./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2964569046

<...>
Warning: Permanently added '10.128.0.147' (ED25519) to the list of known hosts.
execve("./syz-executor2964569046", ["./syz-executor2964569046"], 0x7fff58de0d50 /* 10 vars */) = 0
brk(NULL)                               = 0x555555982000
brk(0x555555982d00)                     = 0x555555982d00
arch_prctl(ARCH_SET_FS, 0x555555982380) = 0
set_tid_address(0x555555982650)         = 5013
set_robust_list(0x555555982660, 24)     = 0
rseq(0x555555982ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2964569046", 4096) = 28
getrandom("\xb7\x99\xea\x4a\xef\x65\x95\x9d", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555555982d00
brk(0x5555559a3d00)                     = 0x5555559a3d00
brk(0x5555559a4000)                     = 0x5555559a4000
mprotect(0x7f54c61c3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5014 attached
, child_tidptr=0x555555982650) = 5014
[pid  5014] set_robust_list(0x555555982660, 24) = 0
[pid  5014] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5014] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5014] setsid()                    = 1
[pid  5014] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5014] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5014] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5014] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5014] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5014] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5014] unshare(CLONE_NEWNS)        = 0
[pid  5014] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5014] unshare(CLONE_NEWIPC)       = 0
[pid  5014] unshare(CLONE_NEWCGROUP)    = 0
[pid  5014] unshare(CLONE_NEWUTS)       = 0
[pid  5014] unshare(CLONE_SYSVSEM)      = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "16777216", 8)     = 8
[pid  5014] close(3)                    = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "536870912", 9)    = 9
[pid  5014] close(3)                    = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "1024", 4)         = 4
[pid  5014] close(3)                    = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "8192", 4)         = 4
[pid  5014] close(3)                    = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "1024", 4)         = 4
[pid  5014] close(3)                    = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "1024", 4)         = 4
[pid  5014] close(3)                    = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5014] close(3)                    = 0
[pid  5014] getpid()                    = 1
[pid  5014] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5014] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5014] unshare(CLONE_NEWNET)       = 0
[pid  5014] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5014] write(3, "0 65535", 7)      = 7
[pid  5014] close(3)                    = 0
[pid  5014] mkdir("/dev/binderfs", 0777) = 0
[pid  5014] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5014] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5014] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid  5014] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4
[pid  5014] socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 5
[pid  5014] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid  5014] recvfrom(5, [{nlmsg_len=52, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=-ENODEV, msg=[{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"]}], 4096, 0, NULL, NULL) = 52
[pid  5014] getsockname(5, {sa_family=AF_NETLINK, nl_pid=1, nl_groups=00000000}, [20 => 12]) = 0
[pid  5014] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x24\x00\x1d\x0f\x3a\x61\xaa\x51\xac\xb1\xd5\x9e\x1a\x43\xca\x38\x01\x00\x00\x00\x00\x00\x00\x00\xf1\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x63\x6c\x73\x61\x63\x74\x00\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48
[   57.098968][ T5014] netlink: 'syz-executor296': attribute type 8 has an invalid length.
