./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4224111934
<...>
Warning: Permanently added '10.128.10.26' (ECDSA) to the list of known hosts.
execve("./syz-executor4224111934", ["./syz-executor4224111934"], 0x7ffe68ce7470 /* 10 vars */) = 0
brk(NULL) = 0x555555811000
brk(0x555555811c40) = 0x555555811c40
arch_prctl(ARCH_SET_FS, 0x555555811300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4224111934", 4096) = 28
brk(0x555555832c40) = 0x555555832c40
brk(0x555555833000) = 0x555555833000
mprotect(0x7f39b4ee5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
prctl(PR_SET_MM, PR_SET_MM_MAP, 0x20000000, 0x68, 0) = 0
brk(0x20ffd000) = 0x20ffd000
exit_group(0) = ?
syzkaller login: [ 49.531344][ T3601] ==================================================================
[ 49.539590][ T3601] BUG: KASAN: use-after-free in exit_mmap+0x6b1/0x720
[ 49.546344][ T3601] Read of size 8 at addr ffff88801fa79cc8 by task syz-executor422/3601
[ 49.554560][ T3601]
[ 49.556865][ T3601] CPU: 0 PID: 3601 Comm: syz-executor422 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 49.566821][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 49.576858][ T3601] Call Trace:
[ 49.580122][ T3601]
[ 49.583038][ T3601] dump_stack_lvl+0xcd/0x134
[ 49.587630][ T3601] print_report.cold+0x2ba/0x719
[ 49.592559][ T3601] ? exit_mmap+0x6b1/0x720
[ 49.597025][ T3601] kasan_report+0xbe/0x1f0
[ 49.601428][ T3601] ? exit_mmap+0x6b1/0x720
[ 49.605829][ T3601] exit_mmap+0x6b1/0x720
[ 49.610057][ T3601] ? __ia32_sys_remap_file_pages+0x150/0x150
[ 49.616028][ T3601] __mmput+0x128/0x4c0
[ 49.620081][ T3601] mmput+0x5c/0x70
[ 49.623788][ T3601] do_exit+0xa09/0x29f0
[ 49.627930][ T3601] ? lock_downgrade+0x6e0/0x6e0
[ 49.632765][ T3601] ? mm_update_next_owner+0x7b0/0x7b0
[ 49.638119][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.643312][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 49.648511][ T3601] do_group_exit+0xd2/0x2f0
[ 49.653037][ T3601] __x64_sys_exit_group+0x3a/0x50
[ 49.658054][ T3601] do_syscall_64+0x35/0xb0
[ 49.662458][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.668349][ T3601] RIP: 0033:0x7f39b4e776a9
[ 49.672760][ T3601] Code: Unable to access opcode bytes at RIP 0x7f39b4e7767f.
[ 49.680120][ T3601] RSP: 002b:00007ffe5f9ced98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 49.688517][ T3601] RAX: ffffffffffffffda RBX: 00007f39b4eeb270 RCX: 00007f39b4e776a9
[ 49.696489][ T3601] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 49.704443][ T3601] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
[ 49.712411][ T3601] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f39b4eeb270
[ 49.720383][ T3601] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 49.728340][ T3601]
[ 49.731344][ T3601]
[ 49.733650][ T3601] Allocated by task 3601:
[ 49.737956][ T3601] kasan_save_stack+0x1e/0x40
[ 49.742621][ T3601] __kasan_slab_alloc+0x90/0xc0
[ 49.747454][ T3601] kmem_cache_alloc+0x2d6/0x4c0
[ 49.752285][ T3601] vm_area_alloc+0x1c/0xf0
[ 49.756685][ T3601] mmap_region+0x448/0x1bf0
[ 49.761171][ T3601] do_mmap+0x825/0xf50
[ 49.765224][ T3601] vm_mmap_pgoff+0x1ab/0x270
[ 49.769800][ T3601] ksys_mmap_pgoff+0x79/0x5a0
[ 49.774465][ T3601] do_syscall_64+0x35/0xb0
[ 49.778868][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.784743][ T3601]
[ 49.787047][ T3601] Freed by task 3601:
[ 49.791005][ T3601] kasan_save_stack+0x1e/0x40
[ 49.795665][ T3601] kasan_set_track+0x21/0x30
[ 49.800242][ T3601] kasan_set_free_info+0x20/0x30
[ 49.805163][ T3601] ____kasan_slab_free+0x166/0x1c0
[ 49.810258][ T3601] slab_free_freelist_hook+0x8b/0x1c0
[ 49.815631][ T3601] kmem_cache_free+0xeb/0x5b0
[ 49.820290][ T3601] exit_mmap+0x288/0x720
[ 49.824533][ T3601] __mmput+0x128/0x4c0
[ 49.828589][ T3601] mmput+0x5c/0x70
[ 49.832291][ T3601] do_exit+0xa09/0x29f0
[ 49.836428][ T3601] do_group_exit+0xd2/0x2f0
[ 49.840917][ T3601] __x64_sys_exit_group+0x3a/0x50
[ 49.845923][ T3601] do_syscall_64+0x35/0xb0
[ 49.850326][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 49.856201][ T3601]
[ 49.858506][ T3601] The buggy address belongs to the object at ffff88801fa79ca8
[ 49.858506][ T3601] which belongs to the cache vm_area_struct of size 152
[ 49.872796][ T3601] The buggy address is located 32 bytes inside of
[ 49.872796][ T3601] 152-byte region [ffff88801fa79ca8, ffff88801fa79d40)
[ 49.885975][ T3601]
[ 49.888282][ T3601] The buggy address belongs to the physical page:
[ 49.894670][ T3601] page:ffffea00007e9e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fa79
[ 49.904812][ T3601] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
