./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3594558657 <...> Warning: Permanently added '10.128.0.235' (ECDSA) to the list of known hosts. execve("./syz-executor3594558657", ["./syz-executor3594558657"], 0x7ffc9226c050 /* 10 vars */) = 0 brk(NULL) = 0x555556ab5000 brk(0x555556ab5c40) = 0x555556ab5c40 arch_prctl(ARCH_SET_FS, 0x555556ab5300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3594558657", 4096) = 28 brk(0x555556ad6c40) = 0x555556ad6c40 brk(0x555556ad7000) = 0x555556ad7000 mprotect(0x7f548fd4c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 io_uring_setup(7464, {flags=0, sq_thread_cpu=0, sq_thread_idle=0, sq_entries=8192, cq_entries=16384, features=IORING_FEAT_SINGLE_MMAP|IORING_FEAT_NODROP|IORING_FEAT_SUBMIT_STABLE|IORING_FEAT_RW_CUR_POS|IORING_FEAT_CUR_PERSONALITY|IORING_FEAT_FAST_POLL|IORING_FEAT_POLL_32BITS|IORING_FEAT_SQPOLL_NONFIXED|IORING_FEAT_EXT_ARG|IORING_FEAT_NATIVE_WORKERS|IORING_FEAT_RSRC_TAGS|IORING_FEAT_CQE_SKIP|0x1000, sq_off={head=0, tail=64, ring_mask=256, ring_entries=264, flags=276, dropped=272, array=262464}, cq_off={head=128, tail=192, ring_mask=260, ring_entries=268, overflow=284, cqes=320, flags=280}}) = 3 mmap(0x2066c000, 295232, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE, 3, 0) = 0x2066c000 mmap(0x200e4000, 524288, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE, 3, 0x10000000) = 0x200e4000 syzkaller login: [ 50.739844][ T3607] general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN [ 50.751578][ T3607] KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] [ 50.760003][ T3607] CPU: 1 PID: 3607 Comm: syz-executor359 Not tainted 6.0.0-rc1-next-20220817-syzkaller #0 [ 50.769908][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 50.779950][ T3607] RIP: 0010:vma_is_shmem+0x21/0x40 [ 50.785057][ T3607] Code: 73 02 e9 20 fc ff ff 66 90 53 48 89 fb e8 07 2c cf ff 48 8d bb 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 10 48 81 bb 90 00 00 00 20 8f f7 89 5b 0f 94 c0 c3 [ 50.804649][ T3607] RSP: 0018:ffffc900037cfb68 EFLAGS: 00010206 [ 50.810698][ T3607] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 50.818667][ T3607] RDX: 0000000000000012 RSI: ffffffff81ace949 RDI: 0000000000000090 [ 50.826620][ T3607] RBP: ffff888071b00720 R08: 0000000000000006 R09: 00000000000000e4 [ 50.834573][ T3607] R10: 0000000000008001 R11: 0000000000000000 R12: 00000000000000e4 [ 50.842540][ T3607] R13: ffff888071b00000 R14: dffffc0000000000 R15: 0000000000000000 [ 50.850496][ T3607] FS: 0000555556ab5300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 50.859424][ T3607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.866005][ T3607] CR2: 00007fa3c8f13260 CR3: 00000000718f5000 CR4: 00000000003506e0 [ 50.873960][ T3607] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.881913][ T3607] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.889866][ T3607] Call Trace: [ 50.893138][ T3607] [ 50.896055][ T3607] io_pin_pages+0x25f/0x430 [ 50.900570][ T3607] io_sqe_buffer_register+0x14e/0x13b0 [ 50.906020][ T3607] ? io_copy_iov+0xd7/0x1c0 [ 50.910510][ T3607] ? io_pin_pages+0x430/0x430 [ 50.915186][ T3607] ? rcu_read_lock_sched_held+0x3a/0x70 [ 50.920715][ T3607] ? trace_kmalloc+0x32/0x100 [ 50.925381][ T3607] io_sqe_buffers_register.cold+0x351/0x445 [ 50.931270][ T3607] ? io_register_rsrc_update+0x960/0x960 [ 50.936896][ T3607] ? find_held_lock+0x2d/0x110 [ 50.941656][ T3607] __do_sys_io_uring_register+0x96d/0x1110 [ 50.947459][ T3607] ? io_cqring_event_overflow+0x730/0x730 [ 50.953169][ T3607] ? _raw_spin_unlock_irq+0x1f/0x40 [ 50.958354][ T3607] ? lockdep_hardirqs_on+0x79/0x100 [ 50.963540][ T3607] ? _raw_spin_unlock_irq+0x2a/0x40 [ 50.968720][ T3607] ? ptrace_notify+0xfa/0x140 [ 50.973392][ T3607] do_syscall_64+0x35/0xb0 [ 50.977802][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.983685][ T3607] RIP: 0033:0x7f548fcdfbb9 [ 50.988082][ T3607] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.007861][ T3607] RSP: 002b:00007ffc644b88f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 51.016265][ T3607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f548fcdfbb9 [ 51.024217][ T3607] RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000000000003 [ 51.032179][ T3607] RBP: 00007f548fca3d60 R08: 0000000010000000 R09: 0000000000000000 [ 51.040133][ T3607] R10: 0000000000000001 R11: 0000000000000246 R12: 00007f548fca3df0 [ 51.048090][ T3607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.056049][ T3607] [ 51.059067][ T3607] Modules linked in: [ 51.064812][ T3607] ---[ end trace 0000000000000000 ]--- [ 51.070323][ T3607] RIP: 0010:vma_is_shmem+0x21/0x40 [ 51.075496][ T3607] Code: 73 02 e9 20 fc ff ff 66 90 53 48 89 fb e8 07 2c cf ff 48 8d bb 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 10 48 81 bb 90 00 00 00 20 8f f7 89 5b 0f 94 c0 c3 [ 51.095136][ T3607] RSP: 0018:ffffc900037cfb68 EFLAGS: 00010206 [ 51.101188][ T3607] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 51.109178][ T3607] RDX: 0000000000000012 RSI: ffffffff81ace949 RDI: 0000000000000090 [ 51.117171][ T3607] RBP: ffff888071b00720 R08: 0000000000000006 R09: 00000000000000e4 [ 51.125160][ T3607] R10: 0000000000008001 R11: 0000000000000000 R12: 00000000000000e4 [ 51.133132][ T3607] R13: ffff888071b00000 R14: dffffc0000000000 R15: 0000000000000000 [ 51.141121][ T3607] FS: 0000555556ab5300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 51.150080][ T3607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.156676][ T3607] CR2: 00007fa3c8f13260 CR3: 00000000718f5000 CR4: 00000000003506e0 [ 51.164667][ T3607] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.172622][ T3607] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.180828][ T3607] Kernel panic - not syncing: Fatal exception [ 51.187060][ T3607] Kernel Offset: disabled [ 51.191379][ T3607] Rebooting in 86400 seconds..