Warning: Permanently added '10.128.1.97' (ED25519) to the list of known hosts. executing program [ 51.317181][ T23] audit: type=1400 audit(1739079013.290:66): avc: denied { execmem } for pid=378 comm="syz-executor963" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 51.336458][ T23] audit: type=1400 audit(1739079013.300:67): avc: denied { read } for pid=379 comm="syz-executor963" name="msr" dev="devtmpfs" ino=9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 51.359611][ T23] audit: type=1400 audit(1739079013.300:68): avc: denied { open } for pid=379 comm="syz-executor963" path="/dev/cpu/0/msr" dev="devtmpfs" ino=9405 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 61.452186][ T538] ================================================================== [ 61.460079][ T538] BUG: KASAN: out-of-bounds in unwind_next_frame+0x1cd/0x1ea0 [ 61.467357][ T538] Read of size 8 at addr ffff8881eb7ef8d0 by task syz-executor963/538 [ 61.475338][ T538] [ 61.477522][ T538] CPU: 0 PID: 538 Comm: syz-executor963 Not tainted 5.4.289-syzkaller-00030-gcb850525fc3e #0 [ 61.487602][ T538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 [ 61.497492][ T538] Call Trace: [ 61.500636][ T538] dump_stack+0x1d8/0x241 [ 61.504786][ T538] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 61.510430][ T538] ? printk+0xd1/0x111 [ 61.514332][ T538] ? check_memory_region+0x6f/0x280 [ 61.519367][ T538] ? unwind_next_frame+0x1cd/0x1ea0 [ 61.524404][ T538] print_address_description+0x8c/0x600 [ 61.529791][ T538] ? widen_string+0x3a/0x310 [ 61.534206][ T538] ? get_reg+0x105/0x220 [ 61.538286][ T538] ? check_memory_region+0x6f/0x280 [ 61.543324][ T538] ? unwind_next_frame+0x1cd/0x1ea0 [ 61.548353][ T538] __kasan_report+0xf3/0x120 [ 61.552781][ T538] ? unwind_next_frame+0x1cd/0x1ea0 [ 61.557820][ T538] kasan_report+0x30/0x60 [ 61.561981][ T538] ? preempt_count_add+0x8f/0x180 [ 61.566861][ T538] unwind_next_frame+0x1cd/0x1ea0 [ 61.571721][ T538] ? check_memory_region+0x6f/0x280 [ 61.576757][ T538] ? unwind_get_return_address_ptr+0xa0/0xa0 [ 61.582557][ T538] ? arch_stack_walk+0xf5/0x140 [ 61.587244][ T538] ? check_memory_region+0x6f/0x280 [ 61.592271][ T538] ? retint_kernel+0x1b/0x1b [ 61.596696][ T538] ? stack_trace_save+0x118/0x1c0 [ 61.601567][ T538] ? stack_trace_snprint+0x170/0x170 [ 61.606687][ T538] ? get_stack_info+0x35/0x200 [ 61.611279][ T538] ? __unwind_start+0x583/0x890 [ 61.615968][ T538] ? deref_stack_reg+0x1f0/0x1f0 [ 61.620739][ T538] ? proc_pid_stack+0x8d/0x1e0 [ 61.625338][ T538] ? proc_single_show+0xda/0x160 [ 61.630205][ T538] ? seq_read+0x4df/0xe60 [ 61.634381][ T538] ? do_preadv+0x20e/0x350 [ 61.638624][ T538] ? in_sched_functions+0x9/0x40 [ 61.643401][ T538] ? stack_trace_save_tsk+0x4b0/0x4b0 [ 61.648619][ T538] arch_stack_walk+0x111/0x140 [ 61.653242][ T538] ? check_memory_region+0x6f/0x280 [ 61.658251][ T538] stack_trace_save_tsk+0x309/0x4b0 [ 61.663278][ T538] ? stack_trace_consume_entry+0x240/0x240 [ 61.669005][ T538] ? _raw_spin_lock+0xa4/0x1b0 [ 61.673615][ T538] ? down_read_interruptible+0x220/0x220 [ 61.679073][ T538] proc_pid_stack+0x125/0x1e0 [ 61.683589][ T538] proc_single_show+0xda/0x160 [ 61.688198][ T538] seq_read+0x4df/0xe60 [ 61.692198][ T538] do_iter_read+0x3e8/0x580 [ 61.696519][ T538] do_preadv+0x20e/0x350 [ 61.700593][ T538] ? vfs_writev+0x350/0x350 [ 61.704951][ T538] do_syscall_64+0xca/0x1c0 [ 61.709366][ T538] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 61.715108][ T538] RIP: 0033:0x7f44b233c2e9 [ 61.719340][ T538] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 61.738889][ T538] RSP: 002b:00007f44b22d9198 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 61.747136][ T538] RAX: ffffffffffffffda RBX: 00007f44b23c3338 RCX: 00007f44b233c2e9 [ 61.754944][ T538] RDX: 0000000000000332 RSI: 00004000000017c0 RDI: 0000000000000004 [ 61.762756][ T538] RBP: 00007f44b23c3330 R08: 0000000000000000 R09: 65732f636f72702f [ 61.770566][ T538] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f44b23900ac [ 61.778379][ T538] R13: 00007f44b22d91a0 R14: 00004000000000c0 R15: 00004000000017c0 [ 61.786192][ T538] [ 61.788354][ T538] The buggy address belongs to the page: [ 61.793837][ T538] page:ffffea0007adfbc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 61.802767][ T538] flags: 0x8000000000000000() [ 61.807285][ T538] raw: 8000000000000000 0000000000000000 ffffea0007adfbc8 0000000000000000 [ 61.815710][ T538] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 61.824121][ T538] page dumped because: kasan: bad access detected [ 61.830385][ T538] page_owner tracks the page as allocated [ 61.835924][ T538] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO) [ 61.847149][ T538] prep_new_page+0x18f/0x370 [ 61.851546][ T538] get_page_from_freelist+0x2d13/0x2d90 [ 61.856930][ T538] __alloc_pages_nodemask+0x393/0x840 [ 61.862134][ T538] dup_task_struct+0x85/0x600 [ 61.866653][ T538] copy_process+0x56d/0x3230 [ 61.871078][ T538] _do_fork+0x197/0x900 [ 61.875067][ T538] __x64_sys_clone+0x26b/0x2c0 [ 61.879669][ T538] do_syscall_64+0xca/0x1c0 [ 61.884007][ T538] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 61.889741][ T538] page last free stack trace: [ 61.894248][ T538] __free_pages_ok+0x847/0x950 [ 61.898871][ T538] __free_pages+0x91/0x140 [ 61.903099][ T538] put_task_stack+0x212/0x260 [ 61.907623][ T538] finish_task_switch+0x24a/0x590 [ 61.912482][ T538] __schedule+0xb0d/0x1320 [ 61.916726][ T538] schedule_idle+0x50/0x80 [ 61.920979][ T538] do_idle+0x609/0x660 [ 61.924884][ T538] cpu_startup_entry+0x14/0x20 [ 61.929487][ T538] start_secondary+0x3a5/0x460 [ 61.934084][ T538] secondary_startup_64+0xa4/0xb0 [ 61.939029][ T538] [ 61.941197][ T538] Memory state around the buggy address: [ 61.946778][ T538] ffff8881eb7ef780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 61.954676][ T538] ffff8881eb7ef800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 61.962573][ T538] >ffff8881eb7ef880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 61.970464][ T538] ^ [ 61.976979][ T538] ffff8881eb7ef900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 61.984878][ T538] ffff8881eb7ef980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 61.992770][ T538] ================================================================== [ 62.000763][ T538] Disabling lock debugging due to kernel taint executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 66.389460][ T24] cfg80211: failed to load regulatory.db executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program