./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1503601863
<...>
Warning: Permanently added '10.128.0.144' (ECDSA) to the list of known hosts.
execve("./syz-executor1503601863", ["./syz-executor1503601863"], 0x7fffeccf7d50 /* 10 vars */) = 0
brk(NULL) = 0x55555685f000
brk(0x55555685fc40) = 0x55555685fc40
arch_prctl(ARCH_SET_FS, 0x55555685f300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1503601863", 4096) = 28
brk(0x555556880c40) = 0x555556880c40
brk(0x555556881000) = 0x555556881000
mprotect(0x7f9b5c1fc000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 3681
openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3
write(3, "10000000000", 11) = 11
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3
write(3, "20", 2) = 2
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
write(3, "100", 3) = 3
close(3) = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3
write(3, "7 4 1 3", 7) = 7
close(3) = 0
openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
write(3, "0 65535", 7) = 7
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3
write(3, "3681", 4) = 4
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
userfaultfd(UFFD_USER_MODE_ONLY) = 3
ioctl(3, UFFDIO_API, {api=0xaa, features=0 => features=UFFD_FEATURE_PAGEFAULT_FLAG_WP|UFFD_FEATURE_EVENT_FORK|UFFD_FEATURE_EVENT_REMAP|UFFD_FEATURE_EVENT_REMOVE|UFFD_FEATURE_MISSING_HUGETLBFS|UFFD_FEATURE_MISSING_SHMEM|UFFD_FEATURE_EVENT_UNMAP|UFFD_FEATURE_SIGBUS|UFFD_FEATURE_THREAD_ID|UFFD_FEATURE_MINOR_HUGETLBFS|UFFD_FEATURE_MINOR_SHMEM|0x800, ioctls=1<<_UFFDIO_REGISTER|1<<_UFFDIO_UNREGISTER|1<<_UFFDIO_API}) = 0
ioctl(3, UFFDIO_REGISTER, {range={start=0x200e2000, len=0xc00000}, mode=UFFDIO_REGISTER_MODE_MISSING, ioctls=1<<_UFFDIO_WAKE|1<<_UFFDIO_COPY|1<<_UFFDIO_ZEROPAGE}) = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
write(4, "10", 2) = 2
mremap(0x204a2000, 8192, 12288, MREMAP_MAYMOVE|MREMAP_FIXED, 0x20ffd000) = -1 ENOMEM (Cannot allocate memory)
exit_group(0) = ?
syzkaller login: [ 49.904270][ T3681] ==================================================================
[ 49.904270][ T3681] ==================================================================
[ 49.904279][ T3681] BUG: KASAN: use-after-free in anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.904310][ T3681] Read of size 8 at addr ffff8880237dbb60 by task syz-executor150/3681
[ 49.904321][ T3681]
[ 49.904325][ T3681] CPU: 1 PID: 3681 Comm: syz-executor150 Not tainted 5.18.0-rc6-next-20220512-syzkaller #0
[ 49.904339][ T3681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.904348][ T3681] Call Trace:
[ 49.904352][ T3681]
[ 49.904356][ T3681] dump_stack_lvl+0xcd/0x134
[ 49.904376][ T3681] print_address_description.constprop.0.cold+0xeb/0x495
[ 49.904396][ T3681] ? anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.904417][ T3681] kasan_report.cold+0xf4/0x1c6
[ 49.904433][ T3681] ? anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.904456][ T3681] anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.904478][ T3681] ? mas_find+0x1fd/0xc90
[ 49.904496][ T3681] unlink_anon_vmas+0x218/0x840
[ 49.904514][ T3681] ? unmap_mapping_range+0x270/0x270
[ 49.904532][ T3681] free_pgtables+0x24d/0x420
[ 49.904548][ T3681] ? free_pgd_range+0xbf0/0xbf0
[ 49.904567][ T3681] exit_mmap+0x1ff/0x740
[ 49.904580][ T3681] ? __ia32_sys_remap_file_pages+0x150/0x150
[ 49.904602][ T3681] __mmput+0x128/0x4c0
[ 49.904620][ T3681] mmput+0x5c/0x70
[ 49.904641][ T3681] do_exit+0xa18/0x2a00
[ 49.904683][ T3681] ? lock_downgrade+0x6e0/0x6e0
[ 49.904711][ T3681] ? mm_update_next_owner+0x7b0/0x7b0
[ 49.904732][ T3681] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.904748][ T3681] do_group_exit+0xd2/0x2f0
[ 49.904769][ T3681] __x64_sys_exit_group+0x3a/0x50
[ 49.904789][ T3681] do_syscall_64+0x35/0xb0
[ 49.904807][ T3681] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.904822][ T3681] RIP: 0033:0x7f9b5c196129
[ 49.904833][ T3681] Code: Unable to access opcode bytes at RIP 0x7f9b5c1960ff.
