./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor103529306 <...> DUID 00:04:f2:2d:62:da:c3:85:a0:c9:3a:ab:4f:1c:2c:dc:65:98 forked to background, child pid 4646 [ 33.240879][ T4647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.250153][ T4647] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.106' (ECDSA) to the list of known hosts. execve("./syz-executor103529306", ["./syz-executor103529306"], 0x7ffc53d51900 /* 10 vars */) = 0 brk(NULL) = 0x55555744e000 brk(0x55555744ed40) = 0x55555744ed40 arch_prctl(ARCH_SET_FS, 0x55555744e400) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x55555744e6d0) = 5075 set_robust_list(0x55555744e6e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f4ae036b630, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f4ae036ab80}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f4ae036b6d0, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4ae036ab80}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor103529306", 4096) = 27 brk(0x55555746fd40) = 0x55555746fd40 brk(0x555557470000) = 0x555557470000 mprotect(0x7f4ae042e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 5075 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "5075", 4) = 4 close(3) = 0 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+memory", 7) = 7 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 syzkaller login: [ 54.860367][ T5075] cgroup: Unknown subsys name 'net' mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) [ 54.976379][ T5075] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 chmod("/dev/raw-gadget", 0666) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f4ae0361c50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4ae036ab80}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f4ae0361c50, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4ae036ab80}, NULL, 8) = 0 getpid() = 5075 mkdir("./syzkaller.FFqJxX", 0700) = 0 chmod("./syzkaller.FFqJxX", 0777) = 0 chdir("./syzkaller.FFqJxX") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5076 attached , child_tidptr=0x55555744e6d0) = 5076 [pid 5076] set_robust_list(0x55555744e6e0, 24) = 0 [pid 5076] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5076] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5076] setsid() = 1 [pid 5076] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5076] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5076] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5076] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5076] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5076] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5076] unshare(CLONE_NEWNS) = 0 [pid 5076] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5076] unshare(CLONE_NEWIPC) = 0 [pid 5076] unshare(CLONE_NEWCGROUP) = 0 [pid 5076] unshare(CLONE_NEWUTS) = 0 [pid 5076] unshare(CLONE_SYSVSEM) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "16777216", 8) = 8 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "536870912", 9) = 9 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1024", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "8192", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1024", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1024", 4) = 4 [pid 5076] close(3) = 0 [pid 5076] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5076] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5076] close(3) = 0 [pid 5076] getpid() = 1 [pid 5076] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5086] <... futex resumed>) = 0 [pid 5087] socket(AF_INET, SOCK_STREAM, IPPROTO_IP [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... socket resumed>) = 3 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] <... futex resumed>) = 0 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... futex resumed>) = 0 [pid 5087] bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] <... futex resumed>) = 0 [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5087] <... futex resumed>) = 0 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("172.20.20.170")}, 16) = 0 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] <... futex resumed>) = 0 [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = 0 [pid 5086] <... futex resumed>) = 1 [pid 