./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2549354805 <...> Warning: Permanently added '10.128.1.22' (ECDSA) to the list of known hosts. execve("./syz-executor2549354805", ["./syz-executor2549354805"], 0x7ffe08d9f2f0 /* 10 vars */) = 0 brk(NULL) = 0x555556d3b000 brk(0x555556d3bc40) = 0x555556d3bc40 arch_prctl(ARCH_SET_FS, 0x555556d3b300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2549354805", 4096) = 28 brk(0x555556d5cc40) = 0x555556d5cc40 brk(0x555556d5d000) = 0x555556d5d000 mprotect(0x7f953106a000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3 ioctl(3, TIOCSETD, [21]) = 0 dup(3) = 4 syzkaller login: [ 38.623852][ T3611] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 38.631711][ T3611] #PF: supervisor instruction fetch in kernel mode [ 38.638293][ T3611] #PF: error_code(0x0010) - not-present page [ 38.644271][ T3611] PGD 70a16067 P4D 70a16067 PUD 21120067 PMD 0 [ 38.650618][ T3611] Oops: 0010 [#1] PREEMPT SMP KASAN [ 38.655811][ T3611] CPU: 0 PID: 3611 Comm: syz-executor254 Not tainted 6.0.0-rc1-syzkaller-00399-g15b3f48a4339 #0 [ 38.666226][ T3611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 38.676374][ T3611] RIP: 0010:0x0 [ 38.680002][ T3611] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [ 38.687709][ T3611] RSP: 0018:ffffc90003b2fcf0 EFLAGS: 00010202 [ 38.693775][ T3611] RAX: 0000000000000001 RBX: ffff888017555000 RCX: 0000000000000000 [ 38.701739][ T3611] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017555000 [ 38.709707][ T3611] RBP: ffffc90003b2fda1 R08: 0000000000000001 R09: 0000000000000004 [ 38.717671][ T3611] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 38.725640][ T3611] R13: 0000000000000000 R14: ffffc90003b2fd90 R15: dffffc0000000000 [ 38.733618][ T3611] FS: 0000555556d3b300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 38.742548][ T3611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.749219][ T3611] CR2: ffffffffffffffd6 CR3: 0000000070a65000 CR4: 0000000000350ef0 [ 38.757369][ T3611] Call Trace: [ 38.760643][ T3611] [ 38.763567][ T3611] gsmld_receive_buf+0x1c2/0x2f0 [ 38.768525][ T3611] ? gsmld_write_wakeup+0x130/0x130 [ 38.773723][ T3611] tty_ioctl+0xa75/0x15d0 [ 38.778050][ T3611] ? tty_fasync+0x390/0x390 [ 38.782548][ T3611] ? find_held_lock+0x2d/0x110 [ 38.787305][ T3611] ? ptrace_notify+0xfa/0x140 [ 38.791974][ T3611] ? lock_downgrade+0x6e0/0x6e0 [ 38.796820][ T3611] ? _raw_spin_unlock_irq+0x1f/0x40 [ 38.802014][ T3611] ? bpf_lsm_file_ioctl+0x5/0x10 [ 38.806951][ T3611] ? tty_fasync+0x390/0x390 [ 38.811539][ T3611] __x64_sys_ioctl+0x193/0x200 [ 38.816392][ T3611] do_syscall_64+0x35/0xb0 [ 38.820806][ T3611] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 38.826697][ T3611] RIP: 0033:0x7f9530ffdb59 [ 38.831110][ T3611] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 38.850725][ T3611] RSP: 002b:00007ffdc4c66bd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 38.859135][ T3611] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9530ffdb59 [ 38.867105][ T3611] RDX: 0000000020000040 RSI: 0000000000005412 RDI: 0000000000000004 [ 38.875077][ T3611] RBP: 00007f9530fc1d00 R08: 0000000000000000 R09: 0000000000000000 [ 38.883049][ T3611] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9530fc1d90 [ 38.891013][ T3611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 38.898985][ T3611] [ 38.901995][ T3611] Modules linked in: [ 38.905881][ T3611] CR2: 0000000000000000 [ 38.910045][ T3611] ---[ end trace 0000000000000000 ]--- [ 38.915497][ T3611] RIP: 0010:0x0 [ 38.918963][ T3611] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [ 38.926675][ T3611] RSP: 0018:ffffc90003b2fcf0 EFLAGS: 00010202 [ 38.932828][ T3611] RAX: 0000000000000001 RBX: ffff888017555000 RCX: 0000000000000000 [ 38.940793][ T3611] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017555000 [ 38.948758][ T3611] RBP: ffffc90003b2fda1 R08: 0000000000000001 R09: 0000000000000004 [ 38.956728][ T3611] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 38.964701][ T3611] R13: 0000000000000000 R14: ffffc90003b2fd90 R15: dffffc0000000000 [ 38.972702][ T3611] FS: 0000555556d3b300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 38.981751][ T3611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.988329][ T3611] CR2: ffffffffffffffd6 CR3: 0000000070a65000 CR4: 0000000000350ef0 [ 38.996298][ T3611] Kernel panic - not syncing: Fatal exception [ 39.003156][ T3611] Kernel Offset: disabled [ 39.007564][ T3611] Rebooting in 86400 seconds..