[ 49.904839][ T3681] RSP: 002b:00007fffb9cf1b58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 49.904852][ T3681] RAX: ffffffffffffffda RBX: 00007f9b5c2023d0 RCX: 00007f9b5c196129
[ 49.904861][ T3681] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 49.904869][ T3681] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00007f9b5c003031
[ 49.904878][ T3681] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f9b5c2023d0
[ 49.904886][ T3681] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 49.904898][ T3681]
[ 49.904902][ T3681]
[ 49.904904][ T3681] Allocated by task 3681:
[ 49.904909][ T3681] kasan_save_stack+0x1e/0x40
[ 49.904929][ T3681] __kasan_slab_alloc+0x90/0xc0
[ 49.904948][ T3681] kmem_cache_alloc+0x204/0x3b0
[ 49.904965][ T3681] vm_area_dup+0x81/0x380
[ 49.904977][ T3681] copy_vma+0x36f/0x890
[ 49.904988][ T3681] move_vma+0x449/0xf60
[ 49.905004][ T3681] __do_sys_mremap+0xe68/0x1540
[ 49.905026][ T3681] do_syscall_64+0x35/0xb0
[ 49.905050][ T3681] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.905070][ T3681]
[ 49.905072][ T3681] Freed by task 3681:
[ 49.905077][ T3681] kasan_save_stack+0x1e/0x40
[ 49.905096][ T3681] kasan_set_track+0x21/0x30
[ 49.905113][ T3681] kasan_set_free_info+0x20/0x30
[ 49.905126][ T3681] ____kasan_slab_free+0x166/0x1a0
[ 49.905144][ T3681] slab_free_freelist_hook+0x8b/0x1c0
[ 49.905161][ T3681] kmem_cache_free+0xdd/0x5a0
[ 49.905178][ T3681] copy_vma+0x6ac/0x890
[ 49.905189][ T3681] move_vma+0x449/0xf60
[ 49.905200][ T3681] __do_sys_mremap+0xe68/0x1540
[ 49.905213][ T3681] do_syscall_64+0x35/0xb0
[ 49.905228][ T3681] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.905242][ T3681]
[ 49.905244][ T3681] The buggy address belongs to the object at ffff8880237dbaf8
[ 49.905244][ T3681] which belongs to the cache vm_area_struct of size 152
[ 49.905254][ T3681] The buggy address is located 104 bytes inside of
[ 49.905254][ T3681] 152-byte region [ffff8880237dbaf8, ffff8880237dbb90)
[ 49.905265][ T3681]
[ 49.905267][ T3681] The buggy address belongs to the physical page:
[ 49.905272][ T3681] page:ffffea00008df6c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x237db
[ 49.905286][ T3681] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 49.905305][ T3681] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888140006b40
[ 49.905317][ T3681] raw: 0000000000000000 0000000080120012 00000001ffffffff 0000000000000000
[ 49.905324][ T3681] page dumped because: kasan: bad access detected
[ 49.905328][ T3681] page_owner tracks the page as allocated
[ 49.905332][ T3681] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3388, tgid 3388 (cmp), ts 30666718744, free_ts 30663321169
[ 49.905353][ T3681] get_page_from_freelist+0x129e/0x3dd0
[ 49.905368][ T3681] __alloc_pages+0x1c7/0x510
[ 49.905380][ T3681] alloc_pages+0x1aa/0x310
[ 49.905398][ T3681] allocate_slab+0x26c/0x3c0
[ 49.905414][ T3681] ___slab_alloc+0x985/0xd90
[ 49.905430][ T3681] __slab_alloc.constprop.0+0x4d/0xa0
[ 49.905447][ T3681] kmem_cache_alloc+0x360/0x3b0
[ 49.905464][ T3681] vm_area_dup+0x81/0x380
[ 49.905477][ T3681] __split_vma+0x9f/0x530
[ 49.905487][ T3681] do_mas_align_munmap+0x553/0xed0
[ 49.905498][ T3681] do_mas_munmap+0x202/0x2c0
[ 49.905509][ T3681] mmap_region+0x219/0x1bf0
[ 49.905520][ T3681] do_mmap+0x825/0xf60
[ 49.905530][ T3681] vm_mmap_pgoff+0x1b7/0x290
[ 49.905546][ T3681] ksys_mmap_pgoff+0x40d/0x5a0
[ 49.905556][ T3681] do_syscall_64+0x35/0xb0
[ 49.905571][ T3681] page last free stack trace:
[ 49.905574][ T3681] free_pcp_prepare+0x549/0xd20
[ 49.905585][ T3681] free_unref_page_list+0x16f/0xf80
[ 49.905598][ T3681] release_pages+0xff1/0x2290
[ 49.905612][ T3681] tlb_batch_pages_flush+0xa8/0x1a0
