./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor258334428
<...>
Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts.
execve("./syz-executor258334428", ["./syz-executor258334428"], 0x7ffec88e6210 /* 10 vars */) = 0
brk(NULL) = 0x555555e55000
brk(0x555555e55c40) = 0x555555e55c40
arch_prctl(ARCH_SET_FS, 0x555555e55300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor258334428", 4096) = 27
brk(0x555555e76c40) = 0x555555e76c40
brk(0x555555e77000) = 0x555555e77000
mprotect(0x7f8db29f0000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
io_uring_setup(1415, {flags=0, sq_thread_cpu=0, sq_thread_idle=0, sq_entries=2048, cq_entries=4096, features=IORING_FEAT_SINGLE_MMAP|IORING_FEAT_NODROP|IORING_FEAT_SUBMIT_STABLE|IORING_FEAT_RW_CUR_POS|IORING_FEAT_CUR_PERSONALITY|IORING_FEAT_FAST_POLL|IORING_FEAT_POLL_32BITS|IORING_FEAT_SQPOLL_NONFIXED|IORING_FEAT_EXT_ARG|IORING_FEAT_NATIVE_WORKERS|IORING_FEAT_RSRC_TAGS|IORING_FEAT_CQE_SKIP|0x1000, sq_off={head=0, tail=64, ring_mask=256, ring_entries=264, flags=276, dropped=272, array=65856}, cq_off={head=128, tail=192, ring_mask=260, ring_entries=268, overflow=284, cqes=320, flags=280}}) = 3
mmap(0x206d5000, 74048, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE, 3, 0) = 0x206d5000
mmap(0x20ffb000, 131072, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE, 3, 0x10000000) = 0x20ffb000
syzkaller login: [ 40.715674][ T3615] ==================================================================
[ 40.723762][ T3615] BUG: KASAN: use-after-free in io_sendrecv_fail+0x3b0/0x3e0
[ 40.731124][ T3615] Write of size 8 at addr ffff888021163080 by task syz-executor258/3615
[ 40.739431][ T3615]
[ 40.741737][ T3615] CPU: 1 PID: 3615 Comm: syz-executor258 Not tainted 6.0.0-rc6-next-20220923-syzkaller #0
[ 40.752400][ T3615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 40.762447][ T3615] Call Trace:
[ 40.765709][ T3615]
[ 40.768637][ T3615] dump_stack_lvl+0xcd/0x134
[ 40.773232][ T3615] print_report+0x15e/0x45d
[ 40.777721][ T3615] ? __phys_addr+0xc4/0x140
[ 40.782209][ T3615] ? io_sendrecv_fail+0x3b0/0x3e0
[ 40.787218][ T3615] kasan_report+0xbb/0x1f0
[ 40.791628][ T3615] ? io_sendrecv_fail+0x3b0/0x3e0
[ 40.796639][ T3615] io_sendrecv_fail+0x3b0/0x3e0
[ 40.801474][ T3615] ? io_sendmsg_zc+0xb00/0xb00
[ 40.806232][ T3615] io_req_complete_failed+0x155/0x1b0
[ 40.811591][ T3615] io_queue_sqe_fallback.cold+0x29f/0x788
[ 40.817309][ T3615] io_submit_sqes+0x1180/0x1df0
[ 40.822177][ T3615] __do_sys_io_uring_enter+0xac6/0x2410
[ 40.827735][ T3615] ? ptrace_stop.part.0+0x5f4/0x8c0
[ 40.832942][ T3615] ? io_submit_sqes+0x1df0/0x1df0
[ 40.837975][ T3615] ? rcu_read_lock_sched_held+0xd/0x70
[ 40.843457][ T3615] ? lock_release+0x5cb/0x810
[ 40.848136][ T3615] ? ptrace_notify+0xfa/0x140
[ 40.852826][ T3615] ? lock_downgrade+0x6e0/0x6e0
[ 40.857685][ T3615] ? _raw_spin_unlock_irq+0x1f/0x40
[ 40.862896][ T3615] ? trace_hardirqs_on+0x2d/0x160
[ 40.867922][ T3615] ? _raw_spin_unlock_irq+0x2a/0x40
[ 40.873133][ T3615] ? ptrace_notify+0xfa/0x140
[ 40.877817][ T3615] do_syscall_64+0x35/0xb0
[ 40.882238][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 40.888162][ T3615] RIP: 0033:0x7f8db2983dc9
[ 40.892589][ T3615] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 40.912294][ T3615] RSP: 002b:00007fffe363f568 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
[ 40.920716][ T3615] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8db2983dc9
[ 40.928691][ T3615] RDX: 0000000000000000 RSI: 0000000000002a6e RDI: 0000000000000003
[ 40.936685][ T3615] RBP: 00007f8db2947f70 R08: 0000000000000000 R09: 0000000000000000
[ 40.944672][ T3615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8db2948000
[ 40.952678][ T3615] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 40.963896][ T3615]
[ 40.966925][ T3615]
[ 40.969340][ T3615] Allocated by task 3615:
[ 40.973757][ T3615] kasan_save_stack+0x1e/0x40
[ 40.978456][ T3615] kasan_set_track+0x21/0x30
[ 40.983063][ T3615] __kasan_kmalloc+0xa1/0xb0
[ 40.987668][ T3615] __kmalloc+0x54/0xc0
[ 40.992526][ T3615] io_alloc_async_data+0x9b/0x160
[ 40.997572][ T3615] io_sendmsg_prep_async+0x19b/0x3c0
[ 41.002859][ T3615] io_req_prep_async+0x1d9/0x300
[ 41.007839][ T3615] io_queue_sqe_fallback.cold+0x281/0x788
[ 41.013578][ T3615] io_submit_sqes+0x1180/0x1df0
[ 41.018443][ T3615] __do_sys_io_uring_enter+0xac6/0x2410
[ 41.024006][ T3615] do_syscall_64+0x35/0xb0
[ 41.028424][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.034335][ T3615]
[ 41.036651][ T3615] Freed by task 3615:
[ 41.040625][ T3615] kasan_save_stack+0x1e/0x40
[ 41.045336][ T3615] kasan_set_track+0x21/0x30
[ 41.049940][ T3615] kasan_save_free_info+0x2a/0x40
[ 41.054971][ T3615] ____kasan_slab_free+0x160/0x1c0
[ 41.060099][ T3615] slab_free_freelist_hook+0x8b/0x1c0
[ 41.065493][ T3615] __kmem_cache_free+0xab/0x3b0
[ 41.070370][ T3615] io_sendrecv_fail+0x2a4/0x3e0
[ 41.075231][ T3615] io_req_complete_failed+0x155/0x1b0
[ 41.080614][ T3615] io_queue_sqe_fallback.cold+0x29f/0x788
[ 41.086344][ T3615] io_submit_sqes+0x1180/0x1df0
[ 41.091209][ T3615] __do_sys_io_uring_enter+0xac6/0x2410
[ 41.096772][ T3615] do_syscall_64+0x35/0xb0
[ 41.101190][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.107107][ T3615]
[ 41.109424][ T3615] The buggy address belongs to the object at ffff888021163000
[ 41.109424][ T3615] which belongs to the cache kmalloc-512 of size 512
[ 41.123492][ T3615] The buggy address is located 128 bytes inside of
[ 41.123492][ T3615] 512-byte region [ffff888021163000, ffff888021163200)
[ 41.136772][ T3615]
[ 41.139094][ T3615] The buggy address belongs to the physical page:
[ 41.145503][ T3615] page:ffffea0000845800 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffffea0000854700 pfn:0x21160
[ 41.156961][ T3615] head:ffffea0000845800 order:2 compound_mapcount:0 compound_pincount:0
[ 41.165308][ T3615] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 41.173300][ T3615] raw: 00fff00000010200 ffff888011841c80 dead000080100010 0000000000000000
[ 41.181883][ T3615] raw: ffffea0000854700 dead000000000002 00000001ffffffff 0000000000000000
[ 41.190456][ T3615] page dumped because: kasan: bad access detected
[ 41.197481][ T3615] page_owner tracks the page as allocated
[ 41.203189][ T3615] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1501, tgid 1501 (kworker/u4:5), ts 8710207687, free_ts 0
[ 41.223611][ T3615] get_page_from_freelist+0x1092/0x2d20
[ 41.229168][ T3615] __alloc_pages+0x1c7/0x5a0
[ 41.233760][ T3615] alloc_pages+0x1a6/0x270
[ 41.238186][ T3615] allocate_slab+0x213/0x300
[ 41.242790][ T3615] ___slab_alloc+0xac1/0x1430
[ 41.247648][ T3615] __slab_alloc.constprop.0+0x4d/0xa0
[ 41.253038][ T3615] __kmem_cache_alloc_node+0x18a/0x3d0
[ 41.258507][ T3615] kmalloc_trace+0x22/0x60
[ 41.262926][ T3615] alloc_bprm+0x51/0x900
[ 41.267179][ T3615] kernel_execve+0xab/0x500
[ 41.271692][ T3615] call_usermodehelper_exec_async+0x2e3/0x580
[ 41.277761][ T3615] ret_from_fork+0x1f/0x30
[ 41.282187][ T3615] page_owner free stack trace missing
[ 41.287547][ T3615]
[ 41.289881][ T3615] Memory state around the buggy address:
[ 41.295505][ T3615] ffff888021162f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 41.303565][ T3615] ffff888021163000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.311622][ T3615] >ffff888021163080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.319702][ T3615] ^
[ 41.323773][ T3615] ffff888021163100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.331849][ T3615] ffff888021163180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 41.339908][ T3615] ==================================================================
[ 41.348494][ T3615] Kernel panic - not syncing: panic_on_warn set ...