5087] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SOCKET_FILTER, insn_cnt=3, insns=0x20000240, license="syzkaller", log_level=4, log_size=1078, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... bpf resumed>) = 4 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5086] <... futex resumed>) = 0 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] socket(AF_KCM, SOCK_SEQPACKET, KCMPROTO_CONNECTED [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... socket resumed>) = 5 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5086] <... futex resumed>) = 0 [pid 5087] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... openat resumed>) = 6 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5086] <... futex resumed>) = 0 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5087] write(6, "verification time 174 usec\nstack depth 0\nprocessed 2 insns (limit 1000000) max_states_per_insn 0 tot"..., 34136651 [pid 5086] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5086] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4ae0315000 [pid 5086] mprotect(0x7f4ae0316000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5086] clone(child_stack=0x7f4ae03352f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[4], tls=0x7f4ae0335700, child_tidptr=0x7f4ae03359d0) = 4 [pid 5086] futex(0x7f4ae04344d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] futex(0x7f4ae04344dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5088 attached [pid 5088] set_robust_list(0x7f4ae03359e0, 24) = 0 [pid 5088] mmap(0x20000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 6, 0 [pid 5087] <... write resumed>) = 2478080 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5088] <... mmap resumed>) = 0x20000000 [pid 5088] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5086] <... futex resumed>) = 0 [pid 5088] futex(0x7f4ae04344d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... futex resumed>) = 0 [pid 5087] ioctl(5, SIOCPROTOPRIVATE, 0x20000180) = 0 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... futex resumed>) = 0 [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... futex resumed>) = 1 [pid 5087] sendmsg(5, 0x20002940, 0) = 2457600 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... futex resumed>) = 0 [pid 5086] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5086] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5087] <... futex resumed>) = 1 [pid 5087] write(5, NULL, 0) = 0 [pid 5087] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] <... futex resumed>) = 0 [pid 5086] close(3) = 0 [pid 5086] close(4) = 0 [pid 5086] close(5) = 0 [pid 5087] <... futex resumed>) = 1 [pid 5086] close(6 [pid 5087] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5086] <... close resumed>) = 0 [pid 5086] close(7) = -1 EBADF (Bad file descriptor) [pid 5086] close(8) = -1 EBADF (Bad file descriptor) [pid 5086] close(9) = -1 EBADF (Bad file descriptor) [pid 5086] close(10) = -1 EBADF (Bad file descriptor) [pid 5086] close(11) = -1 EBADF (Bad file descriptor) [pid 5086] close(12) = -1 EBADF (Bad file descriptor) [pid 5086] close(13) = -1 EBADF (Bad file descriptor) [pid 5086] close(14) = -1 EBADF (Bad file descriptor) [pid 5086] close(15) = -1 EBADF (Bad file descriptor) [pid 5086] close(16) = -1 EBADF (Bad file descriptor) [pid 5086] close(17) = -1 EBADF (Bad file descriptor) [pid 5086] close(18) = -1 EBADF (Bad file descriptor) [pid 5086] close(19) = -1 EBADF (Bad file descriptor) [pid 5086] close(20) = -1 EBADF (Bad file descriptor) [pid 5086] close(21) = -1 EBADF (Bad file descriptor) [pid 5086] close(22) = -1 EBADF (Bad file descriptor) [pid 5086] close(23) = -1 EBADF (Bad file descriptor) [pid 5086] close(24) = -1 EBADF (Bad file descriptor) [pid 5086] close(25) = -1 EBADF (Bad file descriptor) [pid 5086] close(26) = -1 EBADF (Bad file descriptor) [pid 5086] close(27) = -1 EBADF (Bad file descriptor) [pid 5086] close(28) = -1 EBADF (Bad file descriptor) [pid 5086] close(29) = -1 EBADF (Bad file descriptor) [pid 5086] exit_group(0 [pid 5088] <... futex resumed>) = ? [pid 5086] <... exit_group resumed>) = ? [pid 5087] <... futex resumed>) = ? [pid 5088] +++ exited with 0 +++ [pid 5087] +++ exited with 0 +++ [pid 5086] +++ exited with 0 +++ [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 5076] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5076] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5076] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5076] getdents64(3, 0x55555744f720 /* 7 entries */, 32768) = 216 [pid 5076] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5076] unlink("./0/binderfs") = 0 [pid 5076] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5076] unlink("./0/cgroup") = 0 [pid 5076] umount2("./0/cgroup.controllers", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./0/cgroup.controllers", {st_mode=S_IFREG|000, st_size=2478080, ...