[   57.107255][ T5014] ==================================================================
[   57.116261][ T5014] BUG: KASAN: stack-out-of-bounds in __nla_validate_parse+0x136/0x2bd0
[   57.124498][ T5014] Write of size 32 at addr ffffc90003a0ee20 by task syz-executor296/5014
[   57.132980][ T5014] 
[   57.135287][ T5014] CPU: 0 PID: 5014 Comm: syz-executor296 Not tainted 6.5.0-rc2-syzkaller-00307-gd192f5382581 #0
[   57.145671][ T5014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
[   57.155702][ T5014] Call Trace:
[   57.158957][ T5014]  <TASK>
[   57.161897][ T5014]  dump_stack_lvl+0x1e7/0x2d0
[   57.166558][ T5014]  ? nf_tcp_handle_invalid+0x650/0x650
[   57.172003][ T5014]  ? panic+0x770/0x770
[   57.176048][ T5014]  ? _printk+0xd5/0x120
[   57.180182][ T5014]  print_report+0x163/0x540
[   57.184663][ T5014]  ? __virt_addr_valid+0xbd/0x2e0
[   57.189665][ T5014]  ? __nla_validate_parse+0x136/0x2bd0
[   57.195101][ T5014]  kasan_report+0x175/0x1b0
[   57.199582][ T5014]  ? __nla_validate_parse+0x136/0x2bd0
[   57.205022][ T5014]  kasan_check_range+0x27e/0x290
[   57.209944][ T5014]  __asan_memset+0x23/0x40
[   57.214347][ T5014]  __nla_validate_parse+0x136/0x2bd0
[   57.219609][ T5014]  ? lockdep_hardirqs_on_prepare+0x43c/0x7a0
[   57.225568][ T5014]  ? print_irqtrace_events+0x220/0x220
[   57.231007][ T5014]  ? _raw_spin_unlock_irqrestore+0x8f/0x140
[   57.236878][ T5014]  ? lockdep_hardirqs_on+0x98/0x140
[   57.242054][ T5014]  ? __nla_validate+0x50/0x50
[   57.246721][ T5014]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   57.252590][ T5014]  ? _raw_spin_unlock+0x40/0x40
[   57.257419][ T5014]  ? stack_trace_save+0x117/0x1c0
[   57.262437][ T5014]  ? stack_trace_snprint+0xf0/0xf0
[   57.267528][ T5014]  __nla_parse+0x40/0x50
[   57.271748][ T5014]  fl_set_key_cfm+0x1e3/0x440
[   57.276407][ T5014]  ? fl_uninit_mask_free_work+0x20/0x20
[   57.281933][ T5014]  fl_set_key+0x2168/0x6620
[   57.286432][ T5014]  ? tcf_bind_filter+0x500/0x500
[   57.291347][ T5014]  fl_tmplt_create+0x1fe/0x510
[   57.296089][ T5014]  ? __lock_acquire+0x7f70/0x7f70
[   57.301088][ T5014]  ? fl_bind_class+0x220/0x220
[   57.305842][ T5014]  ? __raw_spin_lock_init+0x45/0x100
[   57.311117][ T5014]  ? nla_strscpy+0xfd/0x170
[   57.315599][ T5014]  ? do_raw_read_unlock+0x3c/0x80
[   57.320616][ T5014]  ? _raw_read_unlock+0x28/0x40
[   57.325448][ T5014]  ? tcf_proto_lookup_ops+0xd1/0x280
[   57.330715][ T5014]  ? fl_bind_class+0x220/0x220
[   57.335458][ T5014]  tc_ctl_chain+0x131d/0x1ac0
[   57.340120][ T5014]  ? tc_dump_tfilter+0x1590/0x1590
[   57.345214][ T5014]  ? tc_dump_tfilter+0x1590/0x1590
[   57.350301][ T5014]  rtnetlink_rcv_msg+0x82b/0xf50
[   57.355224][ T5014]  ? rtnetlink_bind+0x80/0x80
[   57.359884][ T5014]  ? mark_lock+0x9a/0x340
[   57.364191][ T5014]  ? __lock_acquire+0x1267/0x7f70
[   57.369199][ T5014]  ? verify_lock_unused+0x140/0x140
[   57.374376][ T5014]  ? kasan_set_track+0x61/0x70
[   57.379116][ T5014]  ? kasan_set_track+0x4f/0x70
