./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1363680712 <...> Warning: Permanently added '10.128.10.21' (ED25519) to the list of known hosts. execve("./syz-executor1363680712", ["./syz-executor1363680712"], 0x7fffd8cd1950 /* 10 vars */) = 0 brk(NULL) = 0x55556ecd9000 brk(0x55556ecd9e00) = 0x55556ecd9e00 arch_prctl(ARCH_SET_FS, 0x55556ecd9480) = 0 set_tid_address(0x55556ecd9750) = 5831 set_robust_list(0x55556ecd9760, 24) = 0 rseq(0x55556ecd9da0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1363680712", 4096) = 28 getrandom("\x1d\xa2\x97\x0b\x88\xbb\x5e\x1c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ecd9e00 brk(0x55556ecfae00) = 0x55556ecfae00 brk(0x55556ecfb000) = 0x55556ecfb000 mprotect(0x7efde5761000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5831}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5831}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5831}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5831}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5831}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5831}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5831}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7efde56b1d20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7efde56bf240}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7efde56b1d20, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7efde56bf240}, NULL, 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5834 attached , child_tidptr=0x55556ecd9750) = 5834 [pid 5834] set_robust_list(0x55556ecd9760, 24) = 0 [pid 5834] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5834] setpgid(0, 0) = 0 [pid 5834] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5834] write(3, "1000", 4) = 4 [pid 5834] close(3) = 0 executing program [pid 5834] write(1, "executing program\n", 18) = 18 [pid 5834] socket(AF_PPPOX, SOCK_STREAM, 1) = 3 [pid 5834] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=7, map_flags=0, inner_map_fd=-1, map_name="\xff\xff\xff\xff", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5834] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=23, insns=0x200002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 148) = -1 EFAULT (Bad address) [pid 5834] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 5834] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6 [pid 5834] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20001c40, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=0x20000000, func_info_cnt=8, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5834] sendmsg(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 5834] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=8, rlim_max=147}, NULL) = 0 [pid 5834] sched_setscheduler(0, SCHED_RR, [6]) = 0 [pid 5834] prctl(PR_SCHED_CORE, PR_SCHED_CORE_CREATE, 0, 0 /* PIDTYPE_PID */, NULL) = 0 [pid 5834] getpid() = 5834 [pid 5834] openat(AT_FDCWD, "/dev/video7", O_RDONLY) = 7 [pid 5834] socketpair(AF_UNIX, SOCK_DGRAM, 0, [8, 9]) = 0 [pid 5834] connect(8, NULL, 0) = -1 EINVAL (Invalid argument) [pid 5834] recvmmsg(8, 0x200000c0, 65798, MSG_PEEK, NULL) = -1 EMSGSIZE (Message too long) [pid 5834] fcntl(-1, F_SETOWN, 5834) = -1 EBADF (Bad file descriptor) [pid 5834] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=262144, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 10 [ 72.226511][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [pid 5834] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_CGROUP_SKB, insn_cnt=28, insns=0x20000d80, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5831] kill(-5834, SIGKILL) = 0 [pid 5831] kill(5834, SIGKILL) = 0 [ 