}) = 0 [pid 5076] unlink("./0/cgroup.controllers") = 0 [pid 5076] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5076] unlink("./0/cgroup.net") = 0 [pid 5076] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5076] unlink("./0/cgroup.cpu") = 0 [pid 5076] getdents64(3, 0x55555744f720 /* 0 entries */, 32768) = 0 [pid 5076] close(3) = 0 [pid 5076] rmdir("./0") = 0 [pid 5076] mkdir("./1", 0777) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5089 attached [pid 5089] set_robust_list(0x55555744e6e0, 24) = 0 [pid 5076] <... clone resumed>, child_tidptr=0x55555744e6d0) = 5 [pid 5089] chdir("./1") = 0 [pid 5089] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5089] setpgid(0, 0) = 0 [pid 5089] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5089] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5089] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5089] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5089] write(3, "1000", 4) = 4 [pid 5089] close(3) = 0 [pid 5089] read(200, 0x7ffdd3cfdce0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5089] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4ae0336000 [pid 5089] mprotect(0x7f4ae0337000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5089] clone(child_stack=0x7f4ae03562f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5090 attached , parent_tid=[6], tls=0x7f4ae0356700, child_tidptr=0x7f4ae03569d0) = 6 [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] set_robust_list(0x7f4ae03569e0, 24) = 0 [pid 5090] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5090] connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("172.20.20.170")}, 16 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] <... connect resumed>) = 0 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5090] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5090] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SOCKET_FILTER, insn_cnt=3, insns=0x20000240, license="syzkaller", log_level=4, log_size=1078, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5090] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5090] socket(AF_KCM, SOCK_SEQPACKET, KCMPROTO_CONNECTED) = 5 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5090] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5090] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5089] <... futex resumed>) = 0 [pid 5090] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] <... openat resumed>) = 6 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5090] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5090] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5090] write(6, "verification time 222 usec\nstack depth 0\nprocessed 2 insns (limit 1000000) max_states_per_insn 0 tot"..., 34136651 [pid 5089] <... futex resumed>) = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5089] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4ae0315000 [pid 5089] mprotect(0x7f4ae0316000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5089] clone(child_stack=0x7f4ae03352f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5091 attached [pid 5091] set_robust_list(0x7f4ae03359e0, 24 [pid 5089] <... clone resumed>, parent_tid=[7], tls=0x7f4ae0335700, child_tidptr=0x7f4ae03359d0) = 7 [pid 5091] <... set_robust_list resumed>) = 0 [pid 5089] futex(0x7f4ae04344d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] mmap(0x20000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 6, 0 [pid 5089] <... futex resumed>) = 0 [pid 5091] <... mmap resumed>) = 0x20000000 [pid 5090] <... write resumed>) = 2084864 [pid 