./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor918008199
<...>
Warning: Permanently added '10.128.0.110' (ECDSA) to the list of known hosts.
execve("./syz-executor918008199", ["./syz-executor918008199"], 0x7fff184a8350 /* 10 vars */) = 0
brk(NULL) = 0x555555608000
brk(0x555555608c40) = 0x555555608c40
arch_prctl(ARCH_SET_FS, 0x555555608300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor918008199", 4096) = 27
brk(0x555555629c40) = 0x555555629c40
brk(0x55555562a000) = 0x55555562a000
mprotect(0x7fc501d87000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE) = 3
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SOCKET_FILTER, insn_cnt=5, insns=0x200003c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4
setsockopt(3, SOL_SOCKET, SO_ATTACH_BPF, [4], 4) = 0
syzkaller login: [ 51.275086][ T3600] netlink: 'syz-executor918': attribute type 21 has an invalid length.
[ 51.283727][ T3600] netlink: 168 bytes leftover after parsing attributes in process `syz-executor918'.
[ 51.311850][ T3600] ------------[ cut here ]------------
[ 51.317372][ T3600] WARNING: CPU: 1 PID: 3600 at include/linux/skbuff.h:2785 bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.329102][ T3600] Modules linked in:
[ 51.333331][ T3600] CPU: 1 PID: 3600 Comm: syz-executor918 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 51.343474][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 51.353713][ T3600] RIP: 0010:bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.361112][ T3600] Code: ff ff 45 31 f6 e9 5a ff ff ff e8 1a 26 3f 00 e9 3b ff ff ff e8 00 26 3f 00 e9 df fe ff ff e8 f6 25 3f 00 eb 9e e8 2f 21 f3 ff <0f> 0b eb b1 e8 06 26 3f 00 e9 79 fe ff ff 90 41 57 41 56 41 55 41
[ 51.380955][ T3600] RSP: 0018:ffffc90002f0f4f8 EFLAGS: 00010293
[ 51.387221][ T3600] RAX: 0000000000000000 RBX: ffffffffffe10002 RCX: 0000000000000000
[ 51.395350][ T3600] RDX: ffff88801e1f57c0 RSI: ffffffff818795e1 RDI: 0000000000000003
[ 51.403569][ T3600] RBP: ffff888020c3ac80 R08: 0000000000000003 R09: 000000000000ffff
[ 51.411869][ T3600] R10: 000000000000ffff R11: 0000000000000001 R12: 0000000000000002
[ 51.419866][ T3600] R13: ffff888020df9800 R14: 000000000000ffff R15: 0000000000000000
[ 51.428069][ T3600] FS: 0000555555608300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
[ 51.437170][ T3600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 51.443982][ T3600] CR2: 000000000045b630 CR3: 0000000074f9e000 CR4: 00000000003506e0
[ 51.452225][ T3600] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 51.460214][ T3600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 51.468431][ T3600] Call Trace:
[ 51.471858][ T3600]
[ 51.474802][ T3600] bpf_skb_load_helper_16_no_cache+0x205/0x2b0
[ 51.480970][ T3600] ? bpf_skb_load_helper_16+0x230/0x230
[ 51.486761][ T3600] bpf_prog_e4a2190aaec26884+0x41/0x4c
[ 51.492389][ T3600] sk_filter_trim_cap+0x351/0x9a0
[ 51.497459][ T3600] ? bpf_xdp_redirect+0x160/0x160
[ 51.502703][ T3600] ? netlink_lookup+0x25e/0x470
[ 51.507573][ T3600] ? __rhashtable_lookup.constprop.0+0x5e0/0x5e0
[ 51.514128][ T3600] ? is_vmalloc_addr+0x28/0x40
[ 51.518921][ T3600] netlink_unicast+0x1bf/0x7f0
[ 51.523869][ T3600] ? netlink_attachskb+0x880/0x880
[ 51.529001][ T3600] ? __build_skb_around+0x274/0x340
[ 51.534576][ T3600] ? memset+0x20/0x40
[ 51.538612][ T3600] ? __nlmsg_put+0x155/0x1c0
[ 51.543499][ T3600] netlink_ack+0x5cd/0xa80
[ 51.547985][ T3600] ? netlink_sendmsg+0xe10/0xe10
[ 51.553170][ T3600] netlink_rcv_skb+0x33d/0x420
[ 51.557957][ T3600] ? rtnl_fdb_dump+0x9a0/0x9a0
[ 51.562933][ T3600] ? netlink_ack+0xa80/0xa80
[ 51.567561][ T3600] ? netlink_deliver_tap+0x1a2/0xc40
[ 51.573099][ T3600] ? netlink_deliver_tap+0x1b1/0xc40
[ 51.578552][ T3600] netlink_unicast+0x543/0x7f0
[ 51.583575][ T3600] ? netlink_attachskb+0x880/0x880
[ 51.588712][ T3600] ? __phys_addr+0xc4/0x140
[ 51.593425][ T3600] ? __phys_addr_symbol+0x2c/0x70
[ 51.598495][ T3600] ? __check_object_size+0x2de/0x700
[ 51.604049][ T3600] netlink_sendmsg+0x917/0xe10
[ 51.608842][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 51.614010][ T3600] ? bpf_lsm_socket_sendmsg+0x5/0x10
[ 51.619324][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 51.624479][ T3600] sock_sendmsg+0xcf/0x120
[ 51.628916][ T3600] ____sys_sendmsg+0x6eb/0x810
[ 51.633867][ T3600] ? kernel_sendmsg+0x50/0x50
[ 51.638561][ T3600] ? do_recvmmsg+0x6d0/0x6d0
[ 51.643346][ T3600] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 51.649343][ T3600] ? lockdep_hardirqs_on+0x79/0x100
[ 51.654737][ T3600] ___sys_sendmsg+0xf3/0x170
[ 51.659350][ T3600] ? sendmsg_copy_msghdr+0x160/0x160
[ 51.664993][ T3600] ? lock_release+0x780/0x780
[ 51.669730][ T3600] ? ptrace_stop.part.0+0x5ec/0xa80
[ 51.675014][ T3600] ? do_raw_spin_lock+0x120/0x2a0
[ 51.680113][ T3600] ? rwlock_bug.part.0+0x90/0x90
[ 51.685186][ T3600] ? _raw_spin_lock_irq+0x41/0x50
[ 51.690239][ T3600] ? __fget_light+0x20a/0x270
[ 51.695048][ T3600] __x64_sys_sendmsg+0x132/0x220
[ 51.700020][ T3600] ? __sys_sendmsg+0x1b0/0x1b0
[ 51.704873][ T3600] ? _raw_spin_unlock_irq+0x2a/0x40
[ 51.710094][ T3600] ? ptrace_notify+0xfa/0x140
[ 51.714836][ T3600] do_syscall_64+0x35/0xb0
[ 51.719269][ T3600] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 51.725256][ T3600] RIP: 0033:0x7fc501d1ae09
[ 51.729692][ T3600] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 51.749359][ T3600] RSP: 002b:00007fffb1e77af8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 51.757837][ T3600] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc501d1ae09
[ 51.765871][ T3600] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
[ 51.773917][ T3600] RBP: 00007fc501cdefb0 R08: 0000000000000000 R09: 0000000000000000
[ 51.781943][ T3600] R10: 0000000000000004 R11: 0000000000000246 R12: 00007fc501cdf040
[ 51.789940][ T3600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 51.798006][ T3600]
[ 51.801057][ T3600] Kernel panic - not syncing: panic_on_warn set ...
[ 51.807643][ T3600] CPU: 1 PID: 3600 Comm: syz-executor918 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 51.817800][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 51.827938][ T3600] Call Trace:
[ 51.831218][ T3600]
[ 51.834236][ T3600] dump_stack_lvl+0xcd/0x134
[ 51.838840][ T3600] panic+0x2d7/0x636
[ 51.842742][ T3600] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 51.848738][ T3600] ? __warn.cold+0x248/0x2c4
[ 51.853335][ T3600] ? bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.860117][ T3600] __warn.cold+0x259/0x2c4
[ 51.864542][ T3600] ? bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.871306][ T3600] report_bug+0x1bc/0x210
[ 51.875644][ T3600] handle_bug+0x3c/0x60
[ 51.879805][ T3600] exc_invalid_op+0x14/0x40
[ 51.884310][ T3600] asm_exc_invalid_op+0x1b/0x20
[ 51.889159][ T3600] RIP: 0010:bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.896535][ T3600] Code: ff ff 45 31 f6 e9 5a ff ff ff e8 1a 26 3f 00 e9 3b ff ff ff e8 00 26 3f 00 e9 df fe ff ff e8 f6 25 3f 00 eb 9e e8 2f 21 f3 ff <0f> 0b eb b1 e8 06 26 3f 00 e9 79 fe ff ff 90 41 57 41 56 41 55 41
[ 51.916142][ T3600] RSP: 0018:ffffc90002f0f4f8 EFLAGS: 00010293
[ 51.922208][ T3600] RAX: 0000000000000000 RBX: ffffffffffe10002 RCX: 0000000000000000
[ 51.930175][ T3600] RDX: ffff88801e1f57c0 RSI: ffffffff818795e1 RDI: 0000000000000003
[ 51.938143][ T3600] RBP: ffff888020c3ac80 R08: 0000000000000003 R09: 000000000000ffff