[   57.383869][ T5014]  ? __kasan_slab_alloc+0x66/0x70
[   57.388883][ T5014]  ? slab_post_alloc_hook+0x6c/0x3b0
[   57.394159][ T5014]  ? kmem_cache_alloc_node+0x149/0x330
[   57.399604][ T5014]  ? kmalloc_reserve+0x8a/0x240
[   57.404437][ T5014]  ? __alloc_skb+0x1b1/0x420
[   57.409006][ T5014]  ? netlink_sendmsg+0x6fc/0xd60
[   57.413918][ T5014]  ? ____sys_sendmsg+0x592/0x890
[   57.418846][ T5014]  ? __sys_sendmsg+0x2b0/0x3a0
[   57.423588][ T5014]  ? do_syscall_64+0x41/0xc0
[   57.428155][ T5014]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   57.434207][ T5014]  netlink_rcv_skb+0x1df/0x430
[   57.438953][ T5014]  ? rtnetlink_bind+0x80/0x80
[   57.443603][ T5014]  ? netlink_ack+0x12a0/0x12a0
[   57.448350][ T5014]  netlink_unicast+0x7c3/0x990
[   57.453093][ T5014]  ? netlink_detachskb+0x90/0x90
[   57.458005][ T5014]  ? __virt_addr_valid+0x22f/0x2e0
[   57.463096][ T5014]  ? __phys_addr_symbol+0x2f/0x70
[   57.468097][ T5014]  ? __check_object_size+0x4e1/0xa40
[   57.473355][ T5014]  ? bpf_lsm_netlink_send+0x9/0x10
[   57.478443][ T5014]  netlink_sendmsg+0xa2a/0xd60
[   57.483194][ T5014]  ? netlink_getsockopt+0x5f0/0x5f0
[   57.488365][ T5014]  ? finish_task_switch+0x134/0x650
[   57.493539][ T5014]  ? bpf_lsm_socket_sendmsg+0x9/0x10
[   57.498798][ T5014]  ? security_socket_sendmsg+0x81/0xa0
[   57.504234][ T5014]  ? netlink_getsockopt+0x5f0/0x5f0
[   57.509407][ T5014]  ____sys_sendmsg+0x592/0x890
[   57.514153][ T5014]  ? __sys_sendmsg_sock+0x30/0x30
[   57.519161][ T5014]  __sys_sendmsg+0x2b0/0x3a0
[   57.523731][ T5014]  ? ____sys_sendmsg+0x890/0x890
[   57.528651][ T5014]  ? print_irqtrace_events+0x220/0x220
[   57.534086][ T5014]  ? ptrace_stop+0x75a/0x970
[   57.538654][ T5014]  ? _raw_spin_unlock_irq+0x2e/0x50
[   57.543842][ T5014]  ? ptrace_notify+0x278/0x380
[   57.548611][ T5014]  ? syscall_enter_from_user_mode+0x32/0x230
[   57.554581][ T5014]  ? syscall_enter_from_user_mode+0x8c/0x230
[   57.560972][ T5014]  do_syscall_64+0x41/0xc0
[   57.565362][ T5014]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   57.571236][ T5014] RIP: 0033:0x7f54c6150759
[   57.575637][ T5014] Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   57.595253][ T5014] RSP: 002b:00007ffe06c30578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   57.603654][ T5014] RAX: ffffffffffffffda RBX: 00007f54c619902d RCX: 00007f54c6150759
[   57.611607][ T5014] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
[   57.619558][ T5014] RBP: 00007ffe06c30590 R08: 0000000000000000 R09: 00007ffe06c305f0
[   57.627509][ T5014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54c61c35f0
[   57.635491][ T5014] R13: 00007ffe06c30778 R14: 0000000000000001 R15: 0000000000000001
[   57.643447][ T5014]  </TASK>
[   57.646446][ T5014] 
[   57.648745][ T5014] The buggy address belongs to stack of task syz-executor296/5014
[   57.656518][ T5014]  and is located at offset 32 in frame:
[   57.662119][ T5014]  fl_set_key_cfm+0x0/0x440
[   57.666603][ T5014] 