[ 41.355097][ T3615] CPU: 1 PID: 3615 Comm: syz-executor258 Not tainted 6.0.0-rc6-next-20220923-syzkaller #0
[ 41.365004][ T3615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
[ 41.375056][ T3615] Call Trace:
[ 41.378334][ T3615]
[ 41.381264][ T3615] dump_stack_lvl+0xcd/0x134
[ 41.385883][ T3615] panic+0x2c8/0x622
[ 41.389787][ T3615] ? panic_print_sys_info.part.0+0x110/0x110
[ 41.395773][ T3615] ? preempt_schedule_common+0x59/0xc0
[ 41.401239][ T3615] ? preempt_schedule_thunk+0x16/0x18
[ 41.406628][ T3615] end_report.part.0+0x3f/0x7c
[ 41.411398][ T3615] ? io_sendrecv_fail+0x3b0/0x3e0
[ 41.416425][ T3615] kasan_report.cold+0xa/0xf
[ 41.421022][ T3615] ? io_sendrecv_fail+0x3b0/0x3e0
[ 41.426057][ T3615] io_sendrecv_fail+0x3b0/0x3e0
[ 41.430910][ T3615] ? io_sendmsg_zc+0xb00/0xb00
[ 41.435677][ T3615] io_req_complete_failed+0x155/0x1b0
[ 41.441061][ T3615] io_queue_sqe_fallback.cold+0x29f/0x788
[ 41.446795][ T3615] io_submit_sqes+0x1180/0x1df0
[ 41.451679][ T3615] __do_sys_io_uring_enter+0xac6/0x2410
[ 41.457263][ T3615] ? ptrace_stop.part.0+0x5f4/0x8c0
[ 41.462483][ T3615] ? io_submit_sqes+0x1df0/0x1df0
[ 41.467523][ T3615] ? rcu_read_lock_sched_held+0xd/0x70
[ 41.472999][ T3615] ? lock_release+0x5cb/0x810
[ 41.477680][ T3615] ? ptrace_notify+0xfa/0x140
[ 41.482363][ T3615] ? lock_downgrade+0x6e0/0x6e0
[ 41.487220][ T3615] ? _raw_spin_unlock_irq+0x1f/0x40
[ 41.492443][ T3615] ? trace_hardirqs_on+0x2d/0x160
[ 41.497478][ T3615] ? _raw_spin_unlock_irq+0x2a/0x40
[ 41.502689][ T3615] ? ptrace_notify+0xfa/0x140
[ 41.507372][ T3615] do_syscall_64+0x35/0xb0
[ 41.511791][ T3615] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 41.517706][ T3615] RIP: 0033:0x7f8db2983dc9
[ 41.522121][ T3615] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 41.541734][ T3615] RSP: 002b:00007fffe363f568 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
[ 41.550149][ T3615] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8db2983dc9
[ 41.558121][ T3615] RDX: 0000000000000000 RSI: 0000000000002a6e RDI: 0000000000000003
[ 41.566091][ T3615] RBP: 00007f8db2947f70 R08: 0000000000000000 R09: 0000000000000000
[ 41.574062][ T3615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8db2948000
[ 41.582031][ T3615] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 41.590022][ T3615]
[ 41.593189][ T3615] Kernel Offset: disabled
[ 41.597505][ T3615] Rebooting in 86400 seconds..