77.756239][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [pid 5834] <... bpf resumed>) = ? [pid 5834] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5834, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1334 /* 13.34 s */} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5835 attached , child_tidptr=0x55556ecd9750) = 5835 [pid 5835] set_robust_list(0x55556ecd9760, 24) = 0 [pid 5835] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5835] setpgid(0, 0) = 0 [pid 5835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5835] write(3, "1000", 4) = 4 [pid 5835] close(3executing program ) = 0 [pid 5835] write(1, "executing program\n", 18) = 18 [pid 5835] socket(AF_PPPOX, SOCK_STREAM, 1) = 3 [pid 5835] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=7, map_flags=0, inner_map_fd=-1, map_name="\xff\xff\xff\xff", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5835] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=23, insns=0x200002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 148) = -1 EFAULT (Bad address) [pid 5835] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 5835] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6 [pid 5835] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20001c40, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=0x20000000, func_info_cnt=8, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5835] sendmsg(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 5835] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=8, rlim_max=147}, NULL) = 0 [pid 5835] sched_setscheduler(0, SCHED_RR, [6]) = 0 [pid 5835] prctl(PR_SCHED_CORE, PR_SCHED_CORE_CREATE, 0, 0 /* PIDTYPE_PID */, NULL) = 0 [pid 5835] getpid() = 5835 [pid 5835] openat(AT_FDCWD, "/dev/video7", O_RDONLY) = 7 [pid 5835] socketpair(AF_UNIX, SOCK_DGRAM, 0, [8, 9]) = 0 [pid 5835] connect(8, NULL, 0) = -1 EINVAL (Invalid argument) [pid 5835] recvmmsg(8, 0x200000c0, 65798, MSG_PEEK, NULL) = -1 EMSGSIZE (Message too long) [pid 5835] fcntl(-1, F_SETOWN, 5835) = -1 EBADF (Bad file descriptor) [pid 5835] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=262144, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 10 [ 81.877942][ T25] cfg80211: failed to load regulatory.db [pid 5835] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_CGROUP_SKB, insn_cnt=28, insns=0x20000d80, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5831] kill(-5835, SIGKILL) = 0 [pid 5831] kill(5835, SIGKILL) = 0 [pid 5835] <... bpf resumed>) = ? [pid 5835] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5835, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=519 /* 5.19 s */} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5837 attached , child_tidptr=0x55556ecd9750) = 5837 [pid 5837] set_robust_list(0x55556ecd9760, 24) = 0 [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5837] setpgid(0, 0) = 0 [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5837] write(3, "1000", 4) = 4 executing program [pid 5837] close(3) = 0 [pid 5837] write(1, "executing program\n", 18) = 18 [pid 5837] socket(AF_PPPOX, SOCK_STREAM, 1) = 3 [pid 5837] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=7, map_flags=0, inner_map_fd=-1, map_name="\xff\xff\xff\xff", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5837] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=23, insns=0x200002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 148) = -1 EFAULT (Bad address) [pid 5837] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 5837] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6 [pid 5837] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20001c40, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=0x20000000, func_info_cnt=8, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5837] sendmsg(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 