./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1873756904 <...> DUID 00:04:e3:38:52:80:67:3f:e9:c9:a2:47:22:a3:59:23:7d:1e forked to background, child pid 3186 [ 23.146808][ T3187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.157998][ T3187] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.100' (ECDSA) to the list of known hosts. execve("./syz-executor1873756904", ["./syz-executor1873756904"], 0x7fff2dd052a0 /* 10 vars */) = 0 brk(NULL) = 0x555556f6f000 brk(0x555556f6fc40) = 0x555556f6fc40 arch_prctl(ARCH_SET_FS, 0x555556f6f300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1873756904", 4096) = 28 brk(0x555556f90c40) = 0x555556f90c40 brk(0x555556f91000) = 0x555556f91000 mprotect(0x7f13d938b000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3615 attached , child_tidptr=0x555556f6f5d0) = 3615 [pid 3615] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3615] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3615] setsid() = 1 [pid 3615] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3615] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3615] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3615] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3615] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3615] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3615] unshare(CLONE_NEWNS) = 0 [pid 3615] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3615] unshare(CLONE_NEWIPC) = 0 [pid 3615] unshare(CLONE_NEWCGROUP) = 0 [pid 3615] unshare(CLONE_NEWUTS) = 0 [pid 3615] unshare(CLONE_SYSVSEM) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "16777216", 8) = 8 [pid 3615] close(3) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "536870912", 9) = 9 [pid 3615] close(3) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "1024", 4) = 4 [pid 3615] close(3) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "8192", 4) = 4 [pid 3615] close(3) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "1024", 4) = 4 [pid 3615] close(3) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "1024", 4) = 4 [pid 3615] close(3) = 0 [pid 3615] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3615] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3615] close(3) = 0 [pid 3615] getpid() = 1 [pid 3615] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 42.006388][ T3615] dump_stack_lvl+0x1b1/0x28e [ 42.011063][ T3615] ? fortify_panic+0x13/0x13 [ 42.015643][ T3615] ? _printk+0xc0/0x100 [ 42.019790][ T3615] ? __wake_up_klogd+0xd6/0x100 [ 42.024632][ T3615] ? __wake_up_klogd+0xcd/0x100 [ 42.029466][ T3615] ? panic+0x715/0x715 [ 42.033518][ T3615] ? _printk+0xc0/0x100 [ 42.037663][ T3615] print_address_description+0x65/0x4b0 [ 42.043202][ T3615] print_report+0x108/0x1f0 [ 42.047696][ T3615] ? read_lock_is_recursive+0x10/0x10 [ 42.053055][ T3615] ? nilfs_test_metadata_dirty+0x39/0x210 [ 42.058766][ T3615] kasan_report+0xc3/0xf0 [ 42.063088][ T3615] ? do_raw_spin_lock+0x148/0x360 [ 42.068113][ T3615] ? nilfs_test_metadata_dirty+0x39/0x210 [ 42.073829][ T3615] nilfs_test_metadata_dirty+0x39/0x210 [ 42.079365][ T3615] nilfs_segctor_confirm+0x78/0x2d0 [ 