[ 49.905624][ T3681] tlb_finish_mmu+0x147/0x7e0
[ 49.905636][ T3681] exit_mmap+0x211/0x740
[ 49.905652][ T3681] __mmput+0x128/0x4c0
[ 49.905663][ T3681] mmput+0x5c/0x70
[ 49.905674][ T3681] begin_new_exec+0xfbd/0x2e50
[ 49.905692][ T3681] load_elf_binary+0x15a3/0x4ec0
[ 49.905705][ T3681] bprm_execve+0x7ef/0x1970
[ 49.905722][ T3681] do_execveat_common+0x727/0x890
[ 49.905739][ T3681] __x64_sys_execve+0x8f/0xc0
[ 49.905756][ T3681] do_syscall_64+0x35/0xb0
[ 49.905771][ T3681] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.905785][ T3681]
[ 49.905787][ T3681] Memory state around the buggy address:
[ 49.905792][ T3681] ffff8880237dba00: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00
[ 49.905800][ T3681] ffff8880237dba80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fa
[ 49.905808][ T3681] >ffff8880237dbb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 49.905814][ T3681] ^
[ 49.905821][ T3681] ffff8880237dbb80: fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb
[ 49.905829][ T3681] ffff8880237dbc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
[ 49.905835][ T3681] ==================================================================
[ 49.906490][ T3681] Kernel panic - not syncing: panic_on_warn set ...
[ 49.906502][ T3681] CPU: 0 PID: 3681 Comm: syz-executor150 Not tainted 5.18.0-rc6-next-20220512-syzkaller #0
[ 49.906525][ T3681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 49.906537][ T3681] Call Trace:
[ 49.906543][ T3681]
[ 49.906551][ T3681] dump_stack_lvl+0xcd/0x134
[ 49.906581][ T3681] panic+0x2d7/0x636
[ 49.906605][ T3681] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 49.906633][ T3681] ? preempt_schedule_common+0x59/0xc0
[ 49.906665][ T3681] ? anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.906701][ T3681] ? preempt_schedule_thunk+0x16/0x18
[ 49.906735][ T3681] ? anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.906771][ T3681] end_report.part.0+0x3f/0x7c
[ 49.906798][ T3681] kasan_report.cold+0x93/0x1c6
[ 49.906825][ T3681] ? anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.906862][ T3681] anon_vma_interval_tree_remove+0xc7d/0xf30
[ 49.906899][ T3681] ? mas_find+0x1fd/0xc90
[ 49.906928][ T3681] unlink_anon_vmas+0x218/0x840
[ 49.906957][ T3681] ? unmap_mapping_range+0x270/0x270
[ 49.906987][ T3681] free_pgtables+0x24d/0x420
[ 49.907015][ T3681] ? free_pgd_range+0xbf0/0xbf0
[ 49.907048][ T3681] exit_mmap+0x1ff/0x740
[ 49.907071][ T3681] ? __ia32_sys_remap_file_pages+0x150/0x150
[ 49.907109][ T3681] __mmput+0x128/0x4c0
[ 49.907133][ T3681] mmput+0x5c/0x70
[ 49.907161][ T3681] do_exit+0xa18/0x2a00
[ 49.907194][ T3681] ? lock_downgrade+0x6e0/0x6e0
[ 49.907228][ T3681] ? mm_update_next_owner+0x7b0/0x7b0
[ 49.907264][ T3681] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.907289][ T3681] do_group_exit+0xd2/0x2f0
[ 49.907323][ T3681] __x64_sys_exit_group+0x3a/0x50
[ 49.907357][ T3681] do_syscall_64+0x35/0xb0
[ 49.907385][ T3681] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.907411][ T3681] RIP: 0033:0x7f9b5c196129
[ 49.907428][ T3681] Code: Unable to access opcode bytes at RIP 0x7f9b5c1960ff.
[ 49.907438][ T3681] RSP: 002b:00007fffb9cf1b58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 49.907460][ T3681] RAX: ffffffffffffffda RBX: 00007f9b5c2023d0 RCX: 00007f9b5c196129
[ 49.907475][ T3681] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 49.907489][ T3681] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00007f9b5c003031
[ 49.907504][ T3681] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f9b5c2023d0
[ 49.907518][ T3681] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 49.907538][ T3681]
[ 49.914149][ T3681] Kernel Offset: disabled