][ T3606] generic_shutdown_super+0x94/0x310 [ 40.190088][ T3606] kill_block_super+0x79/0xd0 [ 40.194754][ T3606] deactivate_locked_super+0xa7/0xf0 [ 40.200031][ T3606] cleanup_mnt+0x4ce/0x560 [ 40.204435][ T3606] task_work_run+0x146/0x1c0 [ 40.209018][ T3606] do_exit+0x6b2/0x2280 [ 40.213164][ T3606] do_group_exit+0x1fd/0x2b0 [ 40.217744][ T3606] __x64_sys_exit_group+0x3b/0x40 [ 40.222758][ T3606] do_syscall_64+0x3d/0xb0 [ 40.227164][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.233054][ T3606] [ 40.235366][ T3606] Last potentially related work creation: [ 40.241072][ T3606] kasan_save_stack+0x2b/0x50 [ 40.245737][ T3606] __kasan_record_aux_stack+0xaf/0xc0 [ 40.251106][ T3606] call_rcu+0x163/0x970 [ 40.255340][ T3606] fib_create_info+0x18d0/0x2410 [ 40.260270][ T3606] fib_table_insert+0x1e5/0x1f50 [ 40.265198][ T3606] fib_magic+0x451/0x650 [ 40.269430][ T3606] fib_add_ifaddr+0x143/0x5c0 [ 40.274098][ T3606] fib_netdev_event+0x628/0x740 [ 40.278942][ T3606] raw_notifier_call_chain+0xe7/0x170 [ 40.284306][ T3606] __dev_notify_flags+0x2ef/0x5d0 [ 40.289331][ T3606] dev_change_flags+0xe3/0x190 [ 40.294088][ T3606] devinet_ioctl+0x8cb/0x1a70 [ 40.298757][ T3606] inet_ioctl+0x314/0x3f0 [ 40.303072][ T3606] sock_ioctl+0x53c/0x8d0 [ 40.307407][ T3606] __se_sys_ioctl+0xfb/0x170 [ 40.311996][ T3606] do_syscall_64+0x3d/0xb0 [ 40.316405][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.322287][ T3606] [ 40.324626][ T3606] The buggy address belongs to the object at ffff8881481f7800 [ 40.324626][ T3606] which belongs to the cache kmalloc-256 of size 256 [ 40.338692][ T3606] The buggy address is located 48 bytes inside of [ 40.338692][ T3606] 256-byte region [ffff8881481f7800, ffff8881481f7900) [ 40.351875][ T3606] [ 40.354189][ T3606] The buggy address belongs to the physical page: [ 40.360585][ T3606] page:ffffea0005207d80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1481f6 [ 40.372557][ T3606] head:ffffea0005207d80 order:1 compound_mapcount:0 compound_pincount:0 [ 40.380872][ T3606] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff) [ 40.388930][ T3606] raw: 057ff00000010200 0000000000000000 dead000000000001 ffff888012041b40 [ 40.397501][ T3606] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 40.406068][ T3606] page dumped because: kasan: bad access detected [ 40.412480][ T3606] page_owner tracks the page as allocated [ 40.418178][ T3606] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11317143355, free_ts 0 [ 40.437094][ T3606] get_page_from_freelist+0x742/0x7c0 [ 40.442458][ T3606] __alloc_pages+0x259/0x560 [ 40.447062][ T3606] alloc_page_interleave+0x22/0x1c0 [ 40.452283][ T3606] alloc_slab_page+0x70/0xf0 [ 40.456895][ T3606] allocate_slab+0x5e/0x520 [ 40.461406][ T3606] ___slab_alloc+0x3ee/0xc40 [ 40.465991][ T3606] __kmalloc+0x2bd/0x370 [ 40.470227][ T3606] tomoyo_init_log+0x1a16/0x1f80 [ 40.475156][ T3606] tomoyo_supervisor+0x38d/0x14f0 [ 40.480184][ T3606] tomoyo_mkdev_perm+0x479/0x7c0 [ 40.485144][ T3606] tomoyo_path_mknod+0x12c/0x1b0 [ 40.490085][ T3606] security_path_mknod+0xdc/0x160 [ 40.495099][ T3606] init_mknod+0x1ed/0x318 [ 40.499416][ T3606] initrd_load+0x22/0xc8 [ 40.503651][ T3606] prepare_namespace+0x6d/0x22d [ 40.508489][ T3606] kernel_init_freeable+0x432/0x57b [ 40.513679][ T3606] page_owner free stack trace missing [ 40.519028][ T3606] [ 40.521339][ T3606] Memory state around the buggy address: [ 40.526952][ T3606] ffff8881481f7700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.534999][ T3606] ffff8881481f7780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.543046][ T3606] >ffff8881481f7800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.551103][ T3606] ^ [ 40.556719][ T3606] ffff8881481f7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 40.564768][ T3606] ffff8881481f7900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.573336][ T3606] ================================================================== [ 40.593170][ T3606] Kernel panic - not syncing: panic_on_warn set ... [ 40.599793][ T3606] CPU: 0 PID: 3606 Comm: syz-executor899 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 [ 40.609840][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 40.620398][ T3606] Call Trace: [ 40.623665][ T3606] [ 40.626587][ T3606] dump_stack_lvl+0x1b1/0x28e [ 40.631259][ T3606] ? fortify_panic+0x13/0x13 [ 40.635833][ T3606] ? panic+0x710/0x710 [ 40.639982][ T3606] ? preempt_schedule_common+0xb7/0xe0 [ 40.645427][ T3606] ? vscnprintf+0x59/0x80 [ 40.649749][ T3606] panic+0x2d6/0x710 [ 40.653641][ T3606] ? fb_is_primary_device+0xcc/0xcc [ 40.658909][ T3606] ? _raw_spin_unlock_irqrestore+0x110/0x120 [ 40.664893][ T3606] ? print_report+0x1b4/0x1f0 [ 40.669554][ T3606] ? nilfs_test_metadata_dirty+0x39/0x210 [ 40.675264][ T3606] end_report+0x91/0xa0 [ 40.679401][ T3606] kasan_report+0xd0/0xf0 [ 40.683717][ T3606] ? do_raw_spin_lock+0x148/0x360 [ 40.688726][ T3606] ? nilfs_test_metadata_dirty+0x39/0x210 [ 40.694434][ T3606] nilfs_test_metadata_dirty+0x39/0x210 [ 40.699979][ T3606] nilfs_segctor_confirm+0x78/0x2d0 [ 40.705180][ T3606] nilfs_detach_log_writer+0x4c1/0xbd0 [ 40.710918][ T3606] ? __might_sleep+0xc0/0xc0 [ 40.715508][ T3606] ? nilfs_attach_log_writer+0x8f0/0x8f0 [ 40.721145][ T3606] ? hook_sb_delete+0x988/0xab0 [ 40.725995][ T3606] ? wake_bit_function+0x240/0x240 [ 40.731108][ T3606] ? hook_inode_free_security+0xa0/0xa0 [ 40.736671][ T3606] ? clear_inode+0x150/0x150 [ 40.741258][ T3606] ? nilfs_free_inode+0x70/0x70 [ 40.746112][ T3606] nilfs_put_super+0x4b/0x150 [ 40.750808][ T3606] ? nilfs_free_inode+0x70/0x70 [ 40.755660][ T3606] generic_shutdown_super+0x130/0x310 [ 40.761041][ T3606] kill_block_super+0x79/0xd0 [ 40.765737][ T3606] deactivate_locked_super+0xa7/0xf0 [ 40.771029][ T3606] cleanup_mnt+0x4ce/0x560 [ 40.775449][ T3606] task_work_run+0x146/0x1c0 [ 40.780217][ T3606] do_exit+0x6b2/0x2280 [ 40.784367][ T3606] ? __lock_acquire+0x1f60/0x1f60 [ 40.789383][ T3606] ? ptrace_notify+0x245/0x340 [ 40.794141][ T3606] ? mm_update_next_owner+0x6d0/0x6d0 [ 40.799592][ T3606] ? print_irqtrace_events+0x220/0x220 [ 40.805059][ T3606] do_group_exit+0x1fd/0x2b0 [ 40.809657][ T3606] __x64_sys_exit_group+0x3b/0x40 [ 40.814705][ T3606] do_syscall_64+0x3d/0xb0 [ 40.819129][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.825027][ T3606] RIP: 0033:0x7fb697378bc9 [ 40.829432][ T3606] Code: Unable to access opcode bytes at 0x7fb697378b9f. [ 40.836454][ T3606] RSP: 002b:00007ffc8e794e08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 40.844882][ T3606] RAX: ffffffffffffffda RBX: 00007fb6973f0330 RCX: 00007fb697378bc9 [ 40.852852][ T3606] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 40.860815][ T3606] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007fb6973eae40 [ 40.868775][ T3606] R10: 00007ffc8e794d20 R11: 0000000000000246 R12: 00007fb6973f0330 [ 40.876738][ T3606] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 40.884707][ T3606] [ 40.887974][ T3606] Kernel Offset: disabled [ 40.892309][ T3606] Rebooting in 86400 seconds..