42.084564][ T3615] nilfs_detach_log_writer+0x4c1/0xbd0 [ 42.090010][ T3615] ? __might_sleep+0xc0/0xc0 [ 42.094590][ T3615] ? nilfs_attach_log_writer+0x8f0/0x8f0 [ 42.100207][ T3615] ? hook_sb_delete+0x988/0xab0 [ 42.105040][ T3615] ? wake_bit_function+0x240/0x240 [ 42.110140][ T3615] ? hook_inode_free_security+0xa0/0xa0 [ 42.115675][ T3615] ? clear_inode+0x150/0x150 [ 42.120253][ T3615] ? nilfs_free_inode+0x70/0x70 [ 42.125091][ T3615] nilfs_put_super+0x4b/0x150 [ 42.129755][ T3615] ? nilfs_free_inode+0x70/0x70 [ 42.134590][ T3615] generic_shutdown_super+0x128/0x300 [ 42.139947][ T3615] kill_block_super+0x79/0xd0 [ 42.144610][ T3615] deactivate_locked_super+0xa7/0xf0 [ 42.149880][ T3615] cleanup_mnt+0x4ce/0x560 [ 42.154279][ T3615] ? _raw_spin_unlock_irq+0x1f/0x40 [ 42.159465][ T3615] task_work_run+0x146/0x1c0 [ 42.164041][ T3615] do_exit+0x55e/0x20a0 [ 42.168181][ T3615] ? _raw_spin_unlock_irq+0x1f/0x40 [ 42.173369][ T3615] ? lockdep_hardirqs_on+0x8d/0x130 [ 42.178558][ T3615] ? _raw_spin_unlock_irq+0x2a/0x40 [ 42.183741][ T3615] ? ptrace_notify+0x245/0x340 [ 42.188488][ T3615] ? mm_update_next_owner+0x6d0/0x6d0 [ 42.193846][ T3615] ? do_notify_parent+0xe00/0xe00 [ 42.198868][ T3615] do_group_exit+0x23b/0x2f0 [ 42.203442][ T3615] __x64_sys_exit_group+0x3b/0x40 [ 42.208450][ T3615] do_syscall_64+0x3d/0xb0 [ 42.212855][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.218734][ T3615] RIP: 0033:0x7f13d9319b99 [ 42.223133][ T3615] Code: Unable to access opcode bytes at RIP 0x7f13d9319b6f. [ 42.230478][ T3615] RSP: 002b:00007ffe014533b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 42.238874][ T3615] RAX: ffffffffffffffda RBX: 00007f13d9391330 RCX: 00007f13d9319b99 [ 42.246830][ T3615] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 42.254787][ T3615] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f13d938be40 [ 42.262738][ T3615] R10: 00007ffe014532d0 R11: 0000000000000246 R12: 00007f13d9391330 [ 42.270693][ T3615] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 42.278653][ T3615] [ 42.281656][ T3615] [ 42.283962][ T3615] Allocated by task 3615: [ 42.288271][ T3615] ____kasan_kmalloc+0xcd/0x100 [ 42.293103][ T3615] kmem_cache_alloc_trace+0x97/0x310 [ 42.298373][ T3615] nilfs_find_or_create_root+0x142/0x4f0 [ 42.303987][ T3615] nilfs_attach_checkpoint+0xcd/0x4a0 [ 42.309340][ T3615] nilfs_fill_super+0x2e8/0x5d0 [ 42.314172][ T3615] nilfs_mount+0x613/0x9b0 [ 42.318576][ T3615] legacy_get_tree+0xea/0x180 [ 42.323241][ T3615] vfs_get_tree+0x88/0x270 [ 42.327645][ T3615] do_new_mount+0x289/0xad0 [ 42.332129][ T3615] __se_sys_mount+0x2d3/0x3c0 [ 42.336787][ T3615] do_syscall_64+0x3d/0xb0 [ 42.341185][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.347063][ T3615] [ 42.349368][ T3615] Freed by task 3615: [ 42.353328][ T3615] kasan_set_track+0x3d/0x60 [ 42.357899][ T3615] kasan_set_free_info+0x1f/0x40 [ 42.362818][ T3615] ____kasan_slab_free+0xd8/0x120 [ 42.367827][ T3615] slab_free_freelist_hook+0x12e/0x1a0 [ 42.373274][ T3615] kfree+0xda/0x210 [ 42.377063][ T3615] nilfs_evict_inode+0xe5/0x3d0 [ 42.381894][ T3615] evict+0x2a4/0x620 [ 42.385773][ T3615] evict_inodes+0x658/0x700 [ 42.390255][ T3615] generic_shutdown_super+0x94/0x300 [ 42.395518][ T3615] kill_block_super+0x79/0xd0 [ 42.400175][ T3615] deactivate_locked_super+0xa7/0xf0 [ 42.405440][ T3615] cleanup_mnt+0x4ce/0x560 [ 42.409843][ T3615] task_work_run+0x146/0x1c0 [ 42.414413][ T3615] do_exit+0x55e/0x20a0 [ 42.418548][ T3615] do_group_exit+0x23b/0x2f0 [ 42.423117][ T3615] __x64_sys_exit_group+0x3b/0x40 [ 42.428122][ T3615] do_syscall_64+0x3d/0xb0 [ 42.432518][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.438393][ T3615] [ 42.440698][ T3615] The buggy address belongs to the object at ffff888012fb4000 [ 42.440698][ T3615] which belongs to the cache kmalloc-256 of size 256 [ 42.454727][ T3615] The buggy address is located 48 bytes inside of [ 42.454727][ T3615] 256-byte region [ffff888012fb4000, ffff888012fb4100) [ 42.467890][ T3615] [ 42.470194][ T3615] The buggy address belongs to the physical page: [ 42.476586][ T3615] page:ffffea00004bed00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12fb4 [ 42.486714][ T3615] head:ffffea00004bed00 order:1 compound_mapcount:0 compound_pincount:0 [ 42.495016][ T3615] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 42.502976][ T3615] raw: 00fff00000010200 ffffea00004b8e00 dead000000000003 ffff888012041b40 [ 42.511538][ T3615] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 42.520117][ T3615] page dumped because: kasan: bad access detected [ 42.526512][ T3615] page_owner tracks the page as allocated [ 42.532205][ T3615] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2081111457, free_ts 0 [ 42.551811][ T3615] get_page_from_freelist+0x742/0x7c0 [ 42.557176][ T3615] __alloc_pages+0x259/0x560 [ 42.561745][ T3615] alloc_page_interleave+0x22/0x1c0 [ 42.566925][ T3615] alloc_slab_page+0x70/0xf0 [ 42.571497][ T3615] allocate_slab+0x5e/0x520 [ 42.575993][ T3615] ___slab_alloc+0x3ee/0xc40 [ 42.580576][ T3615] __kmalloc_track_caller+0x2bb/0x370 [ 42.585938][ T3615] krealloc+0x5c/0xe0 [ 42.589904][ T3615] add_sysfs_param+0xc8/0x800 [ 42.594569][ T3615] kernel_add_sysfs_param+0xb0/0x126 [ 42.599849][ T3615] param_sysfs_builtin+0x1fb/0x2a5 [ 42.604941][ T3615] param_sysfs_init+0x68/0x6c [ 42.609600][ T3615] do_one_initcall+0x1b9/0x3e0 [ 42.614346][ T3615] do_initcall_level+0x168/0x218 [ 42.619267][ T3615] do_initcalls+0x4b/0x8c [ 42.623580][ T3615] kernel_init_freeable+0x3f1/0x57b [ 42.628769][ T3615] page_owner free stack trace missing [ 42.634117][ T3615] [ 42.636424][ T3615] Memory state around the buggy address: [ 42.642033][ T3615] ffff888012fb3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.650077][ T3615] ffff888012fb3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.658118][ T3615] >ffff888012fb4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.666172][ T3615] ^ [ 42.671785][ T3615] ffff888012fb4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.679835][ T3615] ffff888012fb4100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.687878][ T3615] ================================================================== [ 42.696282][ T3615] Kernel panic - not syncing: panic_on_warn set ... [ 42.702867][ T3615] CPU: 