[ 49.912340][ T3601] raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888140006b40
[ 49.920903][ T3601] raw: 0000000000000000 0000000080120012 00000001ffffffff 0000000000000000
[ 49.929468][ T3601] page dumped because: kasan: bad access detected
[ 49.935855][ T3601] page_owner tracks the page as allocated
[ 49.941546][ T3601] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 3596, tgid 3596 (sshd), ts 49436343226, free_ts 44111523441
[ 49.959240][ T3601] get_page_from_freelist+0x210d/0x3a30
[ 49.964770][ T3601] __alloc_pages+0x1c7/0x510
[ 49.969345][ T3601] alloc_pages+0x1aa/0x310
[ 49.973744][ T3601] allocate_slab+0x27e/0x3d0
[ 49.978323][ T3601] ___slab_alloc+0x89d/0xef0
[ 49.982901][ T3601] __slab_alloc.constprop.0+0x4d/0xa0
[ 49.988260][ T3601] kmem_cache_alloc+0x3fb/0x4c0
[ 49.993118][ T3601] vm_area_dup+0x81/0x380
[ 49.997443][ T3601] dup_mmap+0x642/0x1070
[ 50.001667][ T3601] dup_mm+0x91/0x370
[ 50.005545][ T3601] copy_process+0x3ca8/0x7080
[ 50.010209][ T3601] kernel_clone+0xe7/0xab0
[ 50.014609][ T3601] __do_sys_clone+0xba/0x100
[ 50.019180][ T3601] do_syscall_64+0x35/0xb0
[ 50.023597][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.029472][ T3601] page last free stack trace:
[ 50.034121][ T3601] free_pcp_prepare+0x5e4/0xd20
[ 50.038959][ T3601] free_unref_page_list+0x16f/0xb90
[ 50.044139][ T3601] release_pages+0xbe8/0x1810
[ 50.048802][ T3601] tlb_batch_pages_flush+0xa8/0x1a0
[ 50.053984][ T3601] tlb_finish_mmu+0x147/0x7e0
[ 50.058644][ T3601] exit_mmap+0x1fe/0x720
[ 50.062867][ T3601] __mmput+0x128/0x4c0
[ 50.066920][ T3601] mmput+0x5c/0x70
[ 50.070624][ T3601] do_exit+0xa09/0x29f0
[ 50.074763][ T3601] do_group_exit+0xd2/0x2f0
[ 50.079244][ T3601] __x64_sys_exit_group+0x3a/0x50
[ 50.084249][ T3601] do_syscall_64+0x35/0xb0
[ 50.088646][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.094519][ T3601]
[ 50.096827][ T3601] Memory state around the buggy address:
[ 50.102433][ T3601] ffff88801fa79b80: 00 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb
[ 50.110471][ T3601] ffff88801fa79c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
[ 50.118510][ T3601] >ffff88801fa79c80: fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb
[ 50.126552][ T3601] ^
[ 50.132939][ T3601] ffff88801fa79d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 50.140977][ T3601] ffff88801fa79d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 50.149016][ T3601] ==================================================================
[ 50.157442][ T3601] Kernel panic - not syncing: panic_on_warn set ...
[ 50.164029][ T3601] CPU: 0 PID: 3601 Comm: syz-executor422 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 50.173994][ T3601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 50.184038][ T3601] Call Trace:
[ 50.187312][ T3601]
[ 50.190235][ T3601] dump_stack_lvl+0xcd/0x134
[ 50.194832][ T3601] panic+0x2d7/0x636
[ 50.198728][ T3601] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 50.204709][ T3601] ? preempt_schedule_common+0x59/0xc0
[ 50.210167][ T3601] ? preempt_schedule_thunk+0x16/0x18
[ 50.215542][ T3601] ? exit_mmap+0x6b1/0x720
[ 50.219956][ T3601] end_report.part.0+0x3f/0x7c
[ 50.224720][ T3601] kasan_report.cold+0x8/0x12
[ 50.229398][ T3601] ? exit_mmap+0x6b1/0x720
[ 50.233810][ T3601] exit_mmap+0x6b1/0x720
[ 50.238050][ T3601] ? __ia32_sys_remap_file_pages+0x150/0x150
[ 50.244035][ T3601] __mmput+0x128/0x4c0
[ 50.248097][ T3601] mmput+0x5c/0x70
[ 50.251810][ T3601] do_exit+0xa09/0x29f0
[ 50.255956][ T3601] ? lock_downgrade+0x6e0/0x6e0
[ 50.260802][ T3601] ? mm_update_next_owner+0x7b0/0x7b0
[ 50.266168][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.271367][ T3601] ? _raw_spin_unlock_irq+0x1f/0x40
[ 50.276568][ T3601] do_group_exit+0xd2/0x2f0
[ 50.281066][ T3601] __x64_sys_exit_group+0x3a/0x50
[ 50.286083][ T3601] do_syscall_64+0x35/0xb0
[ 50.290497][ T3601] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.296385][ T3601] RIP: 0033:0x7f39b4e776a9
[ 50.300788][ T3601] Code: Unable to access opcode bytes at RIP 0x7f39b4e7767f.
[ 50.308137][ T3601] RSP: 002b:00007ffe5f9ced98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 50.316542][ T3601] RAX: ffffffffffffffda RBX: 00007f39b4eeb270 RCX: 00007f39b4e776a9
[ 50.324506][ T3601] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 50.332467][ T3601] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000
[ 50.340426][ T3601] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f39b4eeb270
[ 50.348394][ T3601] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 50.356362][ T3601]
[ 50.359521][ T3601] Kernel Offset: disabled
[ 50.363838][ T3601] Rebooting in 86400 seconds..