./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3662010231

<...>
Warning: Permanently added '10.128.0.39' (ED25519) to the list of known hosts.
execve("./syz-executor3662010231", ["./syz-executor3662010231"], 0x7ffc515c1700 /* 10 vars */) = 0
brk(NULL)                               = 0x555573ea5000
brk(0x555573ea5d00)                     = 0x555573ea5d00
arch_prctl(ARCH_SET_FS, 0x555573ea5380) = 0
set_tid_address(0x555573ea5650)         = 5095
set_robust_list(0x555573ea5660, 24)     = 0
rseq(0x555573ea5ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3662010231", 4096) = 28
getrandom("\x8b\x32\xff\xc9\x0d\x26\x9d\x09", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555573ea5d00
brk(0x555573ec6d00)                     = 0x555573ec6d00
brk(0x555573ec7000)                     = 0x555573ec7000
mprotect(0x7fd1cdb6a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573ea5650) = 5096
./strace-static-x86_64: Process 5096 attached
[pid  5096] set_robust_list(0x555573ea5660, 24) = 0
[pid  5096] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5096] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5096] setsid()                    = 1
[pid  5096] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5096] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5096] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5096] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5096] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5096] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5096] unshare(CLONE_NEWNS)        = 0
[pid  5096] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5096] unshare(CLONE_NEWIPC)       = 0
[pid  5096] unshare(CLONE_NEWCGROUP)    = 0
[pid  5096] unshare(CLONE_NEWUTS)       = 0
[pid  5096] unshare(CLONE_SYSVSEM)      = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "16777216", 8)     = 8
[pid  5096] close(3)                    = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "536870912", 9)    = 9
[pid  5096] close(3)                    = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "1024", 4)         = 4
[pid  5096] close(3)                    = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "8192", 4)         = 4
[pid  5096] close(3)                    = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "1024", 4)         = 4
[pid  5096] close(3)                    = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "1024", 4)         = 4
[pid  5096] close(3)                    = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5096] close(3)                    = 0
[pid  5096] getpid()                    = 1
[pid  5096] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5096] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5096] unshare(CLONE_NEWNET)       = 0
[pid  5096] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5096] write(3, "0 65535", 7)      = 7
[pid  5096] close(3)                    = 0
[pid  5096] mkdir("/dev/binderfs", 0777) = 0
[pid  5096] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5096] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5096] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5099 attached
, child_tidptr=0x555573ea5650) = 2
[pid  5099] set_robust_list(0x555573ea5660, 24) = 0
[pid  5099] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5099] setpgid(0, 0)               = 0
[pid  5099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5099] write(3, "1000", 4)         = 4
[pid  5099] close(3)                    = 0
[pid  5099] openat(AT_FDCWD, "/dev/vhost-vsock", O_RDWR) = 3
[pid  5099] ioctl(3, VHOST_SET_OWNER, 0) = 0
[pid  5099] close(3)                    = 0
[pid  5099] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5099] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5099] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5099] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5099] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5099] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5099] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5099] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5099] exit_group(0)               = ?
[pid  5099] +++ exited with 0 +++
[pid  5096] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
[pid  5096] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5101 attached
, child_tidptr=0x555573ea5650) = 4
[pid  5101] set_robust_list(0x555573ea5660, 24) = 0
[pid  5101] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5101] setpgid(0, 0)               = 0
[pid  5101] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5101] write(3, "1000", 4)         = 4
[pid  5101] close(3)                    = 0
[pid  5101] openat(AT_FDCWD, "/dev/vhost-vsock", O_RDWR) = 3
[pid  5101] ioctl(3, VHOST_SET_OWNER, 0) = 0
[pid  5101] close(3)                    = 0
[pid  5101] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5101] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5101] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5101] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5101] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5101] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5101] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5101] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5101] exit_group(0)               = ?
[pid  5101] +++ exited with 0 +++
[pid  5096] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  5096] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555573ea5650) = 6
./strace-static-x86_64: Process 5103 attached
[pid  5103] set_robust_list(0x555573ea5660, 24) = 0
[pid  5103] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5103] setpgid(0, 0)               = 0
[pid  5103] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5103] write(3, "1000", 4)         = 4
[pid  5103] close(3)                    = 0
[pid  5103] openat(AT_FDCWD, "/dev/vhost-vsock", O_RDWR) = 3
[pid  5103] ioctl(3, VHOST_SET_OWNER, 0) = 0
[pid  5103] close(3)                    = 0
[pid  5103] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5103] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5103] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5103] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5103] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5103] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5103] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(11)                   = -1 EBADF (Bad file descriptor)
[   79.841753][ T5104] ==================================================================
[   79.849866][ T5104] BUG: KASAN: slab-use-after-free in __mutex_unlock_slowpath+0xef/0x750
[   79.858225][ T5104] Read of size 8 at addr ffff88802a9d9080 by task vhost-5103/5104
[   79.866041][ T5104] 
[   79.868384][ T5104] CPU: 1 PID: 5104 Comm: vhost-5103 Not tainted 6.9.0-rc5-next-20240426-syzkaller #0
[   79.877853][ T5104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   79.887940][ T5104] Call Trace:
[pid  5103] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(13)                   = -1 EBADF (Bad file descriptor)
[   79.891237][ T5104]  <TASK>
[   79.894175][ T5104]  dump_stack_lvl+0x241/0x360
[   79.898897][ T5104]  ? __pfx_dump_stack_lvl+0x10/0x10
[   79.904137][ T5104]  ? __pfx__printk+0x10/0x10
[   79.908775][ T5104]  ? _printk+0xd5/0x120
[   79.912962][ T5104]  ? __virt_addr_valid+0x183/0x520
[   79.918124][ T5104]  ? __virt_addr_valid+0x183/0x520
[   79.923348][ T5104]  print_report+0x169/0x550
[   79.927886][ T5104]  ? __virt_addr_valid+0x183/0x520
[   79.933029][ T5104]  ? __virt_addr_valid+0x183/0x520
[   79.938587][ T5104]  ? __virt_addr_valid+0x44e/0x520
[   79.943848][ T5104]  ? __phys_addr+0xba/0x170
[   79.948475][ T5104]  ? __mutex_unlock_slowpath+0xef/0x750
[   79.954039][ T5104]  kasan_report+0x143/0x180
[   79.958574][ T5104]  ? __mutex_unlock_slowpath+0xef/0x750
[   79.964131][ T5104]  kasan_check_range+0x282/0x290
[   79.969082][ T5104]  ? vhost_task_fn+0x3bc/0x3f0
[   79.973976][ T5104]  __mutex_unlock_slowpath+0xef/0x750
[   79.979362][ T5104]  ? mark_lock+0x9a/0x350
[   79.983802][ T5104]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   79.989795][ T5104]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[   79.995784][ T5104]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   80.001707][ T5104]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   80.008053][ T5104]  ? complete+0xb4/0x1c0
[   80.012308][ T5104]  vhost_task_fn+0x3bc/0x3f0
[   80.016912][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.022032][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.027154][ T5104]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   80.033139][ T5104]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   80.039643][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.044762][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.049883][ T5104]  ? _raw_spin_unlock_irq+0x23/0x50
[   80.055118][ T5104]  ? lockdep_hardirqs_on+0x99/0x150
[   80.060328][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.065469][ T5104]  ret_from_fork+0x4b/0x80
[   80.069900][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.075027][ T5104]  ret_from_fork_asm+0x1a/0x30
[   80.079812][ T5104]  </TASK>
