./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor247765169 <...> forked to background, child pid 3260 [ 26.626904][ T3261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.630691][ T3261] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: [ 27.000784][ T3352] sshd (3352) used greatest stack depth: 22448 bytes left OK syzkaller Warning: Permanently added '10.128.0.239' (ECDSA) to the list of known hosts. execve("./syz-executor247765169", ["./syz-executor247765169"], 0x7fffb88500f0 /* 10 vars */) = 0 brk(NULL) = 0x555556beb000 brk(0x555556bebc40) = 0x555556bebc40 arch_prctl(ARCH_SET_FS, 0x555556beb300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor247765169", 4096) = 27 brk(0x555556c0cc40) = 0x555556c0cc40 brk(0x555556c0d000) = 0x555556c0d000 mprotect(0x7f4cb28b2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3682 attached , child_tidptr=0x555556beb5d0) = 3682 [pid 3682] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3682] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3682] setsid() = 1 [pid 3682] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3682] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3682] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3682] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3682] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3682] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3682] unshare(CLONE_NEWNS) = 0 [pid 3682] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3682] unshare(CLONE_NEWIPC) = 0 [pid 3682] unshare(CLONE_NEWCGROUP) = 0 [pid 3682] unshare(CLONE_NEWUTS) = 0 [pid 3682] unshare(CLONE_SYSVSEM) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "16777216", 8) = 8 [pid 3682] close(3) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "536870912", 9) = 9 [pid 3682] close(3) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "1024", 4) = 4 [pid 3682] close(3) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "8192", 4) = 4 [pid 3682] close(3) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "1024", 4) = 4 [pid 3682] close(3) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "1024", 4) = 4 [pid 3682] close(3) = 0 [pid 3682] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3682] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3682] close(3) = 0 [pid 3682] getpid() = 1 [pid 3682] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x12ca/0x3a60 [ 45.650314][ T3682] #3: ffff88801d0d78d8 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x318/0xbe0 [ 45.650346][ T3682] #4: ffffffff8bd85a40 (rcu_read_lock_bh){....}-{1:2}, at: ip_finish_output2+0x292/0x2170 [ 45.650382][ T3682] #5: ffffffff8bd85a40 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1e3/0x3a60 [ 45.650412][ T3682] #6: ffff888024eb1258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x12ca/0x3a60 [ 45.650443][ T3682] [ 45.650443][ T3682] stack backtrace: [ 45.650447][ T3682] CPU: 0 PID: 3682 Comm: syz-executor247 Not tainted 5.18.0-rc5-next-20220506-syzkaller #0 [ 45.650461][ T3682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/12/2022 [ 45.650469][ T3682] Call Trace: [ 45.650472][ T3682] [ 45.650477][ T3682] dump_stack_lvl+0xcd/0x134 [ 45.650498][ T3682] __lock_acquire.cold+0x1f5/0x3b4 [ 45.650516][ T3682] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 45.650539][ T3682] ? skb_checksum+0x90/0xc0 [ 45.650565][ T3682] ? __skb_checksum+0x890/0x890 [ 45.650589][ T3682] ? csum_block_add_ext+0x40/0x40 [ 45.650613][ T3682] ? reqsk_fastopen_remove+0x620/0x620 [ 45.650635][ T3682] lock_acquire+0x1ab/0x570 [ 45.650660][ T3682] ? sch_direct_xmit+0x318/0xbe0 [ 45.650674][ T3682] ? lock_release+0x780/0x780 [ 45.650694][ T3682] ? validate_xmit_skb+0x87d/0xf10 [ 45.650711][ T3682] _raw_spin_lock+0x2a/0x40 [ 45.650728][ T3682] ? sch_direct_xmit+0x318/0xbe0 [ 45.650741][ T3682] sch_direct_xmit+0x318/0xbe0 [ 45.650756][ T3682] ? dev_watchdog+0x8f0/0x8f0 [ 45.650768][ T3682] ? do_raw_spin_trylock+0xb0/0x180 [ 45.650781][ T3682] ? do_raw_spin_lock+0x1d0/0x2a0 [ 45.650795][ T3682] __dev_queue_xmit+0x14f7/0x3a60 [ 45.650810][ T3682] ? lock_chain_count+0x20/0x20 [ 45.650830][ T3682] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 45.650847][ T3682] ? find_held_lock+0x2d/0x110 [ 45.650865][ T3682] ? ip_finish_output2+0x782/0x2170 [ 45.650887][ T3682] ? mark_held_locks+0x9f/0xe0 [ 45.650906][ T3682] ? memcpy+0x39/0x60 [ 45.650921][ T3682] neigh_resolve_output+0x50f/0x830 [ 45.650937][ T3682] ip_finish_output2+0x782/0x2170 [ 45.650958][ T3682] ? nf_hook+0x20d/0x5b0 [ 45.650977][ T3682] ? ip_fragment.constprop.0+0x240/0x240 [ 45.650997][ T3682] ? ip_mc_finish_output+0x5a0/0x5a0 [ 45.651019][ T3682] __ip_finish_output+0x396/0x650 [ 45.651039][ T3682] ip_finish_output+0x32/0x280 [ 45.651060][ T3682] ip_output+0x19f/0x310 [ 45.651080][ T3682] ip_local_out+0xaf/0x1a0 [ 45.651100][ T3682] iptunnel_xmit+0x67a/0xa40 [ 45.651121][ T3682] ip_tunnel_xmit+0x10f0/0x2c00 [ 45.651137][ T3682] ? ip_md_tunnel_xmit+0x1510/0x1510 [ 45.651149][ T3682] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 45.651170][ T3682] ? lock_chain_count+0x20/0x20 [ 45.651191][ T3682] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 45.651209][ T3682] ? __gre_xmit+0x4f4/0x950 [ 45.651230][ T3682] erspan_xmit+0x7ec/0x29a0 [ 45.651251][ T3682] dev_hard_start_xmit+0x1eb/0x920 [ 45.651268][ T3682] sch_direct_xmit+0x19f/0xbe0 [ 45.651281][ T3682] ? lock_release+0x780/0x780 [ 45.651301][ T3682] ? dev_watchdog+0x8f0/0x8f0 [ 45.651314][ T3682] ? do_raw_spin_trylock+0xb0/0x180 [ 45.651326][ T3682] ? do_raw_spin_lock+0x1d0/0x2a0 [ 45.651340][ T3682] __dev_queue_xmit+0x14f7/0x3a60 [ 45.651357][ T3682] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 45.651373][ T3682] ? find_held_lock+0x2d/0x110 [ 45.651392][ T3682] ? ip_finish_output2+0x782/0x2170 [ 45.651412][ T3682] ? lock_downgrade+0x6e0/0x6e0 [ 45.651431][ T3682] ? do_raw_write_lock+0x11a/0x280 [ 45.651445][ T3682] ? memcpy+0x39/0x60 [ 45.651458][ T3682] neigh_resolve_output+0x50f/0x830 [ 45.651473][ T3682] ip_finish_output2+0x782/0x2170 [ 45.651494][ T3682] ? nf_hook+0x20d/0x5b0 [ 45.651513][ T3682] ? ip_fragment.constprop.0+0x240/0x240 [ 45.651534][ T3682] ? ip_mc_finish_output+0x5a0/0x5a0 [ 45.651556][ T3682] __ip_finish_output+0x396/0x650 [ 45.651576][ T3682] ip_finish_output+0x32/0x280 [ 45.651597][ T3682] ip_output+0x19f/0x310 [ 45.651617][ T3682] ip_send_skb+0xd4/0x260 [ 45.651637][ T3682] udp_send_skb+0x6c8/0x11a0 [ 45.651659][ T3682] udp_sendmsg+0x1bee/0x2760 [ 45.651673][ T3682] ? ip_setup_cork+0x970/0x970 [ 45.651694][ T3682] ? udp_unicast_rcv_skb+0x330/0x330 [ 45.651711][ T3682] ? lock_chain_count+0x20/0x20 [ 45.651730][ T3682] ? lock_chain_count+0x20/0x20 [ 45.651751][ T3682] ? mark_lock.part.0+0xee/0x1910 [ 45.651770][ T3682] ? lock_chain_count+0x20/0x20 [ 45.651791][ T3682] ? __lock_acquire+0x163e/0x5660 [ 45.651812][ T3682] udpv6_sendmsg+0x176b/0x2c50 [ 45.651834][ T3682] ? udp_v6_push_pending_frames+0x200/0x200 [ 45.651853][ T3682] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 45.651876][ T3682] ? find_held_lock+0x2d/0x110 [ 45.651898][ T3682] ? aa_sk_perm+0x30f/0xaa0 [ 45.651914][ T3682] ? aa_af_perm+0x230/0x230 [ 45.651928][ T3682] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 45.651945][ T3682] ? inet6_sendmsg+0x4a/0xe0 [ 45.651966][ T3682] inet6_sendmsg+0x99/0xe0 [ 45.651986][ T3682] ? inet6_compat_ioctl+0x310/0x310 [ 45.652005][ T3682] sock_sendmsg+0xcf/0x120 [ 45.652023][ T3682] ____sys_sendmsg+0x334/0x810 [ 45.652039][ T3682] ? kernel_sendmsg+0x50/0x50 [ 45.652054][ T3682] ? do_recvmmsg+0x6d0/0x6d0 [ 45.652072][ T3682] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 45.652096][ T3682] ___sys_sendmsg+0xf3/0x170 [ 45.652115][ T3682] ? sendmsg_copy_msghdr+0x160/0x160 [ 45.652135][ T3682] ? __lock_acquire+0x163e/0x5660 [ 45.652156][ T3682] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 45.652177][ T3682] ? lockdep_hardirqs_on+0x79/0x100 [ 45.652192][ T3682] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 45.652215][ T3682] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 45.652232][ T3682] ? __fget_light+0x20f/0x270 [ 45.652249][ T3682] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 45.652267][ T3682] __sys_sendmmsg+0x195/0x470 [ 45.652286][ T3682] ? __ia32_sys_sendmsg+0x220/0x220 [ 45.652305][ T3682] ? rwlock_bug.part.0+0x90/0x90 [ 45.652319][ T3682] ? find_held_lock+0x2d/0x110 [ 45.652338][ T3682] ? ptrace_notify+0xfa/0x140 [ 45.652351][ T3682] ? lock_downgrade+0x6e0/0x6e0 [ 45.652372][ T3682] ? _raw_spin_unlock_irq+0x1f/0x40 [ 45.652388][ T3682] ? lockdep_hardirqs_on+0x79/0x100 [ 45.652404][ T3682] __x64_sys_sendmmsg+0x99/0x100 [ 45.652423][ T3682] do_syscall_64+0x35/0xb0 [ 45.652444][ T3682] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 45.652463][ T3682] RIP: 0033:0x7f4cb283e089 [ 45.652474][ T3682] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 45.652486][ T3682] RSP: 002b:00007ffc5a477e98 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 45.652498][ T3682] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4cb283e089 [ 45.652507][ T3682] RDX: 0000000000000001 RSI: 0000000020004d80 RDI: 0000000000000004 [ 45.652514][ T3682] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 45.652522][ T3682] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000031 [ 45.652529][ T3682] R13: 0000000000000047 R14: 00007f4cb28b94a0 R15: 00007ffc5a477f50 [ 45.652541][ T3682] [pid 3682] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3682, si_uid=0, si_status=1, si_utime=0, si_stime=61} --- exit_group(0) = ? +++ exited with 0 +++