./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2540523032
<...>
Warning: Permanently added '10.128.1.24' (ECDSA) to the list of known hosts.
execve("./syz-executor2540523032", ["./syz-executor2540523032"], 0x7fff5d3d46e0 /* 10 vars */) = 0
brk(NULL) = 0x555555610000
brk(0x555555610c40) = 0x555555610c40
arch_prctl(ARCH_SET_FS, 0x555555610300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2540523032", 4096) = 28
brk(0x555555631c40) = 0x555555631c40
brk(0x555555632000) = 0x555555632000
mprotect(0x7fd926e09000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556105d0) = 3613
./strace-static-x86_64: Process 3613 attached
[pid 3613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3613] setpgid(0, 0) = 0
[pid 3613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3613] write(3, "1000", 4) = 4
[pid 3613] close(3) = 0
[pid 3613] openat(AT_FDCWD, "/dev/kvm", O_RDONLY) = 3
[pid 3613] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3613] write(4, "39", 2) = 2
[pid 3613] ioctl(3, KVM_CREATE_VM, 0) = 5
[pid 3613] exit_group(0) = ?
[ 57.478901][ T3613] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[pid 3613] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3613, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3617 attached
, child_tidptr=0x5555556105d0) = 3617
[pid 3617] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3617] setpgid(0, 0) = 0
[pid 3617] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3617] write(3, "1000", 4) = 4
[pid 3617] close(3) = 0
[pid 3617] openat(AT_FDCWD, "/dev/kvm", O_RDONLY) = 3
[pid 3617] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3617] write(4, "39", 2) = 2
[pid 3617] ioctl(3, KVM_CREATE_VM, 0) = -1 ENOMEM (Cannot allocate memory)
[pid 3617] exit_group(0) = ?
[pid 3617] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3617, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3620 attached
, child_tidptr=0x5555556105d0) = 3620
[pid 3620] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3620] setpgid(0, 0) = 0
[pid 3620] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3620] write(3, "1000", 4) = 4
[pid 3620] close(3) = 0
[pid 3620] openat(AT_FDCWD, "/dev/kvm", O_RDONLY) = 3
[pid 3620] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3620] write(4, "39", 2) = 2
[ 57.637355][ C1] ==================================================================
[ 57.637362][ T3620] BUG: unable to handle page fault for address: ffffc900039aa330
[ 57.637376][ T3620] #PF: supervisor read access in kernel mode
[ 57.645509][ C1] BUG: KASAN: vmalloc-out-of-bounds in kvm_arch_hardware_enable+0x1bc/0x6d0
[ 57.653200][ T3620] #PF: error_code(0x0000) - not-present page
[ 57.659149][ C1] Read of size 4 at addr ffffc900039aa330 by task kvm/3621
[ 57.667788][ T3620] PGD 12000067
[ 57.673750][ C1]
[ 57.673757][ C1] CPU: 1 PID: 3621 Comm: kvm Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0
[ 57.680912][ T3620] P4D 12000067
[ 57.684343][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[ 57.686642][ T3620] PUD 121c9067
[ 57.695726][ C1] Call Trace:
[ 57.695736][ C1]
[ 57.699156][ T3620] PMD 1d46a067
[ 57.709185][ C1] dump_stack_lvl+0x1e3/0x2cb
[ 57.712613][ T3620] PTE 0
[ 57.715872][ C1] ? io_notif_register+0x5e7/0x5e7
[ 57.718698][ T3620]
[ 57.718704][ T3620] Oops: 0000 [#1] PREEMPT SMP KASAN
[ 57.722128][ C1] ? __wake_up_klogd+0xcd/0x100
[ 57.726774][ T3620] CPU: 0 PID: 3620 Comm: syz-executor254 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0
[ 57.729511][ C1] ? panic+0x76b/0x76b
[ 57.734586][ T3620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
[ 57.736890][ C1] ? _printk+0xcf/0x10f
[ 57.742056][ T3620] RIP: 0010:kvm_arch_hardware_enable+0x1d1/0x6d0
[ 57.746875][ C1] print_address_description+0x65/0x4b0
[ 57.757076][ T3620] Code: 89 5c 24 38 4c 8d 73 f0 4c 89 f7 be 04 00 00 00 e8 a4 44 cc 00 4d 89 f5 49 c1 ed 03 43 0f b6 44 3d 00 84 c0 0f 85 08 02 00 00 <41> 8b 06 ff c8 48 63 d0 4c 89 64 24 10 4c 89 e7 48 8d 74 24 60 b9
