./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1932849966 <...> Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts. execve("./syz-executor1932849966", ["./syz-executor1932849966"], 0x7fffbd7fc250 /* 10 vars */) = 0 brk(NULL) = 0x555556edb000 brk(0x555556edbc40) = 0x555556edbc40 arch_prctl(ARCH_SET_FS, 0x555556edb300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x555556edb5d0) = 3602 set_robust_list(0x555556edb5e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f6d99dea2d0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f6d99dea9a0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f6d99dea370, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d99dea9a0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1932849966", 4096) = 28 brk(0x555556efcc40) = 0x555556efcc40 brk(0x555556efd000) = 0x555556efd000 mprotect(0x7f6d99ead000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 3602 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "3602", 4) = 4 close(3) = 0 getpid() = 3602 mkdir("./syzkaller.Skj3px", 0700) = 0 chmod("./syzkaller.Skj3px", 0777) = 0 chdir("./syzkaller.Skj3px") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3603 attached , child_tidptr=0x555556edb5d0) = 3603 [pid 3603] set_robust_list(0x555556edb5e0, 24) = 0 [pid 3603] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3603] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 3603] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4 [pid 3603] dup2(4, 202) = 202 [pid 3603] close(4) = 0 [pid 3603] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 3603] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d99400000 [pid 3603] mprotect(0x7f6d99401000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 3603] clone(child_stack=0x7f6d99c003f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[2], tls=0x7f6d99c00700, child_tidptr=0x7f6d99c009d0) = 2 [pid 3603] ioctl(3, HCIDEVUP./strace-static-x86_64: Process 3607 attached [pid 3607] set_robust_list(0x7f6d99c009e0, 24) = 0 [pid 3607] read(202, "\x01\x03\x0c\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x03\x10\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x01\x10\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x09\x10\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13 [pid 3607] read(202, "\x01\x05\x10\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 3607] read(202, "\x01\x23\x0c\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x14\x0c\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x25\x0c\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x38\x0c\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x39\x0c\x00", 1024) = 4 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 3607] read(202, [pid 3603] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [ 39.994717][ T3605] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 40.002660][ T3605] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 40.010329][ T3605] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 40.018992][ T3605] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 40.027349][ T3605] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 40.035371][ T3605] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [pid 3603] ioctl(3, HCISETSCAN [pid 3607] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 3607] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 3607] madvise(0x7f6d99400000, 8372224, MADV_DONTNEED) = 0 [pid 3603] <... ioctl resumed>, 0x7fff0cbfce60) = 0 [pid 3607] exit(0) = ? [pid 3607] +++ exited with 0 +++ [pid 3603] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13 [pid 3603] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14 [pid 3603] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 3603] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 3603] close(3) = 0 [pid 3603] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3603] setsid() = 1 [pid 3603] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3603] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3603] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3603] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3603] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3603] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3603] unshare(CLONE_NEWNS) = 