./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2363147777 <...> Warning: Permanently added '10.128.0.9' (ECDSA) to the list of known hosts. execve("./syz-executor2363147777", ["./syz-executor2363147777"], 0x7ffec29d0940 /* 10 vars */) = 0 brk(NULL) = 0x555555be2000 brk(0x555555be2c40) = 0x555555be2c40 arch_prctl(ARCH_SET_FS, 0x555555be2300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2363147777", 4096) = 28 brk(0x555555c03c40) = 0x555555c03c40 brk(0x555555c04000) = 0x555555c04000 mprotect(0x7fddb2c3f000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555be25d0) = 3638 ./strace-static-x86_64: Process 3638 attached [pid 3638] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3638] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3638] setsid() = 1 [pid 3638] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3638] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3638] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3638] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3638] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3638] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3638] unshare(CLONE_NEWNS) = 0 [pid 3638] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3638] unshare(CLONE_NEWIPC) = 0 [pid 3638] unshare(CLONE_NEWCGROUP) = 0 [pid 3638] unshare(CLONE_NEWUTS) = 0 [pid 3638] unshare(CLONE_SYSVSEM) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "16777216", 8) = 8 [pid 3638] close(3) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "536870912", 9) = 9 [pid 3638] close(3) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "1024", 4) = 4 [pid 3638] close(3) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "8192", 4) = 4 [pid 3638] close(3) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "1024", 4) = 4 [pid 3638] close(3) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "1024", 4) = 4 [pid 3638] close(3) = 0 [pid 3638] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3638] close(3) = 0 [pid 3638] getpid() = 1 [pid 3638] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 3638] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555be25d0) = 3 ./strace-static-x86_64: Process 3648 attached [pid 3648] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3648] setpgid(0, 0) = 0 [pid 3648] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3648] write(3, "1000", 4) = 4 [pid 3648] close(3) = 0 [pid 3648] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 3648] ioctl(3, SIOCADDRT, 0x200000c0) = -1 EEXIST (File exists) [pid 3648] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20000b40, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [ 57.764214][ T3647] syz-executor236 (3647) used greatest stack depth: 22040 bytes left [pid 3648] bpf(BPF_PROG_TEST_RUN, {test={prog_fd=4, retval=672, data_size_in=761, data_size_out=772, data_in=0x20000040, data_out=NULL, repeat=260, duration=0}}, 40) = 0 [pid 3648] close(3) = 0 [pid 3648] close(4) = 0 [pid 3648] close(5) = -1 EBADF (Bad file descriptor) [pid 3648] close(6) = -1 EBADF (Bad file descriptor) [pid 3648] close(7) = -1 EBADF (Bad file descriptor) [pid 3648] close(8) = -1 EBADF (Bad file descriptor) [pid 3648] close(9) = -1 EBADF (Bad file descriptor) [pid 3648] close(10) = -1 EBADF (Bad file descriptor) [pid 3648] close(11) = -1 EBADF (Bad file descriptor) [pid 3648] close(12) = -1 EBADF (Bad file descriptor) [pid 3648] close(13) = -1 EBADF (Bad file descriptor) [pid 3648] close(14) = -1 EBADF (Bad file descriptor) [pid 3648] close(15) = -1 EBADF (Bad file descriptor) [pid 3648] close(16) = -1 EBADF (Bad file descriptor) [pid 3648] close(17) = -1 EBADF (Bad file descriptor) [pid 3648] close(18) = -1 EBADF (Bad file descriptor) [pid 3648] close(19) = -1 EBADF (Bad file descriptor) [pid 3648] close(20) = -1 EBADF (Bad file descriptor) [pid 3648] close(21) = -1 EBADF (Bad file descriptor) [pid 3648] close(22) = -1 EBADF (Bad file descriptor) [pid 3648] close(23) = -1 EBADF (Bad file descriptor) [pid 3648] close(24) = -1 EBADF (Bad file descriptor) [pid 3648] close(25) = -1 EBADF (Bad file descriptor) [pid 3648] close(26) = -1 EBADF (Bad file descriptor) [pid 3648] close(27) = -1 EBADF (Bad file descriptor) [pid 3648] close(28) = -1 EBADF (Bad file descriptor) [pid 3648] close(29) = -1 EBADF (Bad file descriptor) [pid 3648] exit_group(0) = ? [pid 3648] +++ exited with 0 +++ [pid 3638] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 3638] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3638] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3649 attached , child_tidptr=0x555555be25d0) = 4 [pid 3649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3649] setpgid(0, 0) = 0 [pid 3649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3649] write(3, "1000", 4) = 4 [pid 3649] close(3) = 0 [pid 3649] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 3649] ioctl(3, SIOCADDRT, 0x200000c0) = -1 EEXIST (File exists) [pid 3649] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20000b40, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [pid 3649] bpf(BPF_PROG_TEST_RUN, {test={prog_fd=4, retval=672, data_size_in=761, data_size_out=772, data_in=0x20000040, data_out=NULL, repeat=260, duration=0}}, 40) = 0 [pid 3649] close(3) = 0 [pid 3649] close(4) = 0 [pid 3649] close(5) = -1 EBADF (Bad file descriptor) [pid 3649] close(6) = -1 EBADF (Bad file descriptor) [pid 3649] close(7) = -1 EBADF (Bad file descriptor) [pid 3649] close(8) = -1 EBADF (Bad file descriptor) [pid 3649] close(9) = -1 EBADF (Bad file descriptor) [pid 3649] close(10) = -1 EBADF (Bad file descriptor) [pid 3649] close(11) = -1 EBADF (Bad file descriptor) [pid 3649] close(12) = -1 EBADF (Bad file descriptor) [pid 3649] close(13) = -1 EBADF (Bad file descriptor) [pid 3649] close(14) = -1 EBADF (Bad file descriptor) [pid 3649] close(15) = -1 EBADF (Bad file descriptor) [pid 3649] close(16) = -1 EBADF (Bad file descriptor) [pid 3649] close(17) = -1 EBADF (Bad file descriptor) [pid 3649] close(18) = -1 EBADF (Bad file descriptor) [pid 3649] close(19) = -1 EBADF (Bad file descriptor) [pid 3649] close(20) = -1 EBADF (Bad file descriptor) [pid 3649] close(21) = -1 EBADF (Bad file descriptor) [pid 3649] close(22) = -1 EBADF (Bad file descriptor) [pid 3649] close(23) = -1 EBADF (Bad file descriptor) [pid 3649] close(24) = -1 EBADF (Bad file descriptor) [pid 3649] close(25) = -1 EBADF (Bad file descriptor) [pid 3649] close(26) = -1 EBADF (Bad file descriptor) [pid 3649] close(27) = -1 EBADF (Bad file descriptor) [pid 3649] close(28) = -1 EBADF (Bad file descriptor) [pid 3649] close(29) = -1 EBADF (Bad file descriptor) [pid 3649] exit_group(0) = ? [pid 3649] +++ exited with 0 +++ [pid 3638] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 3638] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3638] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555be25d0) = 5 ./strace-static-x86_64: Process 3650 attached [pid 3650] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3650] setpgid(0, 0) = 0 [pid 3650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3650] write(3, "1000", 4) = 4 [pid 3650] close(3) = 0 [pid 3650] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 3650] ioctl(3, SIOCADDRT, 0x200000c0) = -1 EEXIST (File exists) [pid 