./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2455497578 <...> forked to background, child pid 4641 no interfaces have a carrier [ 28.185112][ T4642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.194347][ T4642] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.118' (ECDSA) to the list of known hosts. execve("./syz-executor2455497578", ["./syz-executor2455497578"], 0x7ffcdbfbe3d0 /* 10 vars */) = 0 brk(NULL) = 0x555555650000 brk(0x555555650c40) = 0x555555650c40 arch_prctl(ARCH_SET_FS, 0x555555650300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x5555556505d0) = 5062 set_robust_list(0x5555556505e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f8619c10300, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f8619c109d0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f8619c103a0, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f8619c109d0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2455497578", 4096) = 28 brk(0x555555671c40) = 0x555555671c40 brk(0x555555672000) = 0x555555672000 mprotect(0x7f8619cd0000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556505d0) = 5063 ./strace-static-x86_64: Process 5063 attached [pid 5063] set_robust_list(0x5555556505e0, 24) = 0 [pid 5063] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5063] setpgid(0, 0) = 0 [pid 5063] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5063] write(3, "1000", 4) = 4 [pid 5063] close(3) = 0 [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8619be0000 [pid 5063] mprotect(0x7f8619be1000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5063] clone(child_stack=0x7f8619c003f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5064 attached , parent_tid=[5064], tls=0x7f8619c00700, child_tidptr=0x7f8619c009d0) = 5064 [pid 5063] futex(0x7f8619cd64c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] set_robust_list(0x7f8619c009e0, 24) = 0 [pid 5064] openat(AT_FDCWD, "/dev/char/4:21", O_RDWR) = 3 [pid 5064] futex(0x7f8619cd64cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5063] <... futex resumed>) = 0 [pid 5063] futex(0x7f8619cd64c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] <... futex resumed>) = 1 [pid 5064] ioctl(3, TIOCSETD, [21]) = 0 [pid 5064] futex(0x7f8619cd64cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5063] <... futex resumed>) = 0 [pid 5063] futex(0x7f8619cd64c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] <... futex resumed>) = 1 [pid 5064] openat(AT_FDCWD, "/dev/char/4:21", O_RDWR) = 4 [pid 5064] futex(0x7f8619cd64cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5063] <... futex resumed>) = 0 [pid 5063] futex(0x7f8619cd64c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] <... futex resumed>) = 1 [pid 5064] ioctl(4, GSMIOC_SETCONF [pid 5063] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 5063] futex(0x7f8619cd64dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f8619bbf000 [pid 5063] mprotect(0x7f8619bc0000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5063] clone(child_stack=0x7f8619bdf3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5069], tls=0x7f8619bdf700, child_tidptr=0x7f8619bdf9d0) = 5069 [pid 5063] futex(0x7f8619cd64d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5063] futex(0x7f8619cd64dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5069 attached [pid 5069] set_robust_list(0x7f8619bdf9e0, 24) = 0 [pid 5069] openat(AT_FDCWD, "/dev/char/4:21", O_RDWR [pid 5064] <... ioctl resumed>, 0x20000040) = 0 [pid 5064] futex(0x7f8619cd64cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5069] <... openat resumed>) = 5 [pid 5064] futex(0x7f8619cd64c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5069] futex(0x7f8619cd64dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5063] <... futex resumed>) = 0 [pid 5063] futex(0x7f8619cd64c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5069] futex(0x7f8619cd64d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5064] <... futex resumed>) = 0 [pid 5063] <... futex resumed>) = 1 [pid 5063] futex(0x7f8619cd64cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5064] ioctl(5, GSMIOC_SETCONF [pid 5063] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5063] futex(0x7f8619cd64d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5069] <... futex resumed>) = 0 [pid 5063] <... futex resumed>) = 1 [pid 5069] ioctl(5, GSMIOC_SETCONF [pid 5063] futex(0x7f8619cd64dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) syzkaller login: [ 53.059456][ T5069] ================================================================== [ 53.067549][ T5069] BUG: KASAN: use-after-free in gsm_cleanup_mux+0x78d/0x810 [ 53.074853][ T5069] Read of size 4 at addr ffff888017ce000c by task syz-executor245/5069 [ 53.083080][ T5069] [ 53.085380][ T5069] CPU: 1 PID: 5069 Comm: syz-executor245 Not tainted 6.2.0-rc1-syzkaller #0 [ 53.094038][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 53.104089][ T5069] Call Trace: [ 53.107381][ T5069] [ 53.110312][ T5069] dump_stack_lvl+0xd1/0x138 [ 53.114917][ T5069] print_report+0x15e/0x45d [ 53.119440][ T5069] ? __phys_addr+0xc8/0x140 [ 53.123973][ T5069] ? gsm_cleanup_mux+0x78d/0x810 [ 53.128925][ T5069] kasan_report+0xbf/0x1f0 [ 53.133350][ T5069] ? gsm_cleanup_mux+0x78d/0x810 [ 53.138297][ T5069] gsm_cleanup_mux+0x78d/0x810 [ 53.143073][ T5069] ? gsm_dlci_begin_close+0x200/0x200 [ 53.148462][ T5069] gsmld_ioctl+0x55a/0x11c0 [ 53.152987][ T5069] ? gsmld_close+0x210/0x210 [ 53.157604][ T5069] tty_ioctl+0x808/0x1670 [ 53.161951][ T5069] ? gsmld_close+0x210/0x210 [ 53.166543][ T5069] ? tty_release+0x11b0/0x11b0 [ 53.171329][ T5069] ? find_held_lock+0x2d/0x110 [ 53.176109][ T5069] ? do_one_initcall+0x470/0x790 [ 53.181062][ T5069] ? __fget_files+0x26a/0x440 [ 53.185747][ T5069] ? bpf_lsm_file_ioctl+0x9/0x10 [ 53.190697][ T5069] ? tty_release+0x11b0/0x11b0 [ 53.195488][ T5069] __x64_sys_ioctl+0x197/0x210 [ 53.200260][ T5069] do_syscall_64+0x39/0xb0 [ 53.204698][ T5069] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.210609][ T5069] RIP: 0033:0x7f8619c4ec79 [ 53.215029][ T5069] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 53.234732][ T5069] RSP: 002b:00007f8619bdf318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 53.243161][ T5069] RAX: ffffffffffffffda RBX: 00007f8619cd64d8 RCX: 00007f8619c4ec79 [ 53.251136][ T5069] RDX: 0000000020000040 RSI: 00000000404c4701 RDI: 0000000000000005 [ 53.259114][ T5069] RBP: 00007f8619cd64d0 R08: 0000000000000000 R09: 0000000000000000 [ 53.267091][ T5069] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8619ca407c [ 53.275076][ T5069] R13: 00007ffd9aa5100f R14: 00007f8619bdf400 R15: 0000000000022000 [ 53.283069][ T5069] [ 53.286099][ T5069] [ 53.288426][ T5069] Allocated by task 5064: [ 53.292749][ T5069] kasan_save_stack+0x22/0x40 [ 53.297441][ T5069] kasan_set_track+0x25/0x30 [ 53.302060][ T5069] __kasan_kmalloc+0xa5/0xb0 [pid 5064] <... ioctl resumed>, 0x20000040) = 0 [pid 5064] futex(0x7f8619cd64cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 53.306666][ T5069] gsm_dlci_alloc+0x46/0x7d0 [ 53.311287][ T5069] gsmld_ioctl+0x8e4/0x11c0 [ 53.315804][ T5069] tty_ioctl+0x808/0x1670 [ 53.320155][ T5069] __x64_sys_ioctl+0x197/0x210 [ 53.324924][ T5069] do_syscall_64+0x39/0xb0 [ 53.329356][ T5069] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.335254][ T5069] [ 53.337577][ T5069] Freed by task 5064: [ 53.341576][ T5069] kasan_save_stack+0x22/0x40 [ 53.346263][ T5069] kasan_set_track+0x25/0x30 [ 53.350877][ T5069] kasan_save_free_info+0x2e/0x40 [ 53.355889][ T5069] ____kasan_slab_free+0x160/0x1c0 [ 53.361003][ T5069] slab_free_freelist_hook+0x8b/0x1c0 [ 53.366367][ T5069] __kmem_cache_free+0xaf/0x3b0 [ 53.371200][ T5069] tty_port_put+0x15c/0x1c0 [ 53.375709][ T5069] gsm_cleanup_mux+0x2fe/0x810 [ 53.380476][ T5069] gsmld_ioctl+0x55a/0x11c0 [ 53.384959][ T5069] tty_ioctl+0x808/0x1670 [ 53.389288][ T5069] __x64_sys_ioctl+0x197/0x210 [ 53.394045][ T5069] do_syscall_64+0x39/0xb0 [ 53.398447][ T5069] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.404347][ T5069] [ 53.406656][ T5069] The buggy address belongs to the object at ffff888017ce0000 [ 53.406656][ T5069] which belongs to the cache kmalloc-2k of size 2048 [ 53.420691][ T5069] The buggy address is located 12 bytes inside of [ 53.420691][ T5069] 2048-byte region [ffff888017ce0000, ffff888017ce0800) [ 53.433953][ T5069] [ 53.436284][ T5069] The buggy address belongs to the physical page: [ 53.442672][ T5069] page:ffffea00005f3800 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888017ce7000 pfn:0x17ce0 [ 53.454128][ T5069] head:ffffea00005f3800 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 [ 53.464167][ T5069] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 53.472132][ T5069] raw: 00fff00000010200 ffff888012442000 ffff888012440948 