./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1456499082 <...> DUID 00:04:b0:cd:33:f9:4f:8a:55:45:4d:7b:3b:ee:3a:71:f0:8b forked to background, child pid 4660 [ 29.186427][ T4661] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.197198][ T4661] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.5' (ECDSA) to the list of known hosts. execve("./syz-executor1456499082", ["./syz-executor1456499082"], 0x7ffee5eee1f0 /* 10 vars */) = 0 brk(NULL) = 0x5555567a7000 brk(0x5555567a7c40) = 0x5555567a7c40 arch_prctl(ARCH_SET_FS, 0x5555567a7300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1456499082", 4096) = 28 brk(0x5555567c8c40) = 0x5555567c8c40 brk(0x5555567c9000) = 0x5555567c9000 mprotect(0x7fbb808b3000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 mkdir("./bus", 000) = 0 open("./file0", O_RDWR|O_CREAT|O_SYNC|O_NOATIME, 000) = 3 mkdir("./file1", 000) = 0 mount(NULL, "./bus", "overlay", 0, "upperdir=./bus,workdir=./file1,lowerdir=.") = 0 chdir("./bus") = 0 open("./file0", O_RDONLY) = 4 open("./file0", O_RDWR|O_CREAT|O_SYNC|O_NOATIME, 000) = 5 openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 write(6, "4", 1) = 1 syzkaller login: [ 54.452395][ T27] audit: type=1804 audit(1687877094.711:2): pid=4991 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor145" name="/root/bus/file0" dev="overlay" ino=1928 res=1 errno=0 [ 54.474833][ T4991] FAULT_INJECTION: forcing a failure. [ 54.474833][ T4991] name failslab, interval 1, probability 0, space 0, times 1 [ 54.487739][ T4991] CPU: 0 PID: 4991 Comm: syz-executor145 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0 [ 54.497792][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 54.507836][ T4991] Call Trace: [ 54.511100][ T4991] [ 54.514014][ T4991] dump_stack_lvl+0x1e7/0x2d0 [ 54.518707][ T4991] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.524158][ T4991] ? panic+0x770/0x770 [ 54.528211][ T4991] ? __might_sleep+0xc0/0xc0 [ 54.532882][ T4991] should_fail_ex+0x3aa/0x4e0 [ 54.537544][ T4991] should_failslab+0x9/0x20 [ 54.542039][ T4991] slab_pre_alloc_hook+0x59/0x2b0 [ 54.547049][ T4991] kmem_cache_alloc+0x52/0x2e0 [ 54.551791][ T4991] ? security_file_alloc+0x28/0x120 [ 54.556972][ T4991] security_file_alloc+0x28/0x120 [ 54.561980][ T4991] init_file+0xa0/0x200 [ 54.566130][ T4991] alloc_empty_backing_file+0x67/0xd0 [ 54.571506][ T4991] backing_file_open+0x26/0x100 [ 54.576358][ T4991] ovl_open_realfile+0x1f6/0x350 [ 54.581297][ T4991] ovl_splice_read+0x7cc/0x8c0 [ 54.586058][ T4991] ? ovl_splice_write+0x650/0x650 [ 54.591072][ T4991] ? vfs_splice_read+0x24d/0x3b0 [ 54.595988][ T4991] ? ovl_splice_write+0x650/0x650 [ 54.601001][ T4991] splice_direct_to_actor+0x2a8/0x9a0 [ 54.606372][ T4991] ? do_splice_direct+0x3d0/0x3d0 [ 54.611392][ T4991] ? warn_unsupported+0xc0/0xc0 [ 54.616238][ T4991] ? fsnotify_perm+0x63/0x5a0 [ 54.620909][ T4991] ? security_file_permission+0x79/0xa0 [ 54.626473][ T4991] do_splice_direct+0x286/0x3d0 [ 54.631332][ T4991] ? splice_direct_to_actor+0x9a0/0x9a0 [ 54.636868][ T4991] ? rcu_read_lock_any_held+0xb7/0x160 [ 54.642340][ T4991] do_sendfile+0x623/0x1070 [ 54.646859][ T4991] ? do_pwritev+0x360/0x360 [ 54.651355][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50 [ 54.656542][ T4991] ? ptrace_notify+0x278/0x380 [ 54.661295][ T4991] __se_sys_sendfile64+0x17c/0x1e0 [ 54.666389][ T4991] ? __x64_sys_sendfile64+0xb0/0xb0 [ 54.671572][ T4991] ? syscall_enter_from_user_mode+0x32/0x230 [ 54.677540][ T4991] ? syscall_enter_from_user_mode+0x8c/0x230 [ 54.683503][ T4991] do_syscall_64+0x41/0xc0 [ 54.687902][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.693779][ T4991] RIP: 0033:0x7fbb808467a9 [ 54.698180][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.717769][ T4991] RSP: 002b:00007ffdc0c78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 54.726167][ T4991] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbb808467a9 [ 54.734125][ T4991] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 [ 54.742080][ T4991] RBP: 00007ffdc0c78ff0 R08: 0000000000000001 R09: 00007fbb80800034 [ 54.750034][ T4991] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000006 [ 54.757992][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.765984][ T4991] [ 54.769504][ T4991] ================================================================== [ 54.777575][ T4991] BUG: KASAN: invalid-free in init_file+0x195/0x200 [ 54.784152][ T4991] Free of addr ffff88801ea5a800 by task syz-executor145/4991 [ 54.791496][ T4991] [ 54.793798][ T4991] CPU: 0 PID: 4991 Comm: syz-executor145 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0 [ 54.803834][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 54.813865][ T4991] Call Trace: [ 54.817127][ T4991] [ 54.820043][ T4991] dump_stack_lvl+0x1e7/0x2d0 [ 54.824721][ T4991] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.830178][ T4991] ? panic+0x770/0x770 [ 54.834241][ T4991] ? _printk+0xd5/0x120 [ 54.838463][ T4991] ? init_file+0x195/0x200 [ 54.842862][ T4991] print_report+0x163/0x540 [ 54.847346][ T4991] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 54.853220][ T4991] ? __virt_addr_valid+0x22f/0x2e0 [ 54.858311][ T4991] ? __phys_addr+0xba/0x170 [ 54.862793][ T4991] ? init_file+0x195/0x200 [ 54.867184][ T4991] ? init_file+0x195/0x200 [ 54.871580][ T4991] kasan_report_invalid_free+0xeb/0x100 [ 54.877108][ T4991] ? init_file+0x195/0x200 [ 54.881505][ T4991] ____kasan_slab_free+0xfb/0x120 [ 54.886508][ T4991] kmem_cache_free+0x297/0x520 [ 54.891249][ T4991] ? init_file+0x195/0x200 [ 54.895639][ T4991] init_file+0x195/0x200 [ 54.899860][ T4991] alloc_empty_backing_file+0x67/0xd0 [ 54.905207][ T4991] backing_file_open+0x26/0x100 [ 54.910036][ T4991] ovl_open_realfile+0x1f6/0x350 [ 54.914963][ T4991] ovl_splice_read+0x7cc/0x8c0 [ 54.919882][ T4991] ? ovl_splice_write+0x650/0x650 [ 54.924888][ T4991] ? vfs_splice_read+0x24d/0x3b0 [ 54.929803][ T4991] ? ovl_splice_write+0x650/0x650 [ 54.934809][ T4991] splice_direct_to_actor+0x2a8/0x9a0 [ 54.940165][ T4991] ? do_splice_direct+0x3d0/0x3d0 [ 54.945164][ T4991] ? warn_unsupported+0xc0/0xc0 [ 54.949990][ T4991] ? fsnotify_perm+0x63/0x5a0 [ 54.954644][ T4991] ? security_file_permission+0x79/0xa0 [ 54.960170][ T4991] do_splice_direct+0x286/0x3d0 [ 54.965001][ T4991] ? splice_direct_to_actor+0x9a0/0x9a0 [ 54.970527][ T4991] ? rcu_read_lock_any_held+0xb7/0x160 [ 54.975967][ T4991] do_sendfile+0x623/0x1070 [ 54.980451][ T4991] ? do_pwritev+0x360/0x360 [ 54.984937][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50 [ 54.990113][ T4991] ? ptrace_notify+0x278/0x380 [ 54.994857][ T4991] __se_sys_sendfile64+0x17c/0x1e0 [ 54.999946][ T4991] ? __x64_sys_sendfile64+0xb0/0xb0 [ 55.005118][ T4991] ? syscall_enter_from_user_mode+0x32/0x230 [ 55.011073][ T4991] ? syscall_enter_from_user_mode+0x8c/0x230 [ 55.017029][ T4991] do_syscall_64+0x41/0xc0 [ 55.021429][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.027302][ T4991] RIP: 0033:0x7fbb808467a9 [ 55.031699][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 55.051285][ T4991] RSP: 002b:00007ffdc0c78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 55.059676][ T4991] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbb808467a9 [ 55.067626][ T4991] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 [ 55.075579][ T4991] RBP: 00007ffdc0c78ff0 R08: 0000000000000001 R09: 00007fbb80800034 [ 55.083532][ T4991] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000006 [ 55.091479][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 55.099433][ T4991] [ 55.102430][ T4991] [ 55.104729][ T4991] Allocated by task 4991: [ 55.109033][ T4991] kasan_set_track+0x4f/0x70 [ 55.113604][ T4991] __kasan_kmalloc+0x98/0xb0 [ 55.118171][ T4991] alloc_empty_backing_file+0x52/0xd0 [ 55.123525][ T4991] backing_file_open+0x26/0x100 [ 55.128357][ T4991] ovl_open_realfile+0x1f6/0x350 [ 55.133272][ T4991] ovl_splice_read+0x7cc/0x8c0 [ 55.138016][ T4991] splice_direct_to_actor+0x2a8/0x9a0 [ 55.143370][ T4991] do_splice_direct+0x286/0x3d0 [ 55.148194][ T4991] do_sendfile+0x623/0x1070 [ 55.152671][ T4991] __se_sys_sendfile64+0x17c/0x1e0 [ 55.157755][ T4991] do_syscall_64+0x41/0xc0 [ 55.162151][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.168195][ T4991] [ 55.170503][ T4991] The buggy address belongs to the object at ffff88801ea5a800 [ 55.170503][ T4991] which belongs to the cache kmalloc-512 of size 512 [ 55.184534][ T4991] The buggy address is located 0 bytes inside of [ 55.184534][ T4991] 480-byte region [ffff88801ea5a800, ffff88801ea5a9e0) [ 55.197608][ T4991] [ 55.199912][ T4991] The buggy address belongs to the physical page: [ 55.206295][ T4991] page:ffffea00007a9600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ea58 [ 55.216418][ T4991] head:ffffea00007a9600 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 55.225326][ T4991] anon flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 55.233715][ T4991] page_type: 0xffffffff() [ 55.238026][ T4991] raw: 00fff00000010200 ffff888012441c80 0000000000000000 dead000000000001 [ 55.246589][ T4991] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 55.255146][ T4991] page dumped because: kasan: bad access detected [ 55.261533][ T4991] page_owner tracks the page as allocated [ 55.267220][ T4991] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 733, tgid 733 (kworker/u4:0), ts 6534177535, free_ts 0 [ 55.287430][ T4991] post_alloc_hook+0x1e6/0x210 [ 55.292181][ T4991] get_page_from_freelist+0x320e/0x3390 [ 55.297708][ T4991] __alloc_pages+0x255/0x670 [ 55.302281][ T4991] alloc_slab_page+0x6a/0x160 [ 55.306935][ T4991] new_slab+0x84/0x2f0 [ 55.310984][ T4991] ___slab_alloc+0xa85/0x10a0 [ 55.315640][ T4991] __kmem_cache_alloc_node+0x1b8/0x290 [ 55.321089][ T4991] kmalloc_trace+0x2a/0xe0 [ 55.325502][ T4991] alloc_bprm+0x56/0x900 [ 55.329825][ T4991] kernel_execve+0x96/0xa10 [ 55.334334][ T4991] call_usermodehelper_exec_async+0x233/0x370 [ 55.340396][ T4991] ret_from_fork+0x1f/0x30 [ 55.344798][ T4991] page_owner free stack trace missing [ 55.350142][ T4991] [ 55.352447][ T4991] Memory state around the buggy address: [ 55.358070][ T4991] ffff88801ea5a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.366116][ T4991] ffff88801ea5a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.374170][ T4991] >ffff88801ea5a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.382218][ T4991] ^ [ 55.386266][ T4991] ffff88801ea5a880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.394306][ T4991] ffff88801ea5a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.402342][ T4991] ================================================================== [ 55.411318][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 55.418524][ T4991] CPU: 0 PID: 4991 Comm: syz-executor145 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0 [ 55.428593][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 55.438627][ T4991] Call Trace: [ 55.441885][ T4991] [ 55.444794][ T4991] dump_stack_lvl+0x1e7/0x2d0 [ 55.449454][ T4991] ? nf_tcp_handle_invalid+0x650/0x650 [ 55.454889][ T4991] ? panic+0x770/0x770 [ 55.458931][ T4991] ? preempt_schedule_common+0x83/0xc0 [ 55.464367][ T4991] ? vscnprintf+0x5d/0x80 [ 55.468672][ T4991] ? init_file+0xe0/0x200 [ 55.472980][ T4991] panic+0x30f/0x770 [ 55.476851][ T4991] ? check_panic_on_warn+0x21/0xa0 [ 55.481939][ T4991] ? __memcpy_flushcache+0x2b0/0x2b0 [ 55.487197][ T4991] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 55.493155][ T4991] ? _raw_spin_unlock+0x40/0x40 [ 55.498000][ T4991] ? init_file+0x195/0x200 [ 55.502406][ T4991] check_panic_on_warn+0x82/0xa0 [ 55.507329][ T4991] ? init_file+0x195/0x200 [ 55.511725][ T4991] end_report+0x63/0x110 [ 55.515954][ T4991] kasan_report_invalid_free+0xf6/0x100 [ 55.521481][ T4991] ? init_file+0x195/0x200 [ 55.525911][ T4991] ____kasan_slab_free+0xfb/0x120 [ 55.530933][ T4991] kmem_cache_free+0x297/0x520 [ 55.535701][ T4991] ? init_file+0x195/0x200 [ 55.540099][ T4991] init_file+0x195/0x200 [ 55.544318][ T4991] alloc_empty_backing_file+0x67/0xd0 [ 55.549670][ T4991] backing_file_open+0x26/0x100 [ 55.554503][ T4991] ovl_open_realfile+0x1f6/0x350 [ 55.559425][ T4991] ovl_splice_read+0x7cc/0x8c0 [ 55.564171][ T4991] ? ovl_splice_write+0x650/0x650 [ 55.569175][ T4991] ? vfs_splice_read+0x24d/0x3b0 [ 55.574108][ T4991] ? ovl_splice_write+0x650/0x650 [ 55.579201][ T4991] splice_direct_to_actor+0x2a8/0x9a0 [ 55.584555][ T4991] ? do_splice_direct+0x3d0/0x3d0 [ 55.589556][ T4991] ? warn_unsupported+0xc0/0xc0 [ 55.594382][ T4991] ? fsnotify_perm+0x63/0x5a0 [ 55.599036][ T4991] ? security_file_permission+0x79/0xa0 [ 55.604555][ T4991] do_splice_direct+0x286/0x3d0 [ 55.609384][ T4991] ? splice_direct_to_actor+0x9a0/0x9a0 [ 55.614908][ T4991] ? rcu_read_lock_any_held+0xb7/0x160 [ 55.620348][ T4991] do_sendfile+0x623/0x1070 [ 55.624831][ T4991] ? do_pwritev+0x360/0x360 [ 55.629309][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50 [ 55.634495][ T4991] ? ptrace_notify+0x278/0x380 [ 55.639237][ T4991] __se_sys_sendfile64+0x17c/0x1e0 [ 55.644324][ T4991] ? __x64_sys_sendfile64+0xb0/0xb0 [ 55.649499][ T4991] ? syscall_enter_from_user_mode+0x32/0x230 [ 55.655467][ T4991] ? syscall_enter_from_user_mode+0x8c/0x230 [ 55.661420][ T4991] do_syscall_64+0x41/0xc0 [ 55.665819][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.671688][ T4991] RIP: 0033:0x7fbb808467a9 [ 55.676081][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 55.695663][ T4991] RSP: 002b:00007ffdc0c78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 55.704053][ T4991] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbb808467a9 [ 55.712003][ T4991] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 [ 55.719952][ T4991] RBP: 00007ffdc0c78ff0 R08: 0000000000000001 R09: 00007fbb80800034 [ 55.727900][ T4991] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000006 [ 55.735850][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 55.743801][ T4991] [ 55.747050][ T4991] Kernel Offset: disabled [ 55.751362][ T4991] Rebooting in 86400 seconds..