./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor323305328 <...> DUID 00:04:03:2c:e5:fc:a2:19:b8:8b:c5:bf:62:63:19:3a:75:c6 forked to background, child pid 3189 [ 23.691148][ T3190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.700150][ T3190] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.20' (ECDSA) to the list of known hosts. execve("./syz-executor323305328", ["./syz-executor323305328"], 0x7ffc19349ce0 /* 10 vars */) = 0 brk(NULL) = 0x555555824000 brk(0x555555824c40) = 0x555555824c40 arch_prctl(ARCH_SET_FS, 0x555555824300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor323305328", 4096) = 27 brk(0x555555845c40) = 0x555555845c40 brk(0x555555846000) = 0x555555846000 mprotect(0x7f4216197000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555558245d0) = 3618 ./strace-static-x86_64: Process 3618 attached [pid 3618] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3618] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3618] setsid() = 1 [pid 3618] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3618] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3618] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3618] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3618] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3618] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3618] unshare(CLONE_NEWNS) = 0 [pid 3618] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3618] unshare(CLONE_NEWIPC) = 0 [pid 3618] unshare(CLONE_NEWCGROUP) = 0 [pid 3618] unshare(CLONE_NEWUTS) = 0 [pid 3618] unshare(CLONE_SYSVSEM) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "16777216", 8) = 8 [pid 3618] close(3) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "536870912", 9) = 9 [pid 3618] close(3) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "1024", 4) = 4 [pid 3618] close(3) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "8192", 4) = 4 [pid 3618] close(3) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "1024", 4) = 4 [pid 3618] close(3) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "1024", 4) = 4 [pid 3618] close(3) = 0 [pid 3618] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3618] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3618] close(3) = 0 [pid 3618] getpid() = 1 [pid 3618] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 3618] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555558245d0) = 3 ./strace-static-x86_64: Process 3628 attached [pid 3628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3628] setpgid(0, 0) = 0 [pid 3628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "1000", 4) = 4 [pid 3628] close(3) = 0 [pid 3628] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 3628] ioctl(3, SIOCADDRT, 0x200000c0) = -1 EEXIST (File exists) [pid 3628] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20000b40, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [pid 3628] bpf(BPF_PROG_TEST_RUN, {test={prog_fd=4, retval=672, data_size_in=761, data_size_out=772, data_in=0x20000040, data_out=NULL, repeat=260, duration=0}}, 40) = 0 [pid 3628] close(3) = 0 [pid 3628] close(4) = 0 [pid 3628] close(5) = -1 EBADF (Bad file descriptor) [pid 3628] close(6) = -1 EBADF (Bad file descriptor) [pid 3628] close(7) = -1 EBADF (Bad file descriptor) [pid 3628] close(8) = -1 EBADF (Bad file descriptor) [pid 3628] close(9) = -1 EBADF (Bad file descriptor) [pid 3628] close(10) = -1 EBADF (Bad