./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2604179102 <...> forked to background, child pid 3185 [ 25.299705][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.316940][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: [ 25.610658][ T3273] sshd (3273) used greatest stack depth: 19312 bytes left OK syzkaller Warning: Permanently added '10.128.1.63' (ECDSA) to the list of known hosts. execve("./syz-executor2604179102", ["./syz-executor2604179102"], 0x7ffec16b1db0 /* 10 vars */) = 0 brk(NULL) = 0x555556c92000 brk(0x555556c92d00) = 0x555556c92d00 arch_prctl(ARCH_SET_FS, 0x555556c923c0) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2604179102", 4096) = 28 brk(0x555556cb3d00) = 0x555556cb3d00 brk(0x555556cb4000) = 0x555556cb4000 mprotect(0x7f1b8413b000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f1b8408c0a0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f1b8408cbc0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f1b8408c0a0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f1b8408cbc0}, NULL, 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3614 attached , child_tidptr=0x555556c92690) = 3614 [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3614] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 3613] <... clone resumed>, child_tidptr=0x555556c92690) = 3615 [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3616 [pid 3614] <... openat resumed>) = 3 ./strace-static-x86_64: Process 3616 attached ./strace-static-x86_64: Process 3615 attached [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3616] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 3614] ioctl(3, LOOP_CLR_FD [pid 3616] <... openat resumed>) = 3 [pid 3614] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3616] ioctl(3, LOOP_CLR_FD [pid 3614] close(3 [pid 3616] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3616] close(3 [pid 3615] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 3614] <... close resumed>) = 0 [pid 3616] <... close resumed>) = 0 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3616] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3619 [pid 3614] <... clone resumed>, child_tidptr=0x555556c92690) = 3618 [pid 3615] <... openat resumed>) = 3 [pid 3615] ioctl(3, LOOP_CLR_FD [pid 3613] <... clone resumed>, child_tidptr=0x555556c92690) = 3617 [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3615] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3615] close(3) = 0 [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3613] <... clone resumed>, child_tidptr=0x555556c92690) = 3620 ./strace-static-x86_64: Process 3618 attached ./strace-static-x86_64: Process 3619 attached [pid 3613] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3618] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3619] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 3622 attached ./strace-static-x86_64: Process 3621 attached ./strace-static-x86_64: Process 3620 attached ./strace-static-x86_64: Process 3617 attached [pid 3618] <... prctl resumed>) = 0 [pid 3615] <... clone resumed>, child_tidptr=0x555556c92690) = 3621 [pid 3613] <... clone resumed>, child_tidptr=0x555556c92690) = 3622 [pid 3622] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 3621] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3620] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 3619] <... prctl resumed>) = 0 [pid 3618] setpgid(0, 0 [pid 3617] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 3622] <... openat resumed>) = 3 [pid 3621] <... prctl resumed>) = 0 [pid 3620] <... openat resumed>) = 3 [pid 3619] setpgid(0, 0 [pid 3618] <... setpgid resumed>) = 0 [pid 3617] <... openat resumed>) = 3 [pid 3622] ioctl(3, LOOP_CLR_FD [pid 3621] setpgid(0, 0 [pid 3620] ioctl(3, LOOP_CLR_FD [pid 3617] ioctl(3, LOOP_CLR_FD [pid 3622] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3621] <... setpgid resumed>) = 0 [pid 3620] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3619] <... setpgid resumed>) = 0 [pid 3618] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3617] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3622] close(3 [pid 3621] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3622] <... close resumed>) = 0 [pid 3621] <... openat resumed>) = 3 [pid 3620] close(3 [pid 3619] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3618] <... openat resumed>) = 3 [pid 3617] close(3 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3621] write(3, "1000", 4 [pid 3620] <... close resumed>) = 0 [pid 3617] <... close resumed>) = 0 [pid 3621] <... write resumed>) = 4 [pid 3620] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3619] <... openat resumed>) = 3 [pid 3618] write(3, "1000", 4 [pid 3617] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 3622] <... clone resumed>, child_tidptr=0x555556c92690) = 3624 [pid 3621] close(3 [pid 3619] write(3, "1000", 4 [pid 3618] <... write resumed>) = 4 [pid 3621] <... close resumed>) = 0 [pid 3620] <... clone resumed>, child_tidptr=0x555556c92690) = 3625 [pid 3619] <... write resumed>) = 4 [pid 3618] close(3 [pid 3617] <... clone resumed>, child_tidptr=0x555556c92690) = 3626 [pid 3621] mkdir("./file0", 0777 [pid 3619] close(3 [pid 3618] <... close resumed>) = 0 [pid 3621] <... mkdir resumed>) = 0 [pid 3619] <... close resumed>) = 0 [pid 