syzkaller login: [ 264.285831][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 282.124726][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 282.151900][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 282.182312][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 282.213046][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:48514' (ECDSA) to the list of known hosts. 1970/01/01 00:05:52 fuzzer started 1970/01/01 00:06:04 dialing manager at localhost:33853 [ 369.612041][ T2025] cgroup: Unknown subsys name 'net' [ 370.604489][ T2025] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:06:10 syscalls: 2918 1970/01/01 00:06:10 code coverage: enabled 1970/01/01 00:06:10 comparison tracing: ioctl(KCOV_DISABLE) failed: invalid argument 1970/01/01 00:06:10 extra coverage: ioctl(KCOV_REMOTE_ENABLE) failed: device or resource busy 1970/01/01 00:06:10 delay kcov mmap: mmap returned an invalid pointer 1970/01/01 00:06:10 setuid sandbox: enabled 1970/01/01 00:06:10 namespace sandbox: enabled 1970/01/01 00:06:10 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:06:10 fault injection: enabled 1970/01/01 00:06:10 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:06:10 net packet injection: enabled 1970/01/01 00:06:10 net device setup: enabled 1970/01/01 00:06:10 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:06:10 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:06:10 NIC VF setup: PCI device 0000:00:11.0 is not available 1970/01/01 00:06:10 USB emulation: enabled 1970/01/01 00:06:10 hci packet injection: /dev/vhci does not exist 1970/01/01 00:06:10 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:06:10 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:06:10 fetching corpus: 0, signal 0/2000 (executing program) 1970/01/01 00:06:15 fetching corpus: 27, signal 28384/28629 (executing program) 1970/01/01 00:06:15 fetching corpus: 30, signal 28547/28880 (executing program) 1970/01/01 00:06:15 fetching corpus: 30, signal 28547/28989 (executing program) 1970/01/01 00:06:15 fetching corpus: 30, signal 28547/29109 (executing program) 1970/01/01 00:06:16 fetching corpus: 30, signal 28547/29207 (executing program) 1970/01/01 00:06:16 fetching corpus: 30, signal 28547/29334 (executing program) 1970/01/01 00:06:16 fetching corpus: 30, signal 28547/29451 (executing program) 1970/01/01 00:06:16 fetching corpus: 30, signal 28547/29574 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/29680 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/29803 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/29903 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/30008 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/30132 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/30232 (executing program) 1970/01/01 00:06:17 fetching corpus: 30, signal 28547/30240 (executing program) 1970/01/01 00:06:18 fetching corpus: 30, signal 28547/30240 (executing program) 1970/01/01 00:08:11 starting 2 fuzzer processes 00:08:11 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x40101283, 0xffffffffffffffff) 00:08:12 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000100)=@req={0x10000, 0x5, 0xfffff800}, 0x10) [ 521.206794][ T2032] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 521.787837][ T2032] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 521.897880][ T2030] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 522.492391][ T2030] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 534.615929][ T2032] device hsr_slave_0 entered promiscuous mode [ 534.683828][ T2032] device hsr_slave_1 entered promiscuous mode [ 535.729165][ T2030] device hsr_slave_0 entered promiscuous mode [ 535.749438][ T2030] device hsr_slave_1 entered promiscuous mode [ 535.779429][ T2030] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 535.788199][ T2030] Cannot create hsr debugfs directory [ 538.379476][ C1] ================================================================== [ 538.383502][ C1] BUG: KASAN: wild-memory-access in __wake_up_common+0x108/0x236 [ 538.384800][ C1] Read of size 8 at addr 3120382032332033 by task sshd/2015 [ 538.386176][ C1] [ 538.388656][ C1] CPU: 1 PID: 2015 Comm: sshd Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 538.390657][ C1] Hardware name: riscv-virtio,qemu (DT) [ 538.392276][ C1] Call Trace: [ 538.393242][ C1] [] dump_backtrace+0x2e/0x3c [ 538.394462][ C1] [] show_stack+0x34/0x40 [ 538.395539][ C1] [] dump_stack_lvl+0xe4/0x150 [ 538.396882][ C1] [] kasan_report+0x1de/0x1e0 [ 538.398166][ C1] [] __asan_load8+0x6e/0x96 [ 538.399832][ C1] [] __wake_up_common+0x108/0x236 [ 538.401665][ C1] [] __wake_up_common_lock+0xd6/0x136 [ 538.402930][ C1] [] __wake_up+0x10/0x18 [ 538.403995][ C1] [] ep_poll_callback+0x194/0xa40 [ 538.405200][ C1] [] __wake_up_common+0xb6/0x236 [ 538.406420][ C1] [] __wake_up_common_lock+0xd6/0x136 [ 538.407701][ C1] [] __wake_up_sync_key+0x14/0x1e [ 538.409022][ C1] [] sock_def_readable+0xe4/0x50e [ 538.410833][ C1] [] tcp_data_ready+0xa6/0x2e0 [ 538.412684][ C1] [] tcp_rcv_established+0x146a/0x15e6 [ 538.414809][ C1] [] tcp_v4_do_rcv+0x4b4/0x66e [ 538.415966][ C1] [] tcp_v4_rcv+0x1d22/0x1f46 [ 538.417188][ C1] [] ip_protocol_deliver_rcu+0x9c/0x8c0 [ 538.418780][ C1] [] ip_local_deliver_finish+0x12c/0x278 [ 538.420113][ C1] [] ip_local_deliver+0x160/0x464 [ 538.421759][ C1] [] ip_rcv_finish+0x162/0x1f6 [ 538.422943][ C1] [] ip_rcv+0xd4/0x3be [ 538.424242][ C1] [] __netif_receive_skb_one_core+0xf0/0x13a [ 538.425554][ C1] [] __netif_receive_skb+0x36/0xd8 [ 538.426853][ C1] [] process_backlog+0x206/0x4bc [ 538.428259][ C1] [] __napi_poll+0x7c/0x358 [ 538.429436][ C1] [] net_rx_action+0x5d0/0x702 [ 538.431260][ C1] [] __do_softirq+0x274/0x8fc [ 538.432814][ C1] [] do_softirq+0x158/0x15a [ 538.433955][ C1] [] __local_bh_enable_ip+0x282/0x2a4 [ 538.435148][ C1] [] ip_finish_output2+0x57c/0x1720 [ 538.436363][ C1] [] __ip_finish_output+0x25a/0x3ee [ 538.438450][ C1] [] ip_finish_output+0x3e/0x176 [ 538.439692][ C1] [] ip_output+0x1d0/0x2d0 [ 538.441428][ C1] [] __ip_queue_xmit+0x4a0/0xeb2 [ 538.442634][ C1] [] ip_queue_xmit+0x36/0x44 [ 538.442897][ T2032] Kernel panic - not syncing: corrupted stack end detected inside scheduler [ 538.445766][ C1] [] __tcp_transmit_skb+0xce4/0x1f5e [ 538.447187][ C1] [] tcp_write_xmit+0xd40/0x3344 [ 538.448806][ C1] [] __tcp_push_pending_frames+0x7a/0x22c [ 538.450383][ C1] [] tcp_push+0x19c/0x3b4 [ 538.451726][ C1] [] tcp_sendmsg_locked+0x5fc/0x1d9e [ 538.453754][ C1] [] tcp_sendmsg+0x32/0x4e [ 538.455167][ C1] [] inet_sendmsg+0x74/0x94 [ 538.457032][ C1] [] sock_sendmsg+0xa0/0xc4 [ 538.459036][ C1] [] sock_write_iter+0x1c0/0x272 [ 538.461027][ C1] [] new_sync_write+0x296/0x3aa [ 538.462774][ C1] [] vfs_write+0x2de/0x334 [ 538.464505][ C1] [] ksys_write+0x1c4/0x224 [ 538.466310][ C1] [] sys_write+0x28/0x36 [ 538.468050][ C1] [] ret_from_syscall+0x0/0x2 [ 538.470085][ C1] ================================================================== [ 538.470049][ T2032] CPU: 0 PID: 2032 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 538.472766][ T2032] Hardware name: riscv-virtio,qemu (DT) [ 538.472821][ C1] Disabling lock debugging due to kernel taint [ 538.474434][ T2032] Call Trace: [ 538.474526][ C1] Unable to handle kernel paging request at virtual address 3120382032332033 [ 538.476653][ T2032] [] dump_backtrace+0x2e/0x3c [ 538.477254][ C1] Oops [#1] [ 538.478305][ T2032] [] show_stack+0x34/0x40 [ 538.479212][ C1] Modules linked in: [ 538.480285][ T2032] [] dump_stack_lvl+0xe4/0x150 [ 538.481324][ C1] CPU: 1 PID: 2015 Comm: sshd Tainted: G B 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 538.482713][ T2032] [] dump_stack+0x1c/0x24 [ 538.484754][ C1] Hardware name: riscv-virtio,qemu (DT) [ 538.484982][ C1] epc : __wake_up_common+0x108/0x236 [ 538.486484][ T2032] [] panic+0x24a/0x634 [ 538.486862][ T2032] [] schedule+0x0/0x14c [ 538.488791][ C1] ra : __wake_up_common+0x108/0x236 [ 538.489921][ T2032] [] preempt_schedule_common+0x4e/0xde [ 538.491109][ C1] epc : ffffffff800f76ca ra : ffffffff800f76ca sp : ffffaf800c456200 [ 538.492462][ C1] gp : ffffffff85863ac0 tp : ffffaf800ba88000 t0 : ffffffff86bd9f98 [ 538.493818][ T2032] [] preempt_schedule+0x34/0x36 [ 538.495392][ C1] t1 : fffff5ef0b53c90c t2 : 0000000000000000 s0 : ffffaf800c456270 [ 538.495692][ C1] s1 : ffffffff8451f618 a0 : 0000000000000001 a1 : 0000000000000003 [ 538.497999][ C1] a2 : 1ffff5f001751001 a3 : ffffffff831afd3a a4 : 0000000000000000 [ 538.499455][ T2032] [] __kernfs_new_node+0x5e8/0x5f2 [ 538.501276][ C1] a5 : ffffaf800ba89000 a6 : 0000000000f00000 a7 : ffffaf805a9e4863 [ 538.502418][ C1] s2 : 312038203233201b s3 : 3120382032332033 s4 : 0000000000000000 [ 538.503710][ T2032] [] kernfs_create_dir_ns+0x6e/0x184 [ 538.505248][ C1] s5 : ffffaf800b7568d0 s6 : ffffaf800c4562b0 s7 : 0000000000000001 [ 538.506499][ C1] s8 : 0000000000000003 s9 : 0000000000000000 s10: 0000000000000000 [ 538.507617][ T2032] [] sysfs_create_dir_ns+0x10c/0x1ee [ 538.509146][ C1] s11: 0000000032203634 t3 : 00000000746e6961 t4 : fffff5ef0b53c90c [ 538.510628][ T2032] [] kobject_add_internal+0x1cc/0x65e [ 538.512233][ C1] t5 : fffff5ef0b53c90d t6 : ffffffff86bd9fc7 [ 538.512538][ C1] status: 0000000000000100 badaddr: 3120382032332033 cause: 000000000000000d [ 538.514949][ C1] [] __wake_up_common_lock+0xd6/0x136 [ 538.516788][ T2032] [] kobject_init_and_add+0xda/0x13c [ 538.518525][ T2032] [] netdev_queue_update_kobjects+0x1ac/0x3ba [ 538.519846][ C1] [] __wake_up+0x10/0x18 [ 538.522762][ C1] [] ep_poll_callback+0x194/0xa40 [ 538.521587][ T2032] [] netdev_register_kobject+0x1d4/0x208 [ 538.524379][ C1] [] __wake_up_common+0xb6/0x236 [ 538.525766][ T2032] [] register_netdevice+0x8ee/0xc6a [ 538.527474][ C1] [] __wake_up_common_lock+0xd6/0x136 [ 538.528830][ T2032] [] register_vlan_dev+0x202/0x578 [ 538.530279][ C1] [] __wake_up_sync_key+0x14/0x1e [ 538.531546][ T2032] [] vlan_newlink+0x2a6/0x34c [ 538.532879][ C1] [] sock_def_readable+0xe4/0x50e [ 538.534091][ T2032] [] __rtnl_newlink+0xc16/0xfa0 [ 538.535418][ C1] [] tcp_data_ready+0xa6/0x2e0 [ 538.536856][ T2032] [] rtnl_newlink+0x60/0x8c [ 538.538176][ T2032] [] rtnetlink_rcv_msg+0x338/0x9a0 [ 538.539281][ C1] [] tcp_rcv_established+0x146a/0x15e6 [ 538.540765][ T2032] [] netlink_rcv_skb+0xf8/0x2be [ 538.542066][ C1] [] tcp_v4_do_rcv+0x4b4/0x66e [ 538.543384][ C1] [] tcp_v4_rcv+0x1d22/0x1f46 [ 538.544346][ T2032] [] rtnetlink_rcv+0x26/0x30 [ 538.545416][ T2032] [] netlink_unicast+0x40e/0x5fe [ 538.546516][ C1] [] ip_protocol_deliver_rcu+0x9c/0x8c0 [ 538.548032][ T2032] [] netlink_sendmsg+0x4e0/0x994 [ 538.549448][ C1] [] ip_local_deliver_finish+0x12c/0x278 [ 538.550735][ T2032] [] sock_sendmsg+0xa0/0xc4 [ 538.552030][ C1] [] ip_local_deliver+0x160/0x464 [ 538.552480][ C1] [] ip_rcv_finish+0x162/0x1f6 [ 538.554606][ T2032] [] __sys_sendto+0x1f2/0x2e0 [ 538.555609][ C1] [] ip_rcv+0xd4/0x3be [ 538.556740][ T2032] [] sys_sendto+0x3e/0x52 [ 538.558973][ T2032] [] ret_from_syscall+0x0/0x2 [ 538.558061][ C1] [] __netif_receive_skb_one_core+0xf0/0x13a [ 538.559485][ C1] [] __netif_receive_skb+0x36/0xd8 [ 538.561759][ T2032] SMP: stopping secondary CPUs [ 538.562820][ C1] [] process_backlog+0x206/0x4bc [ 538.565202][ C1] [] __napi_poll+0x7c/0x358 [ 538.566406][ C1] [] net_rx_action+0x5d0/0x702 [ 538.567954][ C1] [] __do_softirq+0x274/0x8fc [ 538.569577][ C1] [] do_softirq+0x158/0x15a [ 538.571124][ C1] [] __local_bh_enable_ip+0x282/0x2a4 [ 538.572848][ C1] [] ip_finish_output2+0x57c/0x1720 [ 538.574671][ C1] [] __ip_finish_output+0x25a/0x3ee [ 538.576483][ C1] [] ip_finish_output+0x3e/0x176 [ 538.578308][ C1] [] ip_output+0x1d0/0x2d0 [ 538.579562][ C1] [] __ip_queue_xmit+0x4a0/0xeb2 [ 538.581202][ C1] [] ip_queue_xmit+0x36/0x44 [ 538.582628][ C1] [] __tcp_transmit_skb+0xce4/0x1f5e [ 538.584450][ C1] [] tcp_write_xmit+0xd40/0x3344 [ 538.586227][ C1] [] __tcp_push_pending_frames+0x7a/0x22c [ 538.588026][ C1] [] tcp_push+0x19c/0x3b4 [ 538.589093][ C1] [] tcp_sendmsg_locked+0x5fc/0x1d9e [ 538.590690][ C1] [] tcp_sendmsg+0x32/0x4e [ 538.592186][ C1] [] inet_sendmsg+0x74/0x94 [ 538.593605][ C1] [] sock_sendmsg+0xa0/0xc4 [ 538.595253][ C1] [] sock_write_iter+0x1c0/0x272 [ 538.596826][ C1] [] new_sync_write+0x296/0x3aa [ 538.598448][ C1] [] vfs_write+0x2de/0x334 [ 538.600060][ C1] [] ksys_write+0x1c4/0x224 [ 538.601570][ C1] [] sys_write+0x28/0x36 [ 538.603137][ C1] [] ret_from_syscall+0x0/0x2 [ 538.606112][ T2032] Rebooting in 86400 seconds.. VM DIAGNOSIS: 11:22:08 Registers: info registers vcpu 0 pc ffffffff80475ab2 mhartid 0000000000000000 mstatus 00000000000000a2 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff8000f97e sepc ffffffff80115bbc mcause 0000000000000009 scause 8000000000000009 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff802012a8 x2/sp ffffaf800e4cdb30 x3/gp ffffffff85863ac0 x4/tp ffffaf800d688000 x5/t0 ffffaf800a05e2e0 x6/t1 c2b4ec02e4d10200 x7/t2 00000000000014b3 x8/s0 ffffaf800e4cdc20 x9/s1 fffff5ef01c99ba0 x10/a0 000000000000c0e6 x11/a1 ffffaf800d688000 x12/a2 1ffff5f0019951c1 x13/a3 ffffffff82b83c96 x14/a4 ffffaf800d688000 x15/a5 0000000000000000 x16/a6 0000000000f00000 x17/a7 ffffffff827b4096 x18/s2 0000000000000000 x19/s3 ffffaf800cca8dc0 x20/s4 0000000000000014 x21/s5 000000000000013c x22/s6 ffffaf800cca8e0a x23/s7 0000000000000014 x24/s8 0000000000000014 x25/s9 ffffaf800cca8de8 x26/s10 ffffffff84b73e00 x27/s11 ffffffff827b42f8 x28/t3 fffffffff3f3f300 x29/t4 fffff5ef019951c8 x30/t5 fffff5ef019951c9 x31/t6 ffffaf800cca8df4 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffff801211d8 mhartid 0000000000000001 mstatus 00000000000000a0 mip 00000000000000a0 mie 000000000000022a mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff80162954 sepc ffffffff80201300 mcause 8000000000000007 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff801211d0 x2/sp ffffaf800c455d90 x3/gp ffffffff85863ac0 x4/tp ffffaf800ba88000 x5/t0 ffffffff86bcb657 x6/t1 ffffaf800c456020 x7/t2 0000000000000000 x8/s0 ffffaf800c455f50 x9/s1 ffffaf800c455ee0 x10/a0 0000007d5a76f174 x11/a1 00000000000f0000 x12/a2 0000000000000106 x13/a3 ffffffff8018d116 x14/a4 ffffaf800ba88000 x15/a5 0000000000000000 x16/a6 0000000000f00000 x17/a7 fffffffff2000000 x18/s2 0000000000000020 x19/s3 0000000000000100 x20/s4 ffffaf800c4560b8 x21/s5 0000000000000000 x22/s6 ffffffff838d2e60 x23/s7 ffffaf800c4560b8 x24/s8 0000000000000000 x25/s9 1ffff5f00188abbc x26/s10 ffffffff85889780 x27/s11 0000000032203634 x28/t3 1ffff5f00188ac04 x29/t4 fffffffef0b180cc x30/t5 fffffffef0b180ce x31/t6 ffffffff858c066c f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000