[   80.082835][ T5104] 
[   80.085157][ T5104] Allocated by task 5103:
[   80.089484][ T5104]  kasan_save_track+0x3f/0x80
[   80.094168][ T5104]  __kasan_kmalloc+0x98/0xb0
[   80.098775][ T5104]  kmalloc_trace_noprof+0x19c/0x2b0
[   80.103998][ T5104]  vhost_task_create+0x149/0x300
[   80.108944][ T5104]  vhost_worker_create+0x17b/0x3f0
[   80.114075][ T5104]  vhost_dev_set_owner+0x563/0x940
[   80.119197][ T5104]  vhost_dev_ioctl+0xda/0xda0
[   80.123883][ T5104]  vhost_vsock_dev_ioctl+0x2bb/0xfa0
[   80.129181][ T5104]  __se_sys_ioctl+0xfc/0x170
[   80.133773][ T5104]  do_syscall_64+0xf5/0x240
[   80.138283][ T5104]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   80.144178][ T5104] 
[   80.146506][ T5104] Freed by task 5103:
[   80.150499][ T5104]  kasan_save_track+0x3f/0x80
[   80.155190][ T5104]  kasan_save_free_info+0x40/0x50
[   80.160226][ T5104]  poison_slab_object+0xe0/0x150
[   80.165169][ T5104]  __kasan_slab_free+0x37/0x60
[   80.170029][ T5104]  kfree+0x149/0x350
[   80.173936][ T5104]  vhost_dev_cleanup+0x9b0/0xba0
[   80.178878][ T5104]  vhost_vsock_dev_release+0x3aa/0x410
[   80.184352][ T5104]  __fput+0x406/0x8b0
[   80.188346][ T5104]  __x64_sys_close+0x7f/0x110
[   80.193031][ T5104]  do_syscall_64+0xf5/0x240
[   80.197548][ T5104]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   80.203539][ T5104] 
[   80.205867][ T5104] The buggy address belongs to the object at ffff88802a9d9000
[   80.205867][ T5104]  which belongs to the cache kmalloc-512 of size 512
[   80.219921][ T5104] The buggy address is located 128 bytes inside of
[   80.219921][ T5104]  freed 512-byte region [ffff88802a9d9000, ffff88802a9d9200)
[   80.233721][ T5104] 
[   80.236044][ T5104] The buggy address belongs to the physical page:
[   80.242449][ T5104] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a9d8
[   80.251214][ T5104] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   80.259711][ T5104] flags: 0xfff80000000040(head|node=0|zone=1|lastcpupid=0xfff)
[   80.267257][ T5104] page_type: 0xffffefff(slab)
[   80.271934][ T5104] raw: 00fff80000000040 ffff888015041c80 ffffea00007e4200 0000000000000002
[   80.280523][ T5104] raw: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000
[   80.289115][ T5104] head: 00fff80000000040 ffff888015041c80 ffffea00007e4200 0000000000000002
[   80.297792][ T5104] head: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000
[   80.306463][ T5104] head: 00fff80000000002 ffffea0000aa7601 ffffffffffffffff 0000000000000000
[   80.315137][ T5104] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   80.323805][ T5104] page dumped because: kasan: bad access detected
[   80.330212][ T5104] page_owner tracks the page as allocated
[   80.335921][ T5104] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4750, tgid 4750 (S40network), ts 45835903170, free_ts 45731176473
[   80.356429][ T5104]  post_alloc_hook+0x1f3/0x230
[   80.361289][ T5104]  get_page_from_freelist+0x2ce2/0x2d90
[   80.366851][ T5104]  __alloc_pages_noprof+0x256/0x6c0
[   80.372113][ T5104]  alloc_slab_page+0x5f/0x120
[   80.376797][ T5104]  allocate_slab+0x5a/0x2e0
[   80.381304][ T5104]  ___slab_alloc+0xcd1/0x14b0
[   80.386003][ T5104]  __slab_alloc+0x58/0xa0
[   80.390351][ T5104]  __kmalloc_noprof+0x25e/0x400
[   80.395219][ T5104]  tomoyo_init_log+0x1b3e/0x2050
[   80.400171][ T5104]  tomoyo_supervisor+0x38a/0x11f0
[   80.405220][ T5104]  tomoyo_path_permission+0x243/0x360
[   80.410623][ T5104]  tomoyo_check_open_permission+0x2fb/0x500
[   80.416574][ T5104]  security_file_open+0x6a/0x730
[   80.421527][ T5104]  do_dentry_open+0x36c/0x1720
[   80.426314][ T5104]  path_openat+0x289f/0x3280
[   80.430915][ T5104]  do_filp_open+0x235/0x490
[   80.435445][ T5104] page last free pid 4749 tgid 4749 stack trace:
[   80.441781][ T5104]  free_unref_page+0xd22/0xea0
[   80.446646][ T5104]  __slab_free+0x31b/0x3d0
[   80.451087][ T5104]  qlist_free_all+0x9e/0x140