[   57.668902][ T5014] This frame has 1 object:
[   57.673288][ T5014]  [32, 56) 'nla_cfm_opt'
[   57.673295][ T5014] 
[   57.679890][ T5014] The buggy address belongs to the virtual mapping at
[   57.679890][ T5014]  [ffffc90003a08000, ffffc90003a11000) created by:
[   57.679890][ T5014]  copy_process+0x5c8/0x4290
[   57.697485][ T5014] 
[   57.699785][ T5014] The buggy address belongs to the physical page:
[   57.706170][ T5014] page:ffffea0000aa4600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a918
[   57.716301][ T5014] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   57.723403][ T5014] page_type: 0xffffffff()
[   57.727707][ T5014] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
[   57.736263][ T5014] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   57.744816][ T5014] page dumped because: kasan: bad access detected
[   57.751215][ T5014] page_owner tracks the page as allocated
[   57.756906][ T5014] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 4895, tgid 4895 (dhcpcd-run-hook), ts 43346656688, free_ts 43344678988
[   57.776448][ T5014]  post_alloc_hook+0x1e6/0x210
[   57.781203][ T5014]  get_page_from_freelist+0x31e8/0x3370
[   57.786729][ T5014]  __alloc_pages+0x255/0x670
[   57.791297][ T5014]  __vmalloc_node_range+0x9a3/0x1490
[   57.796563][ T5014]  dup_task_struct+0x3e5/0x7d0
[   57.801302][ T5014]  copy_process+0x5c8/0x4290
[   57.805868][ T5014]  kernel_clone+0x222/0x800
[   57.810347][ T5014]  __x64_sys_clone+0x258/0x2a0
[   57.815084][ T5014]  do_syscall_64+0x41/0xc0
[   57.819479][ T5014]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   57.825350][ T5014] page last free stack trace:
[   57.829997][ T5014]  free_unref_page_prepare+0x903/0xa30
[   57.835435][ T5014]  free_unref_page_list+0x596/0x830
[   57.840608][ T5014]  release_pages+0x2193/0x2470
[   57.845349][ T5014]  tlb_flush_mmu+0x100/0x210
[   57.849914][ T5014]  tlb_finish_mmu+0xd4/0x1f0
[   57.854481][ T5014]  exit_mmap+0x3e2/0xad0
[   57.858698][ T5014]  __mmput+0x115/0x3c0
[   57.862741][ T5014]  exit_mm+0x21f/0x300
[   57.866791][ T5014]  do_exit+0x612/0x2290
[   57.870927][ T5014]  do_group_exit+0x206/0x2c0
[   57.875500][ T5014]  __x64_sys_exit_group+0x3f/0x40
[   57.880500][ T5014]  do_syscall_64+0x41/0xc0
[   57.884888][ T5014]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   57.890759][ T5014] 
[   57.893060][ T5014] Memory state around the buggy address:
[   57.898662][ T5014]  ffffc90003a0ed00: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
[   57.906698][ T5014]  ffffc90003a0ed80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   57.914732][ T5014] >ffffc90003a0ee00: f1 f1 f1 f1 00 00 00 f3 f3 f3 f3 f3 00 00 00 00
[   57.922766][ T5014]                                         ^
[   57.928634][ T5014]  ffffc90003a0ee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   57.936668][ T5014]  ffffc90003a0ef00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3
[   57.944698][ T5014] ==================================================================