3650] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20000b40, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 4 [ 57.987368][ T3650] ================================================================== [ 57.995462][ T3650] BUG: KASAN: use-after-free in __skb_flow_dissect+0x9c3/0x59a0 [ 58.003087][ T3650] Read of size 1 at addr ffff88816fe8000e by task syz-executor236/3650 [ 58.011303][ T3650] [ 58.013608][ T3650] CPU: 0 PID: 3650 Comm: syz-executor236 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 [ 58.024006][ T3650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 58.034043][ T3650] Call Trace: [ 58.037314][ T3650] [ 58.040230][ T3650] dump_stack_lvl+0xd1/0x138 [ 58.044819][ T3650] print_report+0x15e/0x461 [ 58.049318][ T3650] ? __phys_addr+0xc8/0x140 [ 58.053838][ T3650] ? __skb_flow_dissect+0x9c3/0x59a0 [ 58.059119][ T3650] kasan_report+0xbf/0x1f0 [ 58.063539][ T3650] ? __skb_flow_dissect+0x9c3/0x59a0 [ 58.068867][ T3650] __skb_flow_dissect+0x9c3/0x59a0 [ 58.073998][ T3650] ? bpf_flow_dissect+0x360/0x360 [ 58.079027][ T3650] ? page_ext_put+0x4d/0xb0 [ 58.083530][ T3650] ? __set_page_owner+0x50/0x60 [ 58.088379][ T3650] ? get_page_from_freelist+0x10b5/0x2d50 [ 58.094134][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.099189][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.104225][ T3650] ? lock_chain_count+0x20/0x20 [ 58.109086][ T3650] ? lock_chain_count+0x20/0x20 [ 58.113943][ T3650] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 58.119927][ T3650] ? __zone_watermark_ok+0x460/0x460 [ 58.125212][ T3650] ? __lock_acquire+0x166e/0x56d0 [ 58.130239][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.135265][ T3650] ? arch_stack_walk+0x60/0xf0 [ 58.140040][ T3650] __skb_get_hash+0xba/0x4b0 [ 58.144624][ T3650] ? kernel_text_address+0x35/0x70 [ 58.149742][ T3650] ? __skb_get_hash_symmetric+0x3f0/0x3f0 [ 58.155452][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.160479][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.165504][ T3650] ip_tunnel_xmit+0x18f4/0x3180 [ 58.170357][ T3650] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 58.176271][ T3650] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 58.181579][ T3650] ? skb_network_protocol+0x134/0x590 [ 58.186966][ T3650] ? register_lock_class+0xbe/0x1120 [ 58.192275][ T3650] ? skb_crc32c_csum_help+0x80/0x80 [ 58.197477][ T3650] ipip_tunnel_xmit+0x417/0x510 [ 58.202326][ T3650] dev_hard_start_xmit+0x1c2/0x990 [ 58.207441][ T3650] __dev_queue_xmit+0x2cdf/0x3ba0 [ 58.212475][ T3650] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 58.217765][ T3650] ? find_held_lock+0x2d/0x110 [ 58.222525][ T3650] ? ip_finish_output2+0x78a/0x2180 [ 58.227720][ T3650] ? lock_downgrade+0x6e0/0x6e0 [ 58.232568][ T3650] ? __local_bh_enable_ip+0xa4/0x130 [ 58.237852][ T3650] ? lockdep_hardirqs_on+0x7d/0x100 [ 58.243047][ T3650] ? ___neigh_create+0x188e/0x2a20 [ 58.248159][ T3650] ? neigh_connected_output+0x41e/0x520 [ 58.253725][ T3650] neigh_connected_output+0x3c4/0x520 [ 58.259095][ T3650] ip_finish_output2+0x78a/0x2180 [ 58.264117][ T3650] ? nf_hook+0x20d/0x5b0 [ 58.268370][ T3650] ? ip_fragment.constprop.0+0x240/0x240 [ 58.274002][ T3650] ? ip_mc_finish_output+0x5a0/0x5a0 [ 58.279284][ T3650] ? dst_output+0x170/0x170 [ 58.283786][ T3650] __ip_finish_output+0x396/0x650 [ 58.288807][ T3650] ip_finish_output+0x31/0x280 [ 58.293568][ T3650] ip_mc_output+0x21f/0x710 [ 58.298079][ T3650] ip_local_out+0xb3/0x1a0 [ 58.302594][ T3650] iptunnel_xmit+0x67e/0x9f0 [ 58.307197][ T3650] ip_tunnel_xmit+0x1443/0x3180 [ 58.312060][ T3650] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 58.317345][ T3650] ? skb_network_protocol+0x151/0x590 [ 58.322808][ T3650] ? __gre_xmit+0x4f4/0x9a0 [ 58.327311][ T3650] ipgre_xmit+0x6e4/0x900 [ 58.331651][ T3650] dev_hard_start_xmit+0x1c2/0x990 [ 58.336766][ T3650] __dev_queue_xmit+0x2cdf/0x3ba0 [ 58.341792][ T3650] ? do_raw_spin_unlock+0x175/0x230 [ 58.346992][ T3650] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 58.352285][ T3650] ? skb_release_data+0x565/0x870 [ 58.357397][ T3650] ? skb_headers_offset_update+0x129/0x250 [ 58.363195][ T3650] ? pskb_expand_head+0x5fc/0x1110 [ 58.368327][ T3650] __bpf_redirect+0x666/0xe40 [ 58.373007][ T3650] ? skb_ensure_writable+0xe0/0x450 [ 58.378203][ T3650] bpf_clone_redirect+0x2b2/0x420 [ 58.383230][ T3650] ? __bpf_redirect+0xe40/0xe40 [ 58.388087][ T3650] ___bpf_prog_run+0x37d5/0x7b50 [ 58.393021][ T3650] __bpf_prog_run512+0xa4/0xe0 [ 58.397780][ T3650] ? __bpf_prog_run_args32+0x100/0x100 [ 58.403234][ T3650] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 58.409217][ T3650] ? find_held_lock+0x2d/0x110 [ 58.413980][ T3650] ? bpf_test_timer_enter+0xa0/0x160 [ 58.419262][ T3650] ? lock_downgrade+0x6e0/0x6e0 [ 58.424115][ T3650] ? ktime_get+0x38e/0x470 [ 58.428526][ T3650] ? lockdep_hardirqs_on+0x7d/0x100 [ 58.433745][ T3650] ? ktime_get+0x38e/0x470 [ 58.438168][ T3650] ? ktime_get+0x30f/0x470 [ 58.442587][ T3650] ? bpf_test_timer_continue+0x12e/0x410 [ 58.448220][ T3650] bpf_test_run+0x37c/0x9c0 [ 58.452729][ T3650] ? bpf_test_timer_continue+0x410/0x410 [ 58.458360][ T3650] ? __phys_addr+0xc8/0x140 [ 58.462860][ T3650] ? memset+0x24/0x50 [ 58.466835][ T3650] ? eth_type_trans+0x2ac/0x640 [ 58.471686][ T3650] ? __build_skb+0x54/0x60 [ 58.476102][ T3650] bpf_prog_test_run_skb+0xbaf/0x1e60 [ 58.481494][ T3650] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 58.487240][ T3650] ? __fget_light+0x20a/0x270 [ 58.491936][ T3650] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 58.497674][ T3650] __sys_bpf+0x1599/0x4f40 [ 58.502117][ T3650] ? lock_release+0x810/0x810 [ 58.506818][ T3650] ? bpf_perf_link_attach+0x520/0x520 [ 58.512202][ T3650] ? do_raw_spin_lock+0x124/0x2b0 [ 58.517316][ T3650] ? rwlock_bug.part.0+0x90/0x90 [ 58.522256][ T3650] ? _raw_spin_lock_irq+0x45/0x50 [ 58.527286][ T3650] ? find_held_lock+0x2d/0x110 [ 58.532049][ T3650] ? _raw_spin_unlock_irq+0x23/0x50 [ 58.537246][ T3650] ? lockdep_hardirqs_on+0x7d/0x100 [ 58.542443][ T3650] __x64_sys_bpf+0x79/0xc0 [ 58.546864][ T3650] do_syscall_64+0x39/0xb0 [ 58.551283][ T3650] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.557178][ T3650] RIP: 0033:0x7fddb2bcae69 [ 58.561583][ T3650] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 58.581274][ T3650] RSP: 002b:00007fff0f541838 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 58.589679][ T3650] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fddb2bcae69 [ 58.597644][ T3650] RDX: 0000000000000028 RSI: 0000000020000080 RDI: 000000000000000a [ 58.605618][ T3650] RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d [ 58.613581][ T3650] R10: 000000000000000d R11: 0000000000000246 R12: 00007fff0f541850 [ 58.621542][ T3650] R13: 00000000000f4240 R14: 000000000000e1d1 R15: 00007fff0f541844 [ 58.629507][ T3650] [ 58.632514][ T3650] [ 58.634823][ T3650] The buggy address belongs to the physical page: [ 58.641224][ T3650] page:ffffea0005bfa000 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16fe80 [ 58.651451][ T3650] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 58.658645][ T3650] raw: 057ff00000000000 ffffea0005bfa008 ffffea0005bfa008 0000000000000000 [ 58.667216][ T3650] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 58.675786][ T3650] page dumped because: kasan: bad access detected [ 58.682212][ T3650] page_owner info is not present (never set?) [ 58.688260][ T3650] [ 58.690574][ T3650] Memory state around the buggy address: [ 58.696194][ T3650] ffff88816fe7ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.704243][ T3650] ffff88816fe7ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.712310][ T3650] >ffff88816fe80000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.720366][ T3650] ^ [ 58.724711][ T3650] ffff88816fe80080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.732877][ T3650] ffff88816fe80100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 58.740947][ T3650] ================================================================== [ 58.749072][ T3650] Kernel panic - not syncing: panic_on_warn set ... [ 58.756199][ T3650] CPU: 0 PID: 3650 Comm: syz-executor236 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 [ 58.766630][ T3650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 58.776705][ T3650] Call Trace: [ 58.780007][ T3650] [ 58.782940][ T3650] dump_stack_lvl+0xd1/0x138 [ 58.787539][ T3650] panic+0x2cc/0x626 [ 58.791439][ T3650] ? panic_print_sys_info.part.0+0x110/0x110 [ 58.797412][ T3650] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 58.803596][ T3650] end_report.part.0+0x3f/0x7c [ 58.808375][ T3650] ? __skb_flow_dissect+0x9c3/0x59a0 [ 58.813677][ T3650] kasan_report.cold+0xa/0xf [ 58.818280][ T3650] ? __skb_flow_dissect+0x9c3/0x59a0 [ 58.823575][ T3650] __skb_flow_dissect+0x9c3/0x59a0 [ 58.828681][ T3650] ? bpf_flow_dissect+0x360/0x360 [ 58.833696][ T3650] ? page_ext_put+0x4d/0xb0 [ 58.838203][ T3650] ? __set_page_owner+0x50/0x60 [ 58.843053][ T3650] ? get_page_from_freelist+0x10b5/0x2d50 [ 58.848773][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.853798][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.858821][ T3650] ? lock_chain_count+0x20/0x20 [ 58.863673][ T3650] ? lock_chain_count+0x20/0x20 [ 58.868526][ T3650] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 58.876416][ T3650] ? __zone_watermark_ok+0x460/0x460 [ 58.881697][ T3650] ? __lock_acquire+0x166e/0x56d0 [ 58.886754][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.891797][ T3650] ? arch_stack_walk+0x60/0xf0 [ 58.896556][ T3650] __skb_get_hash+0xba/0x4b0 [ 58.901140][ T3650] ? kernel_text_address+0x35/0x70 [ 58.906255][ T3650] ? __skb_get_hash_symmetric+0x3f0/0x3f0 [ 58.911970][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.916994][ T3650] ? mark_lock.part.0+0xee/0x1910 [ 58.922044][ T3650] ip_tunnel_xmit+0x18f4/0x3180 [ 58.926895][ T3650] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 58.932785][ T3650] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 58.938075][ T3650] ? skb_network_protocol+0x134/0x590 [ 58.943447][ T3650] ? register_lock_class+0xbe/0x1120 [ 58.949166][ T3650] ? skb_crc32c_csum_help+0x80/0x80 [ 58.954363][ T3650] ipip_tunnel_xmit+0x417/0x510 [ 58.959207][ T3650] dev_hard_start_xmit+0x1c2/0x990 [ 58.964319][ T3650] __dev_queue_xmit+0x2cdf/0x3ba0 [ 58.969344][ T3650] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 58.974794][ T3650] ? find_held_lock+0x2d/0x110 [ 58.979564][ T3650] ? ip_finish_output2+0x78a/0x2180 [ 58.984938][ T3650] ? lock_downgrade+0x6e0/0x6e0 [ 58.989899][ T3650] ? __local_bh_enable_ip+0xa4/0x130 [ 58.995230][ T3650] ? lockdep_hardirqs_on+0x7d/0x100 [ 59.000437][ T3650] ? ___neigh_create+0x188e/0x2a20 [ 59.005580][ T3650] ? neigh_connected_output+0x41e/0x520 [ 59.011164][ T3650] neigh_connected_output+0x3c4/0x520 [ 59.016556][ T3650] ip_finish_output2+0x78a/0x2180 [ 59.021580][ T3650] ? nf_hook+0x20d/0x5b0 [ 59.025835][ T3650] ? ip_fragment.constprop.0+0x240/0x240 [ 59.031491][ T3650] ? ip_mc_finish_output+0x5a0/0x5a0 [ 59.036792][ T3650] ? dst_output+0x170/0x170 [ 59.041293][ T3650] __ip_finish_output+0x396/0x650 [ 59.046317][ T3650] ip_finish_output+0x31/0x280 [ 59.051085][ T3650] ip_mc_output+0x21f/0x710 [ 59.055588][ T3650] ip_local_out+0xb3/0x1a0 [ 59.060012][ T3650] iptunnel_xmit+0x67e/0x9f0 [ 59.064603][ T3650] ip_tunnel_xmit+0x1443/0x3180 [ 59.069454][ T3650] ? ip_md_tunnel_xmit+0x18a0/0x18a0 [ 59.074750][ T3650] ? skb_network_protocol+0x151/0x590 [ 59.080132][ T3650] ? __gre_xmit+0x4f4/0x9a0 [ 59.084634][ T3650] ipgre_xmit+0x6e4/0x900 [ 59.088961][ T3650] dev_hard_start_xmit+0x1c2/0x990 [ 59.094075][ T3650] __dev_queue_xmit+0x2cdf/0x3ba0 [ 59.099102][ T3650] ? do_raw_spin_unlock+0x175/0x230 [ 59.104302][ T3650] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 59.109588][ T3650] ? skb_release_data+0x565/0x870 [ 59.114614][ T3650] ? skb_headers_offset_update+0x129/0x250 [ 59.120867][ T3650] ? pskb_expand_head+0x5fc/0x1110 [ 59.125989][ T3650] __bpf_redirect+0x666/0xe40 [ 59.130677][ T3650] ? skb_ensure_writable+0xe0/0x450 [ 59.135877][ T3650] bpf_clone_redirect+0x2b2/0x420 [ 59.140935][ T3650] ? __bpf_redirect+0xe40/0xe40 [ 59.145801][ T3650] ___bpf_prog_run+0x37d5/0x7b50 [ 59.150745][ T3650] __bpf_prog_run512+0xa4/0xe0 [ 59.155510][ T3650] ? __bpf_prog_run_args32+0x100/0x100 [ 59.160980][ T3650] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 59.166963][ T3650] ? find_held_lock+0x2d/0x110 [ 59.171764][ T3650] ? bpf_test_timer_enter+0xa0/0x160 [ 59.177047][ T3650] ? lock_downgrade+0x6e0/0x6e0 [ 59.181899][ T3650] ? ktime_get+0x38e/0x470 [ 59.186313][ T3650] ? lockdep_hardirqs_on+0x7d/0x100 [ 59.191506][ T3650] ? ktime_get+0x38e/0x470 [ 59.195916][ T3650] ? ktime_get+0x30f/0x470 [ 59.200329][ T3650] ? bpf_test_timer_continue+0x12e/0x410 [ 59.205957][ T3650] bpf_test_run+0x37c/0x9c0 [ 59.210460][ T3650] ? bpf_test_timer_continue+0x410/0x410 [ 59.216189][ T3650] ? __phys_addr+0xc8/0x140 [ 59.220780][ T3650] ? memset+0x24/0x50 [ 59.224755][ T3650] ? eth_type_trans+0x2ac/0x640 [ 59.229607][ T3650] ? __build_skb+0x54/0x60 [ 59.234028][ T3650] bpf_prog_test_run_skb+0xbaf/0x1e60 [ 59.239401][ T3650] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 59.245129][ T3650] ? __fget_light+0x20a/0x270 [ 59.249822][ T3650] ? bpf_prog_test_run_raw_tp+0x620/0x620 [ 59.255543][ T3650] __sys_bpf+0x1599/0x4f40 [ 59.259968][ T3650] ? lock_release+0x810/0x810 [ 59.264651][ T3650] ? bpf_perf_link_attach+0x520/0x520 [ 59.270037][ T3650] ? do_raw_spin_lock+0x124/0x2b0 [ 59.275064][ T3650] ? rwlock_bug.part.0+0x90/0x90 [ 59.280006][ T3650] ? _raw_spin_lock_irq+0x45/0x50 [ 59.285039][ T3650] ? find_held_lock+0x2d/0x110 [ 59.289798][ T3650] ? _raw_spin_unlock_irq+0x23/0x50 [ 59.295184][ T3650] ? lockdep_hardirqs_on+0x7d/0x100 [ 59.300380][ T3650] __x64_sys_bpf+0x79/0xc0 [ 59.304815][ T3650] do_syscall_64+0x39/0xb0 [ 59.309224][ T3650] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.315118][ T3650] RIP: 0033:0x7fddb2bcae69 [ 59.319522][ T3650] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 59.339124][ T3650] RSP: 002b:00007fff0f541838 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 59.347532][ T3650] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fddb2bcae69 [ 59.355506][ T3650] RDX: 0000000000000028 RSI: 0000000020000080 RDI: 000000000000000a [ 59.363992][ T3650] RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d [ 59.371953][ T3650] R10: 000000000000000d R11: 0000000000000246 R12: 00007fff0f541850 [ 59.379917][ T3650] R13: 00000000000f4240 R14: 000000000000e1d1 R15: 00007fff0f541844 [ 59.387881][ T3650] [ 59.391110][ T3650] Kernel Offset: disabled [ 59.395420][ T3650] Rebooting in 86400 seconds..