3618] mkdir("./file0", 0777 [pid 3621] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3619] mkdir("./file0", 0777 [pid 3618] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3621] pipe2( [pid 3619] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3618] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3621] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3619] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3618] pipe2( [pid 3621] dup(4 [pid 3619] pipe2( [pid 3621] <... dup resumed>) = 5 [pid 3619] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3618] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3621] mount(NULL, NULL, NULL, 0, NULL [pid 3619] dup(4 [pid 3618] dup(4 [pid 3621] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3619] <... dup resumed>) = 5 [pid 3618] <... dup resumed>) = 5 ./strace-static-x86_64: Process 3626 attached ./strace-static-x86_64: Process 3624 attached [pid 3621] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3619] mount(NULL, NULL, NULL, 0, NULL [pid 3618] mount(NULL, NULL, NULL, 0, NULL [pid 3626] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3619] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3618] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3626] <... prctl resumed>) = 0 [pid 3624] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3619] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3618] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3626] setpgid(0, 0 [pid 3624] <... prctl resumed>) = 0 [pid 3626] <... setpgid resumed>) = 0 [pid 3624] setpgid(0, 0 [pid 3626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3624] <... setpgid resumed>) = 0 [pid 3626] <... openat resumed>) = 3 [pid 3624] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3626] write(3, "1000", 4 [pid 3624] <... openat resumed>) = 3 [pid 3626] <... write resumed>) = 4 [pid 3624] write(3, "1000", 4 [pid 3626] close(3 [pid 3624] <... write resumed>) = 4 [pid 3626] <... close resumed>) = 0 [pid 3624] close(3 [pid 3626] mkdir("./file0", 0777 [pid 3624] <... close resumed>) = 0 [pid 3626] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3624] mkdir("./file0", 0777 [pid 3626] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3624] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3626] pipe2( [pid 3624] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3626] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3624] pipe2( [pid 3626] dup(4 [pid 3624] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3626] <... dup resumed>) = 5 [pid 3624] dup(4 [pid 3626] mount(NULL, NULL, NULL, 0, NULL [pid 3624] <... dup resumed>) = 5 [pid 3626] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3624] mount(NULL, NULL, NULL, 0, NULL [pid 3626] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3624] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3624] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004,"./strace-static-x86_64: Process 3625 attached [pid 3625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3625] setpgid(0, 0) = 0 [pid 3625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3625] write(3, "1000", 4) = 4 [pid 3625] close(3) = 0 [pid 3625] mkdir("./file0", 0777) = -1 EEXIST (File exists) [pid 3625] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3625] pipe2([3, 4], 0) = 0 [pid 3625] dup(4) = 5 [pid 3625] mount(NULL, NULL, NULL, 0, NULL) = -1 EFAULT (Bad address) [pid 3625] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3618] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3618] exit_group(0) = ? [pid 3618] +++ exited with 0 +++ [pid 3614] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3618, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 3614] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 3614] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 3614] close(3) = 0 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3628 ./strace-static-x86_64: Process 3628 attached [pid 3628] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3628] setpgid(0, 0) = 0 [pid 3628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] write(3, "1000", 4) = 4 [pid 3628] close(3) = 0 [pid 3628] mkdir("./file0", 0777) = -1 EEXIST (File exists) [pid 3628] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3628] pipe2([3, 4], 0) = 0 [pid 3628] dup(4) = 5 [pid 3628] mount(NULL, NULL, NULL, 0, NULL) = -1 EFAULT (Bad address) [pid 3628] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3619] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3619] exit_group(0) = ? [pid 3619] +++ exited with 0 +++ [pid 3616] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3619, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3616] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 3616] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 3616] close(3) = 0 [pid 3616] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3629 ./strace-static-x86_64: Process 3629 attached [pid 3629] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3629] setpgid(0, 0) = 0 [pid 3629] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3621] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3629] <... openat resumed>) = 3 [pid 3621] exit_group(0 [pid 3629] write(3, "1000", 4 [pid 3621] <... exit_group resumed>) = ? [pid 3629] <... write resