./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1670944618
<...>
DUID 00:04:e6:bc:8e:bc:c3:7a:f3:fc:35:c5:a5:4f:9b:64:01:ce
forked to background, child pid 4671
[ 34.360673][ T4672] 8021q: adding VLAN 0 to HW filter on device bond0
[ 34.371665][ T4672] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.10.50' (ECDSA) to the list of known hosts.
execve("./syz-executor1670944618", ["./syz-executor1670944618"], 0x7ffe780ac4c0 /* 10 vars */) = 0
brk(NULL) = 0x555556bc1000
brk(0x555556bc1c40) = 0x555556bc1c40
arch_prctl(ARCH_SET_FS, 0x555556bc1300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1670944618", 4096) = 28
brk(0x555556be2c40) = 0x555556be2c40
brk(0x555556be3000) = 0x555556be3000
mprotect(0x7f58c6449000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/vim2m", O_RDWR) = 3
ioctl(3, VIDIOC_REQBUFS, {type=V4L2_BUF_TYPE_VIDEO_OUTPUT, memory=V4L2_MEMORY_USERPTR, count=4294967264 => 27}) = 0
syzkaller login: [ 64.808283][ T5002] ------------[ cut here ]------------
[ 64.813856][ T5002] get_vaddr_frames() cannot follow VM_IO mapping
[ 64.814423][ T5002] WARNING: CPU: 1 PID: 5002 at drivers/media/common/videobuf2/frame_vector.c:63 get_vaddr_frames+0x220/0x230
[ 64.832824][ T5002] Modules linked in:
[ 64.836768][ T5002] CPU: 1 PID: 5002 Comm: syz-executor167 Not tainted 6.4.0-rc2-next-20230515-syzkaller #0
[ 64.846837][ T5002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
[ 64.857111][ T5002] RIP: 0010:get_vaddr_frames+0x220/0x230
[ 64.862773][ T5002] Code: c4 12 fb e9 06 ff ff ff e8 6d c4 12 fb e9 cd fe ff ff e8 e3 c3 bf fa 48 c7 c7 60 49 1f 8b c6 05 2b e0 a0 07 01 e8 e0 70 87 fa <0f> 0b e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 41 57 41 56 41 55
[ 64.882774][ T5002] RSP: 0018:ffffc90003abf758 EFLAGS: 00010282
[ 64.889085][ T5002] RAX: 0000000000000000 RBX: ffffc9000aa00000 RCX: 0000000000000000
[ 64.897232][ T5002] RDX: ffff888028651dc0 RSI: ffffffff814bd247 RDI: 0000000000000001
[ 64.905539][ T5002] RBP: ffffc9000aa00004 R08: 0000000000000001 R09: 0000000000000000
[ 64.913630][ T5002] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000fffffff2
[ 64.921880][ T5002] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888017b84800
[ 64.930106][ T5002] FS: 0000555556bc1300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 64.939200][ T5002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 64.945837][ T5002] CR2: 00000000005fdeb8 CR3: 00000000240dd000 CR4: 00000000003506e0
[ 64.953978][ T5002] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 64.962237][ T5002] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 64.970286][ T5002] Call Trace:
[ 64.973591][ T5002]
[ 64.976566][ T5002] vb2_create_framevec+0x62/0xd0
[ 64.981531][ T5002] vb2_vmalloc_get_userptr+0x13b/0x530
[ 64.987254][ T5002] ? is_bpf_text_address+0x9d/0x1b0
[ 64.992589][ T5002] ? vb2_vmalloc_dmabuf_ops_attach+0x430/0x430
[ 64.998891][ T5002] __prepare_userptr+0x6a6/0x1630
[ 65.003978][ T5002] ? vb2_queue_error+0x60/0x60
[ 65.009524][ T5002] ? __lock_acquire+0x1987/0x5f30
[ 65.015040][ T5002] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 65.021149][ T5002] ? ____kasan_slab_free+0x160/0x1c0
[ 65.026882][ T5002] ? slab_free_freelist_hook+0x8b/0x1c0
[ 65.032639][ T5002] ? __kmem_cache_free+0xaf/0x2d0
[ 65.038141][ T5002] ? tomoyo_path_number_perm+0x43b/0x570
[ 65.043790][ T5002] ? security_file_ioctl+0x54/0xb0
[ 65.049052][ T5002] ? print_usage_bug.part.0+0x660/0x660
[ 65.055022][ T5002] ? mark_lock.part.0+0xee/0x1970
[ 65.060326][ T5002] ? lock_sync+0x190/0x190
[ 65.064955][ T5002] __buf_prepare+0x602/0x7d0
[ 65.069736][ T5002] ? vb2_queue_or_prepare_buf+0x590/0x2cb0
[ 65.075907][ T5002] vb2_core_qbuf+0xc79/0x14e0
[ 65.080878][ T5002] ? __mutex_lock+0x231/0x1350
[ 65.085696][ T5002] vb2_qbuf+0x13d/0x1d0
[ 65.089889][ T5002] ? vb2_ioctl_prepare_buf+0x140/0x140
[ 65.095471][ T5002] ? mutex_lock_io_nested+0x11a0/0x11a0
[ 65.101131][ T5002] v4l2_m2m_qbuf+0x18e/0x920
[ 65.105790][ T5002] ? check_fmt+0x4f4/0x900
[ 65.110479][ T5002] v4l_qbuf+0x96/0xc0
[ 65.114519][ T5002] __video_do_ioctl+0xba6/0xf20
[ 65.119485][ T5002] ? v4l_reqbufs+0xd0/0xd0
[ 65.124385][ T5002] ? __might_fault+0xb2/0x190
[ 65.129273][ T5002] video_usercopy+0x4bf/0x14c0
[ 65.134292][ T5002] ? v4l_reqbufs+0xd0/0xd0
[ 65.138823][ T5002] ? v4l_enumstd+0x70/0x70
[ 65.143279][ T5002] ? lock_downgrade+0x690/0x690
[ 65.152023][ T5002] v4l2_ioctl+0x1b7/0x250
[ 65.156594][ T5002] ? v4l2_read+0x350/0x350
[ 65.161100][ T5002] __x64_sys_ioctl+0x197/0x210
[ 65.165903][ T5002] do_syscall_64+0x39/0xb0
[ 65.170350][ T5002] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.176444][ T5002] RIP: 0033:0x7f58c63dcc49
[ 65.180875][ T5002] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 65.200867][ T5002] RSP: 002b:00007fff7e584ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 65.209340][ T5002] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f58c63dcc49
[ 65.217914][ T5002] RDX: 0000000020000180 RSI: 00000000c058560f RDI: 0000000000000003
[ 65.226375][ T5002] RBP: 00007f58c63a0df0 R08: 0000000000000000 R09: 0000000000000000
[ 65.234574][ T5002] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f58c63a0e80
[ 65.242750][ T5002] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 65.252551][ T5002]
[ 65.256164][ T5002] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 65.263792][ T5002] CPU: 1 PID: 5002 Comm: syz-executor167 Not tainted 6.4.0-rc2-next-20230515-syzkaller #0
[ 65.273687][ T5002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
[ 65.283841][ T5002] Call Trace:
[ 65.287119][ T5002]
[ 65.290058][ T5002] dump_stack_lvl+0xd9/0x150
[ 65.294786][ T5002] panic+0x686/0x730
[ 65.298738][ T5002] ? panic_smp_self_stop+0xa0/0xa0
[ 65.303885][ T5002] ? show_trace_log_lvl+0x285/0x390
[ 65.309219][ T5002] ? get_vaddr_frames+0x220/0x230
[ 65.314345][ T5002] check_panic_on_warn+0xb1/0xc0
[ 65.319665][ T5002] __warn+0xf2/0x390
[ 65.323713][ T5002] ? get_vaddr_frames+0x220/0x230
[ 65.328897][ T5002] report_bug+0x2da/0x500
[ 65.333430][ T5002] handle_bug+0x3c/0x70
[ 65.337713][ T5002] exc_invalid_op+0x18/0x50
[ 65.342269][ T5002] asm_exc_invalid_op+0x1a/0x20
[ 65.347157][ T5002] RIP: 0010:get_vaddr_frames+0x220/0x230
[ 65.353279][ T5002] Code: c4 12 fb e9 06 ff ff ff e8 6d c4 12 fb e9 cd fe ff ff e8 e3 c3 bf fa 48 c7 c7 60 49 1f 8b c6 05 2b e0 a0 07 01 e8 e0 70 87 fa <0f> 0b e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 41 57 41 56 41 55
[ 65.373263][ T5002] RSP: 0018:ffffc90003abf758 EFLAGS: 00010282