0 [pid 3603] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3603] unshare(CLONE_NEWIPC) = 0 [pid 3603] unshare(CLONE_NEWCGROUP) = 0 [pid 3603] unshare(CLONE_NEWUTS) = 0 [pid 3603] unshare(CLONE_SYSVSEM) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "16777216", 8) = 8 [pid 3603] close(3) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "536870912", 9) = 9 [pid 3603] close(3) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "1024", 4) = 4 [pid 3603] close(3) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "8192", 4) = 4 [pid 3603] close(3) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "1024", 4) = 4 [pid 3603] close(3) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "1024", 4) = 4 [pid 3603] close(3) = 0 [pid 3603] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3603] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3603] close(3) = 0 [pid 3603] getpid() = 1 [pid 3603] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3616] set_robust_list(0x7f6d99dd69e0, 24) = 0 [pid 3616] userfaultfd(UFFD_USER_MODE_ONLY|O_CLOEXEC) = 3 [pid 3616] futex(0x7f6d99eb34ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 3603] <... futex resumed>) = 0 [pid 3603] futex(0x7f6d99eb34a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3603] futex(0x7f6d99eb34ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3616] <... futex resumed>) = 1 [pid 3616] ioctl(3, UFFDIO_API, {api=0xaa, features=0 => features=UFFD_FEATURE_PAGEFAULT_FLAG_WP|UFFD_FEATURE_EVENT_FORK|UFFD_FEATURE_EVENT_REMAP|UFFD_FEATURE_EVENT_REMOVE|UFFD_FEATURE_MISSING_HUGETLBFS|UFFD_FEATURE_MISSING_SHMEM|UFFD_FEATURE_EVENT_UNMAP|UFFD_FEATURE_SIGBUS|UFFD_FEATURE_THREAD_ID|UFFD_FEATURE_MINOR_HUGETLBFS|UFFD_FEATURE_MINOR_SHMEM|0x800, ioctls=1<<_UFFDIO_REGISTER|1<<_UFFDIO_UNREGISTER|1<<_UFFDIO_API}) = 0 [pid 3616] futex(0x7f6d99eb34ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 3603] <... futex resumed>) = 0 [pid 3603] futex(0x7f6d99eb34a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3603] futex(0x7f6d99eb34ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3616] <... futex resumed>) = 1 [pid 3616] ioctl(3, UFFDIO_REGISTER, {range={start=0x20ffc000, len=0x4000}, mode=UFFDIO_REGISTER_MODE_MISSING|UFFDIO_REGISTER_MODE_WP, ioctls=1<<_UFFDIO_WAKE|1<<_UFFDIO_COPY|1<<_UFFDIO_ZEROPAGE|1<<_UFFDIO_WRITEPROTECT}) = 0 [pid 3616] futex(0x7f6d99eb34ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 3603] <... futex resumed>) = 0 [pid 3603] futex(0x7f6d99eb34a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3603] futex(0x7f6d99eb34ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3616] <... futex resumed>) = 1 [ 41.517149][ T3616] ================================================================== [ 41.525273][ T3616] BUG: KASAN: use-after-free in mas_next_nentry+0x9e4/0xab0 [ 41.532553][ T3616] Read of size 8 at addr ffff888073815420 by task syz-executor193/3616 [ 41.540817][ T3616] [ 41.543139][ T3616] CPU: 0 PID: 3616 Comm: syz-executor193 Not tainted 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0 [ 41.553722][ T3616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 41.563778][ T3616] Call Trace: [ 41.567039][ T3616] [ 41.569955][ T3616] dump_stack_lvl+0xcd/0x134 [ 41.574534][ T3616] print_report+0x15e/0x45d [ 41.579018][ T3616] ? __phys_addr+0xc4/0x140 [ 41.583504][ T3616] ? mas_next_nentry+0x9e4/0xab0 [ 41.588528][ T3616] kasan_report+0xbb/0x1f0 [ 41.592931][ T3616] ? mas_next_nentry+0x9e4/0xab0 [ 41.597858][ T3616] mas_next_nentry+0x9e4/0xab0 [ 41.602607][ T3616] mas_next+0x1fb/0xc90 [ 41.606743][ T3616] userfaultfd_ioctl+0x33c3/0x4200 [ 41.611852][ T3616] ? rcu_read_unlock_trace_special+0x381/0x3c0 [ 41.618006][ T3616] ? userfaultfd_release+0x680/0x680 [ 41.623305][ T3616] ? rcu_read_lock_sched_held+0xd/0x70 [ 41.628770][ T3616] ? lock_release+0x5cb/0x810 [ 41.633432][ T3616] ? name_to_dev_t+0x5f0/0x990 [ 41.638184][ T3616] ? bpf_lsm_file_ioctl+0x5/0x10 [ 41.643121][ T3616] ? userfaultfd_release+0x680/0x680 [ 41.648478][ T3616] __x64_sys_ioctl+0x193/0x200 [ 41.653225][ T3616] do_syscall_64+0x35/0xb0 [ 41.657627][ T3616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 41.663524][ T3616] RIP: 0033:0x7f6d99e30699 [ 41.667939][ T3616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 41.687660][ T3616] RSP: 002b:00007f6d99dd6318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.696057][ T3616] RAX: ffffffffffffffda RBX: 00007f6d99eb34a8 RCX: 00007f6d99e30699 [ 41.704109][ T3616] RDX: 0000000020000040 RSI: 000000008010aa01 RDI: 0000000000000003 [ 41.712072][ T3616] RBP: 00007f6d99eb34a0 R08: 0000000000000000 R09: 0000000000000000 [ 41.720034][ T3616] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6d99eb34ac [ 41.728094][ T3616] R13: 00007fff0cbfcd9f R14: 00007f6d99dd6400 R15: 0000000000022000 [ 41.736058][ T3616] [ 41.739082][ T3616] [ 41.741404][ T3616] Allocated by task 3602: [ 41.745709][ T3616] kasan_save_stack+0x1e/0x40 [ 41.750381][ T3616] kasan_set_track+0x21/0x30 [ 41.754956][ T3616] __kasan_slab_alloc+0x7e/0x80 [ 41.759797][ T3616] kmem_cache_alloc_bulk+0x3e9/0x830 [ 41.765069][ T3616] mas_alloc_nodes+0x309/0x810 [ 41.769828][ T3616] mas_node_count_gfp+0x106/0x140 [ 41.774836][ T3616] mas_expected_entries+0x113/0x200 [ 41.780112][ T3616] dup_mmap+0x4ca/0x10b0 [ 41.784344][ T3616] dup_mm+0x91/0x370 [ 41.788222][ T3616] copy_process+0x3bc6/0x7190 [ 41.792975][ T3616] kernel_clone+0xe7/0x980 [ 41.797404][ T3616] __do_sys_clone+0xba/0x100 [ 41.801999][ T3616] do_syscall_64+0x35/0xb0 [ 41.806612][ T3616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 41.812501][ T3616] [ 41.814806][ T3616] Freed by task 3616: [ 41.818766][ T3616] kasan_save_stack+0x1e/0x40 [ 41.823436][ T3616] kasan_set_track+0x21/0x30 [ 41.828012][ T3616] kasan_save_free_info+0x2a/0x40 [ 41.833013][ T3616] ____kasan_slab_free+0x160/0x1c0 [ 41.838112][ T3616] slab_free_freelist_hook+0x8b/0x1c0 [ 41.843467][ T3616] kmem_cache_free_bulk.part.0+0x205/0x780 [ 41.849259][ T3616] mas_destroy+0x394/0x5c0 [ 41.853673][ T3616] mas_store_prealloc+0xec/0x150 [ 41.858595][ T3616] __vma_adjust+0xc66/0x1ae0 [ 41.863177][ T3616] __split_vma+0x4b0/0x5c0 [ 41.867583][ T3616] split_vma+0x9f/0xe0 [ 41.871665][ T3616] userfaultfd_ioctl+0x3855/0x4200 [ 41.876764][ T3616] __x64_sys_ioctl+0x193/0x200 [ 41.881695][ T3616] do_syscall_64+0x35/0xb0 [ 41.886103][ T3616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 41.891989][ T3616] [ 41.894294][ T3616] The buggy address belongs to the object at ffff888073815400 [ 41.894294][ T3616] which belongs to the cache maple_node of size 256 [ 41.908249][ T3616] The buggy address is located 32 bytes inside of [ 41.908249][ T3616] 256-byte region [ffff888073815400, ffff888073815500) [ 41.921518][ T3616] [ 41.923820][ T3616] The buggy address belongs to the physical page: [ 41.930304][ T3616] page:ffffea0001ce0500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73814 [ 41.940812][ T3616] head:ffffea0001ce0500 order:1 compound_mapcount:0 compound_pincount:0 [ 41.949129][ T3616] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 41.957105][ T3616] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88801184fdc0 [ 41.965685][ T3616] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 41.974261][ T3616] page dumped because: kasan: bad access detected [ 41.980692][ T3616] page_owner tracks the page as allocated [ 41.986745][ T3616] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3602, tgid 3602 (syz-executor193), ts 38962742925, free_ts 38931681791 [ 42.008361][ T3616] get_page_from_freelist+0x10b5/0x2d50 [ 42.013909][ T3616] __alloc_pages+0x1c7/0x5a0 [ 42.018588][ T3616] alloc_pages+0x1a6/0x270 [ 42.023029][ T3616] allocate_slab+0x213/0x300 [ 42.027611][ T3616] ___slab_alloc+0xa91/0x1400 [ 42.032289][ T3616] kmem_cache_alloc_bulk+0x28b/0x830 [ 42.037565][ T3616] mas_alloc_nodes+0x309/0x810 [ 42.042423][ T3616] mas_preallocate+0x1b7/0x360 [ 42.047280][ T3616] mmap_region+0xd6b/0x1c00 [ 42.051774][ T3616] do_mmap+0x825/0xf50 [ 42.055832][ T3616] vm_mmap_pgoff+0x1ab/0x270 [ 42.060409][ T3616] ksys_mmap_pgoff+0x79/0x5a0 [ 42.065069][ T3616] do_syscall_64+0x35/0xb0 [ 42.067723][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 42.069469][ T3616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.081350][ T3616] page last free stack trace: [ 42.086032][ T3616] free_pcp_prepare+0x65c/0xd90 [ 42.090906][ T3616] free_unref_page+0x19/0x4d0 [ 42.095562][ T3616] qlist_free_all+0x6a/0x170 [ 42.100131][ T3616] kasan_quarantine_reduce+0x180/0x200 [ 42.105567][ T3616] __kasan_slab_alloc+0x62/0x80 [ 42.110400][ T3616] __kmem_cache_alloc_node+0x2da/0x3e0 [ 42.115841][ T3616] kmalloc_trace+0x22/0x60 [ 42.120240][ T3616] tomoyo_init_log+0x18a/0x1ed0 [ 42.125072][ T3616] tomoyo_supervisor+0x350/0xf10 [ 42.129993][ T3616] tomoyo_execute_permission+0x37f/0x4a0 [ 42.135608][ T3616] tomoyo_find_next_domain+0x348/0x1f80 [ 42.141158][ T3616] tomoyo_bprm_check_security+0x121/0x1a0 [ 42.146857][ T3616] security_bprm_check+0x45/0xa0 [ 42.151778][ T3616] bprm_execve+0x732/0x19f0 [ 42.156260][ T3616] do_execveat_common+0x724/0x890 [ 42.161268][ T3616] __x64_sys_execve+0x8f/0xc0 [ 42.165930][ T3616] [ 42.168235][ T3616] Memory state around the buggy address: [ 42.173853][ T3616] ffff888073815300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.181908][ T3616] ffff888073815380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.189957][ T3616] >ffff888073815400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.197996][ T3616] ^ [ 42.203080][ T3616] ffff888073815480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.211125][ T3616] ffff888073815500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [pid 3616] ioctl(3, UFFDIO_UNREGISTER, {start=0x20fff000, len=0x1000} [pid 3603] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 42.219160][ T3616] ================================================================== [ 42.231523][ T3616] Kernel panic - not syncing: panic_on_warn set ... [ 42.238742][ T3616] CPU: 1 PID: 3616 Comm: syz-executor193 Not tainted 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0 [ 42.249147][ T3616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 42.259199][ T3616] Call Trace: [ 42.262469][ T3616] [ 42.265398][ T3616] dump_stack_lvl+0xcd/0x134 [ 42.269990][ T3616] panic+0x2c8/0x622 [ 42.273890][ T3616] ? panic_print_sys_info.part.0+0x110/0x110 [ 42.279876][ T3616] ? preempt_schedule_common+0x59/0xc0 [ 42.285352][ T3616] ? preempt_schedule_thunk+0x16/0x18 [ 42.290756][ T3616] end_report.part.0+0x3f/0x7c [ 42.295514][ T3616] ? mas_next_nentry+0x9e4/0xab0 [ 42.300444][ T3616] kasan_report.cold+0xa/0xf [ 42.305029][ T3616] ? mas_next_nentry+0x9e4/0xab0 [ 42.310058][ T3616] mas_next_nentry+0x9e4/0xab0 [ 42.314823][ T3616] mas_next+0x1fb/0xc90 [pid 3603] exit_group(1) = ? [ 42.318998][ T3616] userfaultfd_ioctl+0x33c3/0x4200 [ 42.324129][ T3616] ? rcu_read_unlock_trace_special+0x381/0x3c0 [ 42.330294][ T3616] ? userfaultfd_release+0x680/0x680 [ 42.335595][ T3616] ? rcu_read_lock_sched_held+0xd/0x70 [ 42.341088][ T3616] ? lock_release+0x5cb/0x810 [ 42.345757][ T3616] ? name_to_dev_t+0x5f0/0x990 [ 42.350521][ T3616] ? bpf_lsm_file_ioctl+0x5/0x10 [ 42.355463][ T3616] ? userfaultfd_release+0x680/0x680 [ 42.360756][ T3616] __x64_sys_ioctl+0x193/0x200 [ 42.365513][ T3616] do_syscall_64+0x35/0xb0 [ 42.369925][ T3616] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.375827][ T3616] RIP: 0033:0x7f6d99e30699 [ 42.380229][ T3616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 42.399832][ T3616] RSP: 002b:00007f6d99dd6318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.408229][ T3616] RAX: ffffffffffffffda RBX: 00007f6d99eb34a8 RCX: 00007f6d99e30699 [ 42.416181][ T3616] RDX: 0000000020000040 RSI: 000000008010aa01 RDI: 0000000000000003 [ 42.424138][ T3616] RBP: 00007f6d99eb34a0 R08: 0000000000000000 R09: 0000000000000000 [ 42.432094][ T3616] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6d99eb34ac [ 42.440057][ T3616] R13: 00007fff0cbfcd9f R14: 00007f6d99dd6400 R15: 0000000000022000 [ 42.448035][ T3616] [ 42.451781][ T3616] Kernel Offset: disabled [ 42.456099][ T3616] Rebooting in 86400 seconds..