./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1535526805 <...> forked to background, child pid 3183 no interfaces have a carrier [ 22.908445][ T3184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 22.920133][ T3184] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.8' (ECDSA) to the list of known hosts. execve("./syz-executor1535526805", ["./syz-executor1535526805"], 0x7ffc42a1a640 /* 10 vars */) = 0 brk(NULL) = 0x555556962000 brk(0x555556962c40) = 0x555556962c40 arch_prctl(ARCH_SET_FS, 0x555556962300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1535526805", 4096) = 28 brk(0x555556983c40) = 0x555556983c40 brk(0x555556984000) = 0x555556984000 mprotect(0x7f7916c4c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 3604 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "3604", 4) = 4 close(3) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=680, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=3604}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1c\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x25\x00\x00\x00\x48\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 680 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3604}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 access("/proc/net", R_OK) = 0 access("/proc/net/unix", R_OK) = 0 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3604}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3604}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3604}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3604}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3604}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 getpid() = 3604 mkdir("./syzkaller.IUwMAH", 0700) = 0 chmod("./syzkaller.IUwMAH", 0777) = 0 chdir("./syzkaller.IUwMAH") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3607 attached , child_tidptr=0x5555569625d0) = 3607 [pid 3607] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3607] setsid() = 1 [pid 3607] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3607] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3607] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3607] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3607] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3607] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3607] unshare(CLONE_NEWNS) = 0 [pid 3607] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3607] unshare(CLONE_NEWIPC) = 0 [pid 3607] unshare(CLONE_NEWCGROUP) = 0 [pid 3607] unshare(CLONE_NEWUTS) = 0 [pid 3607] unshare(CLONE_SYSVSEM) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "16777216", 8) = 8 [pid 3607] close(3) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "536870912", 9) = 9 [pid 3607] close(3) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "1024", 4) = 4 [pid 3607] close(3) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "8192", 4) = 4 [pid 3607] close(3) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "1024", 4) = 4 [pid 3607] close(3) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "1024", 4) = 4 [pid 3607] close(3) = 0 [pid 3607] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3607] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3607] close(3) = 0 [pid 3607] getpid() = 1 [pid 3607] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 43.042326][ T3607] dump_stack_lvl+0xcd/0x134 [ 43.046929][ T3607] print_report.cold+0x2ba/0x719 [ 43.051863][ T3607] ? ntfs_attr_find+0xc02/0xce0 [ 43.056711][ T3607] kasan_report+0xb1/0x1e0 [ 43.061125][ T3607] ? ntfs_attr_find+0xc02/0xce0 [ 43.066056][ T3607] ntfs_attr_find+0xc02/0xce0 [ 43.070811][ T3607] ? __kasan_init_slab_obj+0x21/0x30 [ 43.076179][ T3607] ntfs_attr_lookup+0x1056/0x2070 [ 43.081197][ T3607] ? ntfs_attr_get_search_ctx+0x41/0x200 [ 43.086823][ T3607] ? out_of_line_wait_on_bit+0xd5/0x110 [ 43.092366][ T3607] ? ntfs_attr_reinit_search_ctx+0x3c0/0x3c0 [ 43.098341][ T3607] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.103794][ T3607] ? kmem_cache_alloc+0x31b/0x3b0 [ 43.108987][ T3607] ntfs_read_inode_mount+0x89a/0x2580 [ 43.114361][ T3607] ntfs_fill_super+0x1799/0x9320 [ 43.119292][ T3607] ? lock_downgrade+0x6e0/0x6e0 [ 43.124137][ T3607] ? parse_options+0x1d70/0x1d70 [ 43.129068][ T3607] ? snprintf+0xbb/0xf0 [ 43.133218][ T3607] ? vsprintf+0x30/0x30 [ 43.137365][ T3607] ? wait_for_completion_io_timeout+0x20/0x20 [ 43.143429][ T3607] ? up_write+0x148/0x470 [ 43.147751][ T3607] ? set_blocksize+0x2e5/0x370 [ 43.152509][ T3607] mount_bdev+0x34d/0x410 [ 43.156831][ T3607] ? parse_options+0x1d70/0x1d70 [ 43.161757][ T3607] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 43.167291][ T3607] legacy_get_tree+0x105/0x220 [ 43.172049][ T3607] vfs_get_tree+0x89/0x2f0 [ 43.176458][ T3607] path_mount+0x1326/0x1e20 [ 43.180953][ T3607] ? kmem_cache_free+0xeb/0x5b0 [ 43.185819][ T3607] ? finish_automount+0x960/0x960 [ 43.191012][ T3607] ? putname+0xfe/0x140 [ 43.195165][ T3607] __x64_sys_mount+0x27f/0x300 [ 43.199923][ T3607] ? copy_mnt_ns+0xae0/0xae0 [ 43.204509][ T3607] ? lockdep_hardirqs_on+0x79/0x100 [ 43.209706][ T3607] ? _raw_spin_unlock_irq+0x2a/0x40 [ 43.214895][ T3607] ? ptrace_notify+0xfa/0x140 [ 43.219567][ T3607] do_syscall_64+0x35/0xb0 [ 43.223975][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.229876][ T3607] RIP: 0033:0x7f7916be3b4a [ 43.234283][ T3607] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 f8 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.253906][ T3607] RSP: 002b:00007ffd20250468 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 43.262329][ T3607] RAX: ffffffffffffffda RBX: 00007ffd202504c0 RCX: 00007f7916be3b4a [ 43.270309][ T3607] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd20250480 [ 43.278438][ T3607] RBP: 00007ffd20250480 R08: 00007ffd202504c0 R09: 0000000000000000 [ 43.286486][ T3607] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000230 [ 43.294447][ T3607] R13: 0000000000000003 R14: 0000000000000004 R15: 0000000000000002 [ 43.302499][ T3607] [ 43.305508][ T3607] [ 43.307816][ T3607] Allocated by task 3311: [ 43.312126][ T3607] kasan_save_stack+0x1e/0x40 [ 43.316816][ T3607] __kasan_kmalloc+0xa9/0xd0 [ 43.321409][ T3607] tomoyo_realpath_from_path+0xc3/0x620 [ 43.326944][ T3607] tomoyo_check_open_permission+0x272/0x380 [ 43.332828][ T3607] tomoyo_file_open+0x9d/0xc0 [ 43.337505][ T3607] security_file_open+0x45/0xb0 [ 43.342395][ T3607] do_dentry_open+0x349/0x13a0 [ 43.347167][ T3607] path_openat+0x1c92/0x28f0 [ 43.351758][ T3607] do_filp_open+0x1b6/0x400 [ 43.356253][ T3607] do_sys_openat2+0x16d/0x4c0 [ 43.361004][ T3607] __x64_sys_openat+0x13f/0x1f0 [ 43.366016][ T3607] do_syscall_64+0x35/0xb0 [ 43.370427][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.376485][ T3607] [ 43.378803][ T3607] Freed by task 3311: [ 43.382769][ T3607] kasan_save_stack+0x1e/0x40 [ 43.387469][ T3607] kasan_set_track+0x21/0x30 [ 43.392075][ T3607] kasan_set_free_info+0x20/0x30 [ 43.397005][ T3607] ____kasan_slab_free+0x166/0x1c0 [ 43.402106][ T3607] slab_free_freelist_hook+0x8b/0x1c0 [ 43.407466][ T3607] kfree+0xe2/0x580 [ 43.411259][ T3607] tomoyo_realpath_from_path+0x191/0x620 [ 43.416880][ T3607] tomoyo_check_open_permission+0x272/0x380 [ 43.422767][ T3607] tomoyo_file_open+0x9d/0xc0 [ 43.427430][ T3607] security_file_open+0x45/0xb0 [ 43.432352][ T3607] do_dentry_open+0x349/0x13a0 [ 43.437109][ T3607] path_openat+0x1c92/0x28f0 [ 43.441691][ T3607] do_filp_open+0x1b6/0x400 [ 43.446189][ T3607] do_sys_openat2+0x16d/0x4c0 [ 43.450853][ T3607] __x64_sys_openat+0x13f/0x1f0 [ 43.455694][ T3607] do_syscall_64+0x35/0xb0 [ 43.460104][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.465989][ T3607] [ 43.468472][ T3607] The buggy address belongs to the object at ffff88807e352000 [ 43.468472][ T3607] which belongs to the cache kmalloc-4k of size 4096 [ 43.482515][ T3607] The buggy address is located 9 bytes inside of [ 43.482515][ T3607] 4096-byte region [ffff88807e352000, ffff88807e353000) [ 43.495780][ T3607] [ 43.498089][ T3607] The buggy address belongs to the physical page: [ 43.504484][ T3607] page:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350 [ 43.514645][ T3607] head:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0 [ 43.522977][ T3607] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 43.530982][ T3607] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140 [ 43.539729][ T3607] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 43.548296][ T3607] page dumped because: kasan: bad access detected [ 43.554694][ T3607] page_owner tracks the page as allocated [ 43.560391][ T3607] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3311, tgid 3311 (cmp), ts 23752313648, free_ts 23694935443 [ 43.580374][ T3607] get_page_from_freelist+0x109b/0x2ce0 [ 43.585921][ T3607] __alloc_pages+0x1c7/0x510 [ 43.590500][ T3607] alloc_pages+0x1a6/0x270 [ 43.594923][ T3607] allocate_slab+0x27e/0x3d0 [ 43.599503][ T3607] ___slab_alloc+0x7f1/0xe10 [ 43.604079][ T3607] __slab_alloc.constprop.0+0x4d/0xa0 [ 43.609441][ T3607] __kmalloc+0x32b/0x340 [ 43.613684][ T3607] tomoyo_realpath_from_path+0xc3/0x620 [ 43.619227][ T3607] tomoyo_path_perm+0x21b/0x400 [ 43.624072][ T3607] security_inode_getattr+0xcf/0x140 [ 43.629357][ T3607] vfs_statx+0x16a/0x390 [ 43.633590][ T3607] vfs_fstatat+0x8c/0xb0 [ 43.637822][ T3607] __do_sys_newfstatat+0x91/0x110 [ 43.642835][ T3607] do_syscall_64+0x35/0xb0 [ 43.647246][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.653132][ T3607] page last free stack trace: [ 43.657786][ T3607] free_pcp_prepare+0x5e4/0xd20 [ 43.662627][ T3607] free_unref_page+0x19/0x4d0 [ 43.667293][ T3607] qlist_free_all+0x6a/0x170 [ 43.671877][ T3607] kasan_quarantine_reduce+0x180/0x200 [ 43.677328][ T3607] __kasan_slab_alloc+0xa2/0xc0 [ 43.682170][ T3607] kmem_cache_alloc_node+0x2b1/0x3f0 [ 43.687445][ T3607] __alloc_skb+0x210/0x2f0 [ 43.691851][ T3607] netlink_sendmsg+0x9a2/0xe10 [ 43.696610][ T3607] sock_sendmsg+0xcf/0x120 [ 43.701105][ T3607] __sys_sendto+0x236/0x340 [ 43.705602][ T3607] __x64_sys_sendto+0xdd/0x1b0 [ 43.710355][ T3607] do_syscall_64+0x35/0xb0 [ 43.714760][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.720643][ T3607] [ 43.722950][ T3607] Memory state around the buggy address: [ 43.728563][ T3607] ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.736870][ T3607] ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.744917][ T3607] >ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.753047][ T3607] ^ [ 43.757358][ T3607] ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.765590][ T3607] ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.773638][ T3607] ================================================================== [ 43.799883][ T3607] Kernel panic - not syncing: panic_on_warn set ... [ 43.806508][ T3607] CPU: 1 PID: 3607 Comm: syz-executor153 Not tainted 6.0.0-rc2-syzkaller-00054-gc40e8341e3b3 #0 [ 43.817015][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 43.827060][ T3607] Call Trace: [ 43.830326][ T3607] [ 43.833247][ T3607] dump_stack_lvl+0xcd/0x134 [ 43.837834][ T3607] panic+0x2c8/0x627 [ 43.841719][ T3607] ? panic_print_sys_info.part.0+0x10b/0x10b [ 43.847869][ T3607] ? preempt_schedule_common+0x59/0xc0 [ 43.853320][ T3607] ? preempt_schedule_thunk+0x16/0x18 [ 43.858691][ T3607] ? ntfs_attr_find+0xc02/0xce0 [ 43.863533][ T3607] end_report.part.0+0x3f/0x7c [ 43.868289][ T3607] kasan_report.cold+0xa/0xf [ 43.872872][ T3607] ? ntfs_attr_find+0xc02/0xce0 [ 43.877717][ T3607] ntfs_attr_find+0xc02/0xce0 [ 43.882404][ T3607] ? __kasan_init_slab_obj+0x21/0x30 [ 43.887732][ T3607] ntfs_attr_lookup+0x1056/0x2070 [ 43.892772][ T3607] ? ntfs_attr_get_search_ctx+0x41/0x200 [ 43.898399][ T3607] ? out_of_line_wait_on_bit+0xd5/0x110 [ 43.903959][ T3607] ? ntfs_attr_reinit_search_ctx+0x3c0/0x3c0 [ 43.909937][ T3607] ? rcu_read_lock_sched_held+0xd/0x70 [ 43.915589][ T3607] ? kmem_cache_alloc+0x31b/0x3b0 [ 43.920616][ T3607] ntfs_read_inode_mount+0x89a/0x2580 [ 43.926015][ T3607] ntfs_fill_super+0x1799/0x9320 [ 43.930956][ T3607] ? lock_downgrade+0x6e0/0x6e0 [ 43.935912][ T3607] ? parse_options+0x1d70/0x1d70 [ 43.940926][ T3607] ? snprintf+0xbb/0xf0 [ 43.945104][ T3607] ? vsprintf+0x30/0x30 [ 43.949360][ T3607] ? wait_for_completion_io_timeout+0x20/0x20 [ 43.955422][ T3607] ? up_write+0x148/0x470 [ 43.959845][ T3607] ? set_blocksize+0x2e5/0x370 [ 43.964600][ T3607] mount_bdev+0x34d/0x410 [ 43.968924][ T3607] ? parse_options+0x1d70/0x1d70 [ 43.973857][ T3607] ? ntfs_rl_punch_nolock+0x15b0/0x15b0 [ 43.979417][ T3607] legacy_get_tree+0x105/0x220 [ 43.984238][ T3607] vfs_get_tree+0x89/0x2f0 [ 43.988645][ T3607] path_mount+0x1326/0x1e20 [ 43.993141][ T3607] ? kmem_cache_free+0xeb/0x5b0 [ 43.997981][ T3607] ? finish_automount+0x960/0x960 [ 44.003020][ T3607] ? putname+0xfe/0x140 [ 44.007170][ T3607] __x64_sys_mount+0x27f/0x300 [ 44.011927][ T3607] ? copy_mnt_ns+0xae0/0xae0 [ 44.016507][ T3607] ? lockdep_hardirqs_on+0x79/0x100 [ 44.021699][ T3607] ? _raw_spin_unlock_irq+0x2a/0x40 [ 44.027062][ T3607] ? ptrace_notify+0xfa/0x140 [ 44.031749][ T3607] do_syscall_64+0x35/0xb0 [ 44.036156][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 44.042042][ T3607] RIP: 0033:0x7f7916be3b4a [ 44.046450][ T3607] Code: 48 c7 c2 c0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 f8 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 44.066159][ T3607] RSP: 002b:00007ffd20250468 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 44.074566][ T3607] RAX: ffffffffffffffda RBX: 00007ffd202504c0 RCX: 00007f7916be3b4a [ 44.082533][ T3607] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd20250480 [ 44.090497][ T3607] RBP: 00007ffd20250480 R08: 00007ffd202504c0 R09: 0000000000000000 [ 44.098467][ T3607] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000020000230 [ 44.106517][ T3607] R13: 0000000000000003 R14: 0000000000000004 R15: 0000000000000002 [ 44.114486][ T3607] [ 44.118326][ T3607] Kernel Offset: disabled [ 44.122666][ T3607] Rebooting in 86400 seconds..