./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3372403070 <...> Warning: Permanently added '10.128.1.53' (ECDSA) to the list of known hosts. execve("./syz-executor3372403070", ["./syz-executor3372403070"], 0x7ffe970b6080 /* 10 vars */) = 0 brk(NULL) = 0x555557168000 brk(0x555557168c40) = 0x555557168c40 arch_prctl(ARCH_SET_FS, 0x555557168300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3372403070", 4096) = 28 brk(0x555557189c40) = 0x555557189c40 brk(0x55555718a000) = 0x55555718a000 mprotect(0x7f6a5892e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571685d0) = 3628 ./strace-static-x86_64: Process 3628 attached [pid 3628] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3628] setsid() = 1 [pid 3628] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3628] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3628] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3628] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3628] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 3628] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3628] unshare(CLONE_NEWNS) = 0 [pid 3628] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3628] unshare(CLONE_NEWIPC) = 0 [pid 3628] unshare(CLONE_NEWCGROUP) = 0 [pid 3628] unshare(CLONE_NEWUTS) = 0 [pid 3628] unshare(CLONE_SYSVSEM) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "16777216", 8) = 8 [pid 3628] close(3) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "536870912", 9) = 9 [pid 3628] close(3) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "1024", 4) = 4 [pid 3628] close(3) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "8192", 4) = 4 [pid 3628] close(3) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "1024", 4) = 4 [pid 3628] close(3) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "1024", 4) = 4 [pid 3628] close(3) = 0 [pid 3628] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3628] close(3) = 0 [pid 3628] getpid() = 1 [pid 3628] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571685d0) = 3 ./strace-static-x86_64: Process 3632 attached [pid 3632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3632] setpgid(0, 0) = 0 [pid 3632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "1000", 4) = 4 [pid 3632] close(3) = 0 [pid 3632] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 [pid 3632] bind(3, {sa_family=AF_RXRPC, srx_service=0x2 /* ???_SERVICE */, transport_type=SOCK_DGRAM, transport_len=16, transport={sin={sin_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.20.20.170")}}}, 36) = 0 [pid 3632] close(3) = 0 [pid 3632] close(4) = -1 EBADF (Bad file descriptor) [pid 3632] close(5) = -1 EBADF (Bad file descriptor) [pid 3632] close(6) = -1 EBADF (Bad file descriptor) [pid 3632] close(7) = -1 EBADF (Bad file descriptor) [pid 3632] close(8) = -1 EBADF (Bad file descriptor) [pid 3632] close(9) = -1 EBADF (Bad file descriptor) [pid 3632] close(10) = -1 EBADF (Bad file descriptor) [pid 3632] close(11) = -1 EBADF (Bad file descriptor) [pid 3632] close(12) = -1 EBADF (Bad file descriptor) [pid 3632] close(13) = -1 EBADF (Bad file descriptor) [pid 3632] close(14) = -1 EBADF (Bad file descriptor) [pid 3632] close(15) = -1 EBADF (Bad file descriptor) [pid 3632] close(16) = -1 EBADF (Bad file descriptor) [pid 3632] close(17) = -1 EBADF (Bad file descriptor) [pid 3632] close(18) = -1 EBADF (Bad file descriptor) [pid 3632] close(19) = -1 EBADF (Bad file descriptor) [pid 3632] close(20) = -1 EBADF (Bad file descriptor) [pid 3632] close(21) = -1 EBADF (Bad file descriptor) [pid 3632] close(22) = -1 EBADF (Bad file descriptor) [pid 3632] close(23) = -1 EBADF (Bad file descriptor) [pid 3632] close(24) = -1 EBADF (Bad file descriptor) [pid 3632] close(25) = -1 EBADF (Bad file descriptor) [pid 3632] close(26) = -1 EBADF (Bad file descriptor) [pid 3632] close(27) = -1 EBADF (Bad file descriptor) [pid 3632] close(28) = -1 EBADF (Bad file descriptor) [pid 3632] close(29) = -1 EBADF (Bad file descriptor) [pid 3632] exit_group(0) = ? [pid 3632] +++ exited with 0 +++ [pid 3628] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 3628] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3634 attached , child_tidptr=0x5555571685d0) = 4 [pid 3634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3634] setpgid(0, 0) = 0 [pid 3634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3634] write(3, "1000", 4) = 4 [pid 3634] close(3) = 0 [pid 3634] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 [pid 3634] bind(3, {sa_family=AF_RXRPC, srx_service=0x2 /* ???_SERVICE */, transport_type=SOCK_DGRAM, transport_len=16, transport={sin={sin_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.20.20.170")}}}, 36) = 0 [pid 3634] close(3) = 0 [pid 3634] close(4) = -1 EBADF (Bad file descriptor) [pid 3634] close(5) = -1 EBADF (Bad file descriptor) [pid 3634] close(6) = -1 EBADF (Bad file descriptor) [pid 3634] close(7) = -1 EBADF (Bad file descriptor) [pid 3634] close(8) = -1 EBADF (Bad file descriptor) [pid 3634] close(9) = -1 EBADF (Bad file descriptor) [pid 3634] close(10) = -1 EBADF (Bad file descriptor) [pid 3634] close(11) = -1 EBADF (Bad file descriptor) [pid 3634] close(12) = -1 EBADF (Bad file descriptor) [pid 3634] close(13) = -1 EBADF (Bad file descriptor) [pid 3634] close(14) = -1 EBADF (Bad file descriptor) [pid 3634] close(15) = -1 EBADF (Bad file descriptor) [pid 3634] close(16) = -1 EBADF (Bad file descriptor) [pid 3634] close(17) = -1 EBADF (Bad file descriptor) [pid 3634] close(18) = -1 EBADF (Bad file descriptor) [pid 3634] close(19) = -1 EBADF (Bad file descriptor) [pid 3634] close(20) = -1 EBADF (Bad file descriptor) [pid 3634] close(21) = -1 EBADF (Bad file descriptor) [pid 3634] close(22) = -1 EBADF (Bad file descriptor) [pid 3634] close(23) = -1 EBADF (Bad file descriptor) [pid 3634] close(24) = -1 EBADF (Bad file descriptor) [pid 3634] close(25) = -1 EBADF (Bad file descriptor) [pid 3634] close(26) = -1 EBADF (Bad file descriptor) [pid 3634] close(27) = -1 EBADF (Bad file descriptor) [pid 3634] close(28) = -1 EBADF (Bad file descriptor) [pid 3634] close(29) = -1 EBADF (Bad file descriptor) [pid 3634] exit_group(0) = ? [pid 3634] +++ exited with 0 +++ [pid 3628] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 3628] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3636 attached , child_tidptr=0x5555571685d0) = 5 [pid 3636] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3636] setpgid(0, 0) = 0 [pid 3636] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3636] write(3, "1000", 4) = 4 [pid 3636] close(3) = 0 [pid 3636] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 [pid 3636] bind(3, {sa_family=AF_RXRPC, srx_service=0x2 /* ???_SERVICE */, transport_type=SOCK_DGRAM, transport_len=16, transport={sin={sin_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.20.20.170")}}}, 36) = 0 [pid 3636] close(3) = 0 [pid 3636] close(4) = -1 EBADF (Bad file descriptor) [pid 3636] close(5) = -1 EBADF (Bad file descriptor) [pid 3636] close(6) = -1 EBADF (Bad file descriptor) [pid 3636] close(7) = -1 EBADF (Bad file descriptor) [pid 3636] close(8) = -1 EBADF (Bad file descriptor) [pid 3636] close(9) = -1 EBADF (Bad file descriptor) [pid 3636] close(10) = -1 EBADF (Bad file descriptor) [pid 3636] close(11) = -1 EBADF (Bad file descriptor) [pid 3636] close(12) = -1 EBADF (Bad file descriptor) [pid 3636] close(13) = -1 EBADF (Bad file descriptor) [pid 3636] close(14) = -1 EBADF (Bad file descriptor) [pid 3636] close(15) = -1 EBADF (Bad file descriptor) [pid 3636] close(16) = -1 EBADF (Bad file descriptor) [pid 3636] close(17) = -1 EBADF (Bad file descriptor) [pid 3636] close(18) = -1 EBADF (Bad file descriptor) [pid 3636] close(19) = -1 EBADF (Bad file descriptor) [pid 3636] close(20) = -1 EBADF (Bad file descriptor) [pid 3636] close(21) = -1 EBADF (Bad file descriptor) [pid 3636] close(22) = -1 EBADF (Bad file descriptor) [pid 3636] close(23) = -1 EBADF (Bad file descriptor) [pid 3636] close(24) = -1 EBADF (Bad file descriptor) [pid 3636] close(25) = -1 EBADF (Bad file descriptor) [pid 3636] close(26) = -1 EBADF (Bad file descriptor) [pid 3636] close(27) = -1 EBADF (Bad file descriptor) [pid 3636] close(28) = -1 EBADF (Bad file descriptor) [pid 3636] close(29) = -1 EBADF (Bad file descriptor) [pid 3636] exit_group(0) = ? [pid 3636] +++ exited with 0 +++ [pid 3628] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 3628] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3638 attached , child_tidptr=0x5555571685d0) = 6 [pid 3638] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3638] setpgid(0, 0) = 0 [pid 3638] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3638] write(3, "1000", 4) = 4 [pid 3638] close(3) = 0 [pid 3638] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 [pid 3638] bind(3, {sa_family=AF_RXRPC, srx_service=0x2 /* ???_SERVICE */, transport_type=SOCK_DGRAM, transport_len=16, transport={sin={sin_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.20.20.170")}}}, 36) = 0 [pid 3638] close(3) = 0 [pid 3638] close(4) = -1 EBADF (Bad file descriptor) [pid 3638] close(5) = -1 EBADF (Bad file descriptor) [pid 3638] close(6) = -1 EBADF (Bad file descriptor) [pid 3638] close(7) = -1 EBADF (Bad file descriptor) [pid 3638] close(8) = -1 EBADF (Bad file descriptor) [pid 3638] close(9) = -1 EBADF (Bad file descriptor) [pid 3638] close(10) = -1 EBADF (Bad file descriptor) [pid 3638] close(11) = -1 EBADF (Bad file descriptor) [pid 3638] close(12) = -1 EBADF (Bad file descriptor) [pid 3638] close(13) = -1 EBADF (Bad file descriptor) [pid 3638] close(14) = -1 EBADF (Bad file descriptor) [pid 3638] close(15) = -1 EBADF (Bad file descriptor) [pid 3638] close(16) = -1 EBADF (Bad file descriptor) [pid 3638] close(17) = -1 EBADF (Bad file descriptor) [pid 3638] close(18) = -1 EBADF (Bad file descriptor) [pid 3638] close(19) = -1 EBADF (Bad file descriptor) [pid 3638] close(20) = -1 EBADF (Bad file descriptor) [pid 3638] close(21) = -1 EBADF (Bad file descriptor) [pid 3638] close(22) = -1 EBADF (Bad file descriptor) [pid 3638] close(23) = -1 EBADF (Bad file descriptor) [pid 3638] close(24) = -1 EBADF (Bad file descriptor) [pid 3638] close(25) = -1 EBADF (Bad file descriptor) [pid 3638] close(26) = -1 EBADF (Bad file descriptor) [pid 3638] close(27) = -1 EBADF (Bad file descriptor) [pid 3638] close(28) = -1 EBADF (Bad file descriptor) [pid 3638] close(29) = -1 EBADF (Bad file descriptor) [pid 3638] exit_group(0) = ? [pid 3638] +++ exited with 0 +++ [pid 3628] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571685d0) = 7 ./strace-static-x86_64: Process 3640 attached [pid 3640] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3640] setpgid(0, 0) = 0 [pid 3640] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3640] write(3, "1000", 4) = 4 [pid 3640] close(3) = 0 [pid 3640] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 [pid 3640] bind(3, {sa_family=AF_RXRPC, srx_service=0x2 /* ???