./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4016104095 <...> Warning: Permanently added '10.128.0.57' (ECDSA) to the list of known hosts. execve("./syz-executor4016104095", ["./syz-executor4016104095"], 0x7ffebddc9580 /* 10 vars */) = 0 brk(NULL) = 0x555556e1e000 brk(0x555556e1ec40) = 0x555556e1ec40 arch_prctl(ARCH_SET_FS, 0x555556e1e300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor4016104095", 4096) = 28 brk(0x555556e3fc40) = 0x555556e3fc40 brk(0x555556e40000) = 0x555556e40000 mprotect(0x7f2dfb058000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3609 attached , child_tidptr=0x555556e1e5d0) = 3609 [pid 3609] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3609] setsid() = 1 [pid 3609] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3609] unshare(CLONE_NEWNS) = 0 [pid 3609] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3609] unshare(CLONE_NEWIPC) = 0 [pid 3609] unshare(CLONE_NEWCGROUP) = 0 [pid 3609] unshare(CLONE_NEWUTS) = 0 [pid 3609] unshare(CLONE_SYSVSEM) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "16777216", 8) = 8 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "536870912", 9) = 9 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "8192", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3609] close(3) = 0 [pid 3609] getpid() = 1 [pid 3609] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 54.295238][ T146] dump_stack_lvl+0xcd/0x134 [ 54.299862][ T146] print_report.cold+0x2ba/0x719 [ 54.304834][ T146] ? __list_add_valid+0x93/0xb0 [ 54.309714][ T146] kasan_report+0xb1/0x1e0 [ 54.314172][ T146] ? __list_add_valid+0x93/0xb0 [ 54.319051][ T146] __list_add_valid+0x93/0xb0 [ 54.323753][ T146] udl_get_urb_timeout+0x20e/0x550 [ 54.328895][ T146] ? udl_urb_completion+0x3e0/0x3e0 [ 54.334122][ T146] ? slab_free_freelist_hook+0x8b/0x1c0 [ 54.339687][ T146] ? udl_free_urb_list+0x136/0x250 [ 54.344824][ T146] ? kfree+0xe2/0x580 [ 54.348828][ T146] udl_free_urb_list+0x15f/0x250 [ 54.353796][ T146] ? _raw_spin_unlock_irq+0x1f/0x40 [ 54.359009][ T146] udl_drop_usb+0xd0/0x160 [ 54.363450][ T146] udl_usb_disconnect+0x3f/0x50 [ 54.368332][ T146] usb_unbind_interface+0x1d8/0x8e0 [ 54.375413][ T146] ? usb_unbind_device+0x1a0/0x1a0 [ 54.380572][ T146] device_remove+0x11f/0x170 [ 54.385204][ T146] device_release_driver_internal+0x4a1/0x700 [ 54.391312][ T146] ? put_device+0x1b/0x30 [ 54.395669][ T146] bus_remove_device+0x2e3/0x590 [ 54.400635][ T146] device_del+0x4f3/0xc80 [ 54.404986][ T146] ? usb_disconnect.cold+0x43/0x6ed [ 54.410227][ T146] ? __device_link_del+0x380/0x380 [ 54.415375][ T146] ? mutex_lock_io_nested+0x1190/0x1190 [ 54.420975][ T146] usb_disable_device+0x356/0x7a0 [ 54.426042][ T146] usb_disconnect.cold+0x259/0x6ed [ 54.431295][ T146] hub_event+0x1f86/0x4610 [ 54.435848][ T146] ? hub_port_debounce+0x3b0/0x3b0 [ 54.440990][ T146] ? lock_release+0x780/0x780 [ 54.445687][ T146] ? lock_downgrade+0x6e0/0x6e0 [ 54.450556][ T146] ? do_raw_spin_lock+0x120/0x2a0 [ 54.455606][ T146] process_one_work+0x991/0x1610 [ 