1 PID: 3615 Comm: syz-executor187 Not tainted 6.0.0-syzkaller #0 [ 42.711189][ T3615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 42.721226][ T3615] Call Trace: [ 42.724510][ T3615] [ 42.727431][ T3615] dump_stack_lvl+0x1b1/0x28e [ 42.732099][ T3615] ? fortify_panic+0x13/0x13 [ 42.736674][ T3615] ? panic+0x715/0x715 [ 42.740732][ T3615] ? preempt_schedule_common+0xb7/0xe0 [ 42.746204][ T3615] ? vscnprintf+0x59/0x80 [ 42.750524][ T3615] panic+0x2d6/0x715 [ 42.754407][ T3615] ? fb_is_primary_device+0xcc/0xcc [ 42.759589][ T3615] ? _raw_spin_unlock_irqrestore+0x110/0x120 [ 42.765556][ T3615] ? print_report+0x1b4/0x1f0 [ 42.770232][ T3615] ? nilfs_test_metadata_dirty+0x39/0x210 [ 42.775946][ T3615] end_report+0x91/0xa0 [ 42.780087][ T3615] kasan_report+0xd0/0xf0 [ 42.784399][ T3615] ? do_raw_spin_lock+0x148/0x360 [ 42.789405][ T3615] ? nilfs_test_metadata_dirty+0x39/0x210 [ 42.795110][ T3615] nilfs_test_metadata_dirty+0x39/0x210 [ 42.800642][ T3615] nilfs_segctor_confirm+0x78/0x2d0 [ 42.805825][ T3615] nilfs_detach_log_writer+0x4c1/0xbd0 [ 42.811271][ T3615] ? __might_sleep+0xc0/0xc0 [ 42.815849][ T3615] ? nilfs_attach_log_writer+0x8f0/0x8f0 [ 42.821551][ T3615] ? hook_sb_delete+0x988/0xab0 [ 42.826385][ T3615] ? wake_bit_function+0x240/0x240 [ 42.831487][ T3615] ? hook_inode_free_security+0xa0/0xa0 [ 42.837027][ T3615] ? clear_inode+0x150/0x150 [ 42.841648][ T3615] ? nilfs_free_inode+0x70/0x70 [ 42.846488][ T3615] nilfs_put_super+0x4b/0x150 [ 42.851151][ T3615] ? nilfs_free_inode+0x70/0x70 [ 42.855987][ T3615] generic_shutdown_super+0x128/0x300 [ 42.861345][ T3615] kill_block_super+0x79/0xd0 [ 42.866007][ T3615] deactivate_locked_super+0xa7/0xf0 [ 42.871274][ T3615] cleanup_mnt+0x4ce/0x560 [ 42.875675][ T3615] ? _raw_spin_unlock_irq+0x1f/0x40 [ 42.880858][ T3615] task_work_run+0x146/0x1c0 [ 42.885435][ T3615] do_exit+0x55e/0x20a0 [ 42.889575][ T3615] ? _raw_spin_unlock_irq+0x1f/0x40 [ 42.894757][ T3615] ? lockdep_hardirqs_on+0x8d/0x130 [ 42.899941][ T3615] ? _raw_spin_unlock_irq+0x2a/0x40 [ 42.905120][ T3615] ? ptrace_notify+0x245/0x340 [ 42.909869][ T3615] ? mm_update_next_owner+0x6d0/0x6d0 [ 42.915221][ T3615] ? do_notify_parent+0xe00/0xe00 [ 42.920239][ T3615] do_group_exit+0x23b/0x2f0 [ 42.924812][ T3615] __x64_sys_exit_group+0x3b/0x40 [ 42.929819][ T3615] do_syscall_64+0x3d/0xb0 [ 42.934218][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.940093][ T3615] RIP: 0033:0x7f13d9319b99 [ 42.944494][ T3615] Code: Unable to access opcode bytes at RIP 0x7f13d9319b6f. [ 42.951838][ T3615] RSP: 002b:00007ffe014533b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 42.960233][ T3615] RAX: ffffffffffffffda RBX: 00007f13d9391330 RCX: 00007f13d9319b99 [ 42.968187][ T3615] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 42.976140][ T3615] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f13d938be40 [ 42.984095][ T3615] R10: 00007ffe014532d0 R11: 0000000000000246 R12: 00007f13d9391330 [ 42.992050][ T3615] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 43.000008][ T3615] [ 43.003154][ T3615] Kernel Offset: disabled [ 43.007473][ T3615] Rebooting in 86400 seconds..