./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor138515865 <...> Warning: Permanently added '10.128.10.6' (ED25519) to the list of known hosts. execve("./syz-executor138515865", ["./syz-executor138515865"], 0x7ffc8a229580 /* 10 vars */) = 0 brk(NULL) = 0x555555a38000 brk(0x555555a38d00) = 0x555555a38d00 arch_prctl(ARCH_SET_FS, 0x555555a38380) = 0 set_tid_address(0x555555a38650) = 358 set_robust_list(0x555555a38660, 24) = 0 rseq(0x555555a38ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor138515865", 4096) = 27 getrandom("\xa2\xeb\xc1\xd4\x0b\x1a\x18\x59", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555a38d00 brk(0x555555a59d00) = 0x555555a59d00 brk(0x555555a5a000) = 0x555555a5a000 mprotect(0x7f6f46bfc000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555a38650) = 360 ./strace-static-x86_64: Process 360 attached [pid 360] set_robust_list(0x555555a38660, 24) = 0 [pid 360] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [ 25.320565][ T23] audit: type=1400 audit(1701441631.570:66): avc: denied { execmem } for pid=358 comm="syz-executor138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.345753][ T23] audit: type=1400 audit(1701441631.600:67): avc: denied { mounton } for pid=360 comm="syz-executor138" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [pid 360] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 360] setsid() = 1 [pid 360] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 360] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 360] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 360] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 360] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 360] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 360] unshare(CLONE_NEWNS) = 0 [pid 360] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 360] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 360] unshare(CLONE_NEWCGROUP) = 0 [pid 360] unshare(CLONE_NEWUTS) = 0 [pid 360] unshare(CLONE_SYSVSEM) = 0 [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 360] getpid() = 1 [pid 360] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 2]) = 0 [pid 368] bind(6, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("gretap0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[0x5f, 0xfa, 0x45, 0xaa, 0xe9, 0xe3]}, 20) = 0 [pid 368] sendto(6, "\x41\x04\x09\xfc\xc1\xf7\x48\x02\x01\x0e\x02\x00\xc5\x2c\xf7\xc2\x06\x75\xe0\x05\xb0\x2f\x08\x00\xeb\x2b\x2f\xf0\xda\xc8\x89\x7c\x6b\x11\x20\x02\xfa\xff\xff\xff\x30\x66\x09\x0c\xb6\x00\xc5\x47\x1d\x13\x0a\x66\x32\x1a\x54\xe7\xdf\x30\x5f\x80\xa8\x81\x61\xb6\xfd\x8f\x24\x28\x6a\x57\xc3\xfe\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 64531, MSG_CONFIRM, NULL, 47) = 64531 [pid 368] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 9 [pid 368] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 10 [pid 368] ioctl(10, SIOCGIFINDEX, {ifr_name="batadv_slave_1", ifr_ifindex=34}) = 0 [pid 368] sendmsg(9, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x70\x00\x00\x00\x14\x00\x09\x05\x00\x00\x00\x00\x00\x00\x00\x00\x02\x01\x00\xfd\x22\x00\x00\x00\x14\x00\x06\x00\x06\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x02\x00\xac\x1e\x00\x01\x08\x00\x01\x00\xac\x14\x14\xaa\x08\x00\x04\x00\x7f\x00\x00\x01\x08\x00\x04\x00\xe0\x00\x00\x02\x14\x00\x03\x00\x76\x65\x74\x68\x31\x5f\x74\x6f\x5f\x62\x6f\x6e\x64\x00\x00\x00\x08\x00\x08\x00"..., iov_len=112}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 112 [pid 368] close(3) = 0 [pid 368] close(4) = 0 [pid 368] close(5) = 0 [pid 368] close(6) = 0 [pid 368] close(7) = 0 [pid 368] close(8) = 0 [pid 368] close(9) = 0 [pid 368] close(10) = 0 [pid 368] close(11) = -1 EBADF (Bad file descriptor) [pid 368] close(12) = -1 EBADF (Bad file descriptor) [pid 368] close(13) = -1 EBADF (Bad file descriptor) [pid 368] close(14) = -1 EBADF (Bad file descriptor) [pid 368] close(15) = -1 EBADF (Bad file descriptor) [pid 368] close(16) = -1 EBADF (Bad file descriptor) [pid 368] close(17) = -1 EBADF (Bad file descriptor) [pid 368] close(18) = -1 EBADF (Bad file descriptor) [pid 368] close(19) = -1 EBADF (Bad file descriptor) [pid 368] close(20) = -1 EBADF (Bad file descriptor) [pid 368] close(21) = -1 EBADF (Bad file descriptor) [pid 368] close(22) = -1 EBADF (Bad file descriptor) [pid 368] close(23) = -1 EBADF (Bad file descriptor) [pid 368] close(24) = -1 EBADF (Bad file descriptor) [pid 368] close(25) = -1 EBADF (Bad file descriptor) [pid 368] close(26) = -1 EBADF (Bad file descriptor) [pid 368] close(27) = -1 EBADF (Bad file descriptor) [pid 368] close(28) = -1 EBADF (Bad file descriptor) [pid 368] close(29) = -1 EBADF (Bad file descriptor) [pid 368] exit_group(0) = ? [pid 368] +++ exited with 0 +++ [pid 360] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 360] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 360] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 369 attached , child_tidptr=0x555555a38650) = 3 [pid 369] set_robust_list(0x555555a38660, 24) = 0 [pid 369] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 369] setpgid(0, 0) = 0 [pid 369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 369] write(3, "1000", 4) = 4 [pid 369] close(3) = 0 [pid 369] mkdir("./bus", 000) = -1 EEXIST (File exists) [pid 369] openat(AT_FDCWD, "./bus", O_RDONLY) = 3 [pid 369] openat(AT_FDCWD, "/dev/char/4:1", O_RDWR) = 4 [pid 369] dup(4) = 5 [pid 369] socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) = 6 [pid 369] setsockopt(6, SOL_PACKET, PACKET_VNET_HDR, "\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 197675465) = 0 [pid 369] socketpair(AF_UNIX, SOCK_STREAM, 0, [7, 8]) = 0 [pid 369] getsockname(7, {sa_family=AF_UNIX}, [20 => 2]) = 0 [pid 369] bind(6, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("gretap0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[0x5f, 0xfa, 0x45, 0xaa, 0xe9, 0xe3]}, 20) = 0 [ 26.316995][ T369] ------------[ cut here ]------------ [ 26.322268][ T369] kernel BUG at net/core/dev.c:2873! [ 26.327439][ T369] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 26.333294][ T369] CPU: 0 PID: 369 Comm: syz-executor138 Not tainted 5.4.259-syzkaller-00032-g891e39829ab7 #0 [ 26.343357][ T369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 26.353263][ T369] RIP: 0010:skb_checksum_help+0x873/0x880 [ 26.358807][ T369] Code: ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c d0 fc ff ff 48 89 df e8 1e 22 16 fe e9 c3 fc ff ff e8 54 51 e6 fd 0f 0b e8 4d 51 e6 fd <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 41 57 41 56 41 55 41 54 53 [ 26.378252][ T369] RSP: 0018:ffff8881e2d7f0a8 EFLAGS: 00010293 [ 26.384153][ T369] RAX: ffffffff837df353 RBX: 000000000000045c RCX: ffff8881dc074ec0 [ 26.392055][ T369] RDX: 0000000000000000 RSI: 000000000000045c RDI: 000000000000105f [ 26.399865][ T369] RBP: 000000000000105f R08: ffffffff837dedcf R09: ffffed103c5afe06 [ 26.407676][ T369] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f57f57f0 [ 26.415484][ T369] R13: 000000000000105d R14: ffff8881f57f5780 R15: 1ffff1103eafeafe [ 26.423294][ T369] FS: 0000555555a38380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.432061][ T369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.438491][ T369] CR2: 000000002000f000 CR3: 00000001f0a63000 CR4: 00000000003406b0 [ 26.446302][ T369] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.454108][ T369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.461916][ T369] Call Trace: [ 26.465062][ T369] ? __die+0xb4/0x100 [ 26.468865][ T369] ? die+0x26/0x50 [ 26.472426][ T369] ? do_trap+0x1e7/0x340 [ 26.476509][ T369] ? skb_checksum_help+0x873/0x880 [ 26.481452][ T369] ? skb_checksum_help+0x873/0x880 [ 26.486404][ T369] ? do_invalid_op+0xfb/0x110 [ 26.490911][ T369] ? skb_checksum_help+0x873/0x880 [ 26.495869][ T369] ? invalid_op+0x1e/0x30 [ 26.500024][ T369] ? skb_checksum_help+0x2ef/0x880 [ 26.504970][ T369] ? skb_checksum_help+0x873/0x880 [ 26.509923][ T369] ? skb_checksum_help+0x873/0x880 [ 26.514874][ T369] ? skb_checksum_help+0x873/0x880 [ 26.519816][ T369] ip_do_fragment+0x15e/0x2200 [ 26.524426][ T369] ? ip_fragment+0x210/0x210 [ 26.528843][ T369] ? ip_frag_next+0xad0/0xad0 [ 26.533357][ T369] ? kmem_cache_free+0x10b/0x2c0 [ 26.538127][ T369] ? __ip_finish_output+0x457/0x710 [ 26.543161][ T369] ? ip_fragment+0x9a/0x210 [ 26.547507][ T369] __ip_finish_output+0x49c/0x710 [ 26.552361][ T369] ip_output+0x19b/0x3a0 [ 26.556446][ T369] ? ip_finish_output+0x1d0/0x1d0 [ 26.561303][ T369] ? ip_mc_finish_output+0x340/0x340 [ 26.566426][ T369] iptunnel_xmit+0x476/0x850 [ 26.570865][ T369] sit_tunnel_xmit+0x1972/0x2460 [ 26.575624][ T369] ? ipip6_tunnel_uninit+0x3d0/0x3d0 [ 26.580744][ T369] ? debug_smp_processor_id+0x20/0x20 [ 26.585961][ T369] ? validate_xmit_skb+0x4b5/0xc50 [ 26.590901][ T369] dev_hard_start_xmit+0x1b7/0x6b0 [ 26.595851][ T369] __dev_queue_xmit+0x14da/0x27e0 [ 26.600711][ T369] ? dev_queue_xmit+0x20/0x20 [ 26.605217][ T369] ? virtio_net_hdr_to_skb+0xa10/0x1130 [ 26.610599][ T369] ? fanout_demux_rollover+0xc10/0xc10 [ 26.615903][ T369] ? skb_put+0x110/0x1f0 [ 26.619974][ T369] packet_sendmsg+0x4747/0x6100 [ 26.624668][ T369] ? avc_denied+0x1d0/0x1d0 [ 26.629001][ T369] ? check_preemption_disabled+0x9f/0x320 [ 26.634557][ T369] ? avc_has_perm+0x16f/0x260 [ 26.639071][ T369] ? selinux_socket_sendmsg+0x243/0x340 [ 26.644451][ T369] ? selinux_socket_accept+0x5b0/0x5b0 [ 26.649743][ T369] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 26.654692][ T369] ? cgroup_update_frozen+0x157/0xab0 [ 26.659899][ T369] ? cgroup_update_frozen+0x157/0xab0 [ 26.665108][ T369] ? compat_packet_setsockopt+0x160/0x160 [ 26.670663][ T369] ? ptrace_stop+0x6ee/0xa30 [ 26.675093][ T369] ? security_socket_sendmsg+0x7d/0xa0 [ 26.680379][ T369] ? compat_packet_setsockopt+0x160/0x160 [ 26.685940][ T369] __sys_sendto+0x4f3/0x6c0 [ 26.690278][ T369] ? __ia32_sys_getpeername+0x80/0x80 [ 26.695489][ T369] ? syscall_trace_enter+0x650/0x940 [ 26.700605][ T369] ? do_syscall_64+0x1c0/0x1c0 [ 26.705206][ T369] ? switch_fpu_return+0x1d4/0x410 [ 26.710156][ T369] ? fpu__clear+0x3c0/0x3c0 [ 26.714494][ T369] __x64_sys_sendto+0xda/0xf0 [ 26.719005][ T369] do_syscall_64+0xca/0x1c0 [ 26.723347][ T369] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 26.729071][ T369] Modules linked in: [ 26.732854][ T369] ---[ end trace 1d30077b27ba929e ]--- [ 26.738134][ T369] RIP: 0010:skb_checksum_help+0x873/0x880 [ 26.743661][ T369] Code: ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c d0 fc ff ff 48 89 df e8 1e 22 16 fe e9 c3 fc ff ff e8 54 51 e6 fd 0f 0b e8 4d 51 e6 fd <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 41 57 41 56 41 55 41 54 53 [ 26.763127][ T369] RSP: 0018:ffff8881e2d7f0a8 EFLAGS: 00010293 [ 26.769020][ T369] RAX: ffffffff837df353 RBX: 000000000000045c RCX: ffff8881dc074ec0 [ 26.776831][ T369] RDX: 0000000000000000 RSI: 000000000000045c RDI: 000000000000105f [ 26.784642][ T369] RBP: 000000000000105f R08: ffffffff837dedcf R09: ffffed103c5afe06 [ 26.793290][ T369] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f57f57f0 [ 26.801134][ T369] R13: 000000000000105d R14: ffff8881f57f5780 R15: 1ffff1103eafeafe [ 26.809127][ T369] FS: 0000555555a38380(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.817882][ T369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.824283][ T369] CR2: 000000002000f000 CR3: 00000001f0a63000 CR4: 00000000003406b0 [ 26.832070][ T369] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.839922][ T369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.847715][ T369] Kernel panic - not syncing: Fatal exception in interrupt [ 26.855042][ T369] Kernel Offset: disabled [ 26.859167][ T369] Rebooting in 86400 seconds..