./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4270884748 <...> Warning: Permanently added '10.128.1.99' (ED25519) to the list of known hosts. execve("./syz-executor4270884748", ["./syz-executor4270884748"], 0x7ffffc66fb80 /* 10 vars */) = 0 brk(NULL) = 0x555556046000 brk(0x555556046d00) = 0x555556046d00 arch_prctl(ARCH_SET_FS, 0x555556046380) = 0 set_tid_address(0x555556046650) = 5056 set_robust_list(0x555556046660, 24) = 0 rseq(0x555556046ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4270884748", 4096) = 28 getrandom("\xe5\x14\x87\x2d\x22\xca\xd2\x86", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556046d00 brk(0x555556067d00) = 0x555556067d00 brk(0x555556068000) = 0x555556068000 mprotect(0x7f3e4eb7b000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/profiling", O_WRONLY|O_NOCTTY|O_SYNC|O_LARGEFILE|O_NOFOLLOW|O_NOATIME) = 3 [ 72.185747][ T5056] kernel profiling enabled (shift: 0) [ 72.401552][ C1] ================================================================== [ 72.409648][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xd3/0x150 [ 72.416869][ C1] Read of size 8 at addr ffffc9000398ef60 by task syz-executor427/5056 [ 72.425115][ C1] [ 72.427431][ C1] CPU: 1 PID: 5056 Comm: syz-executor427 Not tainted 6.7.0-rc5-syzkaller #0 [ 72.436099][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 72.446145][ C1] Call Trace: [ 72.449437][ C1] [ 72.452274][ C1] dump_stack_lvl+0x1e7/0x2d0 [ 72.456976][ C1] ? nf_tcp_handle_invalid+0x650/0x650 [ 72.462446][ C1] ? panic+0x850/0x850 [ 72.466511][ C1] ? _printk+0xd5/0x120 [ 72.470665][ C1] print_report+0x163/0x540 [ 72.475167][ C1] ? rcu_read_lock_sched_held+0x8d/0x130 [ 72.480845][ C1] ? __virt_addr_valid+0xbd/0x2e0 [ 72.485883][ C1] ? profile_pc+0xd3/0x150 [ 72.490326][ C1] kasan_report+0x142/0x170 [ 72.494831][ C1] ? profile_pc+0xd3/0x150 [ 72.499256][ C1] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 72.505153][ C1] profile_pc+0xd3/0x150 [ 72.509413][ C1] profile_tick+0xd8/0x130 [ 72.513854][ C1] tick_nohz_highres_handler+0x383/0x550 [ 72.519492][ C1] ? tick_setup_sched_timer+0x2f0/0x2f0 [ 72.525130][ C1] __hrtimer_run_queues+0x562/0xd20 [ 72.530378][ C1] ? hrtimer_interrupt+0x980/0x980 [ 72.535518][ C1] ? ktime_get_update_offsets_now+0x40b/0x420 [ 72.541613][ C1] hrtimer_interrupt+0x396/0x980 [ 72.546566][ C1] __sysvec_apic_timer_interrupt+0x104/0x3a0 [ 72.552550][ C1] sysvec_apic_timer_interrupt+0x92/0xb0 [ 72.558180][ C1] [ 72.561106][ C1] [ 72.564054][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 72.570030][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 [ 72.576544][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ee 77 c8 f6 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 e3 a0 3e f6 65 8b 05 04 ac e1 74 85 c0 74 3f 48 c7 04 24 0e 36 [ 72.596164][ C1] RSP: 0018:ffffc9000398ef60 EFLAGS: 00000206 [ 72.602239][ C1] RAX: 51173545a6652600 RBX: 1ffff92000731df0 RCX: ffffffff816d97aa [ 72.610213][ C1] RDX: dffffc0000000000 RSI: ffffffff8b6aaa40 RDI: 0000000000000001 [ 72.618210][ C1] RBP: ffffc9000398eff0 R08: ffffffff90dd9367 R09: 1ffffffff21bb26c [ 72.626186][ C1] R10: dffffc0000000000 R11: fffffbfff21bb26d R12: dffffc0000000000 [ 72.634161][ C1] R13: 1ffff92000731dec R14: ffffc9000398ef80 R15: 0000000000000246 [ 72.642142][ C1] ? mark_lock+0x9a/0x350 [ 72.646486][ C1] ? _raw_spin_unlock+0x40/0x40 [ 72.651343][ C1] ? __mod_zone_page_state+0xda/0x150 [ 72.656717][ C1] __rmqueue_pcplist+0x20a5/0x2550 [ 72.661866][ C1] ? zone_watermark_fast+0x240/0x240 [ 72.667159][ C1] get_page_from_freelist+0x896/0x3570 [ 72.672657][ C1] ? __might_sleep+0xe0/0xe0 [ 72.677285][ C1] ? fs_reclaim_acquire+0x92/0x120 [ 72.682419][ C1] ? __alloc_pages+0x680/0x680 [ 72.687307][ C1] ? prepare_alloc_pages+0x1d9/0x5b0 [ 72.692644][ C1] __alloc_pages+0x255/0x680 [ 72.697247][ C1] ? zone_statistics+0x170/0x170 [ 72.702195][ C1] ? policy_nodemask+0x1ec/0x720 [ 72.707136][ C1] alloc_pages_mpol+0x3de/0x640 [ 72.711987][ C1] ? mempolicy_in_oom_domain+0x130/0x130 [ 72.717619][ C1] ? __pte_alloc+0x3a0/0x3a0 [ 72.722209][ C1] ? alloc_pages+0xee/0x170 [ 72.726710][ C1] __get_free_pages+0xc/0x30 [ 72.731299][ C1] kasan_populate_vmalloc_pte+0x34/0xe0 [ 72.736853][ C1] __apply_to_page_range+0x8e8/0xe30 [ 72.742165][ C1] ? kasan_populate_vmalloc+0x70/0x70 [ 72.747580][ C1] ? apply_to_page_range+0x50/0x50 [ 72.752714][ C1] ? do_raw_spin_unlock+0x13b/0x8b0 [ 72.757937][ C1] alloc_vmap_area+0x1ad5/0x1c10 [ 72.762919][ C1] ? vm_map_ram+0xcf0/0xcf0 [ 72.768648][ C1] __get_vm_area_node+0x16e/0x370 [ 72.773696][ C1] __vmalloc_node_range+0x3df/0x14a0 [ 72.779050][ C1] ? profile_init+0xee/0x130 [ 72.783677][ C1] ? __alloc_pages+0xbd/0x680 [ 72.788394][ C1] ? policy_nodemask+0x1ec/0x720 [ 72.793363][ C1] ? free_vm_area+0x60/0x60 [ 72.797892][ C1] ? rcu_is_watching+0x15/0xb0 [ 72.802672][ C1] ? profile_init+0xee/0x130 [ 72.807283][ C1] vzalloc+0x79/0x90 [ 72.811208][ C1] ? profile_init+0xee/0x130 [ 72.815829][ C1] profile_init+0xee/0x130 [ 72.820262][ C1] profiling_store+0x5e/0xc0 [ 72.824864][ C1] ? sysfs_kf_read+0x310/0x310 [ 72.829806][ C1] kernfs_fop_write_iter+0x3b3/0x510 [ 72.835099][ C1] vfs_write+0x792/0xb20 [ 72.839356][ C1] ? file_end_write+0x250/0x250 [ 72.844227][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 72.849429][ C1] ? __fdget_pos+0x2c7/0x340 [ 72.854031][ C1] ksys_write+0x1a0/0x2c0 [ 72.858374][ C1] ? print_irqtrace_events+0x220/0x220 [ 72.863864][ C1] ? __ia32_sys_read+0x90/0x90 [ 72.868655][ C1] ? syscall_enter_from_user_mode+0xa4/0x2d0 [ 72.874639][ C1] ? syscall_enter_from_user_mode+0xf5/0x2d0 [ 72.880626][ C1] do_syscall_64+0x45/0x110 [ 72.885142][ C1] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 72.891053][ C1] RIP: 0033:0x7f3e4eb08569 [ 72.895468][ C1] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 72.915071][ C1] RSP: 002b:00007ffd230efd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 72.923486][ C1] RAX: ffffffffffffffda RBX: 00007f3e4eb51004 RCX: 00007f3e4eb08569 [ 72.931460][ C1] RDX: 0000000000000048 RSI: 0000000020002480 RDI: 0000000000000003 [ 72.939440][ C1] RBP: 00007f3e4eb7b610 R08: 00007ffd230efae4 R09: 00007ffd230eff28 [ 72.947436][ C1] R10: 0000000000000014 R11: 0000000000000246 R12: 0000000000000001 [ 72.955407][ C1] R13: 00007ffd230eff18 R14: 0000000000000001 R15: 0000000000000001 [ 72.963654][ C1] [ 72.966682][ C1] [ 72.969020][ C1] The buggy address belongs to stack of task syz-executor427/5056 [ 72.976814][ C1] and is located at offset 0 in frame: [ 72.982347][ C1] _raw_spin_unlock_irqrestore+0x0/0x140 [ 72.987984][ C1] [ 72.990302][ C1] This frame has 1 object: [ 72.994727][ C1] [32, 40) 'flags.i.i.i.i' [ 72.994739][ C1] [ 73.001559][ C1] The buggy address belongs to the virtual mapping at [ 73.001559][ C1] [ffffc90003988000, ffffc90003991000) created by: [ 73.001559][ C1] copy_process+0x5d1/0x3fb0 [ 73.019178][ C1] [ 73.021501][ C1] The buggy address belongs to the physical page: [ 73.027906][ C1] page:ffffea0001db0c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76c30 [ 73.038053][ C1] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 73.045158][ C1] page_type: 0xffffffff() [ 73.049525][ C1] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 73.058124][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 73.066698][ C1] page dumped because: kasan: bad access detected [ 73.073106][ C1] page_owner tracks the page as allocated [ 73.078812][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5048, tgid 5048 (sshd), ts 66200551835, free_ts 66194494581 [ 73.097299][ C1] post_alloc_hook+0x1e6/0x210 [ 73.102062][ C1] get_page_from_freelist+0x33ea/0x3570 [ 73.107607][ C1] __alloc_pages+0x255/0x680 [ 73.112198][ C1] alloc_pages_mpol+0x3de/0x640 [ 73.117043][ C1] __vmalloc_node_range+0x9a3/0x14a0 [ 73.122333][ C1] dup_task_struct+0x3e5/0x7d0 [ 73.127097][ C1] copy_process+0x5d1/0x3fb0 [ 73.131687][ C1] kernel_clone+0x222/0x840 [ 73.136185][ C1] __x64_sys_clone+0x258/0x2a0 [ 73.140945][ C1] do_syscall_64+0x45/0x110 [ 73.145453][ C1] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 73.151350][ C1] page last free stack trace: [ 73.156012][ C1] free_unref_page_prepare+0x931/0xa60 [ 73.161484][ C1] free_unref_page_list+0x5a0/0x840 [ 73.166677][ C1] release_pages+0x2117/0x2400 [ 73.171445][ C1] tlb_flush_mmu+0x34c/0x4e0 [ 73.176032][ C1] tlb_finish_mmu+0xd4/0x1f0 [ 73.180616][ C1] exit_mmap+0x4d3/0xc60 [ 73.184959][ C1] __mmput+0x115/0x3c0 [ 73.189021][ C1] exit_mm+0x21f/0x300 [ 73.193109][ C1] do_exit+0x9b7/0x2750 [ 73.197268][ C1] do_group_exit+0x206/0x2c0 [ 73.201860][ C1] __x64_sys_exit_group+0x3f/0x40 [ 73.206888][ C1] do_syscall_64+0x45/0x110 [ 73.211426][ C1] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 73.217337][ C1] [ 73.219654][ C1] Memory state around the buggy address: [ 73.225277][ C1] ffffc9000398ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 73.233332][ C1] ffffc9000398ee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 73.241409][ C1] >ffffc9000398ef00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 [ 73.249462][ C1] ^ [ 73.256714][ C1] ffffc9000398ef80: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 73.264782][ C1] ffffc9000398f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 73.272853][ C1] ================================================================== [ 73.281003][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 73.288195][ C1] CPU: 1 PID: 5056 Comm: syz-executor427 Not tainted 6.7.0-rc5-syzkaller #0 [ 73.296866][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 73.306920][ C1] Call Trace: [ 73.310216][ C1] [ 73.313058][ C1] dump_stack_lvl+0x1e7/0x2d0 [ 73.317768][ C1] ? nf_tcp_handle_invalid+0x650/0x650 [ 73.323240][ C1] ? panic+0x850/0x850 [ 73.327311][ C1] ? rcu_is_watching+0x15/0xb0 [ 73.332105][ C1] ? vscnprintf+0x5d/0x80 [ 73.336442][ C1] panic+0x349/0x850 [ 73.340339][ C1] ? __lock_acquire+0x1fd0/0x1fd0 [ 73.345374][ C1] ? check_panic_on_warn+0x21/0xa0 [ 73.350494][ C1] ? __memcpy_flushcache+0x2b0/0x2b0 [ 73.355788][ C1] ? do_raw_spin_unlock+0x13b/0x8b0 [ 73.360992][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 73.366891][ C1] ? _raw_spin_unlock+0x40/0x40 [ 73.371749][ C1] check_panic_on_warn+0x82/0xa0 [ 73.376693][ C1] ? profile_pc+0xd3/0x150 [ 73.381110][ C1] end_report+0x6e/0x140 [ 73.385358][ C1] kasan_report+0x153/0x170 [ 73.389870][ C1] ? profile_pc+0xd3/0x150 [ 73.394295][ C1] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 73.400188][ C1] profile_pc+0xd3/0x150 [ 73.404436][ C1] profile_tick+0xd8/0x130 [ 73.408865][ C1] tick_nohz_highres_handler+0x383/0x550 [ 73.414503][ C1] ? tick_setup_sched_timer+0x2f0/0x2f0 [ 73.420047][ C1] __hrtimer_run_queues+0x562/0xd20 [ 73.425264][ C1] ? hrtimer_interrupt+0x980/0x980 [ 73.430382][ C1] ? ktime_get_update_offsets_now+0x40b/0x420 [ 73.436464][ C1] hrtimer_interrupt+0x396/0x980 [ 73.441422][ C1] __sysvec_apic_timer_interrupt+0x104/0x3a0 [ 73.447409][ C1] sysvec_apic_timer_interrupt+0x92/0xb0 [ 73.453045][ C1] [ 73.455974][ C1] [ 73.458907][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 73.464892][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 [ 73.471429][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ee 77 c8 f6 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 e3 a0 3e f6 65 8b 05 04 ac e1 74 85 c0 74 3f 48 c7 04 24 0e 36 [ 73.491050][ C1] RSP: 0018:ffffc9000398ef60 EFLAGS: 00000206 [ 73.497121][ C1] RAX: 51173545a6652600 RBX: 1ffff92000731df0 RCX: ffffffff816d97aa [ 73.505173][ C1] RDX: dffffc0000000000 RSI: ffffffff8b6aaa40 RDI: 0000000000000001 [ 73.513149][ C1] RBP: ffffc9000398eff0 R08: ffffffff90dd9367 R09: 1ffffffff21bb26c [ 73.521123][ C1] R10: dffffc0000000000 R11: fffffbfff21bb26d R12: dffffc0000000000 [ 73.529094][ C1] R13: 1ffff92000731dec R14: ffffc9000398ef80 R15: 0000000000000246 [ 73.537160][ C1] ? mark_lock+0x9a/0x350 [ 73.541506][ C1] ? _raw_spin_unlock+0x40/0x40 [ 73.546360][ C1] ? __mod_zone_page_state+0xda/0x150 [ 73.551757][ C1] __rmqueue_pcplist+0x20a5/0x2550 [ 73.556889][ C1] ? zone_watermark_fast+0x240/0x240 [ 73.562180][ C1] get_page_from_freelist+0x896/0x3570 [ 73.567652][ C1] ? __might_sleep+0xe0/0xe0 [ 73.572253][ C1] ? fs_reclaim_acquire+0x92/0x120 [ 73.577370][ C1] ? __alloc_pages+0x680/0x680 [ 73.582142][ C1] ? prepare_alloc_pages+0x1d9/0x5b0 [ 73.587432][ C1] __alloc_pages+0x255/0x680 [ 73.592025][ C1] ? zone_statistics+0x170/0x170 [ 73.597023][ C1] ? policy_nodemask+0x1ec/0x720 [ 73.601967][ C1] alloc_pages_mpol+0x3de/0x640 [ 73.606823][ C1] ? mempolicy_in_oom_domain+0x130/0x130 [ 73.612458][ C1] ? __pte_alloc+0x3a0/0x3a0 [ 73.617050][ C1] ? alloc_pages+0xee/0x170 [ 73.621556][ C1] __get_free_pages+0xc/0x30 [ 73.626157][ C1] kasan_populate_vmalloc_pte+0x34/0xe0 [ 73.631709][ C1] __apply_to_page_range+0x8e8/0xe30 [ 73.636999][ C1] ? kasan_populate_vmalloc+0x70/0x70 [ 73.642385][ C1] ? apply_to_page_range+0x50/0x50 [ 73.647501][ C1] ? do_raw_spin_unlock+0x13b/0x8b0 [ 73.652709][ C1] alloc_vmap_area+0x1ad5/0x1c10 [ 73.657664][ C1] ? vm_map_ram+0xcf0/0xcf0 [ 73.662180][ C1] __get_vm_area_node+0x16e/0x370 [ 73.667307][ C1] __vmalloc_node_range+0x3df/0x14a0 [ 73.672600][ C1] ? profile_init+0xee/0x130 [ 73.677194][ C1] ? __alloc_pages+0xbd/0x680 [ 73.681896][ C1] ? policy_nodemask+0x1ec/0x720 [ 73.686842][ C1] ? free_vm_area+0x60/0x60 [ 73.691359][ C1] ? rcu_is_watching+0x15/0xb0 [ 73.696139][ C1] ? profile_init+0xee/0x130 [ 73.700729][ C1] vzalloc+0x79/0x90 [ 73.704637][ C1] ? profile_init+0xee/0x130 [ 73.709235][ C1] profile_init+0xee/0x130 [ 73.713654][ C1] profiling_store+0x5e/0xc0 [ 73.718251][ C1] ? sysfs_kf_read+0x310/0x310 [ 73.723017][ C1] kernfs_fop_write_iter+0x3b3/0x510 [ 73.728305][ C1] vfs_write+0x792/0xb20 [ 73.732556][ C1] ? file_end_write+0x250/0x250 [ 73.737417][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 73.742618][ C1] ? __fdget_pos+0x2c7/0x340 [ 73.747216][ C1] ksys_write+0x1a0/0x2c0 [ 73.751554][ C1] ? print_irqtrace_events+0x220/0x220 [ 73.757015][ C1] ? __ia32_sys_read+0x90/0x90 [ 73.762069][ C1] ? syscall_enter_from_user_mode+0xa4/0x2d0 [ 73.768055][ C1] ? syscall_enter_from_user_mode+0xf5/0x2d0 [ 73.774039][ C1] do_syscall_64+0x45/0x110 [ 73.778551][ C1] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 73.784454][ C1] RIP: 0033:0x7f3e4eb08569 [ 73.788871][ C1] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 73.808476][ C1] RSP: 002b:00007ffd230efd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 73.816891][ C1] RAX: ffffffffffffffda RBX: 00007f3e4eb51004 RCX: 00007f3e4eb08569 [ 73.824877][ C1] RDX: 0000000000000048 RSI: 0000000020002480 RDI: 0000000000000003 [ 73.832854][ C1] RBP: 00007f3e4eb7b610 R08: 00007ffd230efae4 R09: 00007ffd230eff28 [ 73.840825][ C1] R10: 0000000000000014 R11: 0000000000000246 R12: 0000000000000001 [ 73.848794][ C1] R13: 00007ffd230eff18 R14: 0000000000000001 R15: 0000000000000001 [ 73.856773][ C1] [ 73.860062][ C1] Kernel Offset: disabled [ 73.864384][ C1] Rebooting in 86400 seconds..