[   80.455688][ T5104]  kasan_quarantine_reduce+0x14f/0x170
[   80.461159][ T5104]  __kasan_slab_alloc+0x23/0x80
[   80.466220][ T5104]  kmem_cache_alloc_noprof+0x135/0x290
[   80.471718][ T5104]  getname_flags+0xbd/0x4f0
[   80.476354][ T5104]  vfs_fstatat+0x11c/0x190
[   80.480791][ T5104]  __x64_sys_newfstatat+0x125/0x1b0
[   80.486011][ T5104]  do_syscall_64+0xf5/0x240
[   80.490557][ T5104]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   80.496546][ T5104] 
[   80.498887][ T5104] Memory state around the buggy address:
[   80.504528][ T5104]  ffff88802a9d8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   80.512591][ T5104]  ffff88802a9d9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.520654][ T5104] >ffff88802a9d9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.528800][ T5104]                    ^
[   80.532898][ T5104]  ffff88802a9d9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[pid  5103] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5103] close(29)                   = -1 EBADF (Bad file descriptor)
[   80.540967][ T5104]  ffff88802a9d9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   80.549122][ T5104] ==================================================================
[   80.559048][ T5104] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   80.566280][ T5104] CPU: 1 PID: 5104 Comm: vhost-5103 Not tainted 6.9.0-rc5-next-20240426-syzkaller #0
[   80.575956][ T5104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   80.586017][ T5104] Call Trace:
[   80.589305][ T5104]  <TASK>
[   80.592239][ T5104]  dump_stack_lvl+0x241/0x360
[   80.596970][ T5104]  ? __pfx_dump_stack_lvl+0x10/0x10
[   80.602188][ T5104]  ? __pfx__printk+0x10/0x10
[   80.606802][ T5104]  ? preempt_schedule+0xe1/0xf0
[   80.611684][ T5104]  ? vscnprintf+0x5d/0x90
[   80.616030][ T5104]  panic+0x349/0x860
[   80.619939][ T5104]  ? check_panic_on_warn+0x21/0xb0
[   80.625078][ T5104]  ? __pfx_panic+0x10/0x10
[   80.629647][ T5104]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   80.635869][ T5104]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   80.642228][ T5104]  ? print_report+0x502/0x550
[   80.646922][ T5104]  check_panic_on_warn+0x86/0xb0
[   80.651972][ T5104]  ? __mutex_unlock_slowpath+0xef/0x750
[   80.657532][ T5104]  end_report+0x77/0x160
[   80.661793][ T5104]  kasan_report+0x154/0x180
[   80.666307][ T5104]  ? __mutex_unlock_slowpath+0xef/0x750
[   80.671863][ T5104]  kasan_check_range+0x282/0x290
[   80.676813][ T5104]  ? vhost_task_fn+0x3bc/0x3f0
[   80.681675][ T5104]  __mutex_unlock_slowpath+0xef/0x750
[   80.687057][ T5104]  ? mark_lock+0x9a/0x350
[   80.691396][ T5104]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   80.697379][ T5104]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[   80.703388][ T5104]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   80.709300][ T5104]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   80.715904][ T5104]  ? complete+0xb4/0x1c0
[   80.720160][ T5104]  vhost_task_fn+0x3bc/0x3f0
[   80.724765][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.729887][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.735005][ T5104]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   80.740995][ T5104]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   80.747413][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.752533][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.757653][ T5104]  ? _raw_spin_unlock_irq+0x23/0x50
[   80.762883][ T5104]  ? lockdep_hardirqs_on+0x99/0x150
[   80.768199][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.773324][ T5104]  ret_from_fork+0x4b/0x80
[   80.777764][ T5104]  ? __pfx_vhost_task_fn+0x10/0x10
[   80.782898][ T5104]  ret_from_fork_asm+0x1a/0x30
[   80.787684][ T5104]  </TASK>
[   80.791031][ T5104] Kernel Offset: disabled
[   80.795353][ T5104] Rebooting in 86400 seconds..