./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor746220003

<...>
DUID 00:04:92:3d:a4:bf:d8:99:95:1d:d2:9f:0e:34:7d:20:a7:e6
forked to background, child pid 4645
[   34.768966][ T4646] 8021q: adding VLAN 0 to HW filter on device bond0
[   34.787728][ T4646] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.40' (ECDSA) to the list of known hosts.
execve("./syz-executor746220003", ["./syz-executor746220003"], 0x7ffe6f6ac1e0 /* 10 vars */) = 0
brk(NULL)                               = 0x555556aae000
brk(0x555556aaec40)                     = 0x555556aaec40
arch_prctl(ARCH_SET_FS, 0x555556aae300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor746220003", 4096) = 27
brk(0x555556acfc40)                     = 0x555556acfc40
brk(0x555556ad0000)                     = 0x555556ad0000
mprotect(0x7f04aa1f6000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=0x20001e80, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 3
syzkaller login: [   55.051127][ T5071] ==================================================================
[   55.059265][ T5071] BUG: KASAN: slab-out-of-bounds in __build_skb_around+0x235/0x340
[   55.067169][ T5071] Write of size 32 at addr ffff88801ff53ac0 by task syz-executor746/5071
[   55.075571][ T5071] 
[   55.077881][ T5071] CPU: 0 PID: 5071 Comm: syz-executor746 Not tainted 6.1.0-rc8-next-20221207-syzkaller #0
[   55.087755][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   55.097798][ T5071] Call Trace:
[   55.101064][ T5071]  <TASK>
[   55.103986][ T5071]  dump_stack_lvl+0xd1/0x138
[   55.108568][ T5071]  print_report+0x15e/0x45d
[   55.113068][ T5071]  ? __phys_addr+0xc8/0x140
[   55.117565][ T5071]  ? __build_skb_around+0x235/0x340
[   55.122754][ T5071]  kasan_report+0xbf/0x1f0
[   55.127181][ T5071]  ? __build_skb_around+0x235/0x340
[   55.132412][ T5071]  kasan_check_range+0x141/0x190
[   55.137380][ T5071]  memset+0x24/0x50
[   55.141653][ T5071]  __build_skb_around+0x235/0x340
[   55.146705][ T5071]  __build_skb+0x4f/0x60
[   55.150969][ T5071]  build_skb+0x22/0x280
[   55.155143][ T5071]  bpf_prog_test_run_skb+0x343/0x1e10
[   55.160531][ T5071]  ? bpf_prog_test_run_raw_tp+0x620/0x620
[   55.166266][ T5071]  ? __fget_light+0x20a/0x270
[   55.170954][ T5071]  ? bpf_prog_test_run_raw_tp+0x620/0x620
[   55.176685][ T5071]  __sys_bpf+0x1599/0x4ff0
[   55.181112][ T5071]  ? lock_release+0x810/0x810
[   55.185800][ T5071]  ? bpf_perf_link_attach+0x520/0x520
[   55.191195][ T5071]  ? do_raw_spin_lock+0x124/0x2b0
[   55.196230][ T5071]  ? rwlock_bug.part.0+0x90/0x90
[   55.201176][ T5071]  ? _raw_spin_lock_irq+0x45/0x50
[   55.206227][ T5071]  ? find_held_lock+0x2d/0x110
[   55.211020][ T5071]  ? _raw_spin_unlock_irq+0x23/0x50
[   55.216243][ T5071]  ? lockdep_hardirqs_on+0x7d/0x100
[   55.221461][ T5071]  __x64_sys_bpf+0x79/0xc0
[   55.225891][ T5071]  do_syscall_64+0x39/0xb0
[   55.230320][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.236232][ T5071] RIP: 0033:0x7f04aa189d29
[   55.240652][ T5071] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   55.260269][ T5071] RSP: 002b:00007ffeb94e6878 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   55.268696][ T5071] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f04aa189d29
[   55.276671][ T5071] RDX: 000000000000002c RSI: 0000000020000080 RDI: 000000000000000a
[   55.284647][ T5071] RBP: 00007f04aa14ded0 R08: 0000000000000000 R09: 0000000000000000
