./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4190996976
<...>
Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts.
execve("./syz-executor4190996976", ["./syz-executor4190996976"], 0x7ffe2a032070 /* 10 vars */) = 0
brk(NULL) = 0x555555c4c000
brk(0x555555c4cd00) = 0x555555c4cd00
arch_prctl(ARCH_SET_FS, 0x555555c4c380) = 0
set_tid_address(0x555555c4c650) = 5072
set_robust_list(0x555555c4c660, 24) = 0
rseq(0x555555c4cca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4190996976", 4096) = 28
getrandom("\xd0\x6f\x43\xb5\x53\x0d\x17\xc5", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555c4cd00
brk(0x555555c6dd00) = 0x555555c6dd00
brk(0x555555c6e000) = 0x555555c6e000
mprotect(0x7fa1bbcd5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
[ 55.405783][ T5072] ==================================================================
[ 55.413865][ T5072] BUG: KASAN: slab-out-of-bounds in btf_datasec_check_meta+0x2c9/0x9a0
[ 55.422109][ T5072] Read of size 1 at addr ffff88802c6cf6b7 by task syz-executor419/5072
[ 55.430338][ T5072]
[ 55.432651][ T5072] CPU: 0 PID: 5072 Comm: syz-executor419 Not tainted 6.8.0-rc6-syzkaller-ge63985ecd226 #0
[ 55.442526][ T5072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
[ 55.452594][ T5072] Call Trace:
[ 55.455858][ T5072]
[ 55.458773][ T5072] dump_stack_lvl+0x1e7/0x2e0
[ 55.463445][ T5072] ? __pfx_dump_stack_lvl+0x10/0x10
[ 55.468636][ T5072] ? __pfx__printk+0x10/0x10
[ 55.473236][ T5072] ? _printk+0xd5/0x120
[ 55.479710][ T5072] ? __virt_addr_valid+0x183/0x520
[ 55.484810][ T5072] ? __virt_addr_valid+0x183/0x520
[ 55.489925][ T5072] print_report+0x167/0x540
[ 55.494430][ T5072] ? __virt_addr_valid+0x183/0x520
[ 55.499536][ T5072] ? __virt_addr_valid+0x183/0x520
[ 55.504628][ T5072] ? __virt_addr_valid+0x44e/0x520
[ 55.509724][ T5072] ? __phys_addr+0xba/0x170
[ 55.514211][ T5072] ? btf_datasec_check_meta+0x2c9/0x9a0
[ 55.519743][ T5072] kasan_report+0x142/0x180
[ 55.524231][ T5072] ? btf_datasec_check_meta+0x2c9/0x9a0
[ 55.529762][ T5072] btf_datasec_check_meta+0x2c9/0x9a0
[ 55.535126][ T5072] btf_check_all_metas+0x3a1/0xaf0
[ 55.540225][ T5072] btf_parse_type_sec+0x148/0x1a80
[ 55.545315][ T5072] ? __pfx_sort+0x10/0x10
[ 55.549627][ T5072] ? __pfx_btf_sec_info_cmp+0x10/0x10
[ 55.554978][ T5072] ? __pfx___might_resched+0x10/0x10
[ 55.560241][ T5072] ? __might_fault+0xa9/0x120
[ 55.564897][ T5072] ? btf_check_sec_info+0x379/0x4f0
[ 55.570079][ T5072] ? __pfx_btf_parse_type_sec+0x10/0x10
[ 55.575600][ T5072] ? __asan_memcpy+0x40/0x70
[ 55.580170][ T5072] ? btf_parse_str_sec+0x21f/0x2b0
[ 55.585282][ T5072] btf_new_fd+0x469/0xad0
[ 55.589590][ T5072] ? __pfx_btf_new_fd+0x10/0x10
[ 55.594416][ T5072] ? bpf_btf_load+0xcf/0x1a0
[ 55.598986][ T5072] __sys_bpf+0x6ef/0x810
[ 55.603207][ T5072] ? __pfx___sys_bpf+0x10/0x10
[ 55.607958][ T5072] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 55.614265][ T5072] ? exc_page_fault+0x587/0x870
[ 55.619106][ T5072] __x64_sys_bpf+0x7c/0x90
[ 55.623499][ T5072] do_syscall_64+0xf9/0x240
[ 55.627979][ T5072] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 55.633857][ T5072] RIP: 0033:0x7fa1bbc623a9
[ 55.638252][ T5072] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 55.657831][ T5072] RSP: 002b:00007ffc1e453658 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[ 55.666219][ T5072] RAX: ffffffffffffffda RBX: 00007ffc1e453838 RCX: 00007fa1bbc623a9
[ 55.674166][ T5072] RDX: 0000000000000020 RSI: 0000000020000300 RDI: 0000000000000012
