./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1323644774 <...> Warning: Permanently added '10.128.10.24' (ECDSA) to the list of known hosts. execve("./syz-executor1323644774", ["./syz-executor1323644774"], 0x7ffcb48d8940 /* 10 vars */) = 0 brk(NULL) = 0x555556bb9000 brk(0x555556bb9c40) = 0x555556bb9c40 arch_prctl(ARCH_SET_FS, 0x555556bb9300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1323644774", 4096) = 28 brk(0x555556bdac40) = 0x555556bdac40 brk(0x555556bdb000) = 0x555556bdb000 mprotect(0x7f0a722cd000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0 sendto(3, NULL, 0, MSG_DONTROUTE|MSG_PROBE|MSG_EOR|MSG_SENDPAGE_NOTLAST|MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 setsockopt(3, SOL_TCP, TCP_ULP, [7564404], 4) = 0 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=18, map_flags=0, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 bpf(BPF_MAP_UPDATE_ELEM, {map_fd=4, key=0x20000340, value=0x20000040, flags=BPF_ANY}, 32) = -1 EINVAL (Invalid argument) exit_group(0) = ? syzkaller login: [ 55.574335][ T3611] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 55.574335][ T3611] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 55.580707][ T3611] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN [ 55.580731][ T3611] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 55.580746][ T3611] CPU: 0 PID: 3611 Comm: syz-executor132 Not tainted 5.18.0-next-20220526-syzkaller #0 [ 55.580769][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 55.580781][ T3611] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 [ 55.580826][ T3611] Code: 02 00 0f 85 16 09 00 00 48 8b 85 f0 02 00 00 4d 8d 6c 24 14 4c 89 ea 48 c1 ea 03 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 02 4c 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 4f 07 00 00 [ 55.580847][ T3611] RSP: 0018:ffffc90002fefb70 EFLAGS: 00010203 [ 55.580866][ T3611] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 55.580880][ T3611] RDX: 0000000000000002 RSI: ffffffff88008a03 RDI: ffff888076430ef0 [ 55.580894][ T3611] RBP: ffff888076430c00 R08: 0000000000000001 R09: 0000000000000000 [ 55.580908][ T3611] R10: 00000000000000f0 R11: 0000000000000000 R12: 0000000000000000 [ 55.580921][ T3611] R13: 0000000000000014 R14: ffff8880237fb908 R15: 0000000000000001 [ 55.580935][ T3611] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 55.580958][ T3611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.580975][ T3611] CR2: 00007f0a722a3ae8 CR3: 000000000ba8e000 CR4: 00000000003506f0 [ 55.580990][ T3611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 55.581003][ T3611] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 55.581017][ T3611] Call Trace: [ 55.581023][ T3611] [ 55.581032][ T3611] ? wait_on_pending_writer+0x430/0x430 [ 55.581059][ T3611] ? __local_bh_enable_ip+0xa0/0x120 [ 55.581085][ T3611] tls_sk_proto_close+0x356/0xaf0 [ 55.581111][ T3611] ? wait_on_pending_writer+0x430/0x430 [ 55.581136][ T3611] ? down_write+0xde/0x150 [ 55.581166][ T3611] ? ip_mc_drop_socket+0x16/0x260 [ 55.581194][ T3611] ? locks_remove_file+0x2f7/0x570 [ 55.581219][ T3611] inet_release+0x12e/0x280 [ 55.581243][ T3611] __sock_release+0xcd/0x280 [ 55.581275][ T3611] sock_close+0x18/0x20 [ 55.581305][ T3611] __fput+0x277/0x9d0 [ 55.581325][ T3611] ? __sock_release+0x280/0x280 [ 55.581358][ T3611] task_work_run+0xdd/0x1a0 [ 55.581390][ T3611] do_exit+0xaff/0x2a00 [ 55.581422][ T3611] ? lock_downgrade+0x6e0/0x6e0 [ 55.581457][ T3611] ? mm_update_next_owner+0x7a0/0x7a0 [ 55.581491][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40 [ 55.581515][ T3611] do_group_exit+0xd2/0x2f0 [ 55.581548][ T3611] __x64_sys_exit_group+0x3a/0x50 [ 55.581581][ T3611] do_syscall_64+0x35/0xb0 [ 55.581614][ T3611] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 55.581638][ T3611] RIP: 0033:0x7f0a7225f7d9 [ 55.581654][ T3611] Code: Unable to access opcode bytes at RIP 0x7f0a7225f7af. [ 55.581663][ T3611] RSP: 002b:00007ffef6103858 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 55.581692][ T3611] RAX: ffffffffffffffda RBX: 00007f0a722d3270 RCX: 00007f0a7225f7d9 [ 55.581707][ T3611] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 55.581720][ T3611] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 55.581733][ T3611] R10: 00007f0a72223900 R11: 0000000000000246 R12: 00007f0a722d3270 [ 55.581747][ T3611] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 55.581767][ T3611] [ 55.581773][ T3611] Modules linked in: [ 55.581808][ T3611] ---[ end trace 0000000000000000 ]--- [ 55.581816][ T3611] RIP: 0010:tls_sk_proto_close+0xd8/0xaf0 [ 55.581840][ T3611] Code: 02 00 0f 85 16 09 00 00 48 8b 85 f0 02 00 00 4d 8d 6c 24 14 4c 89 ea 48 c1 ea 03 48 89 44 24 18 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 02 4c 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 4f 07 00 00 [ 55.581859][ T3611] RSP: 0018:ffffc90002fefb70 EFLAGS: 00010203 [ 55.581875][ T3611] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 55.581888][ T3611] RDX: 0000000000000002 RSI: ffffffff88008a03 RDI: ffff888076430ef0 [ 55.581902][ T3611] RBP: ffff888076430c00 R08: 0000000000000001 R09: 0000000000000000 [ 55.581914][ T3611] R10: 00000000000000f0 R11: 0000000000000000 R12: 0000000000000000 [ 55.581926][ T3611] R13: 0000000000000014 R14: ffff8880237fb908 R15: 0000000000000001 [ 55.581939][ T3611] FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 [ 55.581959][ T3611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.581973][ T3611] CR2: 00007f0a722a3ae8 CR3: 000000000ba8e000 CR4: 00000000003506f0 [ 55.581987][ T3611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 55.581999][ T3611] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 55.582012][ T3611] Kernel panic - not syncing: Fatal exception [ 55.598758][ T3611] Kernel Offset: disabled