[   55.292624][ T5071] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f04aa14df60
[   55.300601][ T5071] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   55.308588][ T5071]  </TASK>
[   55.311609][ T5071] 
[   55.313929][ T5071] Allocated by task 5071:
[   55.318280][ T5071]  kasan_save_stack+0x22/0x40
[   55.322969][ T5071]  kasan_set_track+0x25/0x30
[   55.327563][ T5071]  __kasan_kmalloc+0xa5/0xb0
[   55.332160][ T5071]  __kmalloc+0x5a/0xd0
[   55.336243][ T5071]  bpf_test_init.isra.0+0xa5/0x150
[   55.341374][ T5071]  bpf_prog_test_run_skb+0x22e/0x1e10
[   55.346754][ T5071]  __sys_bpf+0x1599/0x4ff0
[   55.351175][ T5071]  __x64_sys_bpf+0x79/0xc0
[   55.355606][ T5071]  do_syscall_64+0x39/0xb0
[   55.360034][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.365963][ T5071] 
[   55.368281][ T5071] The buggy address belongs to the object at ffff88801ff53800
[   55.368281][ T5071]  which belongs to the cache kmalloc-1k of size 1024
[   55.382335][ T5071] The buggy address is located 704 bytes inside of
[   55.382335][ T5071]  1024-byte region [ffff88801ff53800, ffff88801ff53c00)
[   55.395697][ T5071] 
[   55.398015][ T5071] The buggy address belongs to the physical page:
[   55.404419][ T5071] page:ffffea00007fd400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ff50
[   55.414576][ T5071] head:ffffea00007fd400 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
[   55.424646][ T5071] ksm flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   55.432983][ T5071] raw: 00fff00000010200 ffff888012441dc0 ffffea0001d3a600 0000000000000003
[   55.441578][ T5071] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[   55.450155][ T5071] page dumped because: kasan: bad access detected
[   55.456565][ T5071] page_owner tracks the page as allocated
[   55.462271][ T5071] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4773, tgid 4773 (dhcpcd-run-hook), ts 36021800931, free_ts 35994303327
[   55.483906][ T5071]  get_page_from_freelist+0x119c/0x2ce0
[   55.489470][ T5071]  __alloc_pages+0x1cb/0x5b0
[   55.494087][ T5071]  alloc_pages+0x1aa/0x270
[   55.498510][ T5071]  allocate_slab+0x25f/0x350
[   55.503129][ T5071]  ___slab_alloc+0xa91/0x1400
[   55.507808][ T5071]  __slab_alloc.constprop.0+0x56/0xa0
[   55.513187][ T5071]  __kmem_cache_alloc_node+0x1a4/0x430
[   55.518653][ T5071]  __kmalloc+0x4a/0xd0
[   55.522832][ T5071]  load_elf_phdrs+0x103/0x210
[   55.527527][ T5071]  load_elf_binary+0x1db/0x52c0
[   55.532399][ T5071]  bprm_execve+0x7ef/0x19f0
[   55.536911][ T5071]  do_execveat_common+0x724/0x890
[   55.541942][ T5071]  __x64_sys_execve+0x93/0xc0
[   55.546624][ T5071]  do_syscall_64+0x39/0xb0
[   55.551050][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.556961][ T5071] page last free stack trace:
[   55.561631][ T5071]  free_pcp_prepare+0x65c/0xc00
[   55.566488][ T5071]  free_unref_page+0x1d/0x490
[   55.571198][ T5071]  qlist_free_all+0x6a/0x170
[   55.575813][ T5071]  kasan_quarantine_reduce+0x192/0x220
[   55.581302][ T5071]  __kasan_slab_alloc+0x66/0x90
[   55.586167][ T5071]  kmem_cache_alloc+0x1e4/0x430
[   55.591025][ T5071]  getname_flags.part.0+0x50/0x4f0
[   55.596156][ T5071]  getname+0x92/0xd0
[   55.600062][ T5071]  do_sys_openat2+0xf5/0x4c0
[   55.604653][ T5071]  __x64_sys_openat+0x143/0x1f0
[   55.609508][ T5071]  do_syscall_64+0x39/0xb0
[   55.613944][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.619871][ T5071] 