file descriptor) [pid 3628] close(11) = -1 EBADF (Bad file descriptor) [pid 3628] close(12) = -1 EBADF (Bad file descriptor) [pid 3628] close(13) = -1 EBADF (Bad file descriptor) [ 42.981310][ T3627] syz-executor323 (3627) used greatest stack depth: 22816 bytes left [pid 3628] close(14) = -1 EBADF (Bad file descriptor) [pid 3628] close(15) = -1 EBADF (Bad file descriptor) [pid 3628] close(16) = -1 EBADF (Bad file descriptor) [pid 3628] close(17) = -1 EBADF (Bad file descriptor) [pid 3628] close(18) = -1 EBADF (Bad file descriptor) [pid 3628] close(19) = -1 EBADF (Bad file descriptor) [pid 3628] close(20) = -1 EBADF (Bad file descriptor) [pid 3628] close(21) = -1 EBADF (Bad file descriptor) [pid 3628] close(22) = -1 EBADF (Bad file descriptor) [pid 3628] close(23) = -1 EBADF (Bad file descriptor) [pid 3628] close(24) = -1 EBADF (Bad file descriptor) [pid 3628] close(25) = -1 EBADF (Bad file descriptor) [pid 3628] close(26) = -1 EBADF (Bad file descriptor) [pid 3628] close(27) = -1 EBADF (Bad file descriptor) [pid 3628] close(28) = -1 EBADF (Bad file descriptor) [pid 3628] close(29) = -1 EBADF (Bad file descriptor) [pid 3628] exit_group(0) = ? [pid 3628] +++ exited with 0 +++ [pid 3618] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 3618] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3618] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3629 attached , child_tidptr=0x5555558245d0) = 4 [pid 3629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3629] setpgid(0, 0) = 0 [pid 3629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3629] write(3, "1000", 4) = 4 [pid 3629] close(3) = 0 [pid 3629] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 3629] ioctl(3, SIOCADDRT, 0x200000c0) = -1 EEXIST (File exists) [pid 3629] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20000b40, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [pid 3629] bpf(BPF_PROG_TEST_RUN, {test={prog_fd=4, retval=672, data_size_in=761, data_size_out=772, data_in=0x20000040, data_out=NULL, repeat=260, duration=0}}, 40) = 0 [pid 3629] close(3) = 0 [pid 3629] close(4) = 0 [pid 3629] close(5) = -1 EBADF (Bad file descriptor) [pid 3629] close(6) = -1 EBADF (Bad file descriptor) [pid 3629] close(7) = -1 EBADF (Bad file descriptor) [pid 3629] close(8) = -1 EBADF (Bad file descriptor) [pid 3629] close(9) = -1 EBADF (Bad file descriptor) [pid 3629] close(10) = -1 EBADF (Bad file descriptor) [pid 3629] close(11) = -1 EBADF (Bad file descriptor) [pid 3629] close(12) = -1 EBADF (Bad file descriptor) [pid 3629] close(13) = -1 EBADF (Bad file descriptor) [pid 3629] close(14) = -1 EBADF (Bad file descriptor) [pid 3629] close(15) = -1 EBADF (Bad file descriptor) [pid 3629] close(16) = -1 EBADF (Bad file descriptor) [pid 3629] close(17) = -1 EBADF (Bad file descriptor) [pid 3629] close(18) = -1 EBADF (Bad file descriptor) [pid 3629] close(19) = -1 EBADF (Bad file descriptor) [pid 3629] close(20) = -1 EBADF (Bad file descriptor) [pid 3629] close(21) = -1 EBADF (Bad file descriptor) [pid 3629] close(22) = -1 EBADF (Bad file descriptor) [pid 3629] close(23) = -1 EBADF (Bad file descriptor) [pid 3629] close(24) = -1 EBADF (Bad file descriptor) [pid 3629] close(25) = -1 EBADF (Bad file descriptor) [pid 3629] close(26) = -1 EBADF (Bad file descriptor) [pid 3629] close(27) = -1 EBADF (Bad file descriptor) [pid 3629] close(28) = -1 EBADF (Bad file descriptor) [pid 3629] close(29) = -1 EBADF (Bad file descriptor) [pid 3629] exit_group(0) = ? [pid 3629] +++ exited with 0 +++ [pid 3618] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 3618] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555558245d0) = 5 ./strace-static-x86_64: Process 3630 attached [pid 3630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3630] setpgid(0, 0) = 0 [pid 3630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "1000", 4) = 4 [pid 3630] close(3) = 0 [pid 3630] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 3630] ioctl(3, SIOCADDRT, 0x200000c0) = -1 EEXIST (File exists) [pid 3630] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20000b40, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [ 43.130672][ T3630] ================================================================== [ 43.138759][ T3630] BUG: KASAN: use-after-free in __skb_flow_dissect+0x9bf/0x5920 [ 43.146384][ T3630] Read of size 1 at addr ffff88816f4c000e by task syz-executor323/3630 [ 43.154602][ T3630] [ 43.156910][ T3630] CPU: 0 PID: 3630 Comm: syz-executor323 Not tainted 6.0.0-rc6-next-20220923-syzkaller #0 [ 43.166778][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 43.176821][ T3630] Call Trace: [ 43.180095][ T3630] [ 43.183026][ T3630] dump_stack_lvl+0xcd/0x134 [ 43.187637][ T3630] print_report+0x15e/0x45d [ 43.192151][ T3630] ? __phys_addr+0xc4/0x140 [ 43.196660][ T3630] ? __skb_flow_dissect+0x9bf/0x5920 [ 43.201959][ T3630] kasan_report+0xbb/0x1f0 [ 43.206394][ T3630] ? __skb_flow_dissect+0x9bf/0x5920 [ 43.212035][ T3630] __skb_flow_dissect+0x9bf/0x5920 [ 43.217168][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.222658][ T3630] ? lock_release+0x5cb/0x810 [ 43.227349][ T3630] ? __kernel_text_address+0x9/0x30 [ 43.232574][ T3630] ? bpf_flow_dissect+0x360/0x360 [ 43.237610][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 43.242470][ T3630] ? rwlock_bug.part.0+0x90/0x90 [ 43.247415][ T3630] ? iptunnel_xmit+0x67a/0x9e0 [ 43.252194][ T3630] ? _raw_spin_unlock_irqrestore+0x50/0x70 [ 43.258014][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 43.263043][ T3630] ? __stack_depot_save+0x260/0x560 [ 43.268251][ T3630] ? kvm_sched_clock_read+0x14/0x40 [ 43.273455][ T3630] ? sched_clock_cpu+0x69/0x2b0 [ 43.278312][ T3630] ? save_stack+0xbb/0x1e0 [ 43.282739][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.288213][ T3630] ? lock_release+0x5cb/0x810 [ 43.292899][ T3630] ? page_ext_put+0x27/0xb0 [ 43.297412][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 43.302265][ T3630] ? ref_tracker_alloc+0x14c/0x550 [ 43.307383][ T3630] ? __set_page_owner_handle+0x104/0x3b0 [ 43.313038][ T3630] ? page_ext_put+0x49/0xb0 [ 43.317564][ T3630] ? __set_page_owner+0x4c/0x60 [ 43.322422][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.327897][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.332582][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.338063][ T3630] ? lock_release+0x5cb/0x810 [ 43.342745][ T3630] ? is_bpf_text_address+0x77/0x170 [ 43.347960][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 43.352818][ T3630] ? unwind_next_frame+0xfa9/0x1cc0 [ 43.358032][ T3630] __skb_get_hash+0xb6/0x4b0 [ 43.362636][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.368112][ T3630] ? __skb_get_hash_symmetric+0x3e0/0x3e0 [ 43.373839][ T3630] ? __stack_depot_save+0x260/0x560 [ 43.379050][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 43.383908][ T3630] ? _raw_spin_unlock_irqrestore+0x50/0x70 [ 43.389745][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 43.394776][ T3630] ? _raw_spin_unlock_irqrestore+0x3d/0x70 [ 43.400595][ T3630] ip_tunnel_xmit+0x18f0/0x3170 [ 43.405458][ T3630] ? lock_release+0x5cb/0x810 [ 43.410137][ T3630] ? kasan_save_stack+0x1e/0x40 [ 43.415000][ T3630] ? is_bpf_text_address+0x77/0x170 [ 43.420210][ T3630] ? lock_downgrade+0x670/0x6e0 [ 43.425068][ T3630] ? __sanitizer_cov_trace_switch+0x50/0x90 [ 43.430978][ T3630] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 43.436269][ T3630] ? skb_network_protocol+0x134/0x580 [ 43.441648][ T3630] ? bpf_prog_801cabf80fc815cd+0x59/0x5e [ 43.447282][ T3630] ? skb_crc32c_csum_help+0x70/0x70 [ 43.452496][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.457185][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.462658][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.467340][ T3630] ipip_tunnel_xmit+0x413/0x510 [ 43.472201][ T3630] dev_hard_start_xmit+0x1be/0x990 [ 43.477323][ T3630] __dev_queue_xmit+0x2c9a/0x3b60 [ 43.482360][ T3630] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 43.487652][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.492333][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.497812][ T3630] ? lock_release+0x5cb/0x810 [ 43.502491][ T3630] ? ___neigh_create+0x188e/0x2a20 [ 43.507610][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.513090][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.517770][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.523244][ T3630] ? lock_release+0x5cb/0x810 [ 43.527923][ T3630] ? lock_release+0x810/0x810 [ 43.532607][ T3630] ? ip_finish_output2+0x782/0x2170 [ 43.537818][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 43.542675][ T3630] ? __local_bh_enable_ip+0xa0/0x120 [ 43.547971][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 43.553001][ T3630] ? ___neigh_create+0x188e/0x2a20 [ 43.558114][ T3630] ? __local_bh_enable_ip+0xa0/0x120 [ 43.563406][ T3630] ? ___neigh_create+0xf81/0x2a20 [ 43.568436][ T3630] neigh_connected_output+0x3c0/0x520 [ 43.573829][ T3630] ip_finish_output2+0x782/0x2170 [ 43.578870][ T3630] ? nf_hook+0x20d/0x5b0 [ 43.583124][ T3630] ? ip_fragment.constprop.0+0x240/0x240 [ 43.588772][ T3630] ? ip_mc_finish_output+0x5a0/0x5a0 [ 43.594070][ T3630] ? dst_output+0x170/0x170 [ 43.598597][ T3630] ? lock_release+0x5cb/0x810 [ 43.603284][ T3630] __ip_finish_output+0x396/0x650 [ 43.608335][ T3630] ip_finish_output+0x2d/0x280 [ 43.613119][ T3630] ip_mc_output+0x21b/0x700 [ 43.617642][ T3630] ip_local_out+0xaf/0x1a0 [ 43.622074][ T3630] iptunnel_xmit+0x67a/0x9e0 [ 43.626684][ T3630] ip_tunnel_xmit+0x143f/0x3170 [ 43.631553][ T3630] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 43.636851][ T3630] ? skb_network_protocol+0x151/0x580 [ 43.642235][ T3630] ? __gre_xmit+0x4f4/0x9a0 [ 43.646766][ T3630] ipgre_xmit+0x6e0/0x900 [ 43.651114][ T3630] dev_hard_start_xmit+0x1be/0x990 [ 43.656237][ T3630] __dev_queue_xmit+0x2c9a/0x3b60 [ 43.661270][ T3630] ? setup_object+0x1a/0xa0 [ 43.665785][ T3630] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 43.671077][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 43.676110][ T3630] ? __kmem_cache_alloc_node+0x1d8/0x3d0 [ 43.681756][ T3630] ? skb_release_data+0x565/0x870 [ 43.686794][ T3630] ? skb_headers_offset_update+0x125/0x250 [ 43.692612][ T3630] ? pskb_expand_head+0x5f8/0x1110 [ 43.697740][ T3630] __bpf_redirect+0x666/0xe40 [ 43.702427][ T3630] ? skb_ensure_writable+0xdc/0x450 [ 43.707643][ T3630] bpf_clone_redirect+0x2ae/0x420 [ 43.712678][ T3630] bpf_prog_801cabf80fc815cd+0x59/0x5e [ 43.718143][ T3630] ? __stack_depot_save+0x3a/0x560 [ 43.723263][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.728739][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.733422][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.738899][ T3630] ? lock_release+0x5cb/0x810 [ 43.743600][ T3630] ? lock_release+0x810/0x810 [ 43.748278][ T3630] ? bpf_test_timer_enter+0xa0/0x160 [ 43.753587][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 43.758443][ T3630] ? do_syscall_64+0x35/0xb0 [ 43.763039][ T3630] ? lock_release+0x810/0x810 [ 43.767718][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.773192][ T3630] ? lock_release+0x5cb/0x810 [ 43.777873][ T3630] ? __debug_object_init+0x409/0xd10 [ 43.783175][ T3630] ? ktime_get+0x38a/0x470 [ 43.787608][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 43.792641][ T3630] ? ktime_get+0x38a/0x470 [ 43.797074][ T3630] ? ktime_get+0x30b/0x470 [ 43.801531][ T3630] ? bpf_test_timer_continue+0x12e/0x410 [ 43.807184][ T3630] bpf_test_run+0x381/0x9d0 [ 43.811705][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.816388][ T3630] ? lock_acquire+0x4fc/0x630 [ 43.821070][ T3630] ? bpf_test_timer_continue+0x410/0x410 [ 43.826719][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.832195][ T3630] ? map_id_range_down+0x1c4/0x340 [ 43.837323][ T3630] ? __phys_addr+0xc4/0x140 [ 43.841829][ T3630] ? memset+0x20/0x40 [ 43.845816][ T3630] ? eth_type_trans+0x2a8/0x640 [ 43.850685][ T3630] ? __build_skb+0x50/0x60 [ 43.855118][ T3630] bpf_prog_test_run_skb+0xbab/0x1e60 [ 43.860514][ T3630] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 43.866254][ T3630] ? __fget_light+0x20a/0x270 [ 43.870946][ T3630] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 43.876687][ T3630] __sys_bpf+0x10a0/0x4cf0 [ 43.881115][ T3630] ? lock_release+0x810/0x810 [ 43.885799][ T3630] ? bpf_perf_link_attach+0x520/0x520 [ 43.891178][ T3630] ? do_raw_spin_lock+0x120/0x2a0 [ 43.896210][ T3630] ? rwlock_bug.part.0+0x90/0x90 [ 43.901157][ T3630] ? recalc_sigpending_tsk+0x18f/0x1d0 [ 43.906645][ T3630] ? _raw_spin_unlock_irq+0x1f/0x40 [ 43.911859][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 43.916890][ T3630] __x64_sys_bpf+0x75/0xb0 [ 43.921317][ T3630] do_syscall_64+0x35/0xb0 [ 43.925740][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.931650][ T3630] RIP: 0033:0x7f4216122e69 [ 43.936069][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.955681][ T3630] RSP: 002b:00007fff879260a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 43.964102][ T3630] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4216122e69 [ 43.972163][ T3630] RDX: 0000000000000028 RSI: 0000000020000080 RDI: 000000000000000a [ 43.980138][ T3630] RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d [ 43.988109][ T3630] R10: 000000000000000d R11: 0000000000000246 R12: 00007fff879260c0 [ 43.996084][ T3630] R13: 00000000000f4240 R14: 000000000000a815 R15: 00007fff879260b4 [ 44.004064][ T3630] [ 44.007080][ T3630] [ 44.009398][ T3630] The buggy address belongs to the physical page: [ 44.015800][ T3630] page:ffffea0005bd3000 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16f4c0 [ 44.026040][ T3630] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 