./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1310222809 <...> Warning: Permanently added '10.128.0.154' (ECDSA) to the list of known hosts. execve("./syz-executor1310222809", ["./syz-executor1310222809"], 0x7ffe90b667f0 /* 10 vars */) = 0 brk(NULL) = 0x555557279000 brk(0x555557279c40) = 0x555557279c40 arch_prctl(ARCH_SET_FS, 0x555557279300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1310222809", 4096) = 28 brk(0x55555729ac40) = 0x55555729ac40 brk(0x55555729b000) = 0x55555729b000 mprotect(0x7f7db4c01000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 3631 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "3631", 4) = 4 close(3) = 0 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 getpid() = 3631 mkdir("./syzkaller.rQDZcJ", 0700) = 0 chmod("./syzkaller.rQDZcJ", 0777) = 0 chdir("./syzkaller.rQDZcJ") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572795d0) = 3632 ./strace-static-x86_64: Process 3632 attached [pid 3632] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3632] setsid() = 1 [pid 3632] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3632] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3632] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3632] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3632] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3632] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3632] unshare(CLONE_NEWNS) = 0 [pid 3632] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3632] unshare(CLONE_NEWIPC) = 0 [pid 3632] unshare(CLONE_NEWCGROUP) = 0 [pid 3632] unshare(CLONE_NEWUTS) = 0 [pid 3632] unshare(CLONE_SYSVSEM) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "16777216", 8) = 8 [pid 3632] close(3) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "536870912", 9) = 9 [pid 3632] close(3) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "1024", 4) = 4 [pid 3632] close(3) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "8192", 4) = 4 [pid 3632] close(3) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "1024", 4) = 4 [pid 3632] close(3) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "1024", 4) = 4 [pid 3632] close(3) = 0 [pid 3632] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3632] close(3) = 0 [pid 3632] getpid() = 1 [pid 3632] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 59.247508][ T3632] dump_stack_lvl+0x1b1/0x28e [ 59.252245][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e [ 59.257778][ T3632] ? panic+0x710/0x710 [ 59.261835][ T3632] ? lockdep_hardirqs_on_prepare+0x428/0x790 [ 59.267803][ T3632] should_fail_ex+0x395/0x4c0 [ 59.272559][ T3632] prepare_alloc_pages+0x1d7/0x5a0 [ 59.278133][ T3632] __alloc_pages+0x161/0x560 [ 59.282845][ T3632] ? zone_statistics+0x160/0x160 [ 59.287838][ T3632] ? free_unref_page+0x32e/0x5f0 [ 59.292809][ T3632] ? lockdep_hardirqs_on_prepare+0x428/0x790 [ 59.298804][ T3632] ? mark_free_pages+0x450/0x450 [ 59.303916][ T3632] __kmalloc_large_node+0x8a/0x1a0 [ 59.309048][ T3632] kmalloc_large+0x1c/0x90 [ 59.313817][ T3632] ? diMount+0x16/0x870 [ 59.318194][ T3632] diMount+0x25/0x870 [ 59.322347][ T3632] ? diUnmount+0xef/0x100 [ 59.326777][ T3632] jfs_mount_rw+0x319/0x710 [ 59.331384][ T3632] ? chkSuper+0xf70/0xf70 [ 59.335821][ T3632] ? list_lru_walk_one_irq+0xe0/0xe0 [ 59.341263][ T3632] ? shrink_dentry_list+0x6a4/0x6c0 [ 59.346479][ T3632] ? sync_filesystem+0x103/0x220 [ 59.351429][ T3632] jfs_remount+0x3db/0x710 [ 59.355893][ T3632] ? jfs_statfs+0x510/0x510 [ 59.360477][ T3632] ? legacy_init_fs_context+0x4d/0xb0 [ 59.365947][ T3632] ? hook_sb_remount+0x14/0xc0 [ 59.370731][ T3632] reconfigure_super+0x3bc/0x7b0 [ 59.375684][ T3632] path_mount+0xd20/0x10c0 [ 59.380153][ T3632] ? kmem_cache_free+0x94/0x1d0 [ 59.385180][ T3632] ? user_path_at_empty+0x149/0x1a0 [ 59.390376][ T3632] __se_sys_mount+0x2d3/0x3c0 [ 59.395057][ T3632] ? __x64_sys_mount+0xc0/0xc0 [ 59.399818][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 59.405803][ T3632] ? __x64_sys_mount+0x1c/0xc0 [ 59.410567][ T3632] do_syscall_64+0x3d/0xb0 [ 59.414995][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.420887][ T3632] RIP: 0033:0x7f7db4b91149 [ 59.425300][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 59.445184][ T3632] RSP: 002b:00007ffc10bed888 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 59.453633][ T3632] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7db4b91149 [ 59.461703][ T3632] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000000 [pid 3632] mount(NULL, "./file0", NULL, MS_REMOUNT|MS_I_VERSION, NULL) = -1 ENOMEM (Cannot allocate memory) [pid 3632] close(3) = 0 [pid 3632] close(4) = 0 [pid 3632] close(5) = -1 EBADF (Bad file descriptor) [pid 3632] close(6) = -1 EBADF (Bad file descriptor) [pid 3632] close(7) = -1 EBADF (Bad file descriptor) [pid 3632] close(8) = -1 EBADF (Bad file descriptor) [pid 3632] close(9) = -1 EBADF (Bad file descriptor) [pid 3632] close(10) = -1 EBADF (Bad file descriptor) [pid 3632] close(11) = -1 EBADF (Bad file descriptor) [pid 3632] close(12) = -1 EBADF (Bad file descriptor) [pid 3632] close(13) = -1 EBADF (Bad file descriptor) [pid 3632] close(14) = -1 EBADF (Bad file descriptor) [pid 3632] close(15) = -1 EBADF (Bad file descriptor) [pid 3632] close(16) = -1 EBADF (Bad file descriptor) [pid 3632] close(17) = -1 EBADF (Bad file descriptor) [pid 3632] close(18) = -1 EBADF (Bad file descriptor) [pid 3632] close(19) = -1 EBADF (Bad file descriptor) [pid 3632] close(20) = -1 EBADF (Bad file descriptor) [pid 3632] close(21) = -1 EBADF (Bad file descriptor) [pid 3632] close(22) = -1 EBADF (Bad file descriptor) [pid 3632] close(23) = -1 EBADF (Bad file descriptor) [pid 3632] close(24) = -1 EBADF (Bad file descriptor) [pid 3632] close(25) = -1 EBADF (Bad file descriptor) [pid 3632] close(26) = -1 EBADF (Bad file descriptor) [pid 3632] close(27) = -1 EBADF (Bad file descriptor) [pid 3632] close(28) = -1 EBADF (Bad file descriptor) [pid 3632] close(29) = -1 EBADF (Bad file descriptor) [pid 3632] exit_group(1) = ? [ 59.469700][ T3632] RBP: 00007ffc10bed8a0 R08: 0000000000000000 R09: 00007ffc10bed820 [ 59.477756][ T3632] R10: 0000000000800020 R11: 0000000000000246 R12: 0000000000000004 [ 59.485850][ T3632] R13: 00007ffc10bed8d0 R14: 00007f7db4bd0423 R15: 00007ffc10bed8b0 [ 59.493843][ T3632] [ 59.501733][ T3632] jfs_mount_rw: diMount failed! [ 59.525585][ T3632] ================================================================== [ 59.533763][ T3632] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 [ 59.540868][ T3632] Free of addr ffff88806f410000 by task syz-executor131/3632 [ 59.548316][ T3632] [ 59.550648][ T3632] CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0 [ 59.561200][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 59.571251][ T3632] Call Trace: [ 59.574520][ T3632] [ 59.577437][ T3632] dump_stack_lvl+0x1b1/0x28e [ 59.582099][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e [ 59.587550][ T3632] ? __wake_up_klogd+0xcd/0x100 [ 59.592399][ T3632] ? panic+0x710/0x710 [ 59.596451][ T3632] ? _printk+0xc0/0x100 [ 59.600590][ T3632] ? _raw_spin_lock_irqsave+0x8e/0x100 [ 59.606048][ T3632] ? __kmem_cache_free+0x71/0x110 [ 59.611067][ T3632] print_address_description+0x74/0x340 [ 59.616599][ T3632] print_report+0x107/0x1f0 [ 59.621085][ T3632] ? _raw_spin_unlock+0x40/0x40 [ 59.625920][ T3632] ? __virt_addr_valid+0x21b/0x2d0 [ 59.631017][ T3632] ? __phys_addr+0xb5/0x160 [ 59.635514][ T3632] ? __kmem_cache_free+0x71/0x110 [ 59.640533][ T3632] ? __kmem_cache_free+0x71/0x110 [ 59.645552][ T3632] kasan_report_invalid_free+0xac/0xd0 [ 59.651105][ T3632] ? __kmem_cache_free+0x71/0x110 [ 59.656127][ T3632] ____kasan_slab_free+0xfb/0x120 [ 59.661143][ T3632] slab_free_freelist_hook+0x12e/0x1a0 [ 59.666599][ T3632] ? diUnmount+0xef/0x100 [ 59.670918][ T3632] __kmem_cache_free+0x71/0x110 [ 59.675764][ T3632] diUnmount+0xef/0x100 [ 59.679914][ T3632] jfs_umount+0x108/0x370 [ 59.684238][ T3632] jfs_put_super+0x86/0x190 [ 59.688731][ T3632] ? jfs_free_inode+0x20/0x20 [ 59.693401][ T3632] generic_shutdown_super+0x130/0x310 [ 59.698764][ T3632] kill_block_super+0x79/0xd0 [ 59.703435][ T3632] deactivate_locked_super+0xa7/0xf0 [ 59.708710][ T3632] cleanup_mnt+0x494/0x520 [ 59.713117][ T3632] ? lockdep_hardirqs_on+0x8d/0x130 [ 59.718310][ T3632] task_work_run+0x243/0x300 [ 59.722899][ T3632] ? task_work_cancel+0x290/0x290 [ 59.727917][ T3632] ? do_exit+0x65f/0x2070 [ 59.732247][ T3632] do_exit+0x664/0x2070 [ 59.736402][ T3632] ? lockdep_hardirqs_on_prepare+0x428/0x790 [ 59.742396][ T3632] ? mm_update_next_owner+0x6d0/0x6d0 [ 59.747776][ T3632] ? print_irqtrace_events+0x220/0x220 [ 59.753241][ T3632] ? _raw_spin_unlock_irq+0x1f/0x40 [ 59.758453][ T3632] ? lockdep_hardirqs_on+0x8d/0x130 [ 59.763652][ T3632] do_group_exit+0x1fd/0x2b0 [ 59.768254][ T3632] __x64_sys_exit_group+0x3b/0x40 [ 59.773283][ T3632] do_syscall_64+0x3d/0xb0 [ 59.777697][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.783581][ T3632] RIP: 0033:0x7f7db4b8fc89 [ 59.787986][ T3632] Code: Unable to access opcode bytes at 0x7f7db4b8fc5f. [ 59.794987][ T3632] RSP: 002b:00007ffc10bed838 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 59.803408][ T3632] RAX: ffffffffffffffda RBX: 00007f7db4c073f0 RCX: 00007f7db4b8fc89 [ 59.811370][ T3632] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 59.819350][ T3632] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007ffc10bed820 [ 59.827325][ T3632] R10: 0000000000800020 R11: 0000000000000246 R12: 00007f7db4c073f0 [ 59.835311][ T3632] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 59.843373][ T3632] [ 59.846383][ T3632] [ 59.848716][ T3632] Allocated by task 7: [ 59.852769][ T3632] kasan_set_track+0x3d/0x60 [ 59.857372][ T3632] __kasan_kmalloc+0x97/0xb0 [ 59.861963][ T3632] __kmalloc_node_track_caller+0xad/0x190 [ 59.867688][ T3632] __alloc_skb+0x112/0x2b0 [ 59.872109][ T3632] nsim_dev_trap_report_work+0x268/0xaa0 [ 59.877742][ T3632] process_one_work+0x877/0xdb0 [ 59.882608][ T3632] worker_thread+0xb14/0x1330 [ 59.887290][ T3632] kthread+0x266/0x300 [ 59.891349][ T3632] ret_from_fork+0x1f/0x30 [ 59.895763][ T3632] [ 59.898161][ T3632] Freed by task 7: [ 59.901886][ T3632] kasan_set_track+0x3d/0x60 [ 59.906467][ T3632] kasan_save_free_info+0x27/0x40 [ 59.911481][ T3632] ____kasan_slab_free+0xd6/0x120 [ 59.916493][ T3632] slab_free_freelist_hook+0x12e/0x1a0 [ 59.921947][ T3632] __kmem_cache_free+0x71/0x110 [ 59.926790][ T3632] skb_release_data+0x536/0x6d0 [ 59.931721][ T3632] __kfree_skb+0x56/0x1d0 [ 59.936149][ T3632] nsim_dev_trap_report_work+0x767/0xaa0 [ 59.941861][ T3632] process_one_work+0x877/0xdb0 [ 59.946705][ T3632] worker_thread+0xb14/0x1330 [ 59.951376][ T3632] kthread+0x266/0x300 [ 59.955433][ T3632] ret_from_fork+0x1f/0x30 [ 59.963748][ T3632] [ 59.966066][ T3632] The buggy address belongs to the object at ffff88806f410000 [ 59.966066][ T3632] which belongs to the cache kmalloc-4k of size 4096 [ 59.980193][ T3632] The buggy address is located 0 bytes inside of [ 59.980193][ T3632] 4096-byte region [ffff88806f410000, ffff88806f411000) [ 59.993374][ T3632] [ 59.995709][ T3632] The buggy address belongs to the physical page: [ 60.002105][ T3632] page:ffffea0001bd0400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6f410 [ 60.012243][ T3632] head:ffffea0001bd0400 order:3 compound_mapcount:0 compound_pincount:0 [ 60.020553][ T3632] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 60.028551][ T3632] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888012842140 [ 60.037124][ T3632] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 60.045776][ T3632] page dumped because: kasan: bad access detected [ 60.052173][ T3632] page_owner tracks the page as allocated [ 60.057876][ T3632] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7, tgid 7 (kworker/0:0), ts 59498816300, free_ts 59206909053 [ 60.078092][ T3632] get_page_from_freelist+0x742/0x7c0 [ 60.083462][ T3632] __alloc_pages+0x259/0x560 [ 60.088064][ T3632] alloc_slab_page+0x70/0xf0 [ 60.092652][ T3632] allocate_slab+0x5e/0x4b0 [ 60.097149][ T3632] ___slab_alloc+0x782/0xe20 [ 60.101739][ T3632] __kmem_cache_alloc_node+0x252/0x310 [ 60.107190][ T3632] __kmalloc_node_track_caller+0x9c/0x190 [ 60.112904][ T3632] __alloc_skb+0x112/0x2b0 [ 60.117314][ T3632] nsim_dev_trap_report_work+0x268/0xaa0 [ 60.122941][ T3632] process_one_work+0x877/0xdb0 [ 60.127784][ T3632] worker_thread+0xb14/0x1330 [ 60.132455][ T3632] kthread+0x266/0x300 [ 60.136528][ T3632] ret_from_fork+0x1f/0x30 [ 60.141544][ T3632] page last free stack trace: [ 60.146199][ T3632] free_pcp_prepare+0x80c/0x8f0 [ 60.151038][ T3632] free_unref_page+0x7d/0x5f0 [ 60.155708][ T3632] free_large_kmalloc+0xfb/0x190 [ 60.160635][ T3632] diUnmount+0xef/0x100 [ 60.164781][ T3632] jfs_mount_rw+0x2f4/0x710 [ 60.169279][ T3632] jfs_remount+0x3db/0x710 [ 60.173689][ T3632] reconfigure_super+0x3bc/0x7b0 [ 60.178624][ T3632] path_mount+0xd20/0x10c0 [ 60.183047][ T3632] __se_sys_mount+0x2d3/0x3c0 [ 60.187740][ T3632] do_syscall_64+0x3d/0xb0 [ 60.192164][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.198054][ T3632] [ 60.200368][ T3632] Memory state around the buggy address: [ 60.205983][ T3632] ffff88806f40ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.214029][ T3632] ffff88806f40ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.222097][ T3632] >ffff88806f410000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.230145][ T3632] ^ [ 60.234199][ T3632] ffff88806f410080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.242270][ T3632] ffff88806f410100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.250332][ T3632] ================================================================== [ 60.264567][ T3632] Kernel panic - not syncing: panic_on_warn set ... [ 60.271267][ T3632] CPU: 1 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0 [ 60.281691][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 60.291737][ T3632] Call Trace: [ 60.295008][ T3632] [ 60.297930][ T3632] dump_stack_lvl+0x1b1/0x28e [ 60.302599][ T3632] ? nf_tcp_handle_invalid+0x62e/0x62e [ 60.308061][ T3632] ? panic+0x710/0x710 [ 60.312130][ T3632] ? preempt_schedule_common+0xb7/0xe0 [ 60.317578][ T3632] ? vscnprintf+0x59/0x80 [ 60.321898][ T3632] ? virt_to_slab+0x50/0xa0 [ 60.328239][ T3632] panic+0x2d6/0x710 [ 60.332136][ T3632] ? memcpy_page_flushcache+0xfc/0xfc [ 60.337500][ T3632] ? _raw_spin_unlock_irqrestore+0x110/0x120 [ 60.343475][ T3632] ? print_report+0x1b4/0x1f0 [ 60.348145][ T3632] ? __kmem_cache_free+0x71/0x110 [ 60.353254][ T3632] ? __kmem_cache_free+0x71/0x110 [ 60.358282][ T3632] end_report+0x91/0xa0 [ 60.362462][ T3632] kasan_report_invalid_free+0xb7/0xd0 [ 60.367933][ T3632] ? __kmem_cache_free+0x71/0x110 [ 60.372962][ T3632] ____kasan_slab_free+0xfb/0x120 [ 60.377984][ T3632] slab_free_freelist_hook+0x12e/0x1a0 [ 60.383446][ T3632] ? diUnmount+0xef/0x100 [ 60.387796][ T3632] __kmem_cache_free+0x71/0x110 [ 60.392639][ T3632] diUnmount+0xef/0x100 [ 60.396850][ T3632] jfs_umount+0x108/0x370 [ 60.401168][ T3632] jfs_put_super+0x86/0x190 [ 60.405658][ T3632] ? jfs_free_inode+0x20/0x20 [ 60.410322][ T3632] generic_shutdown_super+0x130/0x310 [ 60.415684][ T3632] kill_block_super+0x79/0xd0 [ 60.420352][ T3632] deactivate_locked_super+0xa7/0xf0 [ 60.425887][ T3632] cleanup_mnt+0x494/0x520 [ 60.430301][ T3632] ? lockdep_hardirqs_on+0x8d/0x130 [ 60.435488][ T3632] task_work_run+0x243/0x300 [ 60.440086][ T3632] ? task_work_cancel+0x290/0x290 [ 60.445109][ T3632] ? do_exit+0x65f/0x2070 [ 60.449440][ T3632] do_exit+0x664/0x2070 [ 60.453589][ T3632] ? lockdep_hardirqs_on_prepare+0x428/0x790 [ 60.459556][ T3632] ? mm_update_next_owner+0x6d0/0x6d0 [ 60.464918][ T3632] ? print_irqtrace_events+0x220/0x220 [ 60.470369][ T3632] ? _raw_spin_unlock_irq+0x1f/0x40 [ 60.475565][ T3632] ? lockdep_hardirqs_on+0x8d/0x130 [ 60.480770][ T3632] do_group_exit+0x1fd/0x2b0 [ 60.485353][ T3632] __x64_sys_exit_group+0x3b/0x40 [ 60.490372][ T3632] do_syscall_64+0x3d/0xb0 [ 60.494778][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.500662][ T3632] RIP: 0033:0x7f7db4b8fc89 [ 60.505064][ T3632] Code: Unable to access opcode bytes at 0x7f7db4b8fc5f. [ 60.512062][ T3632] RSP: 002b:00007ffc10bed838 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 60.520469][ T3632] RAX: ffffffffffffffda RBX: 00007f7db4c073f0 RCX: 00007f7db4b8fc89 [ 60.528440][ T3632] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 60.536405][ T3632] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007ffc10bed820 [ 60.544367][ T3632] R10: 0000000000800020 R11: 0000000000000246 R12: 00007f7db4c073f0 [ 60.552327][ T3632] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 60.560291][ T3632] [ 60.563471][ T3632] Kernel Offset: disabled [ 60.567872][ T3632] Rebooting in 86400 seconds..