5837] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=8, rlim_max=147}, NULL) = 0 [pid 5837] sched_setscheduler(0, SCHED_RR, [6]) = 0 [pid 5837] prctl(PR_SCHED_CORE, PR_SCHED_CORE_CREATE, 0, 0 /* PIDTYPE_PID */, NULL) = 0 [pid 5837] getpid() = 5837 [pid 5837] openat(AT_FDCWD, "/dev/video7", O_RDONLY) = 7 [pid 5837] socketpair(AF_UNIX, SOCK_DGRAM, 0, [8, 9]) = 0 [pid 5837] connect(8, NULL, 0) = -1 EINVAL (Invalid argument) [pid 5837] recvmmsg(8, 0x200000c0, 65798, MSG_PEEK, NULL) = -1 EMSGSIZE (Message too long) [pid 5837] fcntl(-1, F_SETOWN, 5837) = -1 EBADF (Bad file descriptor) [pid 5837] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=262144, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 10 [pid 5837] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_CGROUP_SKB, insn_cnt=28, insns=0x20000d80, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5831] kill(-5837, SIGKILL) = 0 [pid 5831] kill(5837, SIGKILL) = 0 [pid 5837] <... bpf resumed>) = ? [pid 5837] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5837, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=497 /* 4.97 s */} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5839 attached , child_tidptr=0x55556ecd9750) = 5839 [pid 5839] set_robust_list(0x55556ecd9760, 24) = 0 [pid 5839] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5839] setpgid(0, 0) = 0 [pid 5839] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5839] write(3, "1000", 4) = 4 [pid 5839] close(3) = 0 [pid 5839] write(1, "executing program\n", 18executing program ) = 18 [pid 5839] socket(AF_PPPOX, SOCK_STREAM, 1) = 3 [pid 5839] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=7, map_flags=0, inner_map_fd=-1, map_name="\xff\xff\xff\xff", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5839] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=23, insns=0x200002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 148) = -1 EFAULT (Bad address) [pid 5839] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 5839] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6 [pid 5839] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20001c40, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=0x20000000, func_info_cnt=8, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5839] sendmsg(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 5839] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=8, rlim_max=147}, NULL) = 0 [pid 5839] sched_setscheduler(0, SCHED_RR, [6]) = 0 [pid 5839] prctl(PR_SCHED_CORE, PR_SCHED_CORE_CREATE, 0, 0 /* PIDTYPE_PID */, NULL) = 0 [pid 5839] getpid() = 5839 [pid 5839] openat(AT_FDCWD, "/dev/video7", O_RDONLY) = 7 [pid 5839] socketpair(AF_UNIX, SOCK_DGRAM, 0, [8, 9]) = 0 [pid 5839] connect(8, NULL, 0) = -1 EINVAL (Invalid argument) [pid 5839] recvmmsg(8, 0x200000c0, 65798, MSG_PEEK, NULL) = -1 EMSGSIZE (Message too long) [pid 5839] fcntl(-1, F_SETOWN, 5839) = -1 EBADF (Bad file descriptor) [pid 5839] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=262144, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 10 [pid 5839] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_CGROUP_SKB, insn_cnt=28, insns=0x20000d80, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5831] kill(-5839, SIGKILL) = 0 [pid 5831] kill(5839, SIGKILL) = 0 [pid 5839] <... bpf resumed>) = ? [pid 5839] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5839, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=596 /* 5.96 s */} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5841 attached , child_tidptr=0x55556ecd9750) = 