44.033419][ T3630] raw: 057ff00000000000 ffffea0005bd3008 ffffea0005bd3008 0000000000000000 [ 44.042002][ T3630] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 44.050578][ T3630] page dumped because: kasan: bad access detected [ 44.056999][ T3630] page_owner info is not present (never set?) [ 44.063055][ T3630] [ 44.065373][ T3630] Memory state around the buggy address: [ 44.070995][ T3630] ffff88816f4bff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.079057][ T3630] ffff88816f4bff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.087114][ T3630] >ffff88816f4c0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.095170][ T3630] ^ [ 44.099495][ T3630] ffff88816f4c0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.107557][ T3630] ffff88816f4c0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 44.115610][ T3630] ================================================================== [ 44.123712][ T3630] Kernel panic - not syncing: panic_on_warn set ... [ 44.130306][ T3630] CPU: 0 PID: 3630 Comm: syz-executor323 Not tainted 6.0.0-rc6-next-20220923-syzkaller #0 [ 44.140215][ T3630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 44.150280][ T3630] Call Trace: [ 44.153563][ T3630] [ 44.156496][ T3630] dump_stack_lvl+0xcd/0x134 [ 44.161110][ T3630] panic+0x2c8/0x622 [ 44.165008][ T3630] ? panic_print_sys_info.part.0+0x110/0x110 [ 44.170994][ T3630] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 44.177174][ T3630] end_report.part.0+0x3f/0x7c [ 44.181945][ T3630] ? __skb_flow_dissect+0x9bf/0x5920 [ 44.187237][ T3630] kasan_report.cold+0xa/0xf [ 44.191834][ T3630] ? __skb_flow_dissect+0x9bf/0x5920 [ 44.197127][ T3630] __skb_flow_dissect+0x9bf/0x5920 [ 44.202248][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.207723][ T3630] ? lock_release+0x5cb/0x810 [ 44.212402][ T3630] ? __kernel_text_address+0x9/0x30 [ 44.217618][ T3630] ? bpf_flow_dissect+0x360/0x360 [ 44.222650][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 44.227506][ T3630] ? rwlock_bug.part.0+0x90/0x90 [ 44.232453][ T3630] ? iptunnel_xmit+0x67a/0x9e0 [ 44.237233][ T3630] ? _raw_spin_unlock_irqrestore+0x50/0x70 [ 44.243055][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 44.248085][ T3630] ? __stack_depot_save+0x260/0x560 [ 44.253293][ T3630] ? kvm_sched_clock_read+0x14/0x40 [ 44.258497][ T3630] ? sched_clock_cpu+0x69/0x2b0 [ 44.263355][ T3630] ? save_stack+0xbb/0x1e0 [ 44.267778][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.273253][ T3630] ? lock_release+0x5cb/0x810 [ 44.277988][ T3630] ? page_ext_put+0x27/0xb0 [ 44.282590][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 44.287446][ T3630] ? ref_tracker_alloc+0x14c/0x550 [ 44.292567][ T3630] ? __set_page_owner_handle+0x104/0x3b0 [ 44.298208][ T3630] ? page_ext_put+0x49/0xb0 [ 44.302720][ T3630] ? __set_page_owner+0x4c/0x60 [ 44.307579][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.313058][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.317743][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.323217][ T3630] ? lock_release+0x5cb/0x810 [ 44.327897][ T3630] ? is_bpf_text_address+0x77/0x170 [ 44.333112][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 44.337969][ T3630] ? unwind_next_frame+0xfa9/0x1cc0 [ 44.343182][ T3630] __skb_get_hash+0xb6/0x4b0 [ 44.347783][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.353258][ T3630] ? __skb_get_hash_symmetric+0x3e0/0x3e0 [ 44.358984][ T3630] ? __stack_depot_save+0x260/0x560 [ 44.364190][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 44.369051][ T3630] ? _raw_spin_unlock_irqrestore+0x50/0x70 [ 44.374871][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 44.379900][ T3630] ? _raw_spin_unlock_irqrestore+0x3d/0x70 [ 44.385719][ T3630] ip_tunnel_xmit+0x18f0/0x3170 [ 44.390579][ T3630] ? lock_release+0x5cb/0x810 [ 44.395260][ T3630] ? kasan_save_stack+0x1e/0x40 [ 44.400127][ T3630] ? is_bpf_text_address+0x77/0x170 [ 44.405338][ T3630] ? lock_downgrade+0x670/0x6e0 [ 44.410195][ T3630] ? __sanitizer_cov_trace_switch+0x50/0x90 [ 44.416104][ T3630] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 44.421395][ T3630] ? skb_network_protocol+0x134/0x580 [ 44.426771][ T3630] ? bpf_prog_801cabf80fc815cd+0x59/0x5e [ 44.432409][ T3630] ? skb_crc32c_csum_help+0x70/0x70 [ 44.437612][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.442292][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.447769][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.452456][ T3630] ipip_tunnel_xmit+0x413/0x510 [ 44.457322][ T3630] dev_hard_start_xmit+0x1be/0x990 [ 44.462445][ T3630] __dev_queue_xmit+0x2c9a/0x3b60 [ 44.467484][ T3630] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 44.472777][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.477462][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.482941][ T3630] ? lock_release+0x5cb/0x810 [ 44.487623][ T3630] ? ___neigh_create+0x188e/0x2a20 [ 44.492735][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.498212][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.502894][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.508372][ T3630] ? lock_release+0x5cb/0x810 [ 44.513054][ T3630] ? lock_release+0x810/0x810 [ 44.517732][ T3630] ? ip_finish_output2+0x782/0x2170 [ 44.522947][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 44.527800][ T3630] ? __local_bh_enable_ip+0xa0/0x120 [ 44.533179][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 44.538211][ T3630] ? ___neigh_create+0x188e/0x2a20 [ 44.543411][ T3630] ? __local_bh_enable_ip+0xa0/0x120 [ 44.548704][ T3630] ? ___neigh_create+0xf81/0x2a20 [ 44.553734][ T3630] neigh_connected_output+0x3c0/0x520 [ 44.559129][ T3630] ip_finish_output2+0x782/0x2170 [ 44.564173][ T3630] ? nf_hook+0x20d/0x5b0 [ 44.568435][ T3630] ? ip_fragment.constprop.0+0x240/0x240 [ 44.574083][ T3630] ? ip_mc_finish_output+0x5a0/0x5a0 [ 44.579392][ T3630] ? dst_output+0x170/0x170 [ 44.583908][ T3630] ? lock_release+0x5cb/0x810 [ 44.588593][ T3630] __ip_finish_output+0x396/0x650 [ 44.593640][ T3630] ip_finish_output+0x2d/0x280 [ 44.598421][ T3630] ip_mc_output+0x21b/0x700 [ 44.602942][ T3630] ip_local_out+0xaf/0x1a0 [ 44.607375][ T3630] iptunnel_xmit+0x67a/0x9e0 [ 44.611986][ T3630] ip_tunnel_xmit+0x143f/0x3170 [ 44.616851][ T3630] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 44.622142][ T3630] ? skb_network_protocol+0x151/0x580 [ 44.627529][ T3630] ? __gre_xmit+0x4f4/0x9a0 [ 44.632052][ T3630] ipgre_xmit+0x6e0/0x900 [ 44.636401][ T3630] dev_hard_start_xmit+0x1be/0x990 [ 44.641534][ T3630] __dev_queue_xmit+0x2c9a/0x3b60 [ 44.647178][ T3630] ? setup_object+0x1a/0xa0 [ 44.651697][ T3630] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 44.656999][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 44.662032][ T3630] ? __kmem_cache_alloc_node+0x1d8/0x3d0 [ 