ffffea00005f5e10 [ 53.480719][ T5069] raw: ffff888017ce7000 0000000000080005 00000001ffffffff 0000000000000000 [ 53.489285][ T5069] page dumped because: kasan: bad access detected [ 53.495682][ T5069] page_owner tracks the page as allocated [ 53.501374][ T5069] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 1558246129, free_ts 0 [ 53.520976][ T5069] get_page_from_freelist+0x119c/0x2ce0 [ 53.526515][ T5069] __alloc_pages+0x1cb/0x5b0 [ 53.531100][ T5069] alloc_page_interleave+0x1e/0x200 [ 53.536303][ T5069] alloc_pages+0x233/0x270 [ 53.540708][ T5069] allocate_slab+0x25f/0x350 [ 53.545302][ T5069] ___slab_alloc+0xa91/0x1400 [ 53.549959][ T5069] __slab_alloc.constprop.0+0x56/0xa0 [ 53.555312][ T5069] __kmem_cache_alloc_node+0x1a4/0x430 [ 53.560754][ T5069] kmalloc_trace+0x26/0x60 [ 53.565159][ T5069] acpi_ds_create_walk_state+0x8c/0x203 [ 53.570688][ T5069] acpi_ds_auto_serialize_method+0xf2/0x200 [ 53.576566][ T5069] acpi_ds_init_one_object+0x2a5/0x3c7 [ 53.582015][ T5069] acpi_ns_walk_namespace+0x250/0x432 [ 53.587397][ T5069] acpi_ds_initialize_objects+0xe0/0x174 [ 53.593016][ T5069] acpi_ns_load_table+0x95/0x11a [ 53.597947][ T5069] acpi_tb_load_namespace+0x2ea/0x5bf [ 53.603342][ T5069] page_owner free stack trace missing [ 53.608703][ T5069] [ 53.611014][ T5069] Memory state around the buggy address: [ 53.616621][ T5069] ffff888017cdff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.624750][ T5069] ffff888017cdff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.632805][ T5069] >ffff888017ce0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.640866][ T5069] ^ [ 53.645196][ T5069] ffff888017ce0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.653261][ T5069] ffff888017ce0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [pid 5064] futex(0x7f8619cd64c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5063] exit_group(0 [pid 5064] <... futex resumed>) = ? [pid 5063] <... exit_group resumed>) = ? [ 53.661320][ T5069] ================================================================== [ 53.671572][ T5069] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 53.678948][ T5069] CPU: 1 PID: 5069 Comm: syz-executor245 Not tainted 6.2.0-rc1-syzkaller #0 [ 53.687620][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 53.697659][ T5069] Call Trace: [ 53.700922][ T5069] [ 53.703836][ T5069] dump_stack_lvl+0xd1/0x138 [ 53.708416][ T5069] panic+0x2cc/0x626 [pid 5064] +++ exited with 0 +++ [ 53.712311][ T5069] ? panic_print_sys_info.part.0+0x110/0x110 [ 53.718302][ T5069] ? preempt_schedule_thunk+0x1a/0x20 [ 53.723666][ T5069] ? preempt_schedule_common+0x59/0xc0 [ 53.729134][ T5069] check_panic_on_warn.cold+0x19/0x35 [ 53.734498][ T5069] end_report.part.0+0x36/0x73 [ 53.739272][ T5069] ? gsm_cleanup_mux+0x78d/0x810 [ 53.744193][ T5069] kasan_report.cold+0xa/0xf [ 53.748775][ T5069] ? gsm_cleanup_mux+0x78d/0x810 [ 53.753715][ T5069] gsm_cleanup_mux+0x78d/0x810 [ 53.758490][ T5069] ? gsm_dlci_begin_close+0x200/0x200 [ 53.763848][ T5069] gsmld_ioctl+0x55a/0x11c0 [ 53.768337][ T5069] ? gsmld_close+0x210/0x210 [ 53.772913][ T5069] tty_ioctl+0x808/0x1670 [ 53.777259][ T5069] ? gsmld_close+0x210/0x210 [ 53.781854][ T5069] ? tty_release+0x11b0/0x11b0 [ 53.786611][ T5069] ? find_held_lock+0x2d/0x110 [ 53.791387][ T5069] ? do_one_initcall+0x470/0x790 [ 53.796314][ T5069] ? __fget_files+0x26a/0x440 [ 53.800987][ T5069] ? bpf_lsm_file_ioctl+0x9/0x10 [ 53.805924][ T5069] ? tty_release+0x11b0/0x11b0 [ 53.810685][ T5069] __x64_sys_ioctl+0x197/0x210 [ 53.815449][ T5069] do_syscall_64+0x39/0xb0 [ 53.819856][ T5069] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.825746][ T5069] RIP: 0033:0x7f8619c4ec79 [ 53.830176][ T5069] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 53.849773][ T5069] RSP: 002b:00007f8619bdf318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 53.858186][ T5069] RAX: ffffffffffffffda RBX: 00007f8619cd64d8 RCX: 00007f8619c4ec79 [ 53.866157][ T5069] RDX: 0000000020000040 RSI: 00000000404c4701 RDI: 0000000000000005 [ 53.874144][ T5069] RBP: 00007f8619cd64d0 R08: 0000000000000000 R09: 0000000000000000 [ 53.882097][ T5069] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8619ca407c [ 53.890052][ T5069] R13: 00007ffd9aa5100f R14: 00007f8619bdf400 R15: 0000000000022000 [ 53.898028][ T5069] [ 53.902139][ T5069] Kernel Offset: disabled [ 53.906451][ T5069] Rebooting in 86400 seconds..