[   55.622191][ T5071] Memory state around the buggy address:
[   55.627818][ T5071]  ffff88801ff53980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   55.635882][ T5071]  ffff88801ff53a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   55.644119][ T5071] >ffff88801ff53a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.652195][ T5071]                                            ^
[   55.658362][ T5071]  ffff88801ff53b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.666432][ T5071]  ffff88801ff53b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   55.674497][ T5071] ==================================================================
[   55.683148][ T5071] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   55.690352][ T5071] CPU: 0 PID: 5071 Comm: syz-executor746 Not tainted 6.1.0-rc8-next-20221207-syzkaller #0
[   55.700247][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   55.710736][ T5071] Call Trace:
[   55.714013][ T5071]  <TASK>
[   55.716943][ T5071]  dump_stack_lvl+0xd1/0x138
[   55.721547][ T5071]  panic+0x2cc/0x626
[   55.725454][ T5071]  ? panic_print_sys_info.part.0+0x110/0x110
[   55.731447][ T5071]  ? preempt_schedule_thunk+0x1a/0x20
[   55.736838][ T5071]  ? preempt_schedule_common+0x59/0xc0
[   55.742313][ T5071]  check_panic_on_warn.cold+0x19/0x35
[   55.747693][ T5071]  end_report.part.0+0x36/0x73
[   55.752467][ T5071]  ? __build_skb_around+0x235/0x340
[   55.757675][ T5071]  kasan_report.cold+0xa/0xf
[   55.762286][ T5071]  ? __build_skb_around+0x235/0x340
[   55.767496][ T5071]  kasan_check_range+0x141/0x190
[   55.772878][ T5071]  memset+0x24/0x50
[   55.776699][ T5071]  __build_skb_around+0x235/0x340
[   55.781735][ T5071]  __build_skb+0x4f/0x60
[   55.785992][ T5071]  build_skb+0x22/0x280
[   55.790166][ T5071]  bpf_prog_test_run_skb+0x343/0x1e10
[   55.795550][ T5071]  ? bpf_prog_test_run_raw_tp+0x620/0x620
[   55.801281][ T5071]  ? __fget_light+0x20a/0x270
[   55.805963][ T5071]  ? bpf_prog_test_run_raw_tp+0x620/0x620
[   55.811694][ T5071]  __sys_bpf+0x1599/0x4ff0
[   55.816143][ T5071]  ? lock_release+0x810/0x810
[   55.820827][ T5071]  ? bpf_perf_link_attach+0x520/0x520
[   55.826205][ T5071]  ? do_raw_spin_lock+0x124/0x2b0
[   55.831242][ T5071]  ? rwlock_bug.part.0+0x90/0x90
[   55.836185][ T5071]  ? _raw_spin_lock_irq+0x45/0x50
[   55.841237][ T5071]  ? find_held_lock+0x2d/0x110
[   55.846028][ T5071]  ? _raw_spin_unlock_irq+0x23/0x50
[   55.851252][ T5071]  ? lockdep_hardirqs_on+0x7d/0x100
[   55.856466][ T5071]  __x64_sys_bpf+0x79/0xc0
[   55.860893][ T5071]  do_syscall_64+0x39/0xb0
[   55.865324][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   55.871234][ T5071] RIP: 0033:0x7f04aa189d29
[   55.875649][ T5071] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   55.895262][ T5071] RSP: 002b:00007ffeb94e6878 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   55.903681][ T5071] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f04aa189d29
[   55.911741][ T5071] RDX: 000000000000002c RSI: 0000000020000080 RDI: 000000000000000a
[   55.919711][ T5071] RBP: 00007f04aa14ded0 R08: 0000000000000000 R09: 0000000000000000
[   55.927680][ T5071] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f04aa14df60
[   55.935649][ T5071] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   55.943626][ T5071]  </TASK>
[   55.946792][ T5071] Kernel Offset: disabled
[   55.951108][ T5071] Rebooting in 86400 seconds..