[ 65.379452][ T5002] RAX: 0000000000000000 RBX: ffffc9000aa00000 RCX: 0000000000000000
[ 65.387976][ T5002] RDX: ffff888028651dc0 RSI: ffffffff814bd247 RDI: 0000000000000001
[ 65.396873][ T5002] RBP: ffffc9000aa00004 R08: 0000000000000001 R09: 0000000000000000
[ 65.406005][ T5002] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000fffffff2
[ 65.414168][ T5002] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888017b84800
[ 65.422530][ T5002] ? __warn_printk+0x187/0x310
[ 65.427517][ T5002] ? get_vaddr_frames+0x220/0x230
[ 65.432573][ T5002] vb2_create_framevec+0x62/0xd0
[ 65.437636][ T5002] vb2_vmalloc_get_userptr+0x13b/0x530
[ 65.443127][ T5002] ? is_bpf_text_address+0x9d/0x1b0
[ 65.448544][ T5002] ? vb2_vmalloc_dmabuf_ops_attach+0x430/0x430
[ 65.454750][ T5002] __prepare_userptr+0x6a6/0x1630
[ 65.459920][ T5002] ? vb2_queue_error+0x60/0x60
[ 65.464752][ T5002] ? __lock_acquire+0x1987/0x5f30
[ 65.469862][ T5002] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 65.476049][ T5002] ? ____kasan_slab_free+0x160/0x1c0
[ 65.481433][ T5002] ? slab_free_freelist_hook+0x8b/0x1c0
[ 65.487178][ T5002] ? __kmem_cache_free+0xaf/0x2d0
[ 65.492301][ T5002] ? tomoyo_path_number_perm+0x43b/0x570
[ 65.497957][ T5002] ? security_file_ioctl+0x54/0xb0
[ 65.503197][ T5002] ? print_usage_bug.part.0+0x660/0x660
[ 65.508757][ T5002] ? mark_lock.part.0+0xee/0x1970
[ 65.513804][ T5002] ? lock_sync+0x190/0x190
[ 65.518261][ T5002] __buf_prepare+0x602/0x7d0
[ 65.522864][ T5002] ? vb2_queue_or_prepare_buf+0x590/0x2cb0
[ 65.528719][ T5002] vb2_core_qbuf+0xc79/0x14e0
[ 65.533505][ T5002] ? __mutex_lock+0x231/0x1350
[ 65.538401][ T5002] vb2_qbuf+0x13d/0x1d0
[ 65.542577][ T5002] ? vb2_ioctl_prepare_buf+0x140/0x140
[ 65.548050][ T5002] ? mutex_lock_io_nested+0x11a0/0x11a0
[ 65.553707][ T5002] v4l2_m2m_qbuf+0x18e/0x920
[ 65.558336][ T5002] ? check_fmt+0x4f4/0x900
[ 65.562775][ T5002] v4l_qbuf+0x96/0xc0
[ 65.566878][ T5002] __video_do_ioctl+0xba6/0xf20
[ 65.571847][ T5002] ? v4l_reqbufs+0xd0/0xd0
[ 65.576280][ T5002] ? __might_fault+0xb2/0x190
[ 65.581240][ T5002] video_usercopy+0x4bf/0x14c0
[ 65.586134][ T5002] ? v4l_reqbufs+0xd0/0xd0
[ 65.590851][ T5002] ? v4l_enumstd+0x70/0x70
[ 65.595388][ T5002] ? lock_downgrade+0x690/0x690
[ 65.600271][ T5002] v4l2_ioctl+0x1b7/0x250
[ 65.604623][ T5002] ? v4l2_read+0x350/0x350
[ 65.609053][ T5002] __x64_sys_ioctl+0x197/0x210
[ 65.613919][ T5002] do_syscall_64+0x39/0xb0
[ 65.618476][ T5002] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 65.625444][ T5002] RIP: 0033:0x7f58c63dcc49
[ 65.629861][ T5002] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 65.649871][ T5002] RSP: 002b:00007fff7e584ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 65.658316][ T5002] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f58c63dcc49
[ 65.666297][ T5002] RDX: 0000000020000180 RSI: 00000000c058560f RDI: 0000000000000003
[ 65.674982][ T5002] RBP: 00007f58c63a0df0 R08: 0000000000000000 R09: 0000000000000000
[ 65.683695][ T5002] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f58c63a0e80
[ 65.691676][ T5002] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 65.699842][ T5002]
[ 65.703131][ T5002] Kernel Offset: disabled
[ 65.707605][ T5002] Rebooting in 86400 seconds..