54.460587][ T146] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 54.465991][ T146] ? rwlock_bug.part.0+0x90/0x90 [ 54.470947][ T146] ? _raw_spin_lock_irq+0x41/0x50 [ 54.476004][ T146] worker_thread+0x854/0x1080 [ 54.480709][ T146] ? __kthread_parkme+0x15f/0x220 [ 54.485754][ T146] ? process_one_work+0x1610/0x1610 [ 54.490979][ T146] kthread+0x2e4/0x3a0 [ 54.495077][ T146] ? kthread_complete_and_exit+0x40/0x40 [ 54.500752][ T146] ret_from_fork+0x1f/0x30 [ 54.505215][ T146] [ 54.508240][ T146] [ 54.510573][ T146] Allocated by task 146: [ 54.514827][ T146] kasan_save_stack+0x1e/0x40 [ 54.519528][ T146] __kasan_kmalloc+0xa9/0xd0 [ 54.524138][ T146] udl_init+0x736/0xc80 [ 54.528315][ T146] udl_usb_probe+0x4f/0x100 [ 54.532838][ T146] usb_probe_interface+0x30b/0x7f0 [ 54.537966][ T146] really_probe+0x249/0xb90 [ 54.542513][ T146] __driver_probe_device+0x1df/0x4d0 [ 54.547830][ T146] driver_probe_device+0x4c/0x1a0 [ 54.552886][ T146] __device_attach_driver+0x206/0x2e0 [ 54.558771][ T146] bus_for_each_drv+0x15f/0x1e0 [ 54.563643][ T146] __device_attach+0x1e4/0x530 [ 54.568456][ T146] bus_probe_device+0x1e4/0x290 [ 54.573341][ T146] device_add+0xbd5/0x1e90 [ 54.577774][ T146] usb_set_configuration+0x1019/0x1900 [ 54.583261][ T146] usb_generic_driver_probe+0xba/0x100 [ 54.588749][ T146] usb_probe_device+0xd4/0x2c0 [ 54.593569][ T146] really_probe+0x249/0xb90 [ 54.598110][ T146] __driver_probe_device+0x1df/0x4d0 [ 54.603677][ T146] driver_probe_device+0x4c/0x1a0 [ 54.608746][ T146] __device_attach_driver+0x206/0x2e0 [ 54.614414][ T146] bus_for_each_drv+0x15f/0x1e0 [ 54.619286][ T146] __device_attach+0x1e4/0x530 [ 54.624077][ T146] bus_probe_device+0x1e4/0x290 [ 54.628948][ T146] device_add+0xbd5/0x1e90 [ 54.633386][ T146] usb_new_device.cold+0x685/0x10ad [ 54.638608][ T146] hub_event+0x26c7/0x4610 [ 54.643047][ T146] process_one_work+0x991/0x1610 [ 54.648020][ T146] worker_thread+0x665/0x1080 [ 54.652733][ T146] kthread+0x2e4/0x3a0 [ 54.656819][ T146] ret_from_fork+0x1f/0x30 [ 54.661255][ T146] [ 54.663616][ T146] Freed by task 146: [ 54.667512][ T146] kasan_save_stack+0x1e/0x40 [ 54.672223][ T146] kasan_set_track+0x21/0x30 [ 54.676839][ T146] kasan_set_free_info+0x20/0x30 [ 54.681816][ T146] ____kasan_slab_free+0x166/0x1c0 [ 54.686958][ T146] slab_free_freelist_hook+0x8b/0x1c0 [ 54.692348][ T146] kfree+0xe2/0x580 [ 54.696347][ T146] udl_free_urb_list+0x136/0x250 [ 54.701308][ T146] udl_drop_usb+0xd0/0x160 [ 54.705746][ T146] udl_usb_disconnect+0x3f/0x50 [ 54.710613][ T146] usb_unbind_interface+0x1d8/0x8e0 [ 54.715836][ T146] device_remove+0x11f/0x170 [ 54.720455][ T146] device_release_driver_internal+0x4a1/0x700 [ 54.726558][ T146] bus_remove_device+0x2e3/0x590 [ 54.731528][ T146] device_del+0x4f3/0xc80 [ 54.735876][ T146] usb_disable_device+0x356/0x7a0 [ 54.740945][ T146] usb_disconnect.cold+0x259/0x6ed [ 54.746083][ T146] hub_event+0x1f86/0x4610 [ 54.750542][ T146] process_one_work+0x991/0x1610 [ 54.755503][ T146] worker_thread+0x854/0x1080 [ 54.760199][ T146] kthread+0x2e4/0x3a0 [ 54.764285][ T146] ret_from_fork+0x1f/0x30 [ 54.768735][ T146] [ 54.771065][ T146] The buggy address belongs to the object at ffff8880756fce80 [ 54.771065][ T146] which belongs to the cache kmalloc-32 of size 32 [ 54.784952][ T146] The buggy address is located 8 bytes inside of [ 54.784952][ T146] 32-byte region [ffff8880756fce80, ffff8880756fcea0) [ 54.797980][ T146] [ 54.800305][ T146] The buggy address belongs to the physical page: [ 54.806723][ T146] page:ffffea0001d5bf00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x756fc [ 54.816888][ T146] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 54.824461][ T146] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888011841500 [ 54.833062][ T146] raw: 0000000000000000 0000000000400040 00000001ffffffff 0000000000000000 [ 54.841647][ T146] page dumped because: kasan: bad access detected [ 54.848062][ T146] page_owner tracks the page as allocated [ 54.853776][ T146] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 3609, tgid 3609 (syz-executor401), ts 53404959933, free_ts 53124140132 [ 54.872201][ T146] get_page_from_freelist+0x109b/0x2ce0 [ 54.877779][ T146] __alloc_pages+0x1c7/0x510 [ 54.882395][ T146] alloc_pages+0x1a6/0x270 [ 54.886836][ T146] allocate_slab+0x27e/0x3d0 [ 54.891447][ T146] ___slab_alloc+0x7f1/0xe10 [ 54.896063][ T146] __slab_alloc.constprop.0+0x4d/0xa0 [ 54.901451][ T146] __kmalloc+0x32b/0x340 [ 54.905714][ T146] tomoyo_encode2.part.0+0xe9/0x3a0 [ 54.910922][ T146] tomoyo_encode+0x28/0x50 [ 54.915437][ T146] tomoyo_realpath_from_path+0x186/0x620 [ 54.921080][ T146] tomoyo_path_number_perm+0x1d5/0x590 [ 54.926563][ T146] security_file_ioctl+0x50/0xb0 [ 54.931519][ T146] __x64_sys_ioctl+0xb3/0x200 [ 54.936208][ T146] do_syscall_64+0x35/0xb0 [ 54.940646][ T146] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.951241][ T146] page last free stack trace: [ 54.956174][ T146] free_pcp_prepare+0x5e4/0xd20 [ 54.961049][ T146] free_unref_page+0x19/0x4d0 [ 54.965753][ T146] qlist_free_all+0x6a/0x170 [ 54.970372][ T146] kasan_quarantine_reduce+0x180/0x200 [ 54.975860][ T146] __kasan_slab_alloc+0xa2/0xc0 [ 54.980731][ T146] kmem_cache_alloc_node+0x2b1/0x3f0 [ 54.986039][ T146] __alloc_skb+0x210/0x2f0 [ 54.990492][ T146] alloc_skb_with_frags+0x93/0x6c0 [ 54.995628][ T146] sock_alloc_send_pskb+0x7a3/0x930 [ 55.000843][ T146] mld_newpack.isra.0+0x1b9/0x770 [ 55.005891][ T146] add_grhead+0x295/0x340 [ 55.010244][ T146] add_grec+0x1082/0x1560 [ 55.014598][ T146] mld_ifc_work+0x452/0xdc0 [ 55.019130][ T146] process_one_work+0x991/0x1610 [ 55.024096][ T146] worker_thread+0x665/0x1080 [ 55.028814][ T146] kthread+0x2e4/0x3a0 [ 55.032913][ T146] [ 55.035244][ T146] Memory state around the buggy address: [ 55.040885][ T146] ffff8880756fcd80: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 55.048958][ T146] ffff8880756fce00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 55.057041][ T146] >ffff8880756fce80: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc [ 55.065115][ T146] ^ [ 