./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4195469802 <...> Warning: Permanently added '10.128.1.62' (ECDSA) to the list of known hosts. execve("./syz-executor4195469802", ["./syz-executor4195469802"], 0x7ffd82ad10d0 /* 10 vars */) = 0 brk(NULL) = 0x555556390000 brk(0x555556390c40) = 0x555556390c40 arch_prctl(ARCH_SET_FS, 0x555556390300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor4195469802", 4096) = 28 brk(0x5555563b1c40) = 0x5555563b1c40 brk(0x5555563b2000) = 0x5555563b2000 mprotect(0x7fc1e373f000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5005 attached , child_tidptr=0x5555563905d0) = 5005 [pid 5005] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5005] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5005] setsid() = 1 [pid 5005] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5005] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5005] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5005] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5005] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5005] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5005] unshare(CLONE_NEWNS) = 0 [pid 5005] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5005] unshare(CLONE_NEWIPC) = 0 [pid 5005] unshare(CLONE_NEWCGROUP) = 0 [pid 5005] unshare(CLONE_NEWUTS) = 0 [pid 5005] unshare(CLONE_SYSVSEM) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "16777216", 8) = 8 [pid 5005] close(3) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "536870912", 9) = 9 [pid 5005] close(3) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "1024", 4) = 4 [pid 5005] close(3) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "8192", 4) = 4 [pid 5005] close(3) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "1024", 4) = 4 [pid 5005] close(3) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "1024", 4) = 4 [pid 5005] close(3) = 0 [pid 5005] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5005] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5005] close(3) = 0 [pid 5005] getpid() = 1 [pid 5005] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 62.653468][ T5011] dump_stack_lvl+0xd9/0x150 [ 62.658052][ T5011] print_address_description.constprop.0+0x2c/0x3c0 [ 62.664639][ T5011] ? read_descriptors+0x263/0x280 [ 62.669670][ T5011] kasan_report+0x11c/0x130 [ 62.674188][ T5011] ? read_descriptors+0x263/0x280 [ 62.679218][ T5011] read_descriptors+0x263/0x280 [ 62.684076][ T5011] sysfs_kf_bin_read+0x19a/0x270 [ 62.689021][ T5011] ? urbnum_show+0x80/0x80 [ 62.693475][ T5011] ? kernfs_create_link+0x230/0x230 [ 62.698685][ T5011] kernfs_fop_read_iter+0x387/0x690 [ 62.703894][ T5011] vfs_read+0x4b1/0x8a0 [ 62.708158][ T5011] ? kernel_read+0x1c0/0x1c0 [ 62.712769][ T5011] ? rcu_is_watching+0x12/0xb0 [ 62.717634][ T5011] ? __rseq_handle_notify_resume+0x5b3/0xfe0 [ 62.723620][ T5011] ? __fget_light+0x20a/0x270 [ 62.728308][ T5011] ksys_read+0x12b/0x250 [ 62.732549][ T5011] ? vfs_write+0xd50/0xd50 [ 62.736964][ T5011] ? syscall_enter_from_user_mode+0x26/0x80 [ 62.742865][ T5011] do_syscall_64+0x39/0xb0 [ 62.747372][ T5011] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 62.753299][ T5011] RIP: 0033:0x7f07c7916b6a [ 62.757732][ T5011] Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83 [ 62.777344][ T5011] RSP: 002b:00007ffdf34973d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 62.785758][ T5011] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f07c7916b6a [ 62.793728][ T5011] RDX: 0000000000010011 RSI: 00007ffdf3497407 RDI: 0000000000000008 [ 62.801701][ T5011] RBP: 0000000000000008 R08: 0000000000000003 R09: f4f13e10193fbafe [ 62.809666][ T5011] R10: 0000000000000000 R11: 0000000000000246 R12: 000055be37470e10 [ 62.817806][ T5011] R13: 00007ffdf34a7ae8 R14: 00007ffdf34a8138 R15: 00007ffdf3497407 [ 62.825785][ T5011] [ 62.828801][ T5011] [ 62.831126][ T5011] Allocated by task 758: [ 62.835528][ T5011] kasan_save_stack+0x22/0x40 [ 62.840222][ T5011] kasan_set_track+0x25/0x30 [ 62.844817][ T5011] __kasan_kmalloc+0xa2/0xb0 [ 62.849411][ T5011] __kmalloc+0x5e/0x190 [ 62.853565][ T5011] usb_get_configuration+0x1f7/0x5170 [ 62.858943][ T5011] usb_new_device+0x12b0/0x19d0 [ 62.863791][ T5011] hub_event+0x2d9e/0x4e40 [ 62.868211][ T5011] process_one_work+0x99a/0x15e0 [ 62.873153][ T5011] worker_thread+0x67d/0x10c0 [ 62.877831][ T5011] kthread+0x344/0x440 [ 62.881904][ T5011] ret_from_fork+0x1f/0x30 [ 62.886323][ T5011] [ 62.888650][ T5011] The buggy address belongs to the object at ffff88801e78b8c0 [ 62.888650][ T5011] which belongs to the cache kmalloc-8 of size 8 [ 62.902351][ T5011] The buggy address is located 0 bytes to the right of [ 62.902351][ T5011] allocated 8-byte region [ffff88801e78b8c0, ffff88801e78b8c8) [ 62.916673][ T5011] [ 62.918991][ T5011] The buggy address belongs to the physical page: [ 62.925504][ T5011] page:ffffea000079e2c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e78b [ 62.935647][ T5011] anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 62.943746][ T5011] page_type: 0xffffffff() [ 62.948073][ T5011] raw: 00fff00000000200 ffff888012441280 0000000000000000 dead000000000001 [ 62.956930][ T5011] raw: 0000000000000000 0000000000660066 00000001ffffffff 0000000000000000 [ 62.965516][ T5011] page dumped because: kasan: bad access detected [ 62.971922][ T5011] page_owner tracks the page as allocated [ 62.977637][ T5011] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 8298345549, free_ts 8292702290 [ 62.995539][ T5011] post_alloc_hook+0x2db/0x350 [ 63.000341][ T5011] get_page_from_freelist+0xf41/0x2c00 [ 63.005836][ T5011] __alloc_pages+0x1cb/0x4a0 [ 63.010445][ T5011] alloc_page_interleave+0x1e/0x200 [ 63.015663][ T5011] alloc_pages+0x233/0x270 [ 63.020122][ T5011] allocate_slab+0x25f/0x390 [ 63.024724][ T5011] ___slab_alloc+0xa91/0x1400 [ 63.029410][ T5011] __slab_alloc.constprop.0+0x56/0xa0 [ 63.034796][ T5011] __kmem_cache_alloc_node+0x136/0x320 [ 63.040267][ T5011] __kmalloc_node_track_caller+0x4f/0x1a0 [ 63.045991][ T5011] kstrdup+0x3f/0x70 [ 63.049896][ T5011] kstrdup_const+0x57/0x80 [ 63.054326][ T5011] kvasprintf_const+0x10c/0x190 [ 63.059183][ T5011] kobject_set_name_vargs+0x5a/0x150 [ 63.064470][ T5011] dev_set_name+0xbf/0xf0 [ 63.068801][ T5011] tty_register_device_attr+0x301/0x7d0 [ 63.074349][ T5011] page last free stack trace: [ 63.079007][ T5011] free_unref_page_prepare+0x62e/0xcb0 [ 63.084558][ T5011] free_unref_page+0x33/0x370 [ 63.089243][ T5011] vfree+0x180/0x7e0 [ 63.093141][ T5011] delayed_vfree_work+0x57/0x70 [ 63.098167][ T5011] process_one_work+0x99a/0x15e0 [ 63.103113][ T5011] worker_thread+0x67d/0x10c0 [ 63.107803][ T5011] kthread+0x344/0x440 [ 63.111888][ T5011] ret_from_fork+0x1f/0x30 [ 63.116399][ T5011] [ 63.118712][ T5011] Memory state around the buggy address: [ 63.124337][ T5011] ffff88801e78b780: 00 fc fc fc fc fa fc fc fc fc fa fc fc fc fc fa [ 63.132400][ T5011] ffff88801e78b800: fc fc fc fc 00 fc fc fc fc fa fc fc fc fc fa fc [ 63.140452][ T5011] >ffff88801e78b880: fc fc fc fa fc fc fc fc 00 fc fc fc fc 00 fc fc [ 63.148511][ T5011] ^ [ 63.154912][ T5011] ffff88801e78b900: fc fc 00 fc fc fc fc fa fc fc fc fc 00 fc fc fc [ 63.163080][ T5011] ffff88801e78b980: fc 00 fc fc fc fc fa fc fc fc fc 00 fc fc fc fc [ 63.171148][ T5011] ================================================================== [ 63.182728][ T758] usb 1-1: USB disconnect, device number 2 [ 63.196483][ T5011] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 63.203704][ T5011] CPU: 1 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0 [ 63.213248][ T5011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 63.223300][ T5011] Call Trace: [ 63.226573][ T5011] [ 63.229498][ T5011] dump_stack_lvl+0xd9/0x150 [ 63.234095][ T5011] panic+0x686/0x730 [ 63.237997][ T5011] ? panic_smp_self_stop+0xa0/0xa0 [ 63.243116][ T5011] ? preempt_schedule_thunk+0x1a/0x20 [ 63.248498][ T5011] ? preempt_schedule_common+0x45/0xb0 [ 63.253974][ T5011] check_panic_on_warn+0xb1/0xc0 [ 63.258924][ T5011] end_report+0xe9/0x120 [ 63.263174][ T5011] ? read_descriptors+0x263/0x280 [ 63.268213][ T5011] kasan_report+0xf9/0x130 [ 63.272670][ T5011] ? read_descriptors+0x263/0x280 [ 63.277709][ T5011] read_descriptors+0x263/0x280 [ 63.282569][ T5011] sysfs_kf_bin_read+0x19a/0x270 [ 63.287522][ T5011] ? urbnum_show+0x80/0x80 [ 63.291944][ T5011] ? kernfs_create_link+0x230/0x230 [ 63.297154][ T5011] kernfs_fop_read_iter+0x387/0x690 [ 63.302363][ T5011] vfs_read+0x4b1/0x8a0 [ 63.306528][ T5011] ? kernel_read+0x1c0/0x1c0 [ 63.311129][ T5011] ? rcu_is_watching+0x12/0xb0 [ 63.315901][ T5011] ? __rseq_handle_notify_resume+0x5b3/0xfe0 [ 63.321886][ T5011] ? __fget_light+0x20a/0x270 [ 63.326577][ T5011] ksys_read+0x12b/0x250 [ 63.330818][ T5011] ? vfs_write+0xd50/0xd50 [ 63.335251][ T5011] ? syscall_enter_from_user_mode+0x26/0x80 [ 63.341290][ T5011] do_syscall_64+0x39/0xb0 [ 63.345725][ T5011] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 63.351738][ T5011] RIP: 0033:0x7f07c7916b6a [ 63.356162][ T5011] Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83 [ 63.375865][ T5011] RSP: 002b:00007ffdf34973d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 63.384283][ T5011] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f07c7916b6a [ 63.392260][ T5011] RDX: 0000000000010011 RSI: 00007ffdf3497407 RDI: 0000000000000008 [ 63.402224][ T5011] RBP: 0000000000000008 R08: 0000000000000003 R09: f4f13e10193fbafe [ 63.410213][ T5011] R10: 0000000000000000 R11: 0000000000000246 R12: 000055be37470e10 [ 63.418190][ T5011] R13: 00007ffdf34a7ae8 R14: 00007ffdf34a8138 R15: 00007ffdf3497407 [ 63.426178][ T5011] [ 63.429455][ T5011] Kernel Offset: disabled [ 63.433775][ T5011] Rebooting in 86400 seconds..