./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1853197727 <...> Warning: Permanently added '10.128.0.77' (ED25519) to the list of known hosts. execve("./syz-executor1853197727", ["./syz-executor1853197727"], 0x7ffcc983f810 /* 10 vars */) = 0 brk(NULL) = 0x55555678e000 brk(0x55555678ed00) = 0x55555678ed00 arch_prctl(ARCH_SET_FS, 0x55555678e380) = 0 set_tid_address(0x55555678e650) = 5002 set_robust_list(0x55555678e660, 24) = 0 rseq(0x55555678eca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1853197727", 4096) = 28 getrandom("\x35\x3e\xcf\xea\xac\xa2\x9f\x86", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555678ed00 brk(0x5555567afd00) = 0x5555567afd00 brk(0x5555567b0000) = 0x5555567b0000 mprotect(0x7fb8617c1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5003 attached , child_tidptr=0x55555678e650) = 5003 [pid 5003] set_robust_list(0x55555678e660, 24) = 0 [pid 5003] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5003] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5003] setsid() = 1 [pid 5003] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5003] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5003] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5003] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5003] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5003] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5003] unshare(CLONE_NEWNS) = 0 [pid 5003] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5003] unshare(CLONE_NEWIPC) = 0 [pid 5003] unshare(CLONE_NEWCGROUP) = 0 [pid 5003] unshare(CLONE_NEWUTS) = 0 [pid 5003] unshare(CLONE_SYSVSEM) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "16777216", 8) = 8 [pid 5003] close(3) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "536870912", 9) = 9 [pid 5003] close(3) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "1024", 4) = 4 [pid 5003] close(3) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "8192", 4) = 4 [pid 5003] close(3) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "1024", 4) = 4 [pid 5003] close(3) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "1024", 4) = 4 [pid 5003] close(3) = 0 [pid 5003] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5003] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5003] close(3) = 0 [pid 5003] getpid() = 1 [pid 5003] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5029] set_robust_list(0x55555678e660, 24 [pid 5003] <... clone resumed>, child_tidptr=0x55555678e650) = 2 [pid 5029] <... set_robust_list resumed>) = 0 [pid 5029] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5029] setpgid(0, 0) = 0 [pid 5029] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5029] write(3, "1000", 4) = 4 [pid 5029] close(3) = 0 [pid 5029] socket(AF_INET6, SOCK_RAW, IPPROTO_DSTOPTS) = 3 [pid 5029] connect(3, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, "fe80::", &sin6_addr), sin6_scope_id=if_nametoindex("wlan1")}, 28) = 0 [pid 5029] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=",", iov_len=1}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, MSG_WAITALL|MSG_CONFIRM|MSG_NOSIGNAL|MSG_MORE) = 1 [pid 5029] sendmmsg(-1, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x1d", iov_len=1}, {iov_base="\x5e\xa4\xc5\xa8\xf4\x2c\x57\x81\xf8\x06\xd6\x1c\xd0\x33\xc5\x8e\x98\xd6\x8f\x64\x14\x81\xcf\x18\x01\xa4\x94\xe8\x5f\x4d\x0f\xca\xa6\x3f\xdc\x2e\x16\x1e\xa0\x09\x48\x49\x5a\x0f\xa3\x5c\x26\xbe\xda", iov_len=49}], msg_iovlen=2, msg_controllen=0, msg_flags=0}}], 1, 0) = -1 EBADF (Bad file descriptor) [ 148.593804][ T5029] ===================================================== [ 148.601145][ T5029] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 [ 148.609327][ T5029] ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 [ 148.615236][ T5029] ip6_tnl_start_xmit+0xab2/0x1a70 [ 148.620605][ T5029] dev_hard_start_xmit+0x247/0xa10 [ 148.625901][ T5029] __dev_queue_xmit+0x33b8/0x5130 [ 148.631142][ T5029] neigh_connected_output+0x569/0x660 [ 148.636726][ T5029] ip6_finish_output2+0x23a9/0x2b30 [ 148.642192][ T5029] ip6_finish_output+0x855/0x12b0 [ 148.647366][ T5029] ip6_output+0x323/0x610 [ 148.651872][ T5029] ip6_local_out+0xe9/0x140 [ 148.656500][ T5029] ip6_push_pending_frames+0x1f9/0x560 [ 148.662213][ T5029] rawv6_push_pending_frames+0xbe8/0xdf0 [ 148.668011][ T5029] rawv6_sendmsg+0x2b66/0x2e70 [ 148.672969][ T5029] inet_sendmsg+0x105/0x190 [ 148.677605][ T5029] sock_write_iter+0x491/0x610 [ 148.682590][ T5029] do_iter_write+0xceb/0x1340 [ 148.687402][ T5029] vfs_writev+0x329/0x7b0 [ 148.691901][ T5029] do_writev+0x251/0x5b0 [ 148.696300][ T5029] __x64_sys_writev+0x98/0xe0 [ 148.701205][ T5029] do_syscall_64+0x44/0x110 [ 148.705855][ T5029] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 148.712011][ T5029] [ 148.714396][ T5029] Uninit was created at: [ 148.718762][ T5029] slab_post_alloc_hook+0x129/0xa70 [ 148.724196][ T5029] __kmem_cache_alloc_node+0x5c9/0x970 [ 148.729876][ T5029] __kmalloc_node_track_caller+0x118/0x3c0 [ 148.735843][ T5029] kmalloc_reserve+0x249/0x4a0 [ 148.740909][ T5029] pskb_expand_head+0x226/0x1a00 [ 148.746009][ T5029] __pskb_pull_tail+0x13b/0x2310 [ 148.751152][ T5029] ip6_tnl_parse_tlv_enc_lim+0xa2a/0xbb0 [ 148.756977][ T5029] ip6_tnl_start_xmit+0xab2/0x1a70 [ 148.762405][ T5029] dev_hard_start_xmit+0x247/0xa10 [ 148.767703][ T5029] __dev_queue_xmit+0x33b8/0x5130 [ 148.773009][ T5029] neigh_connected_output+0x569/0x660 [ 148.778587][ T5029] ip6_finish_output2+0x23a9/0x2b30 [ 148.784056][ T5029] ip6_finish_output+0x855/0x12b0 [ 148.789232][ T5029] ip6_output+0x323/0x610 [ 148.793758][ T5029] ip6_local_out+0xe9/0x140 [ 148.798387][ T5029] ip6_push_pending_frames+0x1f9/0x560 [ 148.804055][ T5029] rawv6_push_pending_frames+0xbe8/0xdf0 [ 148.809931][ T5029] rawv6_sendmsg+0x2b66/0x2e70 [ 148.814854][ T5029] inet_sendmsg+0x105/0x190 [ 148.819504][ T5029] sock_write_iter+0x491/0x610 [ 148.824592][ T5029] do_iter_write+0xceb/0x1340 [ 148.829425][ T5029] vfs_writev+0x329/0x7b0 [ 148.834060][ T5029] do_writev+0x251/0x5b0 [ 148.838450][ T5029] __x64_sys_writev+0x98/0xe0 [ 148.843435][ T5029] do_syscall_64+0x44/0x110 [ 148.848087][ T5029] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 148.854273][ T5029] [ 148.856681][ T5029] CPU: 1 PID: 5029 Comm: syz-executor185 Not tainted 6.7.0-rc1-syzkaller-00019-gc42d9eeef8e5 #0 [ 148.867331][ T5029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 148.877597][ T5029] ===================================================== [ 148.884796][ T5029] Disabling lock debugging due to kernel taint [ 148.891068][ T5029] Kernel panic - not syncing: kmsan.panic set ... [ 148.897536][ T5029] CPU: 1 PID: 5029 Comm: syz-executor185 Tainted: G B 6.7.0-rc1-syzkaller-00019-gc42d9eeef8e5 #0 [ 148.909535][ T5029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 148.919713][ T5029] Call Trace: [ 148.923083][ T5029] [ 148.926097][ T5029] dump_stack_lvl+0x1bf/0x240 [ 148.930892][ T5029] dump_stack+0x1e/0x20 [ 148.935193][ T5029] panic+0x4de/0xc90 [ 148.939250][ T5029] ? add_taint+0x108/0x1a0 [ 148.943760][ T5029] kmsan_report+0x2d0/0x2d0 [ 148.948460][ T5029] ? __msan_warning+0x96/0x110 [ 148.953399][ T5029] ? ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 [ 148.959410][ T5029] ? ip6_tnl_start_xmit+0xab2/0x1a70 [ 148.964879][ T5029] ? dev_hard_start_xmit+0x247/0xa10 [ 148.970323][ T5029] ? __dev_queue_xmit+0x33b8/0x5130 [ 148.975722][ T5029] ? neigh_connected_output+0x569/0x660 [ 148.981452][ T5029] ? ip6_finish_output2+0x23a9/0x2b30 [ 148.987003][ T5029] ? ip6_finish_output+0x855/0x12b0 [ 148.992299][ T5029] ? ip6_output+0x323/0x610 [ 148.996960][ T5029] ? ip6_local_out+0xe9/0x140 [ 149.001785][ T5029] ? ip6_push_pending_frames+0x1f9/0x560 [ 149.007583][ T5029] ? rawv6_push_pending_frames+0xbe8/0xdf0 [ 149.013554][ T5029] ? rawv6_sendmsg+0x2b66/0x2e70 [ 149.018591][ T5029] ? inet_sendmsg+0x105/0x190 [ 149.023422][ T5029] ? sock_write_iter+0x491/0x610 [ 149.028547][ T5029] ? do_iter_write+0xceb/0x1340 [ 149.033540][ T5029] ? vfs_writev+0x329/0x7b0 [ 149.038157][ T5029] ? do_writev+0x251/0x5b0 [ 149.042661][ T5029] ? __x64_sys_writev+0x98/0xe0 [ 149.047610][ T5029] ? do_syscall_64+0x44/0x110 [ 149.052441][ T5029] ? entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 149.058690][ T5029] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 149.064684][ T5029] ? __pskb_pull_tail+0x1d03/0x2310 [ 149.070023][ T5029] ? slab_post_alloc_hook+0x129/0xa70 [ 149.075545][ T5029] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 149.081502][ T5029] __msan_warning+0x96/0x110 [ 149.086192][ T5029] ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 [ 149.091983][ T5029] ip6_tnl_start_xmit+0xab2/0x1a70 [ 149.097209][ T5029] ? validate_xmit_xfrm+0x8b/0x1b70 [ 149.102553][ T5029] ? ip6_tnl_dev_uninit+0x670/0x670 [ 149.107921][ T5029] dev_hard_start_xmit+0x247/0xa10 [ 149.113193][ T5029] __dev_queue_xmit+0x33b8/0x5130 [ 149.118429][ T5029] ? __dev_queue_xmit+0x34b/0x5130 [ 149.123721][ T5029] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 149.129684][ T5029] neigh_connected_output+0x569/0x660 [ 149.135222][ T5029] ? neigh_event_send+0x1e0/0x1e0 [ 149.140444][ T5029] ip6_finish_output2+0x23a9/0x2b30 [ 149.145819][ T5029] ip6_finish_output+0x855/0x12b0 [ 149.151041][ T5029] ip6_output+0x323/0x610 [ 149.155543][ T5029] ? ip6_output+0x610/0x610 [ 149.160226][ T5029] ? ac6_seq_show+0x1b0/0x1b0 [ 149.165162][ T5029] ip6_local_out+0xe9/0x140 [ 149.170178][ T5029] ip6_push_pending_frames+0x1f9/0x560 [ 149.175789][ T5029] rawv6_push_pending_frames+0xbe8/0xdf0 [ 149.181608][ T5029] ? rawv6_send_hdrinc+0x1d80/0x1d80 [ 149.187028][ T5029] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 149.193041][ T5029] rawv6_sendmsg+0x2b66/0x2e70 [ 149.198035][ T5029] ? compat_rawv6_ioctl+0xb0/0xb0 [ 149.203230][ T5029] inet_sendmsg+0x105/0x190 [ 149.207884][ T5029] ? inet_send_prepare+0x5c0/0x5c0 [ 149.213080][ T5029] sock_write_iter+0x491/0x610 [ 149.218017][ T5029] ? sock_read_iter+0x580/0x580 [ 149.223053][ T5029] do_iter_write+0xceb/0x1340 [ 149.227865][ T5029] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 149.233822][ T5029] vfs_writev+0x329/0x7b0 [ 149.238303][ T5029] ? filter_irq_stacks+0x60/0x1a0 [ 149.243433][ T5029] ? kmsan_internal_set_shadow_origin+0x66/0xe0 [ 149.249823][ T5029] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 149.255827][ T5029] do_writev+0x251/0x5b0 [ 149.260187][ T5029] __x64_sys_writev+0x98/0xe0 [ 149.264952][ T5029] do_syscall_64+0x44/0x110 [ 149.269552][ T5029] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 149.275556][ T5029] RIP: 0033:0x7fb861748ba9 [ 149.280037][ T5029] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 149.299766][ T5029] RSP: 002b:00007ffd0f019948 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 149.308317][ T5029] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fb861748ba9 [ 149.316385][ T5029] RDX: 0000000000000001 RSI: 0000000020000980 RDI: 0000000000000003 [ 149.324479][ T5029] RBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000 [ 149.332561][ T5029] R10: 0000000100000000 R11: 0000000000000246 R12: 00007ffd0f0199a0 [ 149.340604][ T5029] R13: 0000000000000001 R14: 00007ffd0f0199a0 R15: 0000000000000003 [ 149.348688][ T5029] [ 149.352021][ T5029] Kernel Offset: disabled [ 149.356391][ T5029] Rebooting in 86400 seconds..