[ 55.682113][ T5072] RBP: 00007fa1bbcd5610 R08: 0000000000000000 R09: 0000000000000000
[ 55.690062][ T5072] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
[ 55.698009][ T5072] R13: 00007ffc1e453828 R14: 0000000000000001 R15: 0000000000000001
[ 55.705960][ T5072]
[ 55.708961][ T5072]
[ 55.711259][ T5072] Allocated by task 5072:
[ 55.715559][ T5072] kasan_save_track+0x3f/0x80
[ 55.720220][ T5072] __kasan_kmalloc+0x98/0xb0
[ 55.724796][ T5072] __kmalloc_node+0x24e/0x4e0
[ 55.729472][ T5072] kvmalloc_node+0x72/0x190
[ 55.733958][ T5072] btf_new_fd+0x28f/0xad0
[ 55.738699][ T5072] __sys_bpf+0x6ef/0x810
[ 55.742928][ T5072] __x64_sys_bpf+0x7c/0x90
[ 55.747321][ T5072] do_syscall_64+0xf9/0x240
[ 55.751802][ T5072] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 55.757675][ T5072]
[ 55.759978][ T5072] The buggy address belongs to the object at ffff88802c6cf680
[ 55.759978][ T5072] which belongs to the cache kmalloc-64 of size 64
[ 55.773831][ T5072] The buggy address is located 0 bytes to the right of
[ 55.773831][ T5072] allocated 55-byte region [ffff88802c6cf680, ffff88802c6cf6b7)
[ 55.788211][ T5072]
[ 55.790512][ T5072] The buggy address belongs to the physical page:
[ 55.796898][ T5072] page:ffffea0000b1b3c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c6cf
[ 55.807027][ T5072] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 55.814547][ T5072] page_type: 0xffffffff()
[ 55.818853][ T5072] raw: 00fff00000000800 ffff888014c41640 ffffea0000b06980 dead000000000008
[ 55.827411][ T5072] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[ 55.835963][ T5072] page dumped because: kasan: bad access detected
[ 55.842347][ T5072] page_owner tracks the page as allocated
[ 55.848034][ T5072] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 4517, tgid 4517 (S02sysctl), ts 16721648499, free_ts 16711509714
[ 55.865892][ T5072] post_alloc_hook+0x1ea/0x210
[ 55.870644][ T5072] get_page_from_freelist+0x33ea/0x3580
[ 55.876172][ T5072] __alloc_pages+0x255/0x680
[ 55.880741][ T5072] alloc_slab_page+0x5f/0x160
[ 55.885394][ T5072] new_slab+0x84/0x2f0
[ 55.889442][ T5072] ___slab_alloc+0xd17/0x13e0
[ 55.894094][ T5072] __kmalloc+0x2e0/0x490
[ 55.898314][ T5072] tomoyo_supervisor+0xe0a/0x11f0
[ 55.903317][ T5072] tomoyo_path_permission+0x243/0x360
[ 55.908673][ T5072] tomoyo_path_perm+0x480/0x740
[ 55.913499][ T5072] security_inode_getattr+0xd8/0x130
[ 55.918770][ T5072] vfs_getattr+0x45/0x430
[ 55.923076][ T5072] vfs_fstatat+0xd6/0x190
[ 55.927383][ T5072] __x64_sys_newfstatat+0x117/0x190
[ 55.932556][ T5072] do_syscall_64+0xf9/0x240
[ 55.937044][ T5072] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 55.942920][ T5072] page last free pid 4517 tgid 4517 stack trace:
[ 55.949218][ T5072] free_unref_page_prepare+0x968/0xa90
[ 55.954656][ T5072] free_unref_page_list+0x5a3/0x850
[ 55.959833][ T5072] release_pages+0x2744/0x2a80
[ 55.964573][ T5072] tlb_flush_mmu+0x34c/0x4e0
[ 55.969137][ T5072] tlb_finish_mmu+0xd4/0x200
[ 55.973701][ T5072] exit_mmap+0x4b6/0xd40
[ 55.977919][ T5072] __mmput+0x115/0x3c0
[ 55.981970][ T5072] exec_mmap+0x69c/0x730
[ 55.986185][ T5072] begin_new_exec+0x119a/0x1ce0
[ 55.991015][ T5072] load_elf_binary+0x961/0x2590
[ 55.995844][ T5072] bprm_execve+0xaf7/0x1790
[ 56.000322][ T5072] do_execveat_common+0x552/0x6f0
[ 56.005322][ T5072] __x64_sys_execve+0x92/0xb0
[ 56.009973][ T5072] do_syscall_64+0xf9/0x240
[ 56.014452][ T5072] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 56.020324][ T5072]
[ 56.022623][ T5072] Memory state around the buggy address:
[ 56.028228][ T5072] ffff88802c6cf580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 56.036262][ T5072] ffff88802c6cf600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 56.044296][ T5072] >ffff88802c6cf680: 00 00 00 00 00 00 07 fc fc fc fc fc fc fc fc fc
[ 56.052327][ T5072] ^
[ 56.057930][ T5072] ffff88802c6cf700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 56.065964][ T5072] ffff88802c6cf780: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
[ 56.074008][ T5072] ==================================================================
[ 56.082464][ T5072] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 56.089682][ T5072] CPU: 1 PID: 5072 Comm: syz-executor419 Not tainted 6.8.0-rc6-syzkaller-ge63985ecd226 #0
[ 56.099571][ T5072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
[ 56.109614][ T5072] Call Trace:
[ 56.112885][ T5072]
[ 56.115811][ T5072] dump_stack_lvl+0x1e7/0x2e0
[ 56.120483][ T5072] ? __pfx_dump_stack_lvl+0x10/0x10
[ 56.125677][ T5072] ? __pfx__printk+0x10/0x10
[ 56.130255][ T5072] ? vscnprintf+0x5d/0x90
[ 56.134573][ T5072] panic+0x349/0x860
[ 56.138455][ T5072] ? check_panic_on_warn+0x21/0xb0
[ 56.143555][ T5072] ? __pfx_panic+0x10/0x10
[ 56.147961][ T5072] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 56.153928][ T5072] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 56.160248][ T5072] ? print_report+0x4ff/0x540
[ 56.164915][ T5072] check_panic_on_warn+0x86/0xb0
[ 56.169840][ T5072] ? btf_datasec_check_meta+0x2c9/0x9a0
[ 56.175391][ T5072] end_report+0x6e/0x140
[ 56.179632][ T5072] kasan_report+0x153/0x180
[ 56.184142][ T5072] ? btf_datasec_check_meta+0x2c9/0x9a0
[ 56.189698][ T5072] btf_datasec_check_meta+0x2c9/0x9a0
[ 56.195076][ T5072] btf_check_all_metas+0x3a1/0xaf0
[ 56.200196][ T5072] btf_parse_type_sec+0x148/0x1a80
[ 56.205304][ T5072] ? __pfx_sort+0x10/0x10
[ 56.209627][ T5072] ? __pfx_btf_sec_info_cmp+0x10/0x10
[ 56.214988][ T5072] ? __pfx___might_resched+0x10/0x10
[ 56.220260][ T5072] ? __might_fault+0xa9/0x120
[ 56.224929][ T5072] ? btf_check_sec_info+0x379/0x4f0
[ 56.230117][ T5072] ? __pfx_btf_parse_type_sec+0x10/0x10
[ 56.235658][ T5072] ? __asan_memcpy+0x40/0x70
[ 56.240243][ T5072] ? btf_parse_str_sec+0x21f/0x2b0
[ 56.245344][ T5072] btf_new_fd+0x469/0xad0
[ 56.249674][ T5072] ? __pfx_btf_new_fd+0x10/0x10
[ 56.254513][ T5072] ? bpf_btf_load+0xcf/0x1a0
[ 56.259090][ T5072] __sys_bpf+0x6ef/0x810
[ 56.263319][ T5072] ? __pfx___sys_bpf+0x10/0x10
[ 56.268074][ T5072] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 56.274394][ T5072] ? exc_page_fault+0x587/0x870
[ 56.279238][ T5072] __x64_sys_bpf+0x7c/0x90
[ 56.283641][ T5072] do_syscall_64+0xf9/0x240
[ 56.288136][ T5072] entry_SYSCALL_64_after_hwframe+0x6f/0x77
[ 56.294017][ T5072] RIP: 0033:0x7fa1bbc623a9
[ 56.298418][ T5072] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 56.318015][ T5072] RSP: 002b:00007ffc1e453658 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[ 56.326416][ T5072] RAX: ffffffffffffffda RBX: 00007ffc1e453838 RCX: 00007fa1bbc623a9
[ 56.334378][ T5072] RDX: 0000000000000020 RSI: 0000000020000300 RDI: 0000000000000012
[ 56.342332][ T5072] RBP: 00007fa1bbcd5610 R08: 0000000000000000 R09: 0000000000000000
[ 56.350297][ T5072] R10: 00000000ffffffff R11: 0000000000000246 R12: 0000000000000001
[ 56.358347][ T5072] R13: 00007ffc1e453828 R14: 0000000000000001 R15: 0000000000000001
[ 56.366315][ T5072]
[ 56.369406][ T5072] Kernel Offset: disabled
[ 56.373713][ T5072] Rebooting in 86400 seconds..