55.069474][ T146] ffff8880756fcf00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc [ 55.077552][ T146] ffff8880756fcf80: 00 00 00 00 fc fc fc fc 00 00 00 fc fc fc fc fc [ 55.085636][ T146] ================================================================== [ 55.093701][ T146] Kernel panic - not syncing: panic_on_warn set ... [ 55.100307][ T146] CPU: 0 PID: 146 Comm: kworker/0:2 Not tainted 6.0.0-rc1-next-20220818-syzkaller #0 [ 55.109788][ T146] kworker/0:2[146] cmdline: a [ 55.115166][ T146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 55.125285][ T146] Workqueue: usb_hub_wq hub_event [ 55.130337][ T146] Call Trace: [ 55.133626][ T146] [ 55.136563][ T146] dump_stack_lvl+0xcd/0x134 [ 55.141186][ T146] panic+0x2c8/0x627 [ 55.145104][ T146] ? panic_print_sys_info.part.0+0x10b/0x10b [ 55.151150][ T146] ? print_report.cold+0x4f6/0x719 [ 55.156310][ T146] ? __list_add_valid+0x93/0xb0 [ 55.161194][ T146] end_report.part.0+0x3f/0x7c [ 55.165988][ T146] kasan_report.cold+0xa/0xf [ 55.170608][ T146] ? __list_add_valid+0x93/0xb0 [ 55.175486][ T146] __list_add_valid+0x93/0xb0 [ 55.180188][ T146] udl_get_urb_timeout+0x20e/0x550 [ 55.185335][ T146] ? udl_urb_completion+0x3e0/0x3e0 [ 55.190559][ T146] ? slab_free_freelist_hook+0x8b/0x1c0 [ 55.196126][ T146] ? udl_free_urb_list+0x136/0x250 [ 55.201267][ T146] ? kfree+0xe2/0x580 [ 55.205277][ T146] udl_free_urb_list+0x15f/0x250 [ 55.210250][ T146] ? _raw_spin_unlock_irq+0x1f/0x40 [ 55.215499][ T146] udl_drop_usb+0xd0/0x160 [ 55.219949][ T146] udl_usb_disconnect+0x3f/0x50 [ 55.224833][ T146] usb_unbind_interface+0x1d8/0x8e0 [ 55.230070][ T146] ? usb_unbind_device+0x1a0/0x1a0 [ 55.235217][ T146] device_remove+0x11f/0x170 [ 55.239835][ T146] device_release_driver_internal+0x4a1/0x700 [ 55.245937][ T146] ? put_device+0x1b/0x30 [ 55.250289][ T146] bus_remove_device+0x2e3/0x590 [ 55.255252][ T146] device_del+0x4f3/0xc80 [ 55.259596][ T146] ? usb_disconnect.cold+0x43/0x6ed [ 55.264825][ T146] ? __device_link_del+0x380/0x380 [ 55.269962][ T146] ? mutex_lock_io_nested+0x1190/0x1190 [ 55.275539][ T146] usb_disable_device+0x356/0x7a0 [ 55.280616][ T146] usb_disconnect.cold+0x259/0x6ed [ 55.285758][ T146] hub_event+0x1f86/0x4610 [ 55.290211][ T146] ? hub_port_debounce+0x3b0/0x3b0 [ 55.295343][ T146] ? lock_release+0x780/0x780 [ 55.300042][ T146] ? lock_downgrade+0x6e0/0x6e0 [ 55.304907][ T146] ? do_raw_spin_lock+0x120/0x2a0 [ 55.309956][ T146] process_one_work+0x991/0x1610 [ 55.314921][ T146] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 55.320319][ T146] ? rwlock_bug.part.0+0x90/0x90 [ 55.325275][ T146] ? _raw_spin_lock_irq+0x41/0x50 [ 55.330591][ T146] worker_thread+0x854/0x1080 [ 55.335296][ T146] ? __kthread_parkme+0x15f/0x220 [ 55.340339][ T146] ? process_one_work+0x1610/0x1610 [ 55.345560][ T146] kthread+0x2e4/0x3a0 [ 55.349647][ T146] ? kthread_complete_and_exit+0x40/0x40 [ 55.355304][ T146] ret_from_fork+0x1f/0x30 [ 55.359752][ T146] [ 55.362932][ T146] Kernel Offset: disabled [ 55.367252][ T146] Rebooting in 86400 seconds..