./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor775439889 <...> Warning: Permanently added '10.128.1.37' (ED25519) to the list of known hosts. execve("./syz-executor775439889", ["./syz-executor775439889"], 0x7ffeac4e4c50 /* 10 vars */) = 0 brk(NULL) = 0x555556cc3000 brk(0x555556cc3d00) = 0x555556cc3d00 arch_prctl(ARCH_SET_FS, 0x555556cc3380) = 0 set_tid_address(0x555556cc3650) = 5033 set_robust_list(0x555556cc3660, 24) = 0 rseq(0x555556cc3ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor775439889", 4096) = 27 getrandom("\x28\x95\xe1\x2d\xeb\x8d\x80\xe9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556cc3d00 brk(0x555556ce4d00) = 0x555556ce4d00 brk(0x555556ce5000) = 0x555556ce5000 mprotect(0x7f24dda94000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5034 attached , child_tidptr=0x555556cc3650) = 5034 [pid 5034] set_robust_list(0x555556cc3660, 24) = 0 [pid 5034] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5034] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5034] setsid() = 1 [pid 5034] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5034] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5034] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5034] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5034] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5034] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5034] unshare(CLONE_NEWNS) = 0 [pid 5034] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5034] unshare(CLONE_NEWIPC) = 0 [pid 5034] unshare(CLONE_NEWCGROUP) = 0 [pid 5034] unshare(CLONE_NEWUTS) = 0 [pid 5034] unshare(CLONE_SYSVSEM) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "16777216", 8) = 8 [pid 5034] close(3) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "536870912", 9) = 9 [pid 5034] close(3) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "1024", 4) = 4 [pid 5034] close(3) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "8192", 4) = 4 [pid 5034] close(3) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "1024", 4) = 4 [pid 5034] close(3) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "1024", 4) = 4 [pid 5034] close(3) = 0 [pid 5034] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5034] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5034] close(3) = 0 [pid 5034] getpid() = 1 [pid 5034] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 74.735664][ T5034] dump_stack_lvl+0x1e7/0x2d0 [ 74.740362][ T5034] ? nf_tcp_handle_invalid+0x650/0x650 [ 74.745824][ T5034] ? panic+0x770/0x770 [ 74.749900][ T5034] ? _printk+0xd5/0x120 [ 74.754063][ T5034] print_report+0x163/0x540 [ 74.758599][ T5034] ? ktime_get_real_ts64+0x460/0x460 [ 74.763907][ T5034] ? __mutex_lock+0x2ee/0xd60 [ 74.768589][ T5034] ? time64_to_tm+0x331/0x4d0 [ 74.773283][ T5034] ? __virt_addr_valid+0x22f/0x2e0 [ 74.778400][ T5034] ? __phys_addr+0xba/0x170 [ 74.782918][ T5034] ? crc_itu_t+0x1d5/0x2a0 [ 74.787343][ T5034] kasan_report+0x175/0x1b0 [ 74.791874][ T5034] ? crc_itu_t+0x1d5/0x2a0 [ 74.796299][ T5034] ? pvclock_gtod_unregister_notifier+0x50/0x50 [ 74.802563][ T5034] crc_itu_t+0x1d5/0x2a0 [ 74.806817][ T5034] udf_sync_fs+0x1d2/0x380 [ 74.811240][ T5034] ? udf_put_super+0x160/0x160 [ 74.816014][ T5034] ? dentry_kill+0xbb/0x290 [ 74.820531][ T5034] ? get_nr_dirty_inodes+0x1c7/0x210 [ 74.825828][ T5034] sync_filesystem+0xec/0x220 [ 74.830532][ T5034] generic_shutdown_super+0x72/0x2c0 [ 74.835829][ T5034] kill_block_super+0x41/0x70 [ 74.840520][ T5034] deactivate_locked_super+0xa4/0x110 [ 74.845900][ T5034] cleanup_mnt+0x426/0x4c0 [ 74.850324][ T5034] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.855541][ T5034] task_work_run+0x24a/0x300 [ 74.860139][ T5034] ? kasan_quarantine_put+0xd8/0x230 [ 74.865427][ T5034] ? task_work_cancel+0x2b0/0x2b0 [ 74.870458][ T5034] ? kmem_cache_free+0x292/0x500 [ 74.875404][ T5034] ? do_exit+0xa27/0x2650 [ 74.879741][ T5034] do_exit+0xa2c/0x2650 [ 74.883910][ T5034] ? put_task_struct+0xb0/0xb0 [ 74.888681][ T5034] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 74.894681][ T5034] ? print_irqtrace_events+0x220/0x220 [ 74.900147][ T5034] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.905349][ T5034] ? lockdep_hardirqs_on+0x98/0x140 [ 74.910551][ T5034] do_group_exit+0x206/0x2c0 [ 74.915153][ T5034] __x64_sys_exit_group+0x3f/0x40 [ 74.920184][ T5034] do_syscall_64+0x41/0xc0 [ 74.924602][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 74.930672][ T5034] RIP: 0033:0x7f24dd9fed09 [ 74.935091][ T5034] Code: Unable to access opcode bytes at 0x7f24dd9fecdf. [ 74.942108][ T5034] RSP: 002b:00007ffc8de41698 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 74.950530][ T5034] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f24dd9fed09 [ 74.958509][ T5034] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 74.966480][ T5034] RBP: 00007f24dda9a390 R08: ffffffffffffffb8 R09: 0000000000000000 [ 74.974460][ T5034] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f24dda9a390 [ 74.982455][ T5034] R13: 0000000000000000 R14: 00007f24dda9b100 R15: 00007f24dd9ccfe0 [ 74.990442][ T5034] [ 74.993458][ T5034] [ 74.995786][ T5034] The buggy address belongs to the physical page: [ 75.002191][ T5034] page:ffffea0001d46b80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x751ae [ 75.012341][ T5034] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 75.019451][ T5034] page_type: 0xffffffff() [ 75.023786][ T5034] raw: 00fff00000000000 ffffea0001ded748 ffffea0001dea6c8 0000000000000000 [ 75.032406][ T5034] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 75.041008][ T5034] page dumped because: kasan: bad access detected [ 75.047425][ T5034] page_owner tracks the page as freed [ 75.052793][ T5034] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 4990, tgid 4990 (sshd), ts 67467674626, free_ts 67601294482 [ 75.070771][ T5034] post_alloc_hook+0x1e6/0x210 [ 75.075545][ T5034] get_page_from_freelist+0x31db/0x3360 [ 75.081098][ T5034] __alloc_pages+0x255/0x670 [ 75.085692][ T5034] __folio_alloc+0x13/0x30 [ 75.090113][ T5034] vma_alloc_folio+0x48a/0x9a0 [ 75.094916][ T5034] handle_mm_fault+0x2376/0x62b0 [ 75.099894][ T5034] exc_page_fault+0x455/0x860 [ 75.104583][ T5034] asm_exc_page_fault+0x26/0x30 [ 75.109453][ T5034] page last free stack trace: [ 75.114130][ T5034] free_unref_page_prepare+0x8c3/0x9f0 [ 75.119607][ T5034] free_unref_page_list+0x596/0x830 [ 75.124812][ T5034] release_pages+0x2113/0x23f0 [ 75.129579][ T5034] tlb_flush_mmu+0x34c/0x4e0 [ 75.134198][ T5034] tlb_finish_mmu+0xd4/0x1f0 [ 75.138809][ T5034] unmap_region+0x300/0x350 [ 75.143317][ T5034] do_vmi_align_munmap+0x121e/0x1850 [ 75.148609][ T5034] do_vmi_munmap+0x24d/0x2d0 [ 75.153199][ T5034] __vm_munmap+0x230/0x450 [ 75.157615][ T5034] __x64_sys_munmap+0x69/0x80 [ 75.162414][ T5034] do_syscall_64+0x41/0xc0 [ 75.166842][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 75.172743][ T5034] [ 75.175109][ T5034] Memory state around the buggy address: [ 75.180757][ T5034] ffff8880751adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 75.188815][ T5034] ffff8880751adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 75.196889][ T5034] >ffff8880751ae000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 75.204965][ T5034] ^ [ 75.209038][ T5034] ffff8880751ae080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 75.219361][ T5034] ffff8880751ae100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 75.227547][ T5034] ================================================================== [ 75.236587][ T5034] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 75.243841][ T5034] CPU: 0 PID: 5034 Comm: syz-executor775 Not tainted 6.6.0-rc2-syzkaller-00018-g2cf0f7156238 #0 [ 75.254366][ T5034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 [ 75.264433][ T5034] Call Trace: [ 75.267721][ T5034] [ 75.270705][ T5034] dump_stack_lvl+0x1e7/0x2d0 [ 75.275411][ T5034] ? nf_tcp_handle_invalid+0x650/0x650 [ 75.280896][ T5034] ? panic+0x770/0x770 [ 75.285100][ T5034] ? vscnprintf+0x5d/0x80 [ 75.289449][ T5034] panic+0x30f/0x770 [ 75.293374][ T5034] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 75.299539][ T5034] ? check_panic_on_warn+0x21/0xa0 [ 75.304754][ T5034] ? __memcpy_flushcache+0x2b0/0x2b0 [ 75.310047][ T5034] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 75.316034][ T5034] ? _raw_spin_unlock+0x40/0x40 [ 75.320892][ T5034] check_panic_on_warn+0x82/0xa0 [ 75.325923][ T5034] ? crc_itu_t+0x1d5/0x2a0 [ 75.330349][ T5034] end_report+0x6e/0x130 [ 75.334596][ T5034] kasan_report+0x186/0x1b0 [ 75.339110][ T5034] ? crc_itu_t+0x1d5/0x2a0 [ 75.343623][ T5034] ? pvclock_gtod_unregister_notifier+0x50/0x50 [ 75.349884][ T5034] crc_itu_t+0x1d5/0x2a0 [ 75.354147][ T5034] udf_sync_fs+0x1d2/0x380 [ 75.358569][ T5034] ? udf_put_super+0x160/0x160 [ 75.363364][ T5034] ? dentry_kill+0xbb/0x290 [ 75.367873][ T5034] ? get_nr_dirty_inodes+0x1c7/0x210 [ 75.373191][ T5034] sync_filesystem+0xec/0x220 [ 75.377880][ T5034] generic_shutdown_super+0x72/0x2c0 [ 75.383173][ T5034] kill_block_super+0x41/0x70 [ 75.387860][ T5034] deactivate_locked_super+0xa4/0x110 [ 75.393257][ T5034] cleanup_mnt+0x426/0x4c0 [ 75.397682][ T5034] ? _raw_spin_unlock_irq+0x23/0x50 [ 75.402890][ T5034] task_work_run+0x24a/0x300 [ 75.407491][ T5034] ? kasan_quarantine_put+0xd8/0x230 [ 75.412779][ T5034] ? task_work_cancel+0x2b0/0x2b0 [ 75.417813][ T5034] ? kmem_cache_free+0x292/0x500 [ 75.422752][ T5034] ? do_exit+0xa27/0x2650 [ 75.427090][ T5034] do_exit+0xa2c/0x2650 [ 75.431260][ T5034] ? put_task_struct+0xb0/0xb0 [ 75.436029][ T5034] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 75.442017][ T5034] ? print_irqtrace_events+0x220/0x220 [ 75.447531][ T5034] ? _raw_spin_unlock_irq+0x23/0x50 [ 75.452745][ T5034] ? lockdep_hardirqs_on+0x98/0x140 [ 75.458037][ T5034] do_group_exit+0x206/0x2c0 [ 75.462654][ T5034] __x64_sys_exit_group+0x3f/0x40 [ 75.467687][ T5034] do_syscall_64+0x41/0xc0 [ 75.472114][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 75.478020][ T5034] RIP: 0033:0x7f24dd9fed09 [ 75.482438][ T5034] Code: Unable to access opcode bytes at 0x7f24dd9fecdf. [ 75.489458][ T5034] RSP: 002b:00007ffc8de41698 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 75.497971][ T5034] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f24dd9fed09 [ 75.505952][ T5034] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 75.513932][ T5034] RBP: 00007f24dda9a390 R08: ffffffffffffffb8 R09: 0000000000000000 [ 75.521923][ T5034] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f24dda9a390 [ 75.529905][ T5034] R13: 0000000000000000 R14: 00007f24dda9b100 R15: 00007f24dd9ccfe0 [ 75.537889][ T5034] [ 75.541310][ T5034] Kernel Offset: disabled [ 75.545630][ T5034] Rebooting in 86400 seconds..