./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor49637651 <...> forked to background, child pid 3187 no interfaces have a carrier [ 26.099089][ T3188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.111026][ T3188] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.174' (ECDSA) to the list of known hosts. execve("./syz-executor49637651", ["./syz-executor49637651"], 0x7fff1d2a0670 /* 10 vars */) = 0 brk(NULL) = 0x555557449000 brk(0x555557449c40) = 0x555557449c40 arch_prctl(ARCH_SET_FS, 0x555557449300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor49637651", 4096) = 26 brk(0x55555746ac40) = 0x55555746ac40 brk(0x55555746b000) = 0x55555746b000 mprotect(0x7fe9bca78000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3609 attached , child_tidptr=0x5555574495d0) = 3609 [pid 3609] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3609] setsid() = 1 [pid 3609] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3609] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3609] unshare(CLONE_NEWNS) = 0 [pid 3609] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3609] unshare(CLONE_NEWIPC) = 0 [pid 3609] unshare(CLONE_NEWCGROUP) = 0 [pid 3609] unshare(CLONE_NEWUTS) = 0 [pid 3609] unshare(CLONE_SYSVSEM) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "16777216", 8) = 8 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "536870912", 9) = 9 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "8192", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024", 4) = 4 [pid 3609] close(3) = 0 [pid 3609] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3609] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3609] close(3) = 0 [pid 3609] getpid() = 1 [pid 3609] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 3c 02 00 0f 85 4e 31 00 00 49 81 3e 60 64 51 8f 0f 84 4c f3 ff [ 49.776600][ T3610] RSP: 0018:ffffc9000389f268 EFLAGS: 00010002 [ 49.782661][ T3610] RAX: dffffc0000000000 RBX: 1ffff92000713e7c RCX: 0000000000000001 [ 49.790621][ T3610] RDX: 0000000000000025 RSI: 0000000000000000 RDI: 0000000000000001 [ 49.798575][ T3610] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 49.806538][ T3610] R10: fffffbfff1bbd2d2 R11: 0000000000000000 R12: 0000000000000000 [ 49.814500][ T3610] R13: ffff88802074bb00 R14: 0000000000000128 R15: 0000000000000001 [ 49.822455][ T3610] FS: 0000555557449300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 49.831370][ T3610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.837939][ T3610] CR2: 0000000000000000 CR3: 0000000073e37000 CR4: 00000000003506f0 [ 49.845917][ T3610] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 49.854047][ T3610] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 49.861999][ T3610] Call Trace: [ 49.865260][ T3610] [ 49.868189][ T3610] ? lock_chain_count+0x20/0x20 [ 49.873026][ T3610] ? lock_downgrade+0x6e0/0x6e0 [ 49.877862][ T3610] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 49.883838][ T3610] ? lock_release+0x780/0x780 [ 49.888499][ T3610] ? __stack_depot_save+0x23f/0x500 [ 49.893693][ T3610] lock_acquire+0x1ab/0x570 [ 49.898187][ T3610] ? binder_alloc_new_buf+0xa5/0x19e0 [ 49.903544][ T3610] ? lock_release+0x780/0x780 [ 49.908213][ T3610] ? __mutex_lock+0x231/0x1350 [ 49.912962][ T3610] down_read+0x98/0x450 [ 49.917102][ T3610] ? binder_alloc_new_buf+0xa5/0x19e0 [ 49.922455][ T3610] ? rwsem_down_read_slowpath+0xb10/0xb10 [ 49.928172][ T3610] ? find_held_lock+0x2d/0x110 [ 49.932931][ T3610] binder_alloc_new_buf+0xa5/0x19e0 [ 49.938115][ T3610] binder_transaction+0x242e/0x9a80 [ 49.943299][ T3610] ? is_bpf_text_address+0x77/0x170 [ 49.948491][ T3610] ? __lock_acquire+0x166e/0x56d0 [ 49.953505][ T3610] ? binder_deferred_func+0x1150/0x1150 [ 49.959034][ T3610] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 49.965002][ T3610] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 49.970964][ T3610] ? arch_stack_walk+0x93/0xe0 [ 49.975728][ T3610] ? find_held_lock+0x2d/0x110 [ 49.980490][ T3610] ? __might_fault+0xd1/0x170 [ 49.985153][ T3610] ? lock_downgrade+0x6e0/0x6e0 [ 49.989990][ T3610] binder_thread_write+0x8a9/0x3220 [ 49.995189][ T3610] ? binder_transaction+0x9a80/0x9a80 [ 50.000545][ T3610] ? find_held_lock+0x2d/0x110 [ 50.005292][ T3610] ? binder_debug+0xb2/0x160 [ 50.009869][ T3610] ? __traceiter_binder_return+0xa0/0xa0 [ 50.015488][ T3610] ? lock_downgrade+0x6e0/0x6e0 [ 50.020326][ T3610] binder_ioctl+0x3470/0x6d00 [ 50.024998][ T3610] ? tomoyo_path_number_perm+0x24e/0x590 [ 50.030617][ T3610] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 50.036409][ T3610] ? __sanitizer_cov_trace_switch+0x50/0x90 [ 50.042300][ T3610] ? binder_thread_write+0x3220/0x3220 [ 50.047741][ T3610] ? do_vfs_ioctl+0x132/0x15c0 [ 50.052491][ T3610] ? vfs_fileattr_set+0xbe0/0xbe0 [ 50.057500][ T3610] ? find_held_lock+0x2d/0x110 [ 50.062259][ T3610] ? name_to_dev_t+0x780/0x990 [ 50.067019][ T3610] ? lock_downgrade+0x6e0/0x6e0 [ 50.071862][ T3610] ? _raw_spin_unlock_irq+0x1f/0x40 [ 50.077048][ T3610] ? bpf_lsm_file_ioctl+0x5/0x10 [ 50.082010][ T3610] ? binder_thread_write+0x3220/0x3220 [ 50.087465][ T3610] __x64_sys_ioctl+0x193/0x200 [ 50.092214][ T3610] do_syscall_64+0x35/0xb0 [ 50.096616][ T3610] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.102504][ T3610] RIP: 0033:0x7fe9bca0b339 [ 50.106905][ T3610] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 50.126497][ T3610] RSP: 002b:00007ffecbe01af8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 50.134895][ T3610] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe9bca0b339 [ 50.142860][ T3610] RDX: 0000000020000680 RSI: 00000000c0306201 RDI: 0000000000000004 [ 50.150814][ T3610] RBP: 0000000000000000 R08: 00007fe9bca78e40 R09: 00007fe9bca78e40 [ 50.158766][ T3610] R10: 00007fe9bca78e40 R11: 0000000000000246 R12: 00007ffecbe01b30 [ 50.166721][ T3610] R13: 00007ffecbe01b20 R14: 00007ffecbe01b10 R15: 0000000000000000 [ 50.174680][ T3610] [ 50.177682][ T3610] Modules linked in: [ 50.181565][ T3610] ---[ end trace 0000000000000000 ]--- [ 50.186999][ T3610] RIP: 0010:__lock_acquire+0xd83/0x56d0 [ 50.192533][ T3610] Code: 9b 0e 41 bf 01 00 00 00 0f 86 c8 00 00 00 89 05 23 46 9b 0e e9 bd 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 4e 31 00 00 49 81 3e 60 64 51 8f 0f 84 4c f3 ff [ 50.212133][ T3610] RSP: 0018:ffffc9000389f268 EFLAGS: 00010002 [ 50.218182][ T3610] RAX: dffffc0000000000 RBX: 1ffff92000713e7c RCX: 0000000000000001 [ 50.226135][ T3610] RDX: 0000000000000025 RSI: 0000000000000000 RDI: 0000000000000001 [ 50.234088][ T3610] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 50.242045][ T3610] R10: fffffbfff1bbd2d2 R11: 0000000000000000 R12: 0000000000000000 [ 50.249997][ T3610] R13: ffff88802074bb00 R14: 0000000000000128 R15: 0000000000000001 [ 50.257951][ T3610] FS: 0000555557449300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 50.266865][ T3610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.273436][ T3610] CR2: 0000000000000000 CR3: 0000000073e37000 CR4: 00000000003506f0 [ 50.281390][ T3610] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.289342][ T3610] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.297382][ T3610] Kernel panic - not syncing: Fatal exception [ 50.303726][ T3610] Kernel Offset: disabled [ 50.308077][ T3610] Rebooting in 86400 seconds..