5841 [pid 5841] set_robust_list(0x55556ecd9760, 24) = 0 [pid 5841] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5841] setpgid(0, 0) = 0 [pid 5841] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5841] write(3, "1000", 4) = 4 [pid 5841] close(3) = 0 [pid 5841] write(1, "executing program\n", 18executing program ) = 18 [pid 5841] socket(AF_PPPOX, SOCK_STREAM, 1) = 3 [pid 5841] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=7, map_flags=0, inner_map_fd=-1, map_name="\xff\xff\xff\xff", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5841] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=23, insns=0x200002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 148) = -1 EFAULT (Bad address) [pid 5841] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 5841] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6 [pid 5841] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20001c40, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=0x20000000, func_info_cnt=8, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5841] sendmsg(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 5841] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=8, rlim_max=147}, NULL) = 0 [pid 5841] sched_setscheduler(0, SCHED_RR, [6]) = 0 [pid 5841] prctl(PR_SCHED_CORE, PR_SCHED_CORE_CREATE, 0, 0 /* PIDTYPE_PID */, NULL) = 0 [pid 5841] getpid() = 5841 [pid 5841] openat(AT_FDCWD, "/dev/video7", O_RDONLY) = 7 [pid 5841] socketpair(AF_UNIX, SOCK_DGRAM, 0, [8, 9]) = 0 [pid 5841] connect(8, NULL, 0) = -1 EINVAL (Invalid argument) [pid 5841] recvmmsg(8, 0x200000c0, 65798, MSG_PEEK, NULL) = -1 EMSGSIZE (Message too long) [pid 5841] fcntl(-1, F_SETOWN, 5841) = -1 EBADF (Bad file descriptor) [pid 5841] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=262144, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 10 [ 94.615686][ T0] NOHZ tick-stop error: local softirq work is pending, handler #280!!! [pid 5841] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_CGROUP_SKB, insn_cnt=28, insns=0x20000d80, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5831] kill(-5841, SIGKILL) = 0 [pid 5831] kill(5841, SIGKILL) = 0 [pid 5841] <... bpf resumed>) = ? [pid 5841] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5841, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=550 /* 5.50 s */} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5844 attached , child_tidptr=0x55556ecd9750) = 5844 [pid 5844] set_robust_list(0x55556ecd9760, 24) = 0 [pid 5844] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5844] setpgid(0, 0) = 0 [pid 5844] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5844] write(3, "1000", 4) = 4 [pid 5844] close(3) = 0 executing program [pid 5844] write(1, "executing program\n", 18) = 18 [pid 5844] socket(AF_PPPOX, SOCK_STREAM, 1) = 3 [pid 5844] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=7, map_flags=0, inner_map_fd=-1, map_name="\xff\xff\xff\xff", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 4 [pid 5844] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_UNSPEC, insn_cnt=23, insns=0x200002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 148) = -1 EFAULT (Bad address) [pid 5844] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_ARRAY, key_size=4, value_size=8, max_entries=1, map_flags=BPF_F_RDONLY_PROG, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 5844] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6 [pid 5844] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=8, insns=0x20001c40, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=0x20000000, func_info_cnt=8, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5844] sendmsg(-1, NULL, 0) = -1 EBADF (Bad file descriptor) [pid 5844] prlimit64(0, RLIMIT_RTPRIO, {rlim_cur=8, rlim_max=147}, NULL) = 0 [pid 5844] sched_setscheduler(0, SCHED_RR, [6]) = 0 [pid 5844] prctl(PR_SCHED_CORE, PR_SCHED_CORE_CREATE, 0, 0 /* PIDTYPE_PID */, NULL) = 0 [pid 5844] getpid() = 5844 [pid 5844] openat(AT_FDCWD, "/dev/video7", O_RDONLY) = 7 [pid 5844] socketpair(AF_UNIX, SOCK_DGRAM, 0, [8, 9]) = 0 [pid 5844] connect(8, NULL, 0) = -1 EINVAL (Invalid argument) [pid 5844] recvmmsg(8, 0x200000c0, 65798, MSG_PEEK, NULL) = -1 EMSGSIZE (Message too long) [pid 5844] fcntl(-1, F_SETOWN, 5844) = -1 EBADF (Bad file descriptor) [pid 5844] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_RINGBUF, key_size=0, value_size=0, max_entries=262144, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 10 [ 102.435834][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 121.402675][ T5844] ================================================================== [ 121.410822][ T5844] BUG: KASAN: vmalloc-out-of-bounds in vrealloc_noprof+0x340/0x3a0 [ 121.418716][ T5844] Write of size 2097120 at addr ffffc9000c800020 by task syz-executor136/5844 [ 121.427540][ T5844] [ 121.429867][ T5844] CPU: 0 UID: 0 PID: 5844 Comm: syz-executor136 Not tainted 6.12.0-next-20241120-syzkaller #0 [ 121.440083][ T5844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 121.450128][ T5844] Call Trace: [ 121.453398][ T5844] [ 121.456313][ T5844] dump_stack_lvl+0x241/0x360 [ 121.460982][ T5844] ? __pfx_dump_stack_lvl+0x10/0x10 [ 121.466160][ T5844] ? __pfx__printk+0x10/0x10 [ 121.470747][ T5844] ? _printk+0xd5/0x120 [ 121.474904][ T5844] print_report+0x169/0x550 [ 121.479414][ T5844] ? __virt_addr_valid+0xbd/0x530 [ 121.484429][ T5844] ? vrealloc_noprof+0x340/0x3a0 [ 121.489353][ T5844] kasan_report+0x143/0x180 [ 121.493864][ T5844] ? vrealloc_noprof+0x340/0x3a0 [ 121.498783][ T5844] kasan_check_range+0x282/0x290 [ 121.503707][ T5844] __asan_memset+0x23/0x50 [ 121.508116][ T5844] vrealloc_noprof+0x340/0x3a0 [ 121.512859][ T5844] push_insn_history+0x16c/0x6a0 [ 121.517779][ T5844] check_mem_access+0xf30/0x2240 [ 121.522702][ T5844] ? __reg_deduce_bounds+0xc57/0x10d0 [ 121.528072][ T5844] ? __pfx_check_mem_access+0x10/0x10 [ 121.533435][ T5844] ? is_reg64+0x306/0x3a0 [ 121.537757][ T5844] ? __check_reg_arg+0x180/0x4d0 [ 121.542675][ T5844] do_check+0x7d97/0xfcd0 [ 121.546997][ T5844] ? __pfx_do_check+0x10/0x10 [ 121.551655][ T5844] ? mark_reg_not_init+0xd4/0x4b0 [ 121.556660][ T5844] ? __asan_memcpy+0x40/0x70 [ 121.561228][ T5844] ? mark_reg_not_init+0xd4/0x4b0 [ 121.566238][ T5844] do_check_common+0x1564/0x2010 [ 121.571159][ T5844] bpf_check+0x19380/0x1f1b0 [ 121.575904][ T5844] ? bpf_prog_alloc+0x3a/0x1b0 [ 121.580678][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 121.585955][ T5844] ? page_ext_get+0x20/0x2a0 [ 121.590554][ T5844] ? page_ext_get+0x1d6/0x2a0 [ 121.595224][ T5844] ? post_alloc_hook+0x206/0x230 [ 121.600148][ T5844] ? get_page_from_freelist+0x3725/0x3870 [ 121.605851][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 121.611042][ T5844] ? validate_chain+0x11e/0x5920 [ 121.615960][ T5844] ? validate_chain+0x11e/0x5920 [ 121.620880][ T5844] ? mark_lock+0x9a/0x360 [ 121.625190][ T5844] ? validate_chain+0x11e/0x5920 [ 121.630110][ T5844] ? validate_chain+0x11e/0x5920 [ 121.635026][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 121.640209][ T5844] ? validate_chain+0x11e/0x5920 [ 121.645137][ T5844] ? validate_chain+0x11e/0x5920 [ 121.650059][ T5844] ? validate_chain+0x11e/0x5920 [ 121.654982][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 121.660192][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 121.665386][ T5844] ? __pfx_bpf_check+0x10/0x10 [ 121.670134][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 121.675320][ T5844] ? mark_lock+0x9a/0x360 [ 121.679629][ T5844] ? mark_lock+0x9a/0x360 [ 121.683950][ T5844] ? __lock_acquire+0x1397/0x2100 [ 121.688973][ T5844] ? mark_lock+0x9a/0x360 [ 121.693290][ T5844] ? __lock_acquire+0x1397/0x2100 [ 121.698321][ T5844] ? __pfx_lock_acquire+0x10/0x10 [ 121.703372][ T5844] ? ktime_get_with_offset+0x8c/0x290 [ 121.708738][ T5844] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 121.714724][ T5844] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 121.721050][ T5844] ? ktime_get_with_offset+0x8c/0x290 [ 121.726416][ T5844] ? seqcount_lockdep_reader_access+0x157/0x220 [ 121.732643][ T5844] ? lockdep_hardirqs_on+0x99/0x150 [ 121.737837][ T5844] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 121.744060][ T5844] ? __pfx_seqcount_lockdep_reader_access+0x10/0x10 [ 121.750633][ T5844] ? _raw_spin_unlock+0x28/0x50 [ 121.755467][ T5844] ? __asan_memset+0x23/0x50 [ 121.760061][ T5844] ? bpf_obj_name_cpy+0x18a/0x1d0 [ 121.765089][ T5844] bpf_prog_load+0x1667/0x20f0 [ 121.769839][ T5844] ? __pfx_bpf_prog_load+0x10/0x10 [ 121.774934][ T5844] ? __pfx___might_resched+0x10/0x10 [ 121.780230][ T5844] ? __might_fault+0xc6/0x120 [ 121.784892][ T5844] __sys_bpf+0x4ee/0x810 [ 121.789124][ T5844] ? __pfx___sys_bpf+0x10/0x10 [ 121.793878][ T5844] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 121.800189][ T5844] ? do_syscall_64+0x100/0x230 [ 121.804941][ T5844] __x64_sys_bpf+0x7c/0x90 [ 121.809343][ T5844] do_syscall_64+0xf3/0x230 [ 121.813826][ T5844] ? clear_bhb_loop+0x35/0x90 [ 121.818507][ T5844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.824399][ T5844] RIP: 0033:0x7efde56f3b29 [ 121.828801][ T5844] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 121.848406][ T5844] RSP: 002b:00007ffe47f6cfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 121.856818][ T5844] RAX: ffffffffffffffda RBX: 00007ffe47f6d020 RCX: 00007efde56f3b29 [ 121.864775][ T5844] RDX: 0000000000000090 RSI: 0000000020000840 RDI: 0000000000000005 [ 121.872728][ T5844] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000017119 [ 121.880682][ T5844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000017119 [ 121.888632][ T5844] R13: 00007ffe47f6d00c R14: 431bde82d7b634db R15: 00007efde5767384 [ 121.896588][ T5844] [ 121.899762][ T5844] [ 121.902069][ T5844] The buggy address belongs to the virtual mapping at [ 121.902069][ T5844] [ffffc9000c400000, ffffc9000ca01000) created by: [ 121.902069][ T5844] kvrealloc_noprof+0xc7/0x120 [ 121.919844][ T5844] [ 121.922153][ T5844] The buggy address belongs to the physical page: [ 121.928553][ T5844] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6e000 [ 121.937318][ T5844] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 121.944424][ T5844] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 121.952989][ T5844] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 121.961572][ T5844] page dumped because: kasan: bad access detected [ 121.967973][ T5844] page_owner tracks the page as allocated [ 121.973661][ T5844] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102cc2(GFP_HIGHUSER|__GFP_NOWARN), pid 5844, tgid 5844 (syz-executor136), ts 121400802395, free_ts 16640342641 [ 121.991353][ T5844] post_alloc_hook+0x1f3/0x230 [ 121.996123][ T5844] get_page_from_freelist+0x3725/0x3870 [ 122.001648][ T5844] __alloc_pages_noprof+0x292/0x710 [ 122.006824][ T5844] alloc_pages_mpol_noprof+0x3e8/0x680 [ 122.012262][ T5844] __vmalloc_node_range_noprof+0x9c9/0x1380 [ 122.018132][ T5844] __kvmalloc_node_noprof+0x142/0x190 [ 122.023487][ T5844] kvrealloc_noprof+0xc7/0x120 [ 122.028229][ T5844] push_insn_history+0x16c/0x6a0 [ 122.033146][ T5844] check_mem_access+0xf30/0x2240 [ 122.038063][ T5844] do_check+0x7d97/0xfcd0 [ 122.042372][ T5844] do_check_common+0x1564/0x2010 [ 122.047292][ T5844] bpf_check+0x19380/0x1f1b0 [ 122.051872][ T5844] bpf_prog_load+0x1667/0x20f0 [ 122.056613][ T5844] __sys_bpf+0x4ee/0x810 [ 122.060842][ T5844] __x64_sys_bpf+0x7c/0x90 [ 122.065239][ T5844] do_syscall_64+0xf3/0x230 [ 122.069750][ T5844] page last free pid 1 tgid 1 stack trace: [ 122.075543][ T5844] free_unref_page+0xdf9/0x1140 [ 122.080394][ T5844] free_contig_range+0x152/0x550 [ 122.085314][ T5844] destroy_args+0x92/0x910 [ 122.089730][ T5844] debug_vm_pgtable+0x4be/0x550 [ 122.094578][ T5844] do_one_initcall+0x248/0x880 [ 122.099327][ T5844] do_initcall_level+0x157/0x210 [ 122.104263][ T5844] do_initcalls+0x3f/0x80 [ 122.108575][ T5844] kernel_init_freeable+0x435/0x5d0 [ 122.113757][ T5844] kernel_init+0x1d/0x2b0 [ 122.118066][ T5844] ret_from_fork+0x4b/0x80 [ 122.122461][ T5844] ret_from_fork_asm+0x1a/0x30 [ 122.127210][ T5844] [ 122.129689][ T5844] Memory state around the buggy address: [ 122.135313][ T5844] ffffc9000c7fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 122.143354][ T5844] ffffc9000c7fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [pid 5844] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_CGROUP_SKB, insn_cnt=28, insns=0x20000d80, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 5831] kill(-5844, SIGKILL) = 0 [pid 5831] kill(5844, SIGKILL) = 0 [ 122.151411][ T5844] >ffffc9000c800000: 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 122.159460][ T5844] ^ [ 122.164549][ T5844] ffffc9000c800080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 122.172586][ T5844] ffffc9000c800100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 122.180621][ T5844] ================================================================== [ 122.203026][ T5844] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 122.210239][ T5844] CPU: 0 UID: 0 PID: 5844 Comm: syz-executor136 Not tainted 6.12.0-next-20241120-syzkaller #0 [ 122.220458][ T5844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 122.230495][ T5844] Call Trace: [ 122.233756][ T5844] [ 122.236672][ T5844] dump_stack_lvl+0x241/0x360 [ 122.241340][ T5844] ? __pfx_dump_stack_lvl+0x10/0x10 [ 122.246523][ T5844] ? __pfx__printk+0x10/0x10 [ 122.251091][ T5844] ? preempt_schedule+0xe1/0xf0 [ 122.255926][ T5844] ? vscnprintf+0x5d/0x90 [ 122.260240][ T5844] panic+0x349/0x880 [ 122.264114][ T5844] ? check_panic_on_warn+0x21/0xb0 [ 122.269223][ T5844] ? __pfx_panic+0x10/0x10 [ 122.273618][ T5844] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 122.279580][ T5844] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 122.285898][ T5844] ? print_report+0x502/0x550 [ 122.290559][ T5844] check_panic_on_warn+0x86/0xb0 [ 122.295485][ T5844] ? vrealloc_noprof+0x340/0x3a0 [ 122.300400][ T5844] end_report+0x77/0x160 [ 122.304622][ T5844] kasan_report+0x154/0x180 [ 122.309107][ T5844] ? vrealloc_noprof+0x340/0x3a0 [ 122.314039][ T5844] kasan_check_range+0x282/0x290 [ 122.318971][ T5844] __asan_memset+0x23/0x50 [ 122.323363][ T5844] vrealloc_noprof+0x340/0x3a0 [ 122.328119][ T5844] push_insn_history+0x16c/0x6a0 [ 122.333040][ T5844] check_mem_access+0xf30/0x2240 [ 122.337964][ T5844] ? __reg_deduce_bounds+0xc57/0x10d0 [ 122.343406][ T5844] ? __pfx_check_mem_access+0x10/0x10 [ 122.348761][ T5844] ? is_reg64+0x306/0x3a0 [ 122.353071][ T5844] ? __check_reg_arg+0x180/0x4d0 [ 122.357987][ T5844] do_check+0x7d97/0xfcd0 [ 122.362314][ T5844] ? __pfx_do_check+0x10/0x10 [ 122.366975][ T5844] ? mark_reg_not_init+0xd4/0x4b0 [ 122.371979][ T5844] ? __asan_memcpy+0x40/0x70 [ 122.376549][ T5844] ? mark_reg_not_init+0xd4/0x4b0 [ 122.381555][ T5844] do_check_common+0x1564/0x2010 [ 122.386481][ T5844] bpf_check+0x19380/0x1f1b0 [ 122.391067][ T5844] ? bpf_prog_alloc+0x3a/0x1b0 [ 122.395817][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 122.400997][ T5844] ? page_ext_get+0x20/0x2a0 [ 122.405567][ T5844] ? page_ext_get+0x1d6/0x2a0 [ 122.410237][ T5844] ? post_alloc_hook+0x206/0x230 [ 122.415176][ T5844] ? get_page_from_freelist+0x3725/0x3870 [ 122.420874][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 122.426057][ T5844] ? validate_chain+0x11e/0x5920 [ 122.430983][ T5844] ? validate_chain+0x11e/0x5920 [ 122.435899][ T5844] ? mark_lock+0x9a/0x360 [ 122.440217][ T5844] ? validate_chain+0x11e/0x5920 [ 122.445151][ T5844] ? validate_chain+0x11e/0x5920 [ 122.450071][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 122.455252][ T5844] ? validate_chain+0x11e/0x5920 [ 122.460172][ T5844] ? validate_chain+0x11e/0x5920 [ 122.465090][ T5844] ? validate_chain+0x11e/0x5920 [ 122.470011][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 122.475189][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 122.480369][ T5844] ? __pfx_bpf_check+0x10/0x10 [ 122.485120][ T5844] ? __pfx_validate_chain+0x10/0x10 [ 122.490302][ T5844] ? mark_lock+0x9a/0x360 [ 122.494612][ T5844] ? mark_lock+0x9a/0x360 [ 122.498931][ T5844] ? __lock_acquire+0x1397/0x2100 [ 122.503951][ T5844] ? mark_lock+0x9a/0x360 [ 122.508264][ T5844] ? __lock_acquire+0x1397/0x2100 [ 122.513300][ T5844] ? __pfx_lock_acquire+0x10/0x10 [ 122.518321][ T5844] ? ktime_get_with_offset+0x8c/0x290 [ 122.523676][ T5844] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 122.529647][ T5844] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 122.535954][ T5844] ? ktime_get_with_offset+0x8c/0x290 [ 122.541309][ T5844] ? seqcount_lockdep_reader_access+0x157/0x220 [ 122.547533][ T5844] ? lockdep_hardirqs_on+0x99/0x150 [ 122.552714][ T5844] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 122.558950][ T5844] ? __pfx_seqcount_lockdep_reader_access+0x10/0x10 [ 122.565519][ T5844] ? _raw_spin_unlock+0x28/0x50 [ 122.570355][ T5844] ? __asan_memset+0x23/0x50 [ 122.574924][ T5844] ? bpf_obj_name_cpy+0x18a/0x1d0 [ 122.579934][ T5844] bpf_prog_load+0x1667/0x20f0 [ 122.584684][ T5844] ? __pfx_bpf_prog_load+0x10/0x10 [ 122.589774][ T5844] ? __pfx___might_resched+0x10/0x10 [ 122.595050][ T5844] ? __might_fault+0xc6/0x120 [ 122.599734][ T5844] __sys_bpf+0x4ee/0x810 [ 122.603985][ T5844] ? __pfx___sys_bpf+0x10/0x10 [ 122.608929][ T5844] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 122.615244][ T5844] ? do_syscall_64+0x100/0x230 [ 122.619993][ T5844] __x64_sys_bpf+0x7c/0x90 [ 122.624393][ T5844] do_syscall_64+0xf3/0x230 [ 122.628896][ T5844] ? clear_bhb_loop+0x35/0x90 [ 122.633558][ T5844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.639442][ T5844] RIP: 0033:0x7efde56f3b29 [ 122.643859][ T5844] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 122.663454][ T5844] RSP: 002b:00007ffe47f6cfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 122.671853][ T5844] RAX: ffffffffffffffda RBX: 00007ffe47f6d020 RCX: 00007efde56f3b29 [ 122.679808][ T5844] RDX: 0000000000000090 RSI: 0000000020000840 RDI: 0000000000000005 [ 122.687781][ T5844] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000017119 [ 122.695738][ T5844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000017119 [ 122.703696][ T5844] R13: 00007ffe47f6d00c R14: 431bde82d7b634db R15: 00007efde5767384 [ 122.711660][ T5844] [ 122.714938][ T5844] Kernel Offset: disabled [ 122.719250][ T5844] Rebooting in 86400 seconds..