./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1717684463 <...> Warning: Permanently added '10.128.0.125' (ED25519) to the list of known hosts. execve("./syz-executor1717684463", ["./syz-executor1717684463"], 0x7fff3ee85720 /* 10 vars */) = 0 brk(NULL) = 0x55556955b000 brk(0x55556955bd00) = 0x55556955bd00 arch_prctl(ARCH_SET_FS, 0x55556955b380) = 0 set_tid_address(0x55556955b650) = 5839 set_robust_list(0x55556955b660, 24) = 0 rseq(0x55556955bca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1717684463", 4096) = 28 getrandom("\x3a\x72\xc9\x6e\x5d\xd0\x30\x40", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556955bd00 brk(0x55556957cd00) = 0x55556957cd00 brk(0x55556957d000) = 0x55556957d000 mprotect(0x7f2f06a3e000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5840 attached , child_tidptr=0x55556955b650) = 5840 [pid 5840] set_robust_list(0x55556955b660, 24) = 0 [pid 5840] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5840] getppid() = 0 [pid 5840] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5840] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5840] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5840] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5840] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5840] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5840] unshare(CLONE_NEWNS) = 0 [pid 5840] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5840] unshare(CLONE_NEWIPC) = 0 [pid 5840] unshare(CLONE_NEWCGROUP) = 0 [pid 5840] unshare(CLONE_NEWUTS) = 0 [pid 5840] unshare(CLONE_SYSVSEM) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "16777216", 8) = 8 [pid 5840] close(3) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "536870912", 9) = 9 [pid 5840] close(3) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "1024", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "8192", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "1024", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "1024", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5840] close(3) = 0 [pid 5840] getpid() = 1 [pid 5840] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 98.296323][ T5840] dump_stack_lvl+0x189/0x250 [ 98.296347][ T5840] ? __virt_addr_valid+0x1c8/0x5c0 [ 98.296360][ T5840] ? rcu_is_watching+0x15/0xb0 [ 98.296381][ T5840] ? __kasan_check_byte+0x12/0x40 [ 98.296398][ T5840] ? __pfx_dump_stack_lvl+0x10/0x10 [ 98.296420][ T5840] ? rcu_is_watching+0x15/0xb0 [ 98.296441][ T5840] ? lock_release+0x4b/0x3e0 [ 98.296465][ T5840] ? __virt_addr_valid+0x1c8/0x5c0 [ 98.296479][ T5840] ? __virt_addr_valid+0x4a5/0x5c0 [ 98.296493][ T5840] print_report+0xd2/0x2b0 [ 98.296512][ T5840] ? pause_parse_request+0x40/0x160 [ 98.296527][ T5840] kasan_report+0x118/0x150 [ 98.296541][ T5840] ? pause_parse_request+0x40/0x160 [ 98.296559][ T5840] ? __pfx_pause_parse_request+0x10/0x10 [ 98.296575][ T5840] pause_parse_request+0x40/0x160 [ 98.296591][ T5840] ? __pfx_pause_parse_request+0x10/0x10 [ 98.296606][ T5840] ethnl_default_set_doit+0x2c1/0xa40 [ 98.296627][ T5840] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 98.296644][ T5840] genl_family_rcv_msg_doit+0x215/0x300 [ 98.296659][ T5840] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 98.296677][ T5840] ? bpf_lsm_capable+0x9/0x20 [ 98.296690][ T5840] ? security_capable+0x7e/0x2e0 [ 98.296710][ T5840] genl_rcv_msg+0x60e/0x790 [ 98.296724][ T5840] ? __pfx_genl_rcv_msg+0x10/0x10 [ 98.296735][ T5840] ? ref_tracker_free+0x63a/0x7d0 [ 98.296754][ T5840] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 98.296773][ T5840] ? __pfx_ref_tracker_free+0x10/0x10 [ 98.296795][ T5840] netlink_rcv_skb+0x205/0x470 [ 98.296813][ T5840] ? __pfx_genl_rcv_msg+0x10/0x10 [ 98.296825][ T5840] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 98.296847][ T5840] ? down_read+0x1ad/0x2e0 [ 98.296870][ T5840] genl_rcv+0x28/0x40 [ 98.296890][ T5840] netlink_unicast+0x758/0x8d0 [ 98.296909][ T5840] netlink_sendmsg+0x805/0xb30 [ 98.296931][ T5840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 98.296950][ T5840] ? aa_sock_msg_perm+0x94/0x160 [ 98.296968][ T5840] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 98.296986][ T5840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 98.297004][ T5840] __sock_sendmsg+0x21c/0x270 [ 98.297020][ T5840] ____sys_sendmsg+0x505/0x830 [ 98.297043][ T5840] ? __pfx_____sys_sendmsg+0x10/0x10 [ 98.297067][ T5840] ? import_iovec+0x74/0xa0 [ 98.297081][ T5840] ___sys_sendmsg+0x21f/0x2a0 [ 98.297102][ T5840] ? __pfx____sys_sendmsg+0x10/0x10 [ 98.297124][ T5840] ? do_raw_spin_lock+0x121/0x290 [ 98.297154][ T5840] __x64_sys_sendmsg+0x19b/0x260 [ 98.297174][ T5840] ? _raw_spin_unlock_irq+0x2e/0x50 [ 98.297189][ T5840] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 98.297214][ T5840] ? rcu_is_watching+0x15/0xb0 [ 98.297239][ T5840] do_syscall_64+0xfa/0x3b0 [ 98.297256][ T5840] ? lockdep_hardirqs_on+0x9c/0x150 [ 98.297271][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.297284][ T5840] ? clear_bhb_loop+0x60/0xb0 [ 98.297300][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.297313][ T5840] RIP: 0033:0x7f2f069c5999 [ 98.297329][ T5840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 98.297341][ T5840] RSP: 002b:00007ffe2aadf7b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 98.297356][ T5840] RAX: ffffffffffffffda RBX: 00007f2f06a134ad RCX: 00007f2f069c5999 [ 98.297368][ T5840] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 98.297377][ T5840] RBP: 00007f2f06a1347d R08: 0000000000000000 R09: 0000555500000000 [ 98.297386][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2f06a133e5 [ 98.297394][ T5840] R13: 0000000000000001 R14: 00007ffe2aadf800 R15: 0000000000000003 [ 98.297409][ T5840] [ 98.297413][ T5840] [ 98.675890][ T5840] Allocated by task 5840: [ 98.680211][ T5840] kasan_save_track+0x3e/0x80 [ 98.684891][ T5840] __kasan_kmalloc+0x93/0xb0 [ 98.689477][ T5840] __kmalloc_noprof+0x27a/0x4f0 [ 98.694321][ T5840] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 98.700380][ T5840] genl_family_rcv_msg_doit+0xb8/0x300 [ 98.705854][ T5840] genl_rcv_msg+0x60e/0x790 [ 98.710348][ T5840] netlink_rcv_skb+0x205/0x470 [ 98.715122][ T5840] genl_rcv+0x28/0x40 [ 98.719105][ T5840] netlink_unicast+0x758/0x8d0 [ 98.723876][ T5840] netlink_sendmsg+0x805/0xb30 [ 98.728674][ T5840] __sock_sendmsg+0x21c/0x270 [ 98.733343][ T5840] ____sys_sendmsg+0x505/0x830 [ 98.738104][ T5840] ___sys_sendmsg+0x21f/0x2a0 [ 98.742773][ T5840] __x64_sys_sendmsg+0x19b/0x260 [ 98.747703][ T5840] do_syscall_64+0xfa/0x3b0 [ 98.752201][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.758083][ T5840] [ 98.760413][ T5840] The buggy address belongs to the object at ffff888032841880 [ 98.760413][ T5840] which belongs to the cache kmalloc-64 of size 64 [ 98.774291][ T5840] The buggy address is located 8 bytes to the right of [ 98.774291][ T5840] allocated 40-byte region [ffff888032841880, ffff8880328418a8) [ 98.788963][ T5840] [ 98.791279][ T5840] The buggy address belongs to the physical page: [ 98.797708][ T5840] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32841 [ 98.806457][ T5840] ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 98.813908][ T5840] page_type: f5(slab) [ 98.817880][ T5840] raw: 00fff00000000000 ffff88801a4418c0 ffffea000088bf40 dead000000000003 [ 98.826569][ T5840] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 98.835154][ T5840] page dumped because: kasan: bad access detected [ 98.841568][ T5840] page_owner tracks the page as allocated [ 98.847267][ T5840] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5186, tgid 5186 (S01syslogd), ts 31988142167, free_ts 31909866259 [ 98.866193][ T5840] post_alloc_hook+0x240/0x2a0 [ 98.870955][ T5840] get_page_from_freelist+0x21e4/0x22c0 [ 98.876499][ T5840] __alloc_frozen_pages_noprof+0x181/0x370 [ 98.882304][ T5840] alloc_pages_mpol+0x232/0x4a0 [ 98.887153][ T5840] allocate_slab+0x8a/0x3b0 [ 98.891682][ T5840] ___slab_alloc+0xbfc/0x1480 [ 98.896355][ T5840] __kmalloc_noprof+0x305/0x4f0 [ 98.901194][ T5840] tomoyo_encode+0x28b/0x550 [ 98.905782][ T5840] tomoyo_realpath_from_path+0x58d/0x5d0 [ 98.911417][ T5840] tomoyo_check_open_permission+0x1c1/0x3b0 [ 98.917308][ T5840] security_file_open+0xb1/0x270 [ 98.922257][ T5840] do_dentry_open+0x35e/0x1970 [ 98.927021][ T5840] vfs_open+0x3b/0x340 [ 98.931086][ T5840] path_openat+0x2ee5/0x3830 [ 98.935692][ T5840] do_filp_open+0x1fa/0x410 [ 98.940190][ T5840] do_sys_openat2+0x121/0x1c0 [ 98.944865][ T5840] page last free pid 5184 tgid 5184 stack trace: [ 98.951180][ T5840] __free_frozen_pages+0xc71/0xe70 [ 98.956283][ T5840] __tlb_remove_table+0x2d2/0x3b0 [ 98.961303][ T5840] tlb_remove_table_rcu+0x85/0x100 [ 98.966418][ T5840] rcu_core+0xca5/0x1710 [ 98.970680][ T5840] handle_softirqs+0x286/0x870 [ 98.975469][ T5840] __irq_exit_rcu+0xca/0x1f0 [ 98.980059][ T5840] irq_exit_rcu+0x9/0x30 [ 98.984303][ T5840] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 98.989927][ T5840] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 98.995901][ T5840] [ 98.998229][ T5840] Memory state around the buggy address: [ 99.003845][ T5840] ffff888032841780: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 99.011891][ T5840] ffff888032841800: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 99.019943][ T5840] >ffff888032841880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 99.027999][ T5840] ^ [ 99.033613][ T5840] ffff888032841900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 99.041656][ T5840] ffff888032841980: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 99.049702][ T5840] ================================================================== [ 99.060430][ T5840] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 99.067648][ T5840] CPU: 0 UID: 0 PID: 5840 Comm: syz-executor171 Not tainted 6.16.0-rc2-syzkaller-00867-ga9b24b3583ae #0 PREEMPT(full) [ 99.080078][ T5840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 99.090144][ T5840] Call Trace: [ 99.093422][ T5840] [ 99.096346][ T5840] dump_stack_lvl+0x99/0x250 [ 99.100945][ T5840] ? __asan_memcpy+0x40/0x70 [ 99.105537][ T5840] ? __pfx_dump_stack_lvl+0x10/0x10 [ 99.110737][ T5840] ? __pfx__printk+0x10/0x10 [ 99.115346][ T5840] panic+0x2db/0x790 [ 99.119253][ T5840] ? __pfx_panic+0x10/0x10 [ 99.123693][ T5840] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 99.129599][ T5840] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 99.135931][ T5840] ? print_memory_metadata+0x314/0x400 [ 99.141403][ T5840] ? pause_parse_request+0x40/0x160 [ 99.146593][ T5840] check_panic_on_warn+0x89/0xb0 [ 99.151547][ T5840] ? pause_parse_request+0x40/0x160 [ 99.156740][ T5840] end_report+0x78/0x160 [ 99.160978][ T5840] kasan_report+0x129/0x150 [ 99.165476][ T5840] ? pause_parse_request+0x40/0x160 [ 99.170692][ T5840] ? __pfx_pause_parse_request+0x10/0x10 [ 99.176334][ T5840] pause_parse_request+0x40/0x160 [ 99.181455][ T5840] ? __pfx_pause_parse_request+0x10/0x10 [ 99.187090][ T5840] ethnl_default_set_doit+0x2c1/0xa40 [ 99.192470][ T5840] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 99.198806][ T5840] genl_family_rcv_msg_doit+0x215/0x300 [ 99.204373][ T5840] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 99.210445][ T5840] ? bpf_lsm_capable+0x9/0x20 [ 99.215124][ T5840] ? security_capable+0x7e/0x2e0 [ 99.220071][ T5840] genl_rcv_msg+0x60e/0x790 [ 99.224577][ T5840] ? __pfx_genl_rcv_msg+0x10/0x10 [ 99.229599][ T5840] ? ref_tracker_free+0x63a/0x7d0 [ 99.234643][ T5840] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 99.240545][ T5840] ? __pfx_ref_tracker_free+0x10/0x10 [ 99.246019][ T5840] netlink_rcv_skb+0x205/0x470 [ 99.250793][ T5840] ? __pfx_genl_rcv_msg+0x10/0x10 [ 99.255823][ T5840] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 99.261131][ T5840] ? down_read+0x1ad/0x2e0 [ 99.265563][ T5840] genl_rcv+0x28/0x40 [ 99.269576][ T5840] netlink_unicast+0x758/0x8d0 [ 99.274360][ T5840] netlink_sendmsg+0x805/0xb30 [ 99.279139][ T5840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.284450][ T5840] ? aa_sock_msg_perm+0x94/0x160 [ 99.289402][ T5840] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 99.294715][ T5840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.300018][ T5840] __sock_sendmsg+0x21c/0x270 [ 99.304700][ T5840] ____sys_sendmsg+0x505/0x830 [ 99.309487][ T5840] ? __pfx_____sys_sendmsg+0x10/0x10 [ 99.314790][ T5840] ? import_iovec+0x74/0xa0 [ 99.319299][ T5840] ___sys_sendmsg+0x21f/0x2a0 [ 99.323991][ T5840] ? __pfx____sys_sendmsg+0x10/0x10 [ 99.329196][ T5840] ? do_raw_spin_lock+0x121/0x290 [ 99.334236][ T5840] __x64_sys_sendmsg+0x19b/0x260 [ 99.339181][ T5840] ? _raw_spin_unlock_irq+0x2e/0x50 [ 99.344381][ T5840] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 99.349852][ T5840] ? rcu_is_watching+0x15/0xb0 [ 99.354626][ T5840] do_syscall_64+0xfa/0x3b0 [ 99.359131][ T5840] ? lockdep_hardirqs_on+0x9c/0x150 [ 99.364331][ T5840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.370438][ T5840] ? clear_bhb_loop+0x60/0xb0 [ 99.375121][ T5840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.381102][ T5840] RIP: 0033:0x7f2f069c5999 [ 99.385550][ T5840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 99.405164][ T5840] RSP: 002b:00007ffe2aadf7b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 99.413581][ T5840] RAX: ffffffffffffffda RBX: 00007f2f06a134ad RCX: 00007f2f069c5999 [ 99.421561][ T5840] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 99.429536][ T5840] RBP: 00007f2f06a1347d R08: 0000000000000000 R09: 0000555500000000 [ 99.437512][ T5840] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2f06a133e5 [ 99.445495][ T5840] R13: 0000000000000001 R14: 00007ffe2aadf800 R15: 0000000000000003 [ 99.453489][ T5840] [ 99.456859][ T5840] Kernel Offset: disabled [ 99.461191][ T5840] Rebooting in 86400 seconds..