./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3846457318 <...> DUID 00:04:66:e4:01:83:27:57:c7:2c:b4:77:89:67:fd:32:a2:9b forked to background, child pid 3185 [ 26.608169][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.616901][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.207' (ECDSA) to the list of known hosts. execve("./syz-executor3846457318", ["./syz-executor3846457318"], 0x7ffe5c655cf0 /* 10 vars */) = 0 brk(NULL) = 0x555556377000 brk(0x555556377c40) = 0x555556377c40 arch_prctl(ARCH_SET_FS, 0x555556377300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3846457318", 4096) = 28 brk(0x555556398c40) = 0x555556398c40 brk(0x555556399000) = 0x555556399000 mprotect(0x7fec5a131000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEPORT, [11], 4) = 0 bind(3, {sa_family=AF_INET6, sin6_port=htons(20000), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "::", &sin6_addr), sin6_scope_id=0}, 28) = 0 exit_group(0) = ? syzkaller login: [ 49.344918][ T3606] [ 49.347393][ T3606] ============================= [ 49.352270][ T3606] WARNING: suspicious RCU usage [ 49.357233][ T3606] 6.0.0-rc1-syzkaller-00066-g3b06a2755758 #0 Not tainted [ 49.364287][ T3606] ----------------------------- [ 49.369167][ T3606] include/net/sock.h:592 suspicious rcu_dereference_check() usage! [ 49.377046][ T3606] [ 49.377046][ T3606] other info that might help us debug this: [ 49.377046][ T3606] [ 49.387362][ T3606] [ 49.387362][ T3606] rcu_scheduler_active = 2, debug_locks = 1 [ 49.395479][ T3606] 4 locks held by syz-executor384/3606: [ 49.401062][ T3606] #0: ffff8880747f0e10 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: __sock_release+0x86/0x280 [ 49.411691][ T3606] #1: ffffc90001501b08 (&table->hash[i].lock){+...}-{2:2}, at: udp_lib_unhash+0x1d5/0x730 [ 49.421770][ T3606] #2: ffffffff8d7bc038 (reuseport_lock){+...}-{2:2}, at: reuseport_detach_sock+0x22/0x4a0 [ 49.431854][ T3606] #3: ffff88814b2fc3b8 (clock-AF_INET6){++..}-{2:2}, at: bpf_sk_reuseport_detach+0x26/0x190 [ 49.442144][ T3606] [ 49.442144][ T3606] stack backtrace: [ 49.448033][ T3606] CPU: 1 PID: 3606 Comm: syz-executor384 Not tainted 6.0.0-rc1-syzkaller-00066-g3b06a2755758 #0 [ 49.458433][ T3606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 49.468507][ T3606] Call Trace: [ 49.471790][ T3606] [ 49.474721][ T3606] dump_stack_lvl+0xcd/0x134 [ 49.479317][ T3606] bpf_sk_reuseport_detach+0x156/0x190 [ 49.484799][ T3606] reuseport_detach_sock+0x8c/0x4a0 [ 49.490001][ T3606] udp_lib_unhash+0x210/0x730 [ 49.494672][ T3606] ? udpv6_pre_connect+0x180/0x180 [ 49.499783][ T3606] sk_common_release+0xba/0x390 [ 49.504626][ T3606] inet_release+0x12e/0x270 [ 49.509123][ T3606] inet6_release+0x4c/0x70 [ 49.513533][ T3606] __sock_release+0xcd/0x280 [ 49.518114][ T3606] sock_close+0x18/0x20 [ 49.522296][ T3606] __fput+0x277/0x9d0 [ 49.526268][ T3606] ? __sock_release+0x280/0x280 [ 49.531115][ T3606] task_work_run+0xdd/0x1a0 [ 49.535619][ T3606] do_exit+0xad5/0x29b0 [ 49.539767][ T3606] ? mm_update_next_owner+0x7a0/0x7a0 [ 49.545142][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40 [ 49.550367][ T3606] ? _raw_spin_unlock_irq+0x1f/0x40 [ 49.555592][ T3606] do_group_exit+0xd2/0x2f0 [ 49.560109][ T3606] __x64_sys_exit_group+0x3a/0x50 [ 49.565147][ T3606] do_syscall_64+0x35/0xb0 [ 49.569575][ T3606] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.575477][ T3606] RIP: 0033:0x7fec5a0c3679 [ 49.579917][ T3606] Code: Unable to access opcode bytes at RIP 0x7fec5a0c364f. [ 49.587279][ T3606] RSP: 002b:00007ffd88d7f598 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 +++ exited with 0 +++ [ 49.