./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3436215905 <...> Warning: Permanently added '10.128.1.95' (ECDSA) to the list of known hosts. execve("./syz-executor3436215905", ["./syz-executor3436215905"], 0x7ffd1d08ed10 /* 10 vars */) = 0 brk(NULL) = 0x555555693000 brk(0x555555693c40) = 0x555555693c40 arch_prctl(ARCH_SET_FS, 0x555555693300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3436215905", 4096) = 28 brk(0x5555556b4c40) = 0x5555556b4c40 brk(0x5555556b5000) = 0x5555556b5000 mprotect(0x7f4f5b3f1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4 write(4, "5", 1) = 1 syzkaller login: [ 49.108820][ T3608] FAULT_INJECTION: forcing a failure. [ 49.108820][ T3608] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 49.121989][ T3608] CPU: 0 PID: 3608 Comm: syz-executor343 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 [ 49.131986][ T3608] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521 [ 49.141336][ T3608] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 3608, name: syz-executor343 [ 49.150772][ T3608] preempt_count: 0, expected: 0 [ 49.155601][ T3608] RCU nest depth: 0, expected: 0 [ 49.160516][ T3608] no locks held by syz-executor343/3608. [ 49.166130][ T3608] irq event stamp: 4344 [ 49.170260][ T3608] hardirqs last enabled at (4343): [] __up_console_sem+0xae/0xc0 [ 49.179982][ T3608] hardirqs last disabled at (4344): [] dump_stack_lvl+0x2e/0x134 [ 49.189283][ T3608] softirqs last enabled at (4338): [] __irq_exit_rcu+0x123/0x180 [ 49.198656][ T3608] softirqs last disabled at (4313): [] __irq_exit_rcu+0x123/0x180 [ 49.208014][ T3608] CPU: 0 PID: 3608 Comm: syz-executor343 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 [ 49.217905][ T3608] syz-executor343[3608] cmdline: ./syz-executor3436215905 [ 49.225003][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 49.235057][ T3608] Call Trace: [ 49.238335][ T3608] [ 49.241285][ T3608] dump_stack_lvl+0xcd/0x134 [ 49.245896][ T3608] __might_resched.cold+0x222/0x26b [ 49.251103][ T3608] down_read_killable+0x75/0x490 [ 49.256070][ T3608] ? down_read+0x450/0x450 [ 49.260513][ T3608] __access_remote_vm+0xac/0x6f0 [ 49.265469][ T3608] ? follow_phys+0x2c0/0x2c0 [ 49.270416][ T3608] ? do_raw_spin_lock+0x120/0x2a0 [ 49.275451][ T3608] ? rwlock_bug.part.0+0x90/0x90 [ 49.280412][ T3608] ? __up_console_sem+0x47/0xc0 [ 49.285275][ T3608] get_mm_cmdline.part.0+0x217/0x620 [ 49.291457][ T3608] ? dname_to_vma_addr.isra.0+0x360/0x360 [ 49.297189][ T3608] ? _raw_spin_unlock_irqrestore+0x3d/0x70 [ 49.303020][ T3608] get_task_cmdline_kernel+0x1d9/0x220 [ 49.308494][ T3608] dump_stack_print_cmdline.part.0+0x82/0x150 [ 49.314581][ T3608] ? _atomic_dec_and_lock_irqsave+0x150/0x150 [ 49.320697][ T3608] ? dump_stack_print_info+0xc6/0x190 [ 49.326090][ T3608] dump_stack_print_info+0x185/0x190 [ 49.331396][ T3608] dump_stack_lvl+0xc1/0x134 [ 49.336005][ T3608] should_fail.cold+0x5/0xa [ 49.340532][ T3608] copyin+0x19/0x120 [ 49.344438][ T3608] _copy_from_iter+0x36e/0x11c0 [ 49.349306][ T3608] ? _copy_mc_to_iter+0x1430/0x1430 [ 49.354520][ T3608] ? memset+0x20/0x40 [ 49.358519][ T3608] ? __virt_addr_valid+0x5d/0x2d0 [ 49.363546][ T3608] ? __phys_addr+0xc4/0x140 [ 49.368054][ T3608] ? __phys_addr_symbol+0x2c/0x70 [ 49.373103][ T3608] ? __check_object_size+0x2de/0x700 [ 49.378407][ T3608] netlink_sendmsg+0x875/0xe10 [ 49.383204][ T3608] ? netlink_unicast+0x7f0/0x7f0 [ 49.388163][ T3608] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 49.393459][ T3608] ? netlink_unicast+0x7f0/0x7f0 [ 49.398441][ T3608] sock_sendmsg+0xcf/0x120 [ 49.402867][ T3608] ____sys_sendmsg+0x6eb/0x810 [ 49.407643][ T3608] ? copy_msghdr_from_user+0xfc/0x150 [ 49.413033][ T3608] ? kernel_sendmsg+0x50/0x50 [ 49.417731][ T3608] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 49.423735][ T3608] ___sys_sendmsg+0x110/0x1b0 [ 49.428430][ T3608] ? do_recvmmsg+0x6e0/0x6e0 [ 49.433044][ T3608] ? lock_release+0x780/0x780 [ 49.437726][ T3608] ? ptrace_stop.part.0+0x5ec/0xa80 [ 49.442935][ T3608] ? do_raw_spin_lock+0x120/0x2a0 [ 49.447969][ T3608] ? rwlock_bug.part.0+0x90/0x90 [ 49.452912][ T3608] ? _raw_spin_lock_irq+0x41/0x50 [ 49.457945][ T3608] ? __fget_light+0x20a/0x270 [ 49.462638][ T3608] __sys_sendmsg+0xf3/0x1c0 [ 49.467156][ T3608] ? __sys_sendmsg_sock+0x30/0x30 [ 49.472195][ T3608] ? lock_downgrade+0x6e0/0x6e0 [ 49.477440][ T3608] ? lockdep_hardirqs_on+0x79/0x100 [ 49.482658][ T3608] ? _raw_spin_unlock_irq+0x2a/0x40 [ 49.487877][ T3608] ? ptrace_notify+0xfa/0x140 [ 49.492567][ T3608] do_syscall_64+0x35/0xb0 [ 49.496995][ T3608] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.502897][ T3608] RIP: 0033:0x7f4f5b3848f9 [ 49.507320][ T3608] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 49.526928][ T3608] RSP: 002b:00007ffdfef8b808 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 49.535357][ T3608] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f4f5b3848f9 [ 49.543337][ T3608] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 [ 49.551307][ T3608] RBP: 00007ffdfef8b810 R08: 0000000000000001 R09: 00007f4f5b340035 [ 49.559279][ T3608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 49.567247][ T3608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 49.575580][ T3608] [ 49.578614][ T3608] syz-executor343[3608] cmdline: ./syz-executor3436215905 [ 49.585715][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 49.595770][ T3608] Call Trace: [ 49.599046][ T3608] [ 49.601978][ T3608] dump_stack_lvl+0xcd/0x134 [ 49.606589][ T3608] should_fail.cold+0x5/0xa [ 49.611109][ T3608] copyin+0x19/0x120 [ 49.615015][ T3608] _copy_from_iter+0x36e/0x11c0 [ 49.619893][ T3608] ? _copy_mc_to_iter+0x1430/0x1430 [ 49.625103][ T3608] ? memset+0x20/0x40 [ 49.629100][ T3608] ? __virt_addr_valid+0x5d/0x2d0 [ 49.634137][ T3608] ? __phys_addr+0xc4/0x140 [ 49.638643][ T3608] ? __phys_addr_symbol+0x2c/0x70 [ 49.643672][ T3608] ? __check_object_size+0x2de/0x700 [ 49.648992][ T3608] netlink_sendmsg+0x875/0xe10 [ 49.653786][ T3608] ? netlink_unicast+0x7f0/0x7f0 [ 49.658753][ T3608] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 49.664059][ T3608] ? netlink_unicast+0x7f0/0x7f0 [ 49.669104][ T3608] sock_sendmsg+0xcf/0x120 [ 49.673799][ T3608] ____sys_sendmsg+0x6eb/0x810 [ 49.678585][ T3608] ? copy_msghdr_from_user+0xfc/0x150 [ 49.683977][ T3608] ? kernel_sendmsg+0x50/0x50 [ 49.688680][ T3608] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 49.694675][ T3608] ___sys_sendmsg+0x110/0x1b0 [ 49.699379][ T3608] ? do_recvmmsg+0x6e0/0x6e0 [ 49.703995][ T3608] ? lock_release+0x780/0x780 [ 49.708681][ T3608] ? ptrace_stop.part.0+0x5ec/0xa80 [ 49.713906][ T3608] ? do_raw_spin_lock+0x120/0x2a0 [ 49.718949][ T3608] ? rwlock_bug.part.0+0x90/0x90 [ 49.723896][ T3608] ? _raw_spin_lock_irq+0x41/0x50 [ 49.728943][ T3608] ? __fget_light+0x20a/0x270 [ 49.733640][ T3608] __sys_sendmsg+0xf3/0x1c0 [ 49.738166][ T3608] ? __sys_sendmsg_sock+0x30/0x30 [ 49.743209][ T3608] ? lock_downgrade+0x6e0/0x6e0 [ 49.748088][ T3608] ? lockdep_hardirqs_on+0x79/0x100 [ 49.753310][ T3608] ? _raw_spin_unlock_irq+0x2a/0x40 [ 49.758512][ T3608] ? ptrace_notify+0xfa/0x140 [ 49.763204][ T3608] do_syscall_64+0x35/0xb0 [ 49.767631][ T3608] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 49.773533][ T3608] RIP: 0033:0x7f4f5b3848f9 [ 49.777966][ T3608] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 49.797573][ T3608] RSP: 002b:00007ffdfef8b808 EFLAGS: 00000246 ORIG_RAX: 000000000000002e sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x74\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x08\x00\x03\x00\x00\x00\x00\x00\x28\x00\x0e\x00\x80\x00\x00\x00\xff\xff\xff\xff\xff\xff\x08\x02\x11\x00\x00\x00\x08\x02\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x01\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x08\x00\x0c\x00\x64\x00\x00\x00\x08\x00\x0d\x00\x00\x00\x00\x00\x0a\x00\x34\x00\x02\x02\x02\x02"..., iov_len=116}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 49.805992][ T3608] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: