./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2923258096 <...> Warning: Permanently added '10.128.0.164' (ED25519) to the list of known hosts. execve("./syz-executor2923258096", ["./syz-executor2923258096"], 0x7fff6ee8cc40 /* 10 vars */) = 0 brk(NULL) = 0x555574118000 brk(0x555574118d00) = 0x555574118d00 arch_prctl(ARCH_SET_FS, 0x555574118380) = 0 set_tid_address(0x555574118650) = 5227 set_robust_list(0x555574118660, 24) = 0 rseq(0x555574118ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2923258096", 4096) = 28 getrandom("\xd8\xf5\xde\x71\x9f\xf9\x62\x81", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555574118d00 brk(0x555574139d00) = 0x555574139d00 brk(0x55557413a000) = 0x55557413a000 mprotect(0x7fece9eb5000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5228 attached , child_tidptr=0x555574118650) = 5228 [pid 5228] set_robust_list(0x555574118660, 24) = 0 [pid 5228] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5228] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5228] setsid() = 1 [pid 5228] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5228] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5228] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5228] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5228] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5228] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5228] unshare(CLONE_NEWNS) = 0 [pid 5228] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5228] unshare(CLONE_NEWIPC) = 0 [pid 5228] unshare(CLONE_NEWCGROUP) = 0 [pid 5228] unshare(CLONE_NEWUTS) = 0 [pid 5228] unshare(CLONE_SYSVSEM) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "16777216", 8) = 8 [pid 5228] close(3) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "536870912", 9) = 9 [pid 5228] close(3) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "1024", 4) = 4 [pid 5228] close(3) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "8192", 4) = 4 [pid 5228] close(3) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "1024", 4) = 4 [pid 5228] close(3) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "1024", 4) = 4 [pid 5228] close(3) = 0 [pid 5228] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5228] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5228] close(3) = 0 [pid 5228] getpid() = 1 [pid 5228] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5237] set_robust_list(0x555574118660, 24 [pid 5228] <... clone resumed>, child_tidptr=0x555574118650) = 2 [pid 5237] <... set_robust_list resumed>) = 0 [pid 5237] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5237] setpgid(0, 0) = 0 [pid 5237] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5237] write(3, "1000", 4) = 4 [pid 5237] close(3) = 0 [pid 5237] write(1, "executing program\n", 18executing program ) = 18 [pid 5237] socket(AF_CAN, SOCK_DGRAM, CAN_J1939) = 3 [pid 5237] ioctl(3, SIOCGIFINDEX, {ifr_name="vcan0", ifr_ifindex=13}) = 0 [pid 5237] socket(AF_CAN, SOCK_DGRAM, CAN_J1939) = 4 [pid 5237] bind(4, {sa_family=AF_CAN, sa_data="\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, 24) = 0 [pid 5237] sendmsg(4, {msg_name={sa_family=AF_CAN, sa_data="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, msg_namelen=24, msg_iov=[{iov_base="\x92\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=106496}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, MSG_PEEK|MSG_DONTROUTE|MSG_CTRUNC|MSG_TRUNC|MSG_DONTWAIT|MSG_EOR) = 87465 [pid 5237] close(3) = 0 [ 68.909589][ C1] ------------[ cut here ]------------ [ 68.916001][ C1] refcount_t: underflow; use-after-free. [ 68.922134][ C1] WARNING: CPU: 1 PID: 24 at lib/refcount.c:28 refcount_warn_saturate+0x15a/0x1d0 [ 68.931497][ C1] Modules linked in: [ 68.935445][ C1] CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.10.0-syzkaller-12610-g743ff02152bc #0 [ 68.945790][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 