5089] futex(0x7f4ae04344dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5091] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5089] <... futex resumed>) = 0 [pid 5089] futex(0x7f4ae04344d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] futex(0x7f4ae04344dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5091] <... futex resumed>) = 1 [pid 5091] ioctl(5, SIOCPROTOPRIVATE, 0x20000180 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5090] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5091] <... ioctl resumed>) = 0 [pid 5091] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5091] futex(0x7f4ae04344d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5090] <... futex resumed>) = 0 [pid 5090] sendmsg(5, 0x20002940, 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] <... sendmsg resumed>) = 2064384 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5089] <... futex resumed>) = 0 [pid 5090] write(5, NULL, 0 [pid 5089] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5089] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5090] <... write resumed>) = 0 [pid 5090] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5089] <... futex resumed>) = 0 [pid 5090] <... futex resumed>) = 1 [pid 5090] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] close(3) = 0 [pid 5089] close(4) = 0 [pid 5089] close(5) = 0 [pid 5089] close(6) = 0 [pid 5089] close(7) = -1 EBADF (Bad file descriptor) [pid 5089] close(8) = -1 EBADF (Bad file descriptor) [pid 5089] close(9) = -1 EBADF (Bad file descriptor) [pid 5089] close(10) = -1 EBADF (Bad file descriptor) [pid 5089] close(11) = -1 EBADF (Bad file descriptor) [pid 5089] close(12) = -1 EBADF (Bad file descriptor) [pid 5089] close(13) = -1 EBADF (Bad file descriptor) [pid 5089] close(14) = -1 EBADF (Bad file descriptor) [pid 5089] close(15) = -1 EBADF (Bad file descriptor) [pid 5089] close(16) = -1 EBADF (Bad file descriptor) [pid 5089] close(17) = -1 EBADF (Bad file descriptor) [pid 5089] close(18) = -1 EBADF (Bad file descriptor) [pid 5089] close(19) = -1 EBADF (Bad file descriptor) [pid 5089] close(20) = -1 EBADF (Bad file descriptor) [pid 5089] close(21) = -1 EBADF (Bad file descriptor) [pid 5089] close(22) = -1 EBADF (Bad file descriptor) [pid 5089] close(23) = -1 EBADF (Bad file descriptor) [pid 5089] close(24) = -1 EBADF (Bad file descriptor) [pid 5089] close(25) = -1 EBADF (Bad file descriptor) [pid 5089] close(26) = -1 EBADF (Bad file descriptor) [pid 5089] close(27) = -1 EBADF (Bad file descriptor) [pid 5089] close(28) = -1 EBADF (Bad file descriptor) [pid 5089] close(29) = -1 EBADF (Bad file descriptor) [pid 5089] exit_group(0 [pid 5091] <... futex resumed>) = ? [pid 5090] <... futex resumed>) = ? [pid 5089] <... exit_group resumed>) = ? [pid 5091] +++ exited with 0 +++ [pid 5090] +++ exited with 0 +++ [pid 5089] +++ exited with 0 +++ [pid 5076] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5076] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5076] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 5076] getdents64(3, 0x55555744f720 /* 7 entries */, 32768) = 216 [pid 5076] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 5076] unlink("./1/binderfs") = 0 [pid 5076] umount2("./1/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./1/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}) = 0 [pid 5076] unlink("./1/cgroup") = 0 [pid 5076] umount2("./1/cgroup.controllers", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./1/cgroup.controllers", {st_mode=S_IFREG|000, st_size=2084864, ...}) = 0 [pid 5076] unlink("./1/cgroup.controllers") = 0 [pid 5076] umount2("./1/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./1/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5076] unlink("./1/cgroup.net") = 0 [pid 5076] umount2("./1/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5076] lstat("./1/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}) = 0 [pid 5076] unlink("./1/cgroup.cpu") = 0 [pid 5076] getdents64(3, 0x55555744f720 /* 0 entries */, 32768) = 0 [pid 5076] close(3) = 0 [pid 5076] rmdir("./1") = 0 [pid 5076] mkdir("./2", 0777) = 0 [pid 5076] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555744e6d0) = 8 ./strace-static-x86_64: Process 5092 attached [pid 5092] set_robust_list(0x55555744e6e0, 24) = 0 [pid 5092] chdir("./2") = 0 [pid 