./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1459484034 <...> DUID 00:04:87:04:3c:41:30:05:a7:f7:d5:81:12:9d:2d:df:74:1f forked to background, child pid 3208 [ 34.066448][ T3209] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.092123][ T3209] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.93' (ECDSA) to the list of known hosts. execve("./syz-executor1459484034", ["./syz-executor1459484034"], 0x7ffccab1ba10 /* 10 vars */) = 0 brk(NULL) = 0x5555570e3000 brk(0x5555570e3c40) = 0x5555570e3c40 arch_prctl(ARCH_SET_FS, 0x5555570e3300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1459484034", 4096) = 28 brk(0x555557104c40) = 0x555557104c40 brk(0x555557105000) = 0x555557105000 mprotect(0x7f8660883000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3635 attached , child_tidptr=0x5555570e35d0) = 3635 [pid 3635] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3635] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3635] setsid() = 1 [pid 3635] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3635] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3635] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3635] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3635] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3635] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3635] unshare(CLONE_NEWNS) = 0 [pid 3635] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3635] unshare(CLONE_NEWIPC) = 0 [pid 3635] unshare(CLONE_NEWCGROUP) = 0 [pid 3635] unshare(CLONE_NEWUTS) = 0 [pid 3635] unshare(CLONE_SYSVSEM) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "16777216", 8) = 8 [pid 3635] close(3) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "536870912", 9) = 9 [pid 3635] close(3) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "1024", 4) = 4 [pid 3635] close(3) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "8192", 4) = 4 [pid 3635] close(3) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "1024", 4) = 4 [pid 3635] close(3) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "1024", 4) = 4 [pid 3635] close(3) = 0 [pid 3635] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3635] close(3) = 0 [pid 3635] getpid() = 1 [pid 3635] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< b6 14 02 4c 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 47 [ 59.861695][ T3643] RSP: 0018:ffffc90003beee38 EFLAGS: 00010202 [ 59.867771][ T3643] RAX: dffffc0000000000 RBX: ffff88801f385b40 RCX: 0000000000000000 [ 59.876035][ T3643] RDX: 0000000000000001 RSI: ffffffff87f06ccd RDI: ffff88801f385b48 [ 59.884120][ T3643] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001 [ 59.892244][ T3643] R10: 0000000000000000 R11: 1ffffffff2111ba8 R12: ffff88801eeb5dc0 [ 59.900647][ T3643] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a [ 59.908617][ T3643] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 59.917557][ T3643] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.924147][ T3643] CR2: 00007f86608581a8 CR3: 000000000c28e000 CR4: 00000000003506f0 [ 59.932387][ T3643] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.940539][ T3643] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.948511][ T3643] Call Trace: [ 59.951786][ T3643] [ 59.954738][ T3643] __tcf_em_tree_match+0x153/0x560 [ 59.959960][ T3643] ? tcf_em_tree_dump+0x870/0x870 [ 59.965020][ T3643] ? _find_first_zero_bit+0x94/0xb0 [ 59.970241][ T3643] ? lockdep_unlock+0x11b/0x290 [ 59.975109][ T3643] ? __lock_acquire+0x2567/0x56d0 [ 59.980184][ T3643] basic_classify+0x206/0x330 [ 59.984897][ T3643] tcf_classify+0x3ec/0xa40 [ 59.989611][ T3643] prio_enqueue+0x3ab/0x790 [ 59.994146][ T3643] ? prio_reset+0xf0/0xf0 [ 59.998513][ T3643] ? do_raw_spin_lock+0x124/0x2b0 [ 60.003553][ T3643] dev_qdisc_enqueue+0x46/0x390 [ 60.008425][ T3643] __dev_queue_xmit+0x2279/0x3ba0 [ 60.013472][ T3643] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 60.019493][ T3643] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 60.024811][ T3643] ? find_held_lock+0x2d/0x110 [ 60.029602][ T3643] ? __ip_finish_output+0x396/0x650 [ 60.034825][ T3643] ? mark_held_locks+0x9f/0xe0 [ 60.039617][ T3643] ? ip_finish_output2+0x1bd0/0x2180 [ 60.045029][ T3643] ip_finish_output2+0x14e3/0x2180 [ 60.050174][ T3643] ? ip_fragment.constprop.0+0x240/0x240 [ 60.055821][ T3643] ? ip_mc_finish_output+0x5a0/0x5a0 [ 60.061131][ T3643] ? get_random_u32+0x4e3/0x7d0 [ 60.065990][ T3643] __ip_finish_output+0x396/0x650 [ 60.071027][ T3643] ip_finish_output+0x31/0x280 [ 60.075798][ T3643] ip_output+0x1a3/0x320 [ 60.080049][ T3643] ip_local_out+0xb3/0x1a0 [ 60.084735][ T3643] iptunnel_xmit+0x67e/0x9f0 [ 60.089337][ T3643] geneve_xmit+0x1318/0x4910 [ 60.093948][ T3643] ? geneve_init_net+0x310/0x310 [ 60.098894][ T3643] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 60.104808][ T3643] ? skb_crc32c_csum_help+0x80/0x80 [ 60.110043][ T3643] dev_hard_start_xmit+0x1c2/0x990 [ 60.115189][ T3643] __dev_queue_xmit+0x2cdf/0x3ba0 [ 60.120258][ T3643] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 60.125916][ T3643] ? find_held_lock+0x2d/0x110 [ 60.130711][ T3643] ? ip6_finish_output+0x694/0x1170 [ 60.135930][ T3643] ? mark_held_locks+0x9f/0xe0 [ 60.140724][ T3643] ? rcu_read_lock_bh_held+0x29/0x60 [ 60.146042][ T3643] ? ip6_finish_output2+0x11ac/0x1530 [ 60.151442][ T3643] ip6_finish_output2+0xfa3/0x1530 [ 60.156620][ T3643] ip6_finish_output+0x694/0x1170 [ 60.161672][ T3643] ip6_output+0x1f1/0x540 [ 60.166022][ T3643] mld_sendpack+0xa09/0xe70 [ 60.170633][ T3643] ? igmp6_mcf_seq_next+0x550/0x550 [ 60.175951][ T3643] mld_ifc_work+0x720/0xdc0 [ 60.180494][ T3643] process_one_work+0x9bf/0x1710 [ 60.185464][ T3643] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 60.190895][ T3643] ? rwlock_bug.part.0+0x90/0x90 [ 60.195865][ T3643] ? _raw_spin_lock_irq+0x45/0x50 [ 60.200915][ T3643] worker_thread+0x669/0x1090 [ 60.205622][ T3643] ? __kthread_parkme+0x163/0x220 [ 60.210687][ T3643] ? process_one_work+0x1710/0x1710 [ 60.215911][ T3643] kthread+0x2e8/0x3a0 [ 60.219987][ T3643] ? kthread_complete_and_exit+0x40/0x40 [ 60.225632][ T3643] ret_from_fork+0x1f/0x30 [ 60.230073][ T3643] [ 60.233086][ T3643] Modules linked in: [ 60.237132][ T3643] ---[ end trace 0000000000000000 ]--- [ 60.242619][ T3643] RIP: 0010:em_cmp_match+0x55/0x670 [ 60.247853][ T3643] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b0 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 08 4c 8d 7d 0a 4c 89 fa 48 c1 ea 03 <0f> b6 14 02 4c 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 47 [ 60.267723][ T3643] RSP: 0018:ffffc90003beee38 EFLAGS: 00010202 [ 60.273924][ T3643] RAX: dffffc0000000000 RBX: ffff88801f385b40 RCX: 0000000000000000 [ 60.281924][ T3643] RDX: 0000000000000001 RSI: ffffffff87f06ccd RDI: ffff88801f385b48 [ 60.289903][ T3643] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001 [ 60.297900][ T3643] R10: 0000000000000000 R11: 1ffffffff2111ba8 R12: ffff88801eeb5dc0 [ 60.305991][ T3643] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a [ 60.314007][ T3643] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 60.322988][ T3643] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.329577][ T3643] CR2: 00007f86608581a8 CR3: 000000000c28e000 CR4: 00000000003506f0 [ 60.337661][ T3643] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 60.345663][ T3643] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 60.353666][ T3643] Kernel panic - not syncing: Fatal exception in interrupt [ 60.361214][ T3643] Kernel Offset: disabled [ 60.365534][ T3643] Rebooting in 86400 seconds..