_SERVICE */, transport_type=SOCK_DGRAM, transport_len=16, transport={sin={sin_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.20.20.170")}}}, 36) = 0 [pid 3640] close(3) = 0 [pid 3640] close(4) = -1 EBADF (Bad file descriptor) [pid 3640] close(5) = -1 EBADF (Bad file descriptor) [pid 3640] close(6) = -1 EBADF (Bad file descriptor) [pid 3640] close(7) = -1 EBADF (Bad file descriptor) [pid 3640] close(8) = -1 EBADF (Bad file descriptor) [pid 3640] close(9) = -1 EBADF (Bad file descriptor) [pid 3640] close(10) = -1 EBADF (Bad file descriptor) [pid 3640] close(11) = -1 EBADF (Bad file descriptor) [pid 3640] close(12) = -1 EBADF (Bad file descriptor) [pid 3640] close(13) = -1 EBADF (Bad file descriptor) [pid 3640] close(14) = -1 EBADF (Bad file descriptor) [pid 3640] close(15) = -1 EBADF (Bad file descriptor) [pid 3640] close(16) = -1 EBADF (Bad file descriptor) [pid 3640] close(17) = -1 EBADF (Bad file descriptor) [pid 3640] close(18) = -1 EBADF (Bad file descriptor) [pid 3640] close(19) = -1 EBADF (Bad file descriptor) [pid 3640] close(20) = -1 EBADF (Bad file descriptor) [pid 3640] close(21) = -1 EBADF (Bad file descriptor) [pid 3640] close(22) = -1 EBADF (Bad file descriptor) [pid 3640] close(23) = -1 EBADF (Bad file descriptor) [pid 3640] close(24) = -1 EBADF (Bad file descriptor) [pid 3640] close(25) = -1 EBADF (Bad file descriptor) [pid 3640] close(26) = -1 EBADF (Bad file descriptor) [pid 3640] close(27) = -1 EBADF (Bad file descriptor) [pid 3640] close(28) = -1 EBADF (Bad file descriptor) [pid 3640] close(29) = -1 EBADF (Bad file descriptor) [pid 3640] exit_group(0) = ? [pid 3640] +++ exited with 0 +++ [pid 3628] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=7, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571685d0) = 8 ./strace-static-x86_64: Process 3642 attached [pid 3642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3642] setpgid(0, 0) = 0 [pid 3642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3642] write(3, "1000", 4) = 4 [pid 3642] close(3) = 0 [pid 3642] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 [pid 3642] bind(3, {sa_family=AF_RXRPC, srx_service=0x2 /* ???_SERVICE */, transport_type=SOCK_DGRAM, transport_len=16, transport={sin={sin_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("172.20.20.170")}}}, 36) = -1 EADDRINUSE (Address already in use) [pid 3642] close(3) = 0 [pid 3642] close(4) = -1 EBADF (Bad file descriptor) [pid 3642] close(5) = -1 EBADF (Bad file descriptor) [pid 3642] close(6) = -1 EBADF (Bad file descriptor) [pid 3642] close(7) = -1 EBADF (Bad file descriptor) [pid 3642] close(8) = -1 EBADF (Bad file descriptor) [pid 3642] close(9) = -1 EBADF (Bad file descriptor) [pid 3642] close(10) = -1 EBADF (Bad file descriptor) [pid 3642] close(11) = -1 EBADF (Bad file descriptor) [pid 3642] close(12) = -1 EBADF (Bad file descriptor) [pid 3642] close(13) = -1 EBADF (Bad file descriptor) [pid 3642] close(14) = -1 EBADF (Bad file descriptor) [pid 3642] close(15) = -1 EBADF (Bad file descriptor) [pid 3642] close(16) = -1 EBADF (Bad file descriptor) [pid 3642] close(17) = -1 EBADF (Bad file descriptor) [pid 3642] close(18) = -1 EBADF (Bad file descriptor) [pid 3642] close(19) = -1 EBADF (Bad file descriptor) [pid 3642] close(20) = -1 EBADF (Bad file descriptor) [pid 3642] close(21) = -1 EBADF (Bad file descriptor) [pid 3642] close(22) = -1 EBADF (Bad file descriptor) [pid 3642] close(23) = -1 EBADF (Bad file descriptor) [pid 3642] close(24) = -1 EBADF (Bad file descriptor) [pid 3642] close(25) = -1 EBADF (Bad file descriptor) [pid 3642] close(26) = -1 EBADF (Bad file descriptor) [pid 3642] close(27) = -1 EBADF (Bad file descriptor) [pid 3642] close(28) = -1 EBADF (Bad file descriptor) [pid 3642] close(29) = -1 EBADF (Bad file descriptor) [pid 3642] exit_group(0) = ? [pid 3642] +++ exited with 0 +++ [pid 3628] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 3628] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3628] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3643 attached , child_tidptr=0x5555571685d0) = 9 [pid 3643] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3643] setpgid(0, 0) = 0 [pid 3643] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3643] write(3, "1000", 4) = 4 [pid 3643] close(3) = 0 [pid 3643] socket(AF_RXRPC, SOCK_DGRAM, AF_INET6) = 3 syzkaller login: [ 52.223710][ T3643] ================================================================== [ 52.231807][ T3643] BUG: KASAN: use-after-free in rxrpc_lookup_local+0xdcf/0xfb0 [ 52.239354][ T3643] Read of size 2 at addr ffff88802364f21c by task syz-executor337/3643 [ 52.247573][ T3643] [ 52.249879][ T3643] CPU: 0 PID: 3643 Comm: syz-executor337 Not tainted 6.1.0-rc7-syzkaller-01867-gd8b879c00f69 #0 [ 52.260617][ T3643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 52.270679][ T3643] Call Trace: [ 52.273940][ T3643] [ 52.276855][ T3643] dump_stack_lvl+0xd1/0x138 [ 52.281438][ T3643] print_report+0x15e/0x45d [ 52.285926][ T3643] ? __phys_addr+0xc8/0x140 [ 52.290422][ T3643] ? rxrpc_lookup_local+0xdcf/0xfb0 [ 52.295616][ T3643] kasan_report+0xbf/0x1f0 [ 52.300024][ T3643] ? rxrpc_lookup_local+0xdcf/0xfb0 [ 52.305216][ T3643] rxrpc_lookup_local+0xdcf/0xfb0 [ 52.310233][ T3643] rxrpc_bind+0x35e/0x5c0 [ 52.314549][ T3643] __sys_bind+0x1ed/0x260 [ 52.318863][ T3643] ? __ia32_sys_socketpair+0x100/0x100 [ 52.324308][ T3643] ? _raw_spin_unlock_irq+0x23/0x50 [ 52.329497][ T3643] ? lockdep_hardirqs_on+0x7d/0x100 [ 52.334702][ T3643] ? _raw_spin_unlock_irq+0x2e/0x50 [ 52.339901][ T3643] __x64_sys_bind+0x73/0xb0 [ 52.344403][ T3643] do_syscall_64+0x39/0xb0 [ 52.348829][ T3643] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.354723][ T3643] RIP: 0033:0x7f6a588c10b9 [ 52.359133][ T3643] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 52.378740][ T3643] RSP: 002b:00007ffc3794a8e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 52.387149][ T3643] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f6a588c10b9 [ 52.395115][ T3643] RDX: 0000000000000024 RSI: 0000000020000840 RDI: 0000000000000003 [ 52.403080][ T3643] RBP: 0000000000000000 R08: 000000005892ee40 R09: 000000005892ee40 [ 52.411045][ T3643] R10: 00007ffc3794a360 R11: 0000000000000246 R12: 000000000000cbc3 [ 52.419010][ T3643] R13: 00007ffc3794a910 R14: 00007ffc3794a900 R15: 00007ffc3794a8f4 [ 52.426983][ T3643] [ 52.430083][ T3643] [ 52.432401][ T3643] Allocated by task 3640: [ 52.436720][ T3643] kasan_save_stack+0x22/0x40 [ 52.441401][ T3643] kasan_set_track+0x25/0x30 [ 52.445993][ T3643] __kasan_kmalloc+0xa5/0xb0 [ 