[   57.953647][ T5014] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   57.960860][ T5014] CPU: 1 PID: 5014 Comm: syz-executor296 Not tainted 6.5.0-rc2-syzkaller-00307-gd192f5382581 #0
[   57.971272][ T5014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
[   57.981321][ T5014] Call Trace:
[   57.984595][ T5014]  <TASK>
[   57.987511][ T5014]  dump_stack_lvl+0x1e7/0x2d0
[   57.992169][ T5014]  ? nf_tcp_handle_invalid+0x650/0x650
[   57.997605][ T5014]  ? panic+0x770/0x770
[   58.001652][ T5014]  ? preempt_schedule_common+0x83/0xc0
[   58.007088][ T5014]  ? vscnprintf+0x5d/0x80
[   58.011397][ T5014]  panic+0x30f/0x770
[   58.015271][ T5014]  ? check_panic_on_warn+0x21/0xa0
[   58.020363][ T5014]  ? __memcpy_flushcache+0x2b0/0x2b0
[   58.025648][ T5014]  ? _raw_spin_unlock_irqrestore+0x12c/0x140
[   58.031631][ T5014]  ? _raw_spin_unlock+0x40/0x40
[   58.036469][ T5014]  ? print_report+0x4fb/0x540
[   58.041139][ T5014]  check_panic_on_warn+0x82/0xa0
[   58.046063][ T5014]  ? __nla_validate_parse+0x136/0x2bd0
[   58.051513][ T5014]  end_report+0x6e/0x130
[   58.055745][ T5014]  kasan_report+0x186/0x1b0
[   58.060316][ T5014]  ? __nla_validate_parse+0x136/0x2bd0
[   58.065760][ T5014]  kasan_check_range+0x27e/0x290
[   58.070677][ T5014]  __asan_memset+0x23/0x40
[   58.075073][ T5014]  __nla_validate_parse+0x136/0x2bd0
[   58.080337][ T5014]  ? lockdep_hardirqs_on_prepare+0x43c/0x7a0
[   58.086300][ T5014]  ? print_irqtrace_events+0x220/0x220
[   58.091742][ T5014]  ? _raw_spin_unlock_irqrestore+0x8f/0x140
[   58.097617][ T5014]  ? lockdep_hardirqs_on+0x98/0x140
[   58.102794][ T5014]  ? __nla_validate+0x50/0x50
[   58.107450][ T5014]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   58.113323][ T5014]  ? _raw_spin_unlock+0x40/0x40
[   58.118154][ T5014]  ? stack_trace_save+0x117/0x1c0
[   58.123158][ T5014]  ? stack_trace_snprint+0xf0/0xf0
[   58.128267][ T5014]  __nla_parse+0x40/0x50
[   58.132492][ T5014]  fl_set_key_cfm+0x1e3/0x440
[   58.137238][ T5014]  ? fl_uninit_mask_free_work+0x20/0x20
[   58.142772][ T5014]  fl_set_key+0x2168/0x6620
[   58.147256][ T5014]  ? tcf_bind_filter+0x500/0x500
[   58.152172][ T5014]  fl_tmplt_create+0x1fe/0x510
[   58.157003][ T5014]  ? __lock_acquire+0x7f70/0x7f70
[   58.162005][ T5014]  ? fl_bind_class+0x220/0x220
[   58.166808][ T5014]  ? __raw_spin_lock_init+0x45/0x100
[   58.172086][ T5014]  ? nla_strscpy+0xfd/0x170
[   58.176577][ T5014]  ? do_raw_read_unlock+0x3c/0x80
[   58.181587][ T5014]  ? _raw_read_unlock+0x28/0x40
[   58.186424][ T5014]  ? tcf_proto_lookup_ops+0xd1/0x280
[   58.191690][ T5014]  ? fl_bind_class+0x220/0x220
[   58.196433][ T5014]  tc_ctl_chain+0x131d/0x1ac0
[   58.201090][ T5014]  ? tc_dump_tfilter+0x1590/0x1590
[   58.206187][ T5014]  ? tc_dump_tfilter+0x1590/0x1590
[   58.211273][ T5014]  rtnetlink_rcv_msg+0x82b/0xf50
[   58.216189][ T5014]  ? rtnetlink_bind+0x80/0x80
[   58.220841][ T5014]  ? mark_lock+0x9a/0x340
[   58.225149][ T5014]  ? __lock_acquire+0x1267/0x7f70