5092] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5092] setpgid(0, 0) = 0 [pid 5092] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5092] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5092] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5092] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5092] write(3, "1000", 4) = 4 [pid 5092] close(3) = 0 [pid 5092] read(200, 0x7ffdd3cfdce0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 5092] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5092] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4ae0336000 [pid 5092] mprotect(0x7f4ae0337000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5092] clone(child_stack=0x7f4ae03562f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5093 attached [pid 5093] set_robust_list(0x7f4ae03569e0, 24) = 0 [pid 5092] <... clone resumed>, parent_tid=[9], tls=0x7f4ae0356700, child_tidptr=0x7f4ae03569d0) = 9 [pid 5093] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = 0 [pid 5092] <... futex resumed>) = 1 [pid 5093] socket(AF_INET, SOCK_STREAM, IPPROTO_IP [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... socket resumed>) = 3 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16 [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... bind resumed>) = 0 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5092] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("172.20.20.170")}, 16 [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... connect resumed>) = 0 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5093] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = 0 [pid 5092] <... futex resumed>) = 1 [pid 5093] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SOCKET_FILTER, insn_cnt=3, insns=0x20000240, license="syzkaller", log_level=4, log_size=1078, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... bpf resumed>) = 4 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5092] <... futex resumed>) = 0 [pid 5093] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] socket(AF_KCM, SOCK_SEQPACKET, KCMPROTO_CONNECTED [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... socket resumed>) = 5 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5092] <... futex resumed>) = 0 [pid 5093] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] write(6, "verification time 342 usec\nstack depth 0\nprocessed 2 insns (limit 1000000) max_states_per_insn 0 tot"..., 34136651 [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 5092] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5092] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4ae0315000 [pid 5092] mprotect(0x7f4ae0316000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5092] clone(child_stack=0x7f4ae03352f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5094 attached [pid 5094] set_robust_list(0x7f4ae03359e0, 24 [pid 5092] <... clone resumed>, parent_tid=[10], tls=0x7f4ae0335700, child_tidptr=0x7f4ae03359d0) = 10 [pid 5094] <... set_robust_list resumed>) = 0 [pid 5092] futex(0x7f4ae04344d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] mmap(0x20000000, 11755520, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 6, 0 [pid 5092] <... futex resumed>) = 0 [pid 5093] <... write resumed>) = 2248704 [pid 5092] futex(0x7f4ae04344dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5093] futex(0x7f4ae04344c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5094] <... mmap resumed>) = 0x20000000 [pid 5094] futex(0x7f4ae04344dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5094] futex(0x7f4ae04344d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] <... futex resumed>) = 0 [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = 0 [pid 5092] <... futex resumed>) = 1 [pid 5093] ioctl(5, SIOCPROTOPRIVATE, 0x20000180 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... ioctl resumed>) = 0 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5092] <... futex resumed>) = 0 [pid 5093] sendmsg(5, 0x20002940, 0 [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... sendmsg resumed>) = 2228224 [pid 5092] <... futex resumed>) = 0 [pid 5093] futex(0x7f4ae04344cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5093] <... futex resumed>) = 0 [pid 5092] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] write(5, NULL, 