[ 57.761119][ C1] print_report+0x108/0x220
[ 57.771143][ T3620] RSP: 0018:ffffc900038dfaa0 EFLAGS: 00010082
[ 57.775268][ C1] ? __lock_acquire+0x1f60/0x1f60
[ 57.781559][ T3620]
[ 57.781565][ T3620] RAX: 0000000000000000 RBX: ffffc900039aa340 RCX: ffffffff8110f0c2
[ 57.787074][ C1] ? kvm_arch_hardware_enable+0x1bc/0x6d0
[ 57.806645][ T3620] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc900039aa330
[ 57.811119][ C1] kasan_report+0xfb/0x130
[ 57.817151][ T3620] RBP: ffffc900038dfb80 R08: dffffc0000000000 R09: fffff52000735466
[ 57.822144][ C1] ? kvm_arch_hardware_enable+0x1bc/0x6d0
[ 57.824441][ T3620] R10: fffff52000735467 R11: 1ffff92000735466 R12: ffffc900039aa240
[ 57.832387][ C1] kasan_check_range+0x2a7/0x2e0
[ 57.838084][ T3620] R13: 1ffff92000735466 R14: ffffc900039aa330 R15: dffffc0000000000
[ 57.846031][ C1] kvm_arch_hardware_enable+0x1bc/0x6d0
[ 57.850414][ T3620] FS: 0000555555610300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 57.858360][ C1] ? kvm_vcpu_deliver_sipi_vector+0x1a0/0x1a0
[ 57.864045][ T3620] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 57.871994][ C1] hardware_enable_nolock+0xa1/0x140
[ 57.876896][ T3620] CR2: ffffc900039aa330 CR3: 0000000076051000 CR4: 00000000003526f0
[ 57.884841][ C1] __flush_smp_call_function_queue+0x2bc/0xcc0
[ 57.890356][ T3620] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 57.899251][ C1] ? kvm_guest_get_ip+0xd0/0xd0
[ 57.905282][ T3620] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 57.911841][ C1] __sysvec_call_function_single+0x62/0x70
[ 57.917090][ T3620] Call Trace:
[ 57.917098][ T3620]
[ 57.925051][ C1] sysvec_call_function_single+0x8c/0xb0
[ 57.931174][ T3620] ? kvm_vcpu_deliver_sipi_vector+0x1a0/0x1a0
[ 57.939116][ C1]
[ 57.943944][ T3620] ? send_call_function_single_ipi+0x17f/0x1e0
[ 57.951889][ C1]
[ 57.951897][ C1] asm_sysvec_call_function_single+0x16/0x20
[ 57.957674][ T3620] ? ttwu_do_activate+0x2b0/0x2b0
[ 57.960932][ C1] RIP: 0010:lock_acquire+0x21e/0x400
[ 57.963848][ T3620] hardware_enable_nolock+0xa1/0x140
[ 57.969444][ C1] Code: 23 00 74 08 4c 89 f7 e8 90 e9 73 00 f6 44 24 61 02 0f 85 76 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 04 2c 00 00 00 00 43 c7 44 2c 09 00 00 00 00 43 c7 44 2c 11
[ 57.975479][ T3620] smp_call_function_many_cond+0xebc/0x16f0
[ 57.978393][ C1] RSP: 0018:ffffc90003987b00 EFLAGS: 00000206
[ 57.984519][ T3620] ? kvm_guest_get_ip+0xd0/0xd0
[ 57.987431][ C1]
[ 57.993378][ T3620] ? smp_call_function_many+0x30/0x30
[ 57.998371][ C1] RAX: 0000000000000001 RBX: 1ffff92000730f6c RCX: ffff88801ff14570
[ 58.003636][ T3620] ? lockdep_softirqs_off+0x420/0x420
[ 58.008889][ C1] RDX: dffffc0000000000 RSI: ffffffff8aad8740 RDI: ffffffff8b0a5460
[ 58.028468][ T3620] ? do_raw_spin_lock+0x148/0x360
[ 58.034329][ C1] RBP: ffffc90003987c48 R08: dffffc0000000000 R09: fffffbfff1ff380b
[ 58.040367][ T3620] ? __rwlock_init+0x140/0x140
[ 58.045182][ C1] R10: fffffbfff1ff380b R11: 1ffffffff1ff380a R12: dffffc0000000000
[ 58.047485][ T3620] ? kvm_guest_get_ip+0xd0/0xd0
[ 58.052824][ C1] R13: 1ffff92000730f68 R14: ffffc90003987b60 R15: 0000000000000246
[ 58.060770][ T3620] on_each_cpu_cond_mask+0x3b/0x80
[ 58.066121][ C1] ? read_lock_is_recursive+0x10/0x10
[ 58.074058][ T3620] hardware_enable_all+0x77/0x120
[ 58.079051][ C1] ? __might_sleep+0xc0/0xc0
[ 58.086997][ T3620] kvm_dev_ioctl+0x1076/0x17e0
[ 58.091730][ C1] ? print_irqtrace_events+0x220/0x220
[ 58.099674][ T3620] ? smack_file_alloc_security+0xd0/0xd0
[ 58.104492][ C1] ? do_raw_spin_unlock+0x134/0x8a0
[ 58.112443][ T3620] ? kvm_reboot+0x40/0x40
[ 58.117526][ C1] ? lockdep_hardirqs_on+0x95/0x140
[ 58.122860][ T3620] ? vtime_user_exit+0x2b2/0x3e0
[ 58.127855][ C1] __mutex_lock_common+0x1de/0x26c0
[ 58.132413][ T3620] ? __ct_user_exit+0x81/0xe0
[ 58.137144][ C1] ? rescuer_thread+0x6e/0x10e0
[ 58.142573][ T3620] ? bpf_lsm_file_ioctl+0x5/0x10
[ 58.148176][ C1] ? set_user_nice+0x6e7/0xd20
[ 58.153532][ T3620] ? security_file_ioctl+0x9d/0xb0
[ 58.157833][ C1] ? rescuer_thread+0x6e/0x10e0
[ 58.163000][ T3620] ? kvm_reboot+0x40/0x40
[ 58.167908][ C1] ? mutex_lock_io_nested+0x60/0x60
[ 58.173071][ T3620] __se_sys_ioctl+0xfb/0x170
[ 58.177719][ C1] ? __balance_callbacks+0x270/0x270
[ 58.182624][ T3620] do_syscall_64+0x2b/0x70
[ 58.187534][ C1] ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[ 58.192270][ T3620] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 58.197347][ C1] ? print_irqtrace_events+0x220/0x220
[ 58.202163][ T3620] RIP: 0033:0x7fd926d9c049
[ 58.206465][ C1] mutex_lock_nested+0x17/0x20
[ 58.211631][ T3620] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 58.216187][ C1] rescuer_thread+0x6e/0x10e0
[ 58.221440][ T3620] RSP: 002b:00007ffce6c2e948 EFLAGS: 00000246
[ 58.225827][ C1] ? lockdep_hardirqs_on+0x95/0x140
[ 58.231772][ T3620] ORIG_RAX: 0000000000000010
[ 58.237635][ C1] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 58.243059][ T3620] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd926d9c049
[ 58.247445][ C1] ? _raw_spin_unlock+0x40/0x40
[ 58.252175][ T3620] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003
[ 58.271752][ C1] ? _raw_spin_unlock_irqrestore+0xd9/0x130
[ 58.276399][ T3620] RBP: 00007ffce6c2e960 R08: 0000000000000002 R09: 0000000000000001
[ 58.282434][ C1] ? _raw_spin_unlock+0x40/0x40
[ 58.287602][ T3620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 58.292248][ C1] ? lockdep_hardirqs_on_prepare+0x448/0x7b0
[ 58.298118][ T3620] R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
[ 58.306068][ C1] ? __kthread_parkme+0x166/0x1c0
[ 58.310905][ T3620]
[ 58.318842][ C1] kthread+0x266/0x300
[ 58.324701][ T3620] Modules linked in:
[ 58.332647][ C1] ? rcu_free_pwq+0x20/0x20
[ 58.337466][ T3620] CR2: ffffc900039aa330
[ 58.345421][ C1] ? kthread_blkcg+0xd0/0xd0
[ 58.351374][ T3620] ---[ end trace 0000000000000000 ]---
[ 58.359315][ C1] ret_from_fork+0x1f/0x30
[ 58.364316][ T3620] RIP: 0010:kvm_arch_hardware_enable+0x1d1/0x6d0
[ 58.367356][ C1]
[ 58.371409][ T3620] Code: 89 5c 24 38 4c 8d 73 f0 4c 89 f7 be 04 00 00 00 e8 a4 44 cc 00 4d 89 f5 49 c1 ed 03 43 0f b6 44 3d 00 84 c0 0f 85 08 02 00 00 <41> 8b 06 ff c8 48 63 d0 4c 89 64 24 10 4c 89 e7 48 8d 74 24 60 b9
[ 58.375281][ C1]
[ 58.375293][ C1] Memory state around the buggy address:
[ 58.379768][ T3620] RSP: 0018:ffffc900038dfaa0 EFLAGS: 00010082
[ 58.383918][ C1] ffffc900039aa200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 58.388474][ T3620]
[ 58.388482][ T3620] RAX: 0000000000000000 RBX: ffffc900039aa340 RCX: ffffffff8110f0c2
[ 58.393915][ C1] ffffc900039aa280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 58.398294][ T3620] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffc900039aa330
[ 58.404592][ C1] >ffffc900039aa300: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 58.407584][ T3620] RBP: ffffc900038dfb80 R08: dffffc0000000000 R09: fffff52000735466
[ 58.427162][ C1] ^
[ 58.429463][ T3620] R10: fffff52000735467 R11: 1ffff92000735466 R12: ffffc900039aa240
[ 58.435069][ C1] ffffc900039aa380: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 58.441097][ T3620] R13: 1ffff92000735466 R14: ffffc900039aa330 R15: dffffc0000000000
[ 58.449135][ C1] ffffc900039aa400: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
[ 58.451434][ T3620] FS: 0000555555610300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 58.459376][ C1] ==================================================================
[ 58.459386][ C1] Kernel panic - not syncing: panic_on_warn set ...
[ 58.467409][ T3620] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 58.475370][ T3620] CR2: ffffc900039aa330 CR3: 0000000076051000 CR4: 00000000003526f0
[ 58.483418][ T3620] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 58.491380][ T3620] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 59.572669][ C1] Shutting down cpus with NMI
[ 59.664098][ C1] Kernel Offset: disabled
[ 59.668413][ C1] Rebooting in 86400 seconds..