[   58.230161][ T5014]  ? verify_lock_unused+0x140/0x140
[   58.235337][ T5014]  ? kasan_set_track+0x61/0x70
[   58.240079][ T5014]  ? kasan_set_track+0x4f/0x70
[   58.244828][ T5014]  ? __kasan_slab_alloc+0x66/0x70
[   58.249833][ T5014]  ? slab_post_alloc_hook+0x6c/0x3b0
[   58.255097][ T5014]  ? kmem_cache_alloc_node+0x149/0x330
[   58.260532][ T5014]  ? kmalloc_reserve+0x8a/0x240
[   58.265362][ T5014]  ? __alloc_skb+0x1b1/0x420
[   58.269948][ T5014]  ? netlink_sendmsg+0x6fc/0xd60
[   58.274859][ T5014]  ? ____sys_sendmsg+0x592/0x890
[   58.279777][ T5014]  ? __sys_sendmsg+0x2b0/0x3a0
[   58.284517][ T5014]  ? do_syscall_64+0x41/0xc0
[   58.289084][ T5014]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   58.295138][ T5014]  netlink_rcv_skb+0x1df/0x430
[   58.299920][ T5014]  ? rtnetlink_bind+0x80/0x80
[   58.304577][ T5014]  ? netlink_ack+0x12a0/0x12a0
[   58.309324][ T5014]  netlink_unicast+0x7c3/0x990
[   58.314066][ T5014]  ? netlink_detachskb+0x90/0x90
[   58.318977][ T5014]  ? __virt_addr_valid+0x22f/0x2e0
[   58.324068][ T5014]  ? __phys_addr_symbol+0x2f/0x70
[   58.329071][ T5014]  ? __check_object_size+0x4e1/0xa40
[   58.334328][ T5014]  ? bpf_lsm_netlink_send+0x9/0x10
[   58.339414][ T5014]  netlink_sendmsg+0xa2a/0xd60
[   58.344159][ T5014]  ? netlink_getsockopt+0x5f0/0x5f0
[   58.349333][ T5014]  ? finish_task_switch+0x134/0x650
[   58.354509][ T5014]  ? bpf_lsm_socket_sendmsg+0x9/0x10
[   58.359767][ T5014]  ? security_socket_sendmsg+0x81/0xa0
[   58.365211][ T5014]  ? netlink_getsockopt+0x5f0/0x5f0
[   58.370389][ T5014]  ____sys_sendmsg+0x592/0x890
[   58.375135][ T5014]  ? __sys_sendmsg_sock+0x30/0x30
[   58.380141][ T5014]  __sys_sendmsg+0x2b0/0x3a0
[   58.384706][ T5014]  ? ____sys_sendmsg+0x890/0x890
[   58.389627][ T5014]  ? print_irqtrace_events+0x220/0x220
[   58.395062][ T5014]  ? ptrace_stop+0x75a/0x970
[   58.399631][ T5014]  ? _raw_spin_unlock_irq+0x2e/0x50
[   58.404804][ T5014]  ? ptrace_notify+0x278/0x380
[   58.409552][ T5014]  ? syscall_enter_from_user_mode+0x32/0x230
[   58.415509][ T5014]  ? syscall_enter_from_user_mode+0x8c/0x230
[   58.421486][ T5014]  do_syscall_64+0x41/0xc0
[   58.425880][ T5014]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   58.431753][ T5014] RIP: 0033:0x7f54c6150759
[   58.436147][ T5014] Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   58.455814][ T5014] RSP: 002b:00007ffe06c30578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   58.464201][ T5014] RAX: ffffffffffffffda RBX: 00007f54c619902d RCX: 00007f54c6150759
[   58.472150][ T5014] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
[   58.480281][ T5014] RBP: 00007ffe06c30590 R08: 0000000000000000 R09: 00007ffe06c305f0
[   58.488364][ T5014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54c61c35f0
[   58.496314][ T5014] R13: 00007ffe06c30778 R14: 0000000000000001 R15: 0000000000000001
[   58.504266][ T5014]  </TASK>
[   58.507362][ T5014] Kernel Offset: disabled
[   58.511667][ T5014] Rebooting in 86400 seconds..