./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2266879490 <...> Warning: Permanently added '10.128.1.42' (ECDSA) to the list of known hosts. execve("./syz-executor2266879490", ["./syz-executor2266879490"], 0x7ffe2f2442b0 /* 10 vars */) = 0 brk(NULL) = 0x555556cb5000 brk(0x555556cb5c40) = 0x555556cb5c40 arch_prctl(ARCH_SET_FS, 0x555556cb5300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2266879490", 4096) = 28 brk(0x555556cd6c40) = 0x555556cd6c40 brk(0x555556cd7000) = 0x555556cd7000 mprotect(0x7ffad5563000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 chmod("/dev/raw-gadget", 0666) = 0 getpid() = 5056 mkdir("./syzkaller.Yf29Mv", 0700) = 0 chmod("./syzkaller.Yf29Mv", 0777) = 0 chdir("./syzkaller.Yf29Mv") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5057 attached , child_tidptr=0x555556cb55d0) = 5057 [pid 5057] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5057] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5057] setsid() = 1 [pid 5057] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5057] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5057] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5057] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5057] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5057] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5057] unshare(CLONE_NEWNS) = 0 [pid 5057] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5057] unshare(CLONE_NEWIPC) = 0 [pid 5057] unshare(CLONE_NEWCGROUP) = 0 [pid 5057] unshare(CLONE_NEWUTS) = 0 [pid 5057] unshare(CLONE_SYSVSEM) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "16777216", 8) = 8 [pid 5057] close(3) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "536870912", 9) = 9 [pid 5057] close(3) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "1024", 4) = 4 [pid 5057] close(3) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "8192", 4) = 4 [pid 5057] close(3) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "1024", 4) = 4 [pid 5057] close(3) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "1024", 4) = 4 [pid 5057] close(3) = 0 [pid 5057] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5057] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5057] close(3) = 0 [pid 5057] getpid() = 1 [pid 5057] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 53.650730][ T5057] dump_stack_lvl+0x1e3/0x2d0 [ 53.655430][ T5057] ? nf_tcp_handle_invalid+0x630/0x630 [ 53.660889][ T5057] ? panic+0x770/0x770 [ 53.664958][ T5057] ? __might_sleep+0xc0/0xc0 [ 53.669547][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.675532][ T5057] should_fail_ex+0x3aa/0x4e0 [ 53.680209][ T5057] ? dccp_feat_entry_new+0x1d7/0x450 [ 53.685499][ T5057] should_failslab+0x5/0x20 [ 53.689997][ T5057] __kmem_cache_alloc_node+0x68/0x340 [ 53.695374][ T5057] ? dccp_feat_entry_new+0x1d7/0x450 [ 53.700660][ T5057] kmalloc_trace+0x26/0x60 [ 53.705074][ T5057] dccp_feat_entry_new+0x1d7/0x450 [ 53.710189][ T5057] dccp_feat_parse_options+0xe6d/0x2a70 [ 53.715745][ T5057] ? dccp_feat_server_ccid_dependencies+0x3e0/0x3e0 [ 53.722345][ T5057] dccp_parse_options+0x7b1/0x1a80 [ 53.727483][ T5057] dccp_rcv_established+0x51/0x310 [ 53.732596][ T5057] dccp_v4_do_rcv+0xfc/0x1f0 [ 53.737186][ T5057] __release_sock+0x1d8/0x4c0 [ 53.741870][ T5057] release_sock+0x5d/0x1c0 [ 53.746284][ T5057] dccp_sendmsg+0x502/0x820 [ 53.750793][ T5057] ? dccp_getsockopt+0x1080/0x1080 [ 53.755909][ T5057] ? inet_sendmsg+0x80/0x310 [ 53.760496][ T5057] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 53.765778][ T5057] ? security_socket_sendmsg+0x9d/0xb0 [ 53.771233][ T5057] ? inet_send_prepare+0x250/0x250 [ 53.776342][ T5057] ____sys_sendmsg+0x597/0x8e0 [ 53.781115][ T5057] ? __sys_sendmsg_sock+0x30/0x30 [ 53.786155][ T5057] __sys_sendmmsg+0x3d7/0x770 [ 53.790832][ T5057] ? __ia32_sys_sendmsg+0x90/0x90 [ 53.795875][ T5057] ? rcu_read_lock_sched_held+0x89/0x130 [ 53.801504][ T5057] ? __bpf_trace_rcu_stall_warning+0x10/0x10 [ 53.807486][ T5057] ? __rwlock_init+0x140/0x140 [ 53.812262][ T5057] ? trace_lock_release+0x95/0x220 [ 53.817388][ T5057] ? _raw_spin_lock_irqsave+0x120/0x120 [ 53.822949][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.828929][ T5057] ? print_irqtrace_events+0x220/0x220 [ 53.834393][ T5057] ? ptrace_stop+0x74d/0x970 [ 53.838999][ T5057] ? _raw_spin_unlock_irq+0x2a/0x40 [ 53.844209][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 53.850190][ T5057] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 53.856171][ T5057] __x64_sys_sendmmsg+0x9c/0xb0 [ 53.861018][ T5057] do_syscall_64+0x2b/0x70 [ 53.867078][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.872967][ T5057] RIP: 0033:0x7ffad54edd09 [ 53.877381][ T5057] Code: 46 01 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.896981][ T5057] RSP: 002b:00007ffd8bea4868 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 53.905391][ T5057] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ffad54edd09 [ 53.913378][ T5057] RDX: 04000000000001e6 RSI: 0000000020000c00 RDI: 0000000000000005 [ 53.921367][ T5057] RBP: 00007ffd8bea4880 R08: 0000000000000001 R09: 00007ffd8bea4910 [ 53.929344][ T5057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 53.937312][ T5057] R13: 00007ffd8bea48b0 R14: 00007ffd8bea4880 R15: 0000000000000000 [ 53.945300][ T5057] [ 53.963260][ T5057] dccp_parse_options: DCCP(ffff88814a3c8ac0): Option 32 (len=7) error=9 [ 53.974044][ T5057] ================================================================== [ 53.982111][ T5057] BUG: KASAN: use-after-free in ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 53.990253][ T5057] Read of size 1 at addr ffff888078b25494 by task syz-executor226/5057 [ 53.998475][ T5057] [ 54.000782][ T5057] CPU: 1 PID: 5057 Comm: syz-executor226 Not tainted 6.2.0-rc1-syzkaller-00095-ge4cf7c25bae5 #0 [ 54.011205][ T5057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 54.021242][ T5057] Call Trace: [ 54.024507][ T5057] [ 54.027428][ T5057] dump_stack_lvl+0x1e3/0x2d0 [ 54.032106][ T5057] ? nf_tcp_handle_invalid+0x630/0x630 [ 54.037731][ T5057] ? __wake_up_klogd+0xcd/0x100 [ 54.042582][ T5057] ? panic+0x770/0x770 [ 54.046645][ T5057] ? _printk+0xcf/0x110 [ 54.050783][ T5057] ? _raw_spin_lock_irqsave+0xac/0x120 [ 54.056226][ T5057] print_address_description+0x74/0x340 [ 54.061780][ T5057] print_report+0x107/0x220 [ 54.066298][ T5057] ? __virt_addr_valid+0x21b/0x2d0 [ 54.071400][ T5057] ? __phys_addr+0xb5/0x160 [ 54.075894][ T5057] ? ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 54.081695][ T5057] kasan_report+0x139/0x170 [ 54.086198][ T5057] ? ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 54.091997][ T5057] ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 54.097623][ T5057] ? kasan_quarantine_put+0xd4/0x230 [ 54.103004][ T5057] ? dccp_ackvec_clear_state+0x63b/0x900 [ 54.108639][ T5057] ? ccid2_hc_rx_packet_recv+0x71/0x180 [ 54.114174][ T5057] ? ccid2_hc_rx_packet_recv+0x180/0x180 [ 54.119798][ T5057] dccp_rcv_established+0x284/0x310 [ 54.124993][ T5057] dccp_v4_do_rcv+0xfc/0x1f0 [ 54.129589][ T5057] __release_sock+0x1d8/0x4c0 [ 54.134265][ T5057] release_sock+0x5d/0x1c0 [ 54.138673][ T5057] dccp_sendmsg+0x502/0x820 [ 54.143186][ T5057] ? dccp_getsockopt+0x1080/0x1080 [ 54.148297][ T5057] ? inet_sendmsg+0x80/0x310 [ 54.152879][ T5057] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 54.158169][ T5057] ? security_socket_sendmsg+0x9d/0xb0 [ 54.163624][ T5057] ? inet_send_prepare+0x250/0x250 [ 54.168728][ T5057] ____sys_sendmsg+0x597/0x8e0 [ 54.173486][ T5057] ? __sys_sendmsg_sock+0x30/0x30 [ 54.178506][ T5057] ? rcu_read_lock_sched_held+0x89/0x130 [ 54.184136][ T5057] __sys_sendmmsg+0x3d7/0x770 [ 54.188813][ T5057] ? __ia32_sys_sendmsg+0x90/0x90 [ 54.193842][ T5057] ? rcu_read_lock_sched_held+0x89/0x130 [ 54.199466][ T5057] ? __bpf_trace_rcu_stall_warning+0x10/0x10 [ 54.205437][ T5057] ? __rwlock_init+0x140/0x140 [ 54.210196][ T5057] ? trace_lock_release+0x95/0x220 [ 54.215298][ T5057] ? _raw_spin_lock_irqsave+0x120/0x120 [ 54.220839][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 54.226896][ T5057] ? print_irqtrace_events+0x220/0x220 [ 54.232343][ T5057] ? ptrace_stop+0x74d/0x970 [ 54.236929][ T5057] ? _raw_spin_unlock_irq+0x2a/0x40 [ 54.242123][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 54.248118][ T5057] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 54.254109][ T5057] __x64_sys_sendmmsg+0x9c/0xb0 [ 54.258953][ T5057] do_syscall_64+0x2b/0x70 [ 54.263361][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.269249][ T5057] RIP: 0033:0x7ffad54edd09 [ 54.273654][ T5057] Code: 46 01 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.293250][ T5057] RSP: 002b:00007ffd8bea4868 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 54.301662][ T5057] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ffad54edd09 [ 54.309647][ T5057] RDX: 04000000000001e6 RSI: 0000000020000c00 RDI: 0000000000000005 [ 54.317608][ T5057] RBP: 00007ffd8bea4880 R08: 0000000000000001 R09: 00007ffd8bea4910 [ 54.325568][ T5057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 54.333528][ T5057] R13: 00007ffd8bea48b0 R14: 00007ffd8bea4880 R15: 0000000000000000 [ 54.341496][ T5057] [ 54.344504][ T5057] [ 54.346817][ T5057] Allocated by task 5057: [ 54.351127][ T5057] kasan_set_track+0x4c/0x70 [ 54.355711][ T5057] __kasan_kmalloc+0x97/0xb0 [ 54.360296][ T5057] __kmalloc_node_track_caller+0xad/0x190 [ 54.366002][ T5057] __alloc_skb+0x12c/0x2c0 [ 54.370409][ T5057] dccp_send_ack+0xa0/0x300 [ 54.374904][ T5057] ccid2_hc_rx_packet_recv+0xf1/0x180 [ 54.380286][ T5057] dccp_rcv_established+0x1b2/0x310 [ 54.385491][ T5057] dccp_v4_do_rcv+0xfc/0x1f0 [ 54.390071][ T5057] __sk_receive_skb+0x43f/0x9e0 [ 54.394909][ T5057] ip_protocol_deliver_rcu+0x5d5/0xd40 [ 54.400357][ T5057] ip_local_deliver_finish+0x269/0x480 [ 54.405807][ T5057] __netif_receive_skb+0x1c5/0x500 [ 54.410904][ T5057] process_backlog+0x568/0x920 [ 54.415657][ T5057] __napi_poll+0xbe/0x4b0 [ 54.419972][ T5057] net_rx_action+0x76c/0x1100 [ 54.424643][ T5057] __do_softirq+0x277/0x75b [ 54.429157][ T5057] [ 54.431467][ T5057] Freed by task 5057: [ 54.435435][ T5057] kasan_set_track+0x4c/0x70 [ 54.440015][ T5057] kasan_save_free_info+0x27/0x40 [ 54.445031][ T5057] ____kasan_slab_free+0xd6/0x120 [ 54.450051][ T5057] slab_free_freelist_hook+0x12e/0x1a0 [ 54.455498][ T5057] __kmem_cache_free+0x71/0x110 [ 54.460335][ T5057] skb_release_data+0x4f6/0x710 [ 54.465177][ T5057] kfree_skb_reason+0xfa/0x2c0 [ 54.469936][ T5057] dccp_v4_do_rcv+0x143/0x1f0 [ 54.474603][ T5057] __release_sock+0x1d8/0x4c0 [ 54.479275][ T5057] release_sock+0x5d/0x1c0 [ 54.483678][ T5057] dccp_sendmsg+0x502/0x820 [ 54.488174][ T5057] ____sys_sendmsg+0x597/0x8e0 [ 54.492924][ T5057] __sys_sendmmsg+0x3d7/0x770 [ 54.497587][ T5057] __x64_sys_sendmmsg+0x9c/0xb0 [ 54.502423][ T5057] do_syscall_64+0x2b/0x70 [ 54.506827][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.512711][ T5057] [ 54.515025][ T5057] The buggy address belongs to the object at ffff888078b25000 [ 54.515025][ T5057] which belongs to the cache kmalloc-2k of size 2048 [ 54.529064][ T5057] The buggy address is located 1172 bytes inside of [ 54.529064][ T5057] 2048-byte region [ffff888078b25000, ffff888078b25800) [ 54.542499][ T5057] [ 54.544811][ T5057] The buggy address belongs to the physical page: [ 54.551217][ T5057] page:ffffea0001e2c800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78b20 [ 54.561354][ T5057] head:ffffea0001e2c800 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 [ 54.571399][ T5057] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 54.579370][ T5057] raw: 00fff00000010200 ffff888012842000 dead000000000122 0000000000000000 [ 54.587946][ T5057] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 54.596512][ T5057] page dumped because: kasan: bad access detected [ 54.602907][ T5057] page_owner tracks the page as allocated [ 54.608605][ T5057] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5053, tgid 5053 (strace-static-x), ts 53593701360, free_ts 33150100132 [ 54.630387][ T5057] get_page_from_freelist+0x72b/0x7a0 [ 54.635759][ T5057] __alloc_pages+0x259/0x560 [ 54.640338][ T5057] alloc_slab_page+0xbd/0x190 [ 54.645013][ T5057] allocate_slab+0x5e/0x3c0 [ 54.649503][ T5057] ___slab_alloc+0x7f4/0xeb0 [ 54.654168][ T5057] __kmem_cache_alloc_node+0x25b/0x340 [ 54.659616][ T5057] __kmalloc+0x9e/0x190 [ 54.663759][ T5057] sk_prot_alloc+0xde/0x200 [ 54.668251][ T5057] sk_alloc+0x34/0x360 [ 54.672311][ T5057] __netlink_create+0x6b/0x2b0 [ 54.677065][ T5057] netlink_create+0x368/0x530 [ 54.681732][ T5057] __sock_create+0x3fd/0x850 [ 54.686316][ T5057] __sys_socket+0x137/0x3a0 [ 54.690810][ T5057] __x64_sys_socket+0x76/0x80 [ 54.695490][ T5057] do_syscall_64+0x2b/0x70 [ 54.699904][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.705816][ T5057] page last free stack trace: [ 54.710474][ T5057] free_pcp_prepare+0x751/0x780 [ 54.715316][ T5057] free_unref_page+0x19/0x4c0 [ 54.719980][ T5057] __unfreeze_partials+0x1a5/0x1e0 [ 54.725080][ T5057] put_cpu_partial+0x116/0x180 [ 54.729835][ T5057] qlist_free_all+0x2b/0x70 [ 54.734325][ T5057] kasan_quarantine_reduce+0x156/0x170 [ 54.739772][ T5057] __kasan_slab_alloc+0x1f/0x70 [ 54.744615][ T5057] kmem_cache_alloc+0x1b3/0x350 [ 54.749451][ T5057] vm_area_alloc+0x20/0xe0 [ 54.753853][ T5057] mmap_region+0xd75/0x1e60 [ 54.758344][ T5057] do_mmap+0x8d9/0xf30 [ 54.762399][ T5057] vm_mmap_pgoff+0x1e5/0x2f0 [ 54.766978][ T5057] ksys_mmap_pgoff+0x48c/0x6d0 [ 54.771737][ T5057] do_syscall_64+0x2b/0x70 [ 54.776141][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.782026][ T5057] [ 54.784339][ T5057] Memory state around the buggy address: [ 54.789953][ T5057] ffff888078b25380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.798003][ T5057] ffff888078b25400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.806050][ T5057] >ffff888078b25480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.814092][ T5057] ^ [ 54.818664][ T5057] ffff888078b25500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.826714][ T5057] ffff888078b25580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 54.834763][ T5057] ================================================================== [ 54.864245][ T5057] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 54.871477][ T5057] CPU: 1 PID: 5057 Comm: syz-executor226 Not tainted 6.2.0-rc1-syzkaller-00095-ge4cf7c25bae5 #0 [ 54.881882][ T5057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 54.891926][ T5057] Call Trace: [ 54.895198][ T5057] [ 54.898118][ T5057] dump_stack_lvl+0x1e3/0x2d0 [ 54.902795][ T5057] ? nf_tcp_handle_invalid+0x630/0x630 [ 54.908245][ T5057] ? panic+0x770/0x770 [ 54.912319][ T5057] ? vscnprintf+0x59/0x80 [ 54.916657][ T5057] panic+0x316/0x770 [ 54.920546][ T5057] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 54.926697][ T5057] ? check_panic_on_warn+0x1d/0xa0 [ 54.931802][ T5057] ? memcpy_page_flushcache+0x100/0x100 [ 54.937343][ T5057] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 54.943323][ T5057] ? _raw_spin_unlock+0x40/0x40 [ 54.948173][ T5057] check_panic_on_warn+0x80/0xa0 [ 54.953102][ T5057] ? ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 54.958897][ T5057] end_report+0x47/0x90 [ 54.963046][ T5057] kasan_report+0x146/0x170 [ 54.967545][ T5057] ? ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 54.973344][ T5057] ccid2_hc_tx_packet_recv+0x2042/0x2a50 [ 54.978964][ T5057] ? kasan_quarantine_put+0xd4/0x230 [ 54.984255][ T5057] ? dccp_ackvec_clear_state+0x63b/0x900 [ 54.989881][ T5057] ? ccid2_hc_rx_packet_recv+0x71/0x180 [ 54.995415][ T5057] ? ccid2_hc_rx_packet_recv+0x180/0x180 [ 55.001040][ T5057] dccp_rcv_established+0x284/0x310 [ 55.006234][ T5057] dccp_v4_do_rcv+0xfc/0x1f0 [ 55.010818][ T5057] __release_sock+0x1d8/0x4c0 [ 55.015491][ T5057] release_sock+0x5d/0x1c0 [ 55.019917][ T5057] dccp_sendmsg+0x502/0x820 [ 55.024421][ T5057] ? dccp_getsockopt+0x1080/0x1080 [ 55.029529][ T5057] ? inet_sendmsg+0x80/0x310 [ 55.034109][ T5057] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 55.039384][ T5057] ? security_socket_sendmsg+0x9d/0xb0 [ 55.044836][ T5057] ? inet_send_prepare+0x250/0x250 [ 55.049957][ T5057] ____sys_sendmsg+0x597/0x8e0 [ 55.054714][ T5057] ? __sys_sendmsg_sock+0x30/0x30 [ 55.059732][ T5057] ? rcu_read_lock_sched_held+0x89/0x130 [ 55.065364][ T5057] __sys_sendmmsg+0x3d7/0x770 [ 55.070034][ T5057] ? __ia32_sys_sendmsg+0x90/0x90 [ 55.075055][ T5057] ? rcu_read_lock_sched_held+0x89/0x130 [ 55.080679][ T5057] ? __bpf_trace_rcu_stall_warning+0x10/0x10 [ 55.086651][ T5057] ? __rwlock_init+0x140/0x140 [ 55.091429][ T5057] ? trace_lock_release+0x95/0x220 [ 55.096533][ T5057] ? _raw_spin_lock_irqsave+0x120/0x120 [ 55.102074][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 55.108044][ T5057] ? print_irqtrace_events+0x220/0x220 [ 55.113516][ T5057] ? ptrace_stop+0x74d/0x970 [ 55.118102][ T5057] ? _raw_spin_unlock_irq+0x2a/0x40 [ 55.123316][ T5057] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 55.129310][ T5057] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 55.135302][ T5057] __x64_sys_sendmmsg+0x9c/0xb0 [ 55.140154][ T5057] do_syscall_64+0x2b/0x70 [ 55.144564][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.150449][ T5057] RIP: 0033:0x7ffad54edd09 [ 55.154855][ T5057] Code: 46 01 00 85 c0 b8 00 00 00 00 48 0f 44 c3 5b c3 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 55.174448][ T5057] RSP: 002b:00007ffd8bea4868 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 55.182879][ T5057] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ffad54edd09 [ 55.190840][ T5057] RDX: 04000000000001e6 RSI: 0000000020000c00 RDI: 0000000000000005 [ 55.198801][ T5057] RBP: 00007ffd8bea4880 R08: 0000000000000001 R09: 00007ffd8bea4910 [ 55.206766][ T5057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 55.214745][ T5057] R13: 00007ffd8bea48b0 R14: 00007ffd8bea4880 R15: 0000000000000000 [ 55.222712][ T5057] [ 55.225784][ T5057] Kernel Offset: disabled [ 55.230101][ T5057] Rebooting in 86400 seconds..