[ 51.946110][ T3600] R10: 000000000000ffff R11: 0000000000000001 R12: 0000000000000002
[ 51.954089][ T3600] R13: ffff888020df9800 R14: 000000000000ffff R15: 0000000000000000
[ 51.962070][ T3600] ? bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.968847][ T3600] ? bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0
[ 51.975636][ T3600] bpf_skb_load_helper_16_no_cache+0x205/0x2b0
[ 51.981894][ T3600] ? bpf_skb_load_helper_16+0x230/0x230
[ 51.987457][ T3600] bpf_prog_e4a2190aaec26884+0x41/0x4c
[ 51.992918][ T3600] sk_filter_trim_cap+0x351/0x9a0
[ 51.997954][ T3600] ? bpf_xdp_redirect+0x160/0x160
[ 52.002993][ T3600] ? netlink_lookup+0x25e/0x470
[ 52.007856][ T3600] ? __rhashtable_lookup.constprop.0+0x5e0/0x5e0
[ 52.014201][ T3600] ? is_vmalloc_addr+0x28/0x40
[ 52.018974][ T3600] netlink_unicast+0x1bf/0x7f0
[ 52.023750][ T3600] ? netlink_attachskb+0x880/0x880
[ 52.028864][ T3600] ? __build_skb_around+0x274/0x340
[ 52.034063][ T3600] ? memset+0x20/0x40
[ 52.038049][ T3600] ? __nlmsg_put+0x155/0x1c0
[ 52.042662][ T3600] netlink_ack+0x5cd/0xa80
[ 52.047097][ T3600] ? netlink_sendmsg+0xe10/0xe10
[ 52.052046][ T3600] netlink_rcv_skb+0x33d/0x420
[ 52.056815][ T3600] ? rtnl_fdb_dump+0x9a0/0x9a0
[ 52.061591][ T3600] ? netlink_ack+0xa80/0xa80
[ 52.066186][ T3600] ? netlink_deliver_tap+0x1a2/0xc40
[ 52.071478][ T3600] ? netlink_deliver_tap+0x1b1/0xc40
[ 52.076773][ T3600] netlink_unicast+0x543/0x7f0
[ 52.081547][ T3600] ? netlink_attachskb+0x880/0x880
[ 52.086660][ T3600] ? __phys_addr+0xc4/0x140
[ 52.091175][ T3600] ? __phys_addr_symbol+0x2c/0x70
[ 52.096216][ T3600] ? __check_object_size+0x2de/0x700
[ 52.101509][ T3600] netlink_sendmsg+0x917/0xe10
[ 52.106298][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 52.111244][ T3600] ? bpf_lsm_socket_sendmsg+0x5/0x10
[ 52.116535][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 52.121476][ T3600] sock_sendmsg+0xcf/0x120
[ 52.125898][ T3600] ____sys_sendmsg+0x6eb/0x810
[ 52.130666][ T3600] ? kernel_sendmsg+0x50/0x50
[ 52.135349][ T3600] ? do_recvmmsg+0x6d0/0x6d0
[ 52.139960][ T3600] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 52.145943][ T3600] ? lockdep_hardirqs_on+0x79/0x100
[ 52.151154][ T3600] ___sys_sendmsg+0xf3/0x170
[ 52.155756][ T3600] ? sendmsg_copy_msghdr+0x160/0x160
[ 52.161055][ T3600] ? lock_release+0x780/0x780
[ 52.165733][ T3600] ? ptrace_stop.part.0+0x5ec/0xa80
[ 52.170935][ T3600] ? do_raw_spin_lock+0x120/0x2a0
[ 52.175964][ T3600] ? rwlock_bug.part.0+0x90/0x90
[ 52.180903][ T3600] ? _raw_spin_lock_irq+0x41/0x50
[ 52.185943][ T3600] ? __fget_light+0x20a/0x270
[ 52.190638][ T3600] __x64_sys_sendmsg+0x132/0x220
[ 52.195583][ T3600] ? __sys_sendmsg+0x1b0/0x1b0
[ 52.200374][ T3600] ? _raw_spin_unlock_irq+0x2a/0x40
[ 52.205582][ T3600] ? ptrace_notify+0xfa/0x140
[ 52.210277][ T3600] do_syscall_64+0x35/0xb0
[ 52.214700][ T3600] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 52.220593][ T3600] RIP: 0033:0x7fc501d1ae09
[ 52.225012][ T3600] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 52.244651][ T3600] RSP: 002b:00007fffb1e77af8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 52.253067][ T3600] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc501d1ae09
[ 52.261037][ T3600] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
[ 52.269006][ T3600] RBP: 00007fc501cdefb0 R08: 0000000000000000 R09: 0000000000000000
[ 52.276973][ T3600] R10: 0000000000000004 R11: 0000000000000246 R12: 00007fc501cdf040
[ 52.284947][ T3600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 52.292932][ T3600]
[ 52.296300][ T3600] Kernel Offset: disabled
[ 52.300674][ T3600] Rebooting in 86400 seconds..