52.450583][ T3643] rxrpc_lookup_local+0x4d9/0xfb0 [ 52.455702][ T3643] rxrpc_bind+0x35e/0x5c0 [ 52.460024][ T3643] __sys_bind+0x1ed/0x260 [ 52.464349][ T3643] __x64_sys_bind+0x73/0xb0 [ 52.468846][ T3643] do_syscall_64+0x39/0xb0 [ 52.473262][ T3643] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.479155][ T3643] [ 52.481469][ T3643] Freed by task 3624: [ 52.485441][ T3643] kasan_save_stack+0x22/0x40 [ 52.490137][ T3643] kasan_set_track+0x25/0x30 [ 52.494734][ T3643] kasan_save_free_info+0x2e/0x40 [ 52.499763][ T3643] ____kasan_slab_free+0x160/0x1c0 [ 52.504873][ T3643] slab_free_freelist_hook+0x8b/0x1c0 [ 52.510243][ T3643] __kmem_cache_free+0xaf/0x3b0 [ 52.515111][ T3643] rcu_core+0x81f/0x1980 [ 52.519352][ T3643] __do_softirq+0x1fb/0xadc [ 52.523856][ T3643] [ 52.526174][ T3643] Last potentially related work creation: [ 52.531873][ T3643] kasan_save_stack+0x22/0x40 [ 52.536550][ T3643] __kasan_record_aux_stack+0xbc/0xd0 [ 52.541929][ T3643] call_rcu+0x9d/0x820 [ 52.545999][ T3643] rxrpc_put_local.part.0+0x128/0x170 [ 52.551371][ T3643] rxrpc_put_local+0x25/0x30 [ 52.555960][ T3643] rxrpc_release+0x237/0x550 [ 52.560546][ T3643] __sock_release+0xcd/0x280 [ 52.565229][ T3643] sock_close+0x1c/0x20 [ 52.569394][ T3643] __fput+0x27c/0xa90 [ 52.573378][ T3643] task_work_run+0x16f/0x270 [ 52.577968][ T3643] ptrace_notify+0x118/0x140 [ 52.582554][ T3643] syscall_exit_to_user_mode_prepare+0x129/0x280 [ 52.588883][ T3643] syscall_exit_to_user_mode+0xd/0x50 [ 52.594262][ T3643] do_syscall_64+0x46/0xb0 [ 52.598681][ T3643] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 52.604573][ T3643] [ 52.606890][ T3643] The buggy address belongs to the object at ffff88802364f000 [ 52.606890][ T3643] which belongs to the cache kmalloc-1k of size 1024 [ 52.620934][ T3643] The buggy address is located 540 bytes inside of [ 52.620934][ T3643] 1024-byte region [ffff88802364f000, ffff88802364f400) [ 52.634294][ T3643] [ 52.636610][ T3643] The buggy address belongs to the physical page: [ 52.643012][ T3643] page:ffffea00008d9200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x23648 [ 52.653157][ T3643] head:ffffea00008d9200 order:3 compound_mapcount:0 compound_pincount:0 [ 52.661473][ T3643] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 52.669451][ T3643] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888012041dc0 [ 52.678030][ T3643] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 52.686600][ T3643] page dumped because: kasan: bad access detected [ 52.693002][ T3643] page_owner tracks the page as allocated [ 52.698704][ T3643] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3622, tgid 3622 (sshd), ts 52174165960, free_ts 48201876872 [ 52.719364][ T3643] get_page_from_freelist+0x10b5/0x2d50 [ 52.724919][ T3643] __alloc_pages+0x1cb/0x5b0 [ 52.729501][ T3643] alloc_pages+0x1aa/0x270 [ 52.733920][ T3643] allocate_slab+0x213/0x300 [ 52.738598][ T3643] ___slab_alloc+0xa91/0x1400 [ 52.743279][ T3643] __slab_alloc.constprop.0+0x56/0xa0 [ 52.748738][ T3643] __kmem_cache_alloc_node+0x199/0x3e0 [ 52.754200][ T3643] __kmalloc_node_track_caller+0x4b/0xc0 [ 52.759830][ T3643] __alloc_skb+0xe9/0x310 [ 52.764155][ T3643] tcp_stream_alloc_skb+0x3c/0x580 [ 52.769265][ T3643] tcp_sendmsg_locked+0xc4f/0x2960 [ 52.774374][ T3643] tcp_sendmsg+0x2f/0x50 [ 52.778617][ T3643] inet_sendmsg+0x9d/0xe0 [ 52.782954][ T3643] sock_sendmsg+0xd3/0x120 [ 52.787376][ T3643] sock_write_iter+0x295/0x3d0 [ 52.792143][ T3643] vfs_write+0x9ed/0xdd0 [ 52.796392][ T3643] page last free stack trace: [ 52.801061][ T3643] free_pcp_prepare+0x65c/0xd90 [ 52.805924][ T3643] free_unref_page+0x1d/0x4d0 [ 52.810609][ T3643] __unfreeze_partials+0x17c/0x1a0 [ 52.815731][ T3643] qlist_free_all+0x6a/0x170 [ 52.820333][ T3643] kasan_quarantine_reduce+0x184/0x210 [ 52.825793][ T3643] __kasan_slab_alloc+0x66/0x90 [ 52.830648][ T3643] kmem_cache_alloc+0x2b4/0x3d0 [ 52.835499][ T3643] vm_area_dup+0x85/0x380 [ 52.840090][ T3643] __split_vma+0xae/0x5e0 [ 52.844427][ T3643] do_mas_align_munmap+0x7e0/0x1260 [ 52.849637][ T3643] do_mas_munmap+0x26e/0x2c0 [ 52.854235][ T3643] mmap_region+0x21d/0x1dd0 [ 52.858746][ T3643] do_mmap+0x831/0xf60 [ 52.862823][ T3643] vm_mmap_pgoff+0x1af/0x280 [ 52.867415][ T3643] ksys_mmap_pgoff+0x41f/0x5a0 [ 52.872185][ T3643] do_syscall_64+0x39/0xb0 [ 52.876609][ T3643] [ 52.878925][ T3643] Memory state around the buggy address: [ 52.884553][ T3643] ffff88802364f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.892609][ T3643] ffff88802364f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.900679][ T3643] >ffff88802364f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.908731][ T3643] ^ [ 52.913569][ T3643] ffff88802364f280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.921637][ T3643] ffff88802364f300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 52.929687][ T3643] ================================================================== [ 52.938242][ T3643] Kernel panic - not syncing: panic_on_warn set ... [ 52.944851][ T3643] CPU: 0 PID: 3643 Comm: syz-executor337 Not tainted 6.1.0-rc7-syzkaller-01867-gd8b879c00f69 #0 [ 52.955284][ T3643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 52.965346][ T3643] Call Trace: [ 52.968627][ T3643] [ 52.971599][ T3643] dump_stack_lvl+0xd1/0x138 [ 52.976233][ T3643] panic+0x2cc/0x626 [ 52.980142][ T3643] ? panic_print_sys_info.part.0+0x110/0x110 [ 52.986140][ T3643] ? preempt_schedule_common+0x59/0xc0 [ 52.991699][ T3643] ? preempt_schedule_thunk+0x1a/0x1c [ 52.997116][ T3643] end_report.part.0+0x3f/0x7c [ 53.001896][ T3643] ? rxrpc_lookup_local+0xdcf/0xfb0 [ 53.007102][ T3643] kasan_report.cold+0xa/0xf [ 53.011698][ T3643] ? rxrpc_lookup_local+0xdcf/0xfb0 [ 53.016918][ T3643] rxrpc_lookup_local+0xdcf/0xfb0 [ 53.022035][ T3643] rxrpc_bind+0x35e/0x5c0 [ 53.026365][ T3643] __sys_bind+0x1ed/0x260 [ 53.030695][ T3643] ? __ia32_sys_socketpair+0x100/0x100 [ 53.036174][ T3643] ? _raw_spin_unlock_irq+0x23/0x50 [ 53.041400][ T3643] ? lockdep_hardirqs_on+0x7d/0x100 [ 53.046621][ T3643] ? _raw_spin_unlock_irq+0x2e/0x50 [ 53.051825][ T3643] __x64_sys_bind+0x73/0xb0 [ 53.056329][ T3643] do_syscall_64+0x39/0xb0 [ 53.060752][ T3643] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.066657][ T3643] RIP: 0033:0x7f6a588c10b9 [ 53.071073][ T3643] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 53.090681][ T3643] RSP: 002b:00007ffc3794a8e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 53.099098][ T3643] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f6a588c10b9 [ 53.107068][ T3643] RDX: 0000000000000024 RSI: 0000000020000840 RDI: 0000000000000003 [ 53.115036][ T3643] RBP: 0000000000000000 R08: 000000005892ee40 R09: 000000005892ee40 [ 53.123002][ T3643] R10: 00007ffc3794a360 R11: 0000000000000246 R12: 000000000000cbc3 [ 53.130972][ T3643] R13: 00007ffc3794a910 R14: 00007ffc3794a900 R15: 00007ffc3794a8f4 [ 53.138957][ T3643] [ 53.142113][ T3643] Kernel Offset: disabled [ 53.146432][ T3643] Rebooting in 86400 seconds..