./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4190792273 <...> Warning: Permanently added '10.128.10.6' (ED25519) to the list of known hosts. execve("./syz-executor4190792273", ["./syz-executor4190792273"], 0x7ffd37acd970 /* 10 vars */) = 0 brk(NULL) = 0x55555630c000 brk(0x55555630ce00) = 0x55555630ce00 arch_prctl(ARCH_SET_FS, 0x55555630c480) = 0 set_tid_address(0x55555630c750) = 5797 set_robust_list(0x55555630c760, 24) = 0 rseq(0x55555630cda0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4190792273", 4096) = 28 getrandom("\xdd\x3e\x75\xf1\xaa\x31\x29\x0a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555630ce00 brk(0x55555632de00) = 0x55555632de00 brk(0x55555632e000) = 0x55555632e000 mprotect(0x7fc6dafb4000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7fc6daf008f0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fc6daf17a00}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7fc6daf008f0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fc6daf17a00}, NULL, 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555630c750) = 5798 ./strace-static-x86_64: Process 5798 attached [pid 5798] set_robust_list(0x55555630c760, 24) = 0 [pid 5798] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5798] setpgid(0, 0) = 0 [pid 5798] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5798] write(3, "1000", 4) = 4 [pid 5798] close(3) = 0 [pid 5798] write(1, "executing program\n", 18executing program ) = 18 [pid 5798] openat(AT_FDCWD, "/dev/vmci", O_RDWR) = 3 [pid 5798] ioctl(3, IOCTL_VMCI_VERSION2, 0x200000000000) = 65536 [pid 5798] ioctl(3, IOCTL_VMCI_INIT_CONTEXT, 0x200000000100) = 0 [pid 5798] ioctl(3, IOCTL_VMCI_CTX_SET_CPT_STATE, 0x200000001680) = 0 [pid 5798] openat(AT_FDCWD, "/dev/vmci", O_RDWR) = 4 [pid 5798] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LSM, insn_cnt=24, insns=0x2000000001c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=BPF_F_TEST_STATE_FREQ|BPF_F_SLEEPABLE, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148) = -1 EFAULT (Bad address) [pid 5798] ioctl(4, IOCTL_VMCI_VERSION2, 0x200000000100) = 524288 [pid 5798] mprotect(0x200000000000, 8388608, PROT_READ|PROT_EXEC) = 0 [pid 5798] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000140} --- [pid 5798] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000144} --- [pid 5798] ioctl(4, IOCTL_VMCI_INIT_CONTEXT, 0x200000000140) = -1 EFAULT (Bad address) [pid 5798] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000200} --- [pid 5798] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000208} --- [pid 5798] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000000020c} --- [ 233.139821][ T5798] ===================================================== [ 233.147748][ T5798] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 [ 233.155447][ T5798] _copy_to_user+0xcc/0x120 [ 233.160249][ T5798] vmci_host_unlocked_ioctl+0x1e7e/0x5200 [ 233.166753][ T5798] __se_sys_ioctl+0x23c/0x400 [ 233.171946][ T5798] __x64_sys_ioctl+0x97/0xe0 [ 233.177229][ T5798] x64_sys_call+0x1ebe/0x3db0 [ 233.182340][ T5798] do_syscall_64+0xd9/0x210 [ 233.187302][ T5798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.193686][ T5798] [ 233.196130][ T5798] Local variable __x.i.i created at: [ 233.201555][ T5798] copy_fpstate_to_sigframe+0x11f2/0x13d0 [ 233.207701][ T5798] get_sigframe+0xc6a/0x1020 [ 233.212670][ T5798] [ 233.215284][ T5798] Bytes 28-31 of 40 are uninitialized [ 233.220907][ T5798] Memory access of size 40 starts at ffff888131f74080 [ 233.228156][ T5798] Data copied to user address 000000000000a4bf [ 233.234742][ T5798] [ 233.237201][ T5798] CPU: 1 UID: 0 PID: 5798 Comm: syz-executor419 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(undef) [ 233.250189][ T5798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 233.260893][ T5798] ===================================================== [ 233.268199][ T5798] Disabling lock debugging due to kernel taint [ 233.274632][ T5798] Kernel panic - not syncing: kmsan.panic set ... [ 233.281252][ T5798] CPU: 1 UID: 0 PID: 5798 Comm: syz-executor419 Tainted: G B 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(undef) [ 233.295717][ T5798] Tainted: [B]=BAD_PAGE [ 233.300254][ T5798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 233.310472][ T5798] Call Trace: [ 233.313853][ T5798] [ 233.316964][ T5798] __dump_stack+0x26/0x30 [ 233.321517][ T5798] dump_stack_lvl+0x53/0x270 [ 233.326297][ T5798] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 233.332413][ T5798] dump_stack+0x1e/0x25 [ 233.336858][ T5798] panic+0x4bd/0xd50 [ 233.341122][ T5798] kmsan_report+0x31c/0x320 [ 233.345896][ T5798] ? kmsan_internal_check_memory+0x16c/0x230 [ 233.352076][ T5798] ? kmsan_copy_to_user+0xf1/0x190 [ 233.357365][ T5798] ? _copy_to_user+0xcc/0x120 [ 233.362233][ T5798] ? vmci_host_unlocked_ioctl+0x1e7e/0x5200 [ 233.368298][ T5798] ? __se_sys_ioctl+0x23c/0x400 [ 233.373374][ T5798] ? __x64_sys_ioctl+0x97/0xe0 [ 233.378346][ T5798] ? x64_sys_call+0x1ebe/0x3db0 [ 233.383725][ T5798] ? do_syscall_64+0xd9/0x210 [ 233.388750][ T5798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.395104][ T5798] ? kmsan_internal_unpoison_memory+0x14/0x20 [ 233.401441][ T5798] ? _raw_spin_unlock_irqrestore+0x3f/0x60 [ 233.407549][ T5798] ? stack_depot_save_flags+0x60f/0x7b0 [ 233.413328][ T5798] ? kmsan_get_metadata+0xfb/0x160 [ 233.418826][ T5798] ? kmsan_get_metadata+0xfb/0x160 [ 233.424228][ T5798] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 233.430829][ T5798] ? kmsan_internal_unpoison_memory+0x14/0x20 [ 233.437116][ T5798] ? kmsan_get_metadata+0xfb/0x160 [ 233.442493][ T5798] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 233.448543][ T5798] kmsan_internal_check_memory+0x16c/0x230 [ 233.454716][ T5798] kmsan_copy_to_user+0xf1/0x190 [ 233.459878][ T5798] _copy_to_user+0xcc/0x120 [ 233.464641][ T5798] vmci_host_unlocked_ioctl+0x1e7e/0x5200 [ 233.470560][ T5798] ? kmsan_get_metadata+0xfb/0x160 [ 233.475957][ T5798] ? __pfx_vmci_host_unlocked_ioctl+0x10/0x10 [ 233.482200][ T5798] __se_sys_ioctl+0x23c/0x400 [ 233.487418][ T5798] __x64_sys_ioctl+0x97/0xe0 [ 233.492445][ T5798] x64_sys_call+0x1ebe/0x3db0 [ 233.497396][ T5798] do_syscall_64+0xd9/0x210 [ 233.502048][ T5798] ? irqentry_exit+0x16/0x60 [ 233.506800][ T5798] ? clear_bhb_loop+0x40/0x90 [ 233.511709][ T5798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.517753][ T5798] RIP: 0033:0x7fc6daf41c79 [ 233.522288][ T5798] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 233.542647][ T5798] RSP: 002b:00007ffc7a5c69e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 233.551314][ T5798] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc6daf41c79 [ 233.559681][ T5798] RDX: 0000200000000200 RSI: 00000000000007ac RDI: 0000000000000003 [ 233.567991][ T5798] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 233.576119][ T5798] R10: 00007ffc7a5c69f0 R11: 0000000000000246 R12: 0000000000000001 [ 233.584664][ T5798] R13: 431bde82d7b634db R14: 00007ffc7a5c6a20 R15: 0000000000000001 [ 233.593015][ T5798] [ 233.596376][ T5798] Kernel Offset: disabled [ 233.600812][ T5798] Rebooting in 86400 seconds..