68.955918][ C1] RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 [ 68.962186][ C1] Code: 00 17 40 8c e8 67 97 a5 fc 90 0f 0b 90 90 eb 99 e8 1b 89 e3 fc c6 05 76 7d 31 0b 01 90 48 c7 c7 60 17 40 8c e8 47 97 a5 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 f8 88 e3 fc c6 05 50 7d 31 0b 01 90 [ 68.981963][ C1] RSP: 0018:ffffc900001e7480 EFLAGS: 00010246 [ 68.988055][ C1] RAX: 43494ae667f4e400 RBX: ffff8880221385e4 RCX: ffff888018280000 [ 68.996084][ C1] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.004116][ C1] RBP: 0000000000000003 R08: ffffffff81559432 R09: fffffbfff1cb9f88 [ 69.012130][ C1] R10: dffffc0000000000 R11: fffffbfff1cb9f88 R12: ffff88802bbf3800 [ 69.020144][ C1] R13: ffff8880221385e4 R14: ffff88802bbf3800 R15: ffff88807b111e18 [ 69.028188][ C1] FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 [ 69.037220][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.043847][ C1] CR2: 00000000200009c0 CR3: 000000002b6ae000 CR4: 00000000003506f0 [ 69.051864][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 69.059831][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 69.067851][ C1] Call Trace: [ 69.071198][ C1] [ 69.074135][ C1] ? __warn+0x163/0x4e0 [ 69.078401][ C1] ? refcount_warn_saturate+0x15a/0x1d0 [ 69.084017][ C1] ? report_bug+0x2b3/0x500 [ 69.088603][ C1] ? refcount_warn_saturate+0x15a/0x1d0 [ 69.094490][ C1] ? handle_bug+0x3e/0x70 [ 69.098841][ C1] ? exc_invalid_op+0x1a/0x50 [ 69.103585][ C1] ? asm_exc_invalid_op+0x1a/0x20 [ 69.108640][ C1] ? __warn_printk+0x292/0x360 [ 69.113492][ C1] ? refcount_warn_saturate+0x15a/0x1d0 [ 69.119060][ C1] j1939_xtp_rx_cts+0x54f/0xc70 [ 69.124053][ C1] j1939_tp_recv+0x8ae/0x1050 [ 69.128724][ C1] j1939_can_recv+0x732/0xb20 [ 69.133447][ C1] ? __pfx_j1939_can_recv+0x10/0x10 [ 69.138673][ C1] ? __lock_acquire+0x137a/0x2040 [ 69.143777][ C1] ? __pfx_j1939_can_recv+0x10/0x10 [ 69.148993][ C1] can_rcv_filter+0x359/0x7f0 [ 69.153723][ C1] ? can_receive+0x1cd/0x470 [ 69.158344][ C1] can_receive+0x31c/0x470 [ 69.162807][ C1] can_rcv+0x144/0x260 [ 69.166894][ C1] ? __pfx_can_rcv+0x10/0x10 [ 69.171522][ C1] __netif_receive_skb+0x2e0/0x650 [ 69.176647][ C1] ? __pfx_lock_acquire+0x10/0x10 [ 69.181730][ C1] ? __pfx___netif_receive_skb+0x10/0x10 [ 69.187381][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 69.193410][ C1] ? __pfx_lock_release+0x10/0x10 [ 69.198476][ C1] ? _raw_spin_lock_irq+0xdf/0x120 [ 69.203662][ C1] process_backlog+0x662/0x15b0 [ 69.208532][ C1] ? process_backlog+0x33b/0x15b0 [ 69.213675][ C1] ? __pfx_process_backlog+0x10/0x10 [ 69.218976][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 69.225010][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 69.231427][ C1] __napi_poll+0xcb/0x490 [ 69.235781][ C1] net_rx_action+0x89b/0x1240 [ 69.240537][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 69.245686][ C1] ? rcu_qs+0xf1/0x190 [ 69.249770][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 69.256155][ C1] handle_softirqs+0x2c4/0x970 [ 69.260994][ C1] ? run_ksoftirqd+0xca/0x130 [ 69.265705][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 69.271064][ C1] run_ksoftirqd+0xca/0x130 [ 69.275592][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 69.280761][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 69.285890][ C1] smpboot_thread_fn+0x544/0xa30 [ 69.290880][ C1] ? smpboot_thread_fn+0x4e/0xa30 [ 69.295927][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 69.301442][ C1] kthread+0x2f0/0x390 [ 69.305526][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 69.311028][ C1] ? __pfx_kthread+0x10/0x10 [ 69.315635][ C1] ret_from_fork+0x4b/0x80 [ 69.320064][ C1] ? __pfx_kthread+0x10/0x10 [ 69.324700][ C1] ret_from_fork_asm+0x1a/0x30 [ 69.329497][ C1] [ 69.332560][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 69.339846][ C1] CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.10.0-syzkaller-12610-g743ff02152bc #0 [ 69.350076][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 69.360310][ C1] Call Trace: [ 69.363593][ C1] [ 69.366514][ C1] dump_stack_lvl+0x241/0x360 [ 69.371184][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.376374][ C1] ? __pfx__printk+0x10/0x10 [ 69.381048][ C1] ? vscnprintf+0x5d/0x90 [ 69.385374][ C1] panic+0x349/0x860 [ 69.389315][ C1] ? __warn+0x172/0x4e0 [ 69.393466][ C1] ? __pfx_panic+0x10/0x10 [ 69.397891][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 69.402832][ C1] __warn+0x346/0x4e0 [ 69.406809][ C1] ? refcount_warn_saturate+0x15a/0x1d0 [ 69.412356][ C1] report_bug+0x2b3/0x500 [ 69.416679][ C1] ? refcount_warn_saturate+0x15a/0x1d0 [ 69.422224][ C1] handle_bug+0x3e/0x70 [ 69.426377][ C1] exc_invalid_op+0x1a/0x50 [ 69.430874][ C1] asm_exc_invalid_op+0x1a/0x20 [ 69.435725][ C1] RIP: 0010:refcount_warn_saturate+0x15a/0x1d0 [ 69.441872][ C1] Code: 00 17 40 8c e8 67 97 a5 fc 90 0f 0b 90 90 eb 99 e8 1b 89 e3 fc c6 05 76 7d 31 0b 01 90 48 c7 c7 60 17 40 8c e8 47 97 a5 fc 90 <0f> 0b 90 90 e9 76 ff ff ff e8 f8 88 e3 fc c6 05 50 7d 31 0b 01 90 [ 69.461473][ C1] RSP: 0018:ffffc900001e7480 EFLAGS: 00010246 [ 69.467710][ C1] RAX: 43494ae667f4e400 RBX: ffff8880221385e4 RCX: ffff888018280000 [ 69.475678][ C1] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.483644][ C1] RBP: 0000000000000003 R08: ffffffff81559432 R09: fffffbfff1cb9f88 [ 69.491613][ C1] R10: dffffc0000000000 R11: fffffbfff1cb9f88 R12: ffff88802bbf3800 [ 69.499668][ C1] R13: ffff8880221385e4 R14: ffff88802bbf3800 R15: ffff88807b111e18 [ 69.507640][ C1] ? __warn_printk+0x292/0x360 [ 69.512409][ C1] j1939_xtp_rx_cts+0x54f/0xc70 [ 69.517269][ C1] j1939_tp_recv+0x8ae/0x1050 [ 69.521946][ C1] j1939_can_recv+0x732/0xb20 [ 69.526619][ C1] ? __pfx_j1939_can_recv+0x10/0x10 [ 69.531815][ C1] ? __lock_acquire+0x137a/0x2040 [ 69.536835][ C1] ? __pfx_j1939_can_recv+0x10/0x10 [ 69.542198][ C1] can_rcv_filter+0x359/0x7f0 [ 69.546957][ C1] ? can_receive+0x1cd/0x470 [ 69.551539][ C1] can_receive+0x31c/0x470 [ 69.555953][ C1] can_rcv+0x144/0x260 [ 69.560014][ C1] ? __pfx_can_rcv+0x10/0x10 [ 69.564595][ C1] __netif_receive_skb+0x2e0/0x650 [ 69.569698][ C1] ? __pfx_lock_acquire+0x10/0x10 [ 69.574721][ C1] ? __pfx___netif_receive_skb+0x10/0x10 [ 69.580349][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 69.586330][ C1] ? __pfx_lock_release+0x10/0x10 [ 69.591356][ C1] ? _raw_spin_lock_irq+0xdf/0x120 [ 69.596476][ C1] process_backlog+0x662/0x15b0 [ 69.601329][ C1] ? process_backlog+0x33b/0x15b0 [ 69.606354][ C1] ? __pfx_process_backlog+0x10/0x10 [ 69.611633][ C1] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 69.618160][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 69.624488][ C1] __napi_poll+0xcb/0x490 [ 69.628812][ C1] net_rx_action+0x89b/0x1240 [ 69.633498][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 69.638604][ C1] ? rcu_qs+0xf1/0x190 [ 69.642681][ C1] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 69.649012][ C1] handle_softirqs+0x2c4/0x970 [ 69.653778][ C1] ? run_ksoftirqd+0xca/0x130 [ 69.658454][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 69.663741][ C1] run_ksoftirqd+0xca/0x130 [ 69.668245][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 69.673361][ C1] ? __pfx_run_ksoftirqd+0x10/0x10 [ 69.678469][ C1] smpboot_thread_fn+0x544/0xa30 [ 69.683404][ C1] ? smpboot_thread_fn+0x4e/0xa30 [ 69.688427][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 69.693892][ C1] kthread+0x2f0/0x390 [ 69.697956][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 69.703406][ C1] ? __pfx_kthread+0x10/0x10 [ 69.707988][ C1] ret_from_fork+0x4b/0x80 [ 69.712398][ C1] ? __pfx_kthread+0x10/0x10 [ 69.716977][ C1] ret_from_fork_asm+0x1a/0x30 [ 69.721749][ C1] [ 69.724972][ C1] Kernel Offset: disabled [ 69.729306][ C1] Rebooting in 86400 seconds..