44.667683][ T3630] ? skb_release_data+0x565/0x870 [ 44.672722][ T3630] ? skb_headers_offset_update+0x125/0x250 [ 44.678537][ T3630] ? pskb_expand_head+0x5f8/0x1110 [ 44.683664][ T3630] __bpf_redirect+0x666/0xe40 [ 44.688347][ T3630] ? skb_ensure_writable+0xdc/0x450 [ 44.693560][ T3630] bpf_clone_redirect+0x2ae/0x420 [ 44.698597][ T3630] bpf_prog_801cabf80fc815cd+0x59/0x5e [ 44.704060][ T3630] ? __stack_depot_save+0x3a/0x560 [ 44.709189][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.714673][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.719367][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.724843][ T3630] ? lock_release+0x5cb/0x810 [ 44.729527][ T3630] ? lock_release+0x810/0x810 [ 44.734208][ T3630] ? bpf_test_timer_enter+0xa0/0x160 [ 44.739514][ T3630] ? lock_downgrade+0x6e0/0x6e0 [ 44.744806][ T3630] ? do_syscall_64+0x35/0xb0 [ 44.749400][ T3630] ? lock_release+0x810/0x810 [ 44.754080][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.759556][ T3630] ? lock_release+0x5cb/0x810 [ 44.764250][ T3630] ? __debug_object_init+0x409/0xd10 [ 44.769551][ T3630] ? ktime_get+0x38a/0x470 [ 44.773982][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 44.779012][ T3630] ? ktime_get+0x38a/0x470 [ 44.783443][ T3630] ? ktime_get+0x30b/0x470 [ 44.787876][ T3630] ? bpf_test_timer_continue+0x12e/0x410 [ 44.793531][ T3630] bpf_test_run+0x381/0x9d0 [ 44.798052][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.802742][ T3630] ? lock_acquire+0x4fc/0x630 [ 44.807422][ T3630] ? bpf_test_timer_continue+0x410/0x410 [ 44.813069][ T3630] ? rcu_read_lock_sched_held+0xd/0x70 [ 44.818547][ T3630] ? map_id_range_down+0x1c4/0x340 [ 44.823881][ T3630] ? __phys_addr+0xc4/0x140 [ 44.828475][ T3630] ? memset+0x20/0x40 [ 44.832464][ T3630] ? eth_type_trans+0x2a8/0x640 [ 44.837334][ T3630] ? __build_skb+0x50/0x60 [ 44.841760][ T3630] bpf_prog_test_run_skb+0xbab/0x1e60 [ 44.847156][ T3630] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 44.852895][ T3630] ? __fget_light+0x20a/0x270 [ 44.857602][ T3630] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 44.863360][ T3630] __sys_bpf+0x10a0/0x4cf0 [ 44.867798][ T3630] ? lock_release+0x810/0x810 [ 44.872484][ T3630] ? bpf_perf_link_attach+0x520/0x520 [ 44.877862][ T3630] ? do_raw_spin_lock+0x120/0x2a0 [ 44.882894][ T3630] ? rwlock_bug.part.0+0x90/0x90 [ 44.887844][ T3630] ? recalc_sigpending_tsk+0x18f/0x1d0 [ 44.893329][ T3630] ? _raw_spin_unlock_irq+0x1f/0x40 [ 44.898539][ T3630] ? trace_hardirqs_on+0x2d/0x160 [ 44.903570][ T3630] __x64_sys_bpf+0x75/0xb0 [ 44.908081][ T3630] do_syscall_64+0x35/0xb0 [ 44.912499][ T3630] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 44.918408][ T3630] RIP: 0033:0x7f4216122e69 [ 44.922837][ T3630] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 44.942459][ T3630] RSP: 002b:00007fff879260a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 44.950878][ T3630] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4216122e69 [ 44.958849][ T3630] RDX: 0000000000000028 RSI: 0000000020000080 RDI: 000000000000000a [ 44.966915][ T3630] RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d [ 44.974882][ T3630] R10: 000000000000000d R11: 0000000000000246 R12: 00007fff879260c0 [ 44.982892][ T3630] R13: 00000000000f4240 R14: 000000000000a815 R15: 00007fff879260b4 [ 44.990909][ T3630] [ 44.994189][ T3630] Kernel Offset: disabled [ 45.000594][ T3630] Rebooting in 86400 seconds..