0 [pid 5092] futex(0x7f4ae04344c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 57.672672][ T5093] ------------[ cut here ]------------ [ 57.678314][ T5093] WARNING: CPU: 0 PID: 5093 at net/kcm/kcmsock.c:634 kcm_write_msgs+0x10ba/0x1990 [ 57.687678][ T5093] Modules linked in: [ 57.691598][ T5093] CPU: 0 PID: 5093 Comm: syz-executor103 Not tainted 6.1.0-syzkaller-11831-gd75858ef108c #0 [ 57.701848][ T5093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 57.713139][ T5093] RIP: 0010:kcm_write_msgs+0x10ba/0x1990 [pid 5092] futex(0x7f4ae04344cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 57.718835][ T5093] Code: 07 00 00 48 8b 44 24 68 45 31 e4 48 8b 74 24 08 48 89 70 10 e9 d5 f3 ff ff e8 62 72 82 f8 0f 0b e9 09 f5 ff ff e8 56 72 82 f8 <0f> 0b 41 bc ea ff ff ff e9 b7 f3 ff ff e8 44 72 82 f8 48 8b 7c 24 [ 57.740824][ T5093] RSP: 0018:ffffc90003d0f9d8 EFLAGS: 00010293 [ 57.747136][ T5093] RAX: 0000000000000000 RBX: 00000000000000c0 RCX: 0000000000000000 [ 57.755228][ T5093] RDX: ffff88801c259d40 RSI: ffffffff88fedfba RDI: 0000000000000001 [ 57.763626][ T5093] RBP: ffff88807d735cc0 R08: 0000000000000001 R09: 0000000000000000 [ 57.771739][ T5093] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000008000 [ 57.779726][ T5093] R13: ffff88807d7202c0 R14: ffff88807d735c00 R15: 0000000000000000 [ 57.788472][ T5093] FS: 00007f4ae0356700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 57.797634][ T5093] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.804394][ T5093] CR2: 00007f4ae03f3870 CR3: 00000000252c9000 CR4: 00000000003506f0 [ 57.826705][ T5093] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.838458][ T5093] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.846659][ T5093] Call Trace: [ 57.850022][ T5093] [ 57.853304][ T5093] kcm_sendmsg+0x1dab/0x2360 [ 57.857983][ T5093] ? aa_sk_perm+0x313/0xab0 [ 57.862900][ T5093] ? kcm_tx_work+0x160/0x160 [ 57.867613][ T5093] ? __lock_acquire+0xbc3/0x56d0 [ 57.872880][ T5093] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 57.878201][ T5093] ? kcm_tx_work+0x160/0x160 [ 57.882985][ T5093] sock_sendmsg+0xd3/0x120 [ 57.887450][ T5093] sock_write_iter+0x295/0x3d0 [ 57.893951][ T5093] ? sock_sendmsg+0x120/0x120 [ 57.898660][ T5093] ? bpf_lsm_file_permission+0x9/0x10 [ 57.904188][ T5093] ? security_file_permission+0xaf/0xd0 [ 57.909768][ T5093] vfs_write+0x9ed/0xdd0 [ 57.914205][ T5093] ? kernel_write+0x630/0x630 [ 57.918931][ T5093] ? __fget_files+0x26a/0x440 [ 57.923832][ T5093] ? __fget_light+0xe5/0x270 [ 57.928447][ T5093] ksys_write+0x1ec/0x250 [ 57.933968][ T5093] ? __ia32_sys_read+0xb0/0xb0 [ 57.938739][ T5093] ? lockdep_hardirqs_on+0x7d/0x100 [ 57.944090][ T5093] ? _raw_spin_unlock_irq+0x2e/0x50 [ 57.949324][ T5093] ? ptrace_notify+0xfe/0x140 [ 57.954129][ T5093] do_syscall_64+0x39/0xb0 [ 57.958583][ T5093] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.964585][ T5093] RIP: 0033:0x7f4ae03b1bb9 [pid 5092] close(3) = 0 [pid 5092] close(4) = 0 [pid 5092] close(5) = 0 [pid 5092] close(6) = 0 [pid 5092] close(7) = -1 EBADF (Bad file descriptor) [pid 5092] close(8) = -1 EBADF (Bad file descriptor) [pid 5092] close(9) = -1 EBADF (Bad file descriptor) [pid 5092] close(10) = -1 EBADF (Bad file descriptor) [pid 5092] close(11) = -1 EBADF (Bad file descriptor) [pid 5092] close(12) = -1 EBADF (Bad file descriptor) [pid 5092] close(13) = -1 EBADF (Bad file descriptor) [pid 5092] close(14) = -1 EBADF (Bad file descriptor) [pid 5092] close(15) = -1 EBADF (Bad file descriptor) [pid 5092] close(16) = -1 EBADF (Bad file descriptor) [pid 5092] close(17) = -1 EBADF (Bad file descriptor) [ 57.969010][ T5093] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 57.990012][ T5093] RSP: 002b:00007f4ae0356208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 57.998552][ T5093] RAX: ffffffffffffffda RBX: 00007f4ae04344c8 RCX: 00007f4ae03b1bb9 [ 58.007871][ T5093] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 58.016024][ T5093] RBP: 00007f4ae04344c0 R08: 0000000000000000 R09: 0000000000000000 [pid 5092] close(18) = -1 EBADF (Bad file descriptor) [pid 5092] close(19) = -1 EBADF (Bad file descriptor) [pid 5092] close(20) = -1 EBADF (Bad file descriptor) [pid 5092] close(21) = -1 EBADF (Bad file descriptor) [pid 5092] close(22) = -1 EBADF (Bad file descriptor) [pid 5092] close(23) = -1 EBADF (Bad file descriptor) [pid 5092] close(24) = -1 EBADF (Bad file descriptor) [pid 5092] close(25) = -1 EBADF (Bad file descriptor) [pid 5092] close(26) = -1 EBADF (Bad file descriptor) [pid 5092] close(27) = -1 EBADF (Bad file descriptor) [pid 5092] close(28) = -1 EBADF (Bad file descriptor) [pid 5092] close(29) = -1 EBADF (Bad file descriptor) [pid 5092] exit_group(0) = ? [pid 5094] <... futex resumed>) = ? [ 58.024176][ T5093] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4ae04344cc [ 58.032241][ T5093] R13: 00007ffdd3cfe05f R14: 00007f4ae0356300 R15: 0000000000022000 [ 58.040263][ T5093] [ 58.043524][ T5093] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 58.050812][ T5093] CPU: 0 PID: 5093 Comm: syz-executor103 Not tainted 6.1.0-syzkaller-11831-gd75858ef108c #0 [ 58.060871][ T5093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 58.070928][ T5093] Call Trace: [ 58.074205][ T5093] [ 58.077135][ T5093] dump_stack_lvl+0xd1/0x138 [ 58.081739][ T5093] panic+0x2cc/0x626 [ 58.085643][ T5093] ? panic_print_sys_info.part.0+0x110/0x110 [ 58.091649][ T5093] ? kcm_write_msgs+0x10ba/0x1990 [ 58.096693][ T5093] check_panic_on_warn.cold+0x19/0x35 [ 58.102094][ T5093] __warn+0xf2/0x1a0 [ 58.106002][ T5093] ? kcm_write_msgs+0x10ba/0x1990 [ 58.111039][ T5093] report_bug+0x1c0/0x210 [ 58.115378][ T5093] handle_bug+0x3c/0x70 [ 58.119548][ T5093] exc_invalid_op+0x18/0x50 [ 58.124060][ T5093] asm_exc_invalid_op+0x1a/0x20 [ 58.128913][ T5093] RIP: 0010:kcm_write_msgs+0x10ba/0x1990 [ 58.134560][ T5093] Code: 07 00 00 48 8b 44 24 68 45 31 e4 48 8b 74 24 08 48 89 70 10 e9 d5 f3 ff ff e8 62 72 82 f8 0f 0b e9 09 f5 ff ff e8 56 72 82 f8 <0f> 0b 41 bc ea ff ff ff e9 b7 f3 ff ff e8 44 72 82 f8 48 8b 7c 24 [ 58.154166][ T5093] RSP: 0018:ffffc90003d0f9d8 EFLAGS: 00010293 [ 58.160236][ T5093] RAX: 0000000000000000 RBX: 00000000000000c0 RCX: 0000000000000000 [ 58.168207][ T5093] RDX: ffff88801c259d40 RSI: ffffffff88fedfba RDI: 0000000000000001 [ 58.176179][ T5093] RBP: ffff88807d735cc0 R08: 0000000000000001 R09: 0000000000000000 [ 58.184149][ T5093] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000008000 [ 58.192117][ T5093] R13: ffff88807d7202c0 R14: ffff88807d735c00 R15: 0000000000000000 [ 58.200094][ T5093] ? kcm_write_msgs+0x10ba/0x1990 [ 58.205137][ T5093] ? kcm_write_msgs+0x10ba/0x1990 [ 58.210189][ T5093] kcm_sendmsg+0x1dab/0x2360 [ 58.214800][ T5093] ? aa_sk_perm+0x313/0xab0 [ 58.219316][ T5093] ? kcm_tx_work+0x160/0x160 [ 58.223917][ T5093] ? __lock_acquire+0xbc3/0x56d0 [ 58.228859][ T5093] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 58.234160][ T5093] ? kcm_tx_work+0x160/0x160 [ 58.238764][ T5093] sock_sendmsg+0xd3/0x120 [ 58.243190][ T5093] sock_write_iter+0x295/0x3d0 [ 58.247962][ T5093] ? sock_sendmsg+0x120/0x120 [ 58.252672][ T5093] ? bpf_lsm_file_permission+0x9/0x10 [ 58.258065][ T5093] ? security_file_permission+0xaf/0xd0 [ 58.263629][ T5093] vfs_write+0x9ed/0xdd0 [ 58.267880][ T5093] ? kernel_write+0x630/0x630 [ 58.272563][ T5093] ? __fget_files+0x26a/0x440 [ 58.277252][ T5093] ? __fget_light+0xe5/0x270 [ 58.281847][ T5093] ksys_write+0x1ec/0x250 [ 58.286182][ T5093] ? __ia32_sys_read+0xb0/0xb0 [ 58.290946][ T5093] ? lockdep_hardirqs_on+0x7d/0x100 [ 58.296147][ T5093] ? _raw_spin_unlock_irq+0x2e/0x50 [ 58.301352][ T5093] ? ptrace_notify+0xfe/0x140 [ 58.306040][ T5093] do_syscall_64+0x39/0xb0 [ 58.310470][ T5093] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.316378][ T5093] RIP: 0033:0x7f4ae03b1bb9 [ 58.320798][ T5093] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 58.340407][ T5093] RSP: 002b:00007f4ae0356208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 58.348827][ T5093] RAX: ffffffffffffffda RBX: 00007f4ae04344c8 RCX: 00007f4ae03b1bb9 [ 58.356799][ T5093] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 58.364767][ T5093] RBP: 00007f4ae04344c0 R08: 0000000000000000 R09: 0000000000000000 [ 58.372738][ T5093] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4ae04344cc [ 58.380712][ T5093] R13: 00007ffdd3cfe05f R14: 00007f4ae0356300 R15: 0000000000022000 [ 58.388700][ T5093] [ 58.391958][ T5093] Kernel Offset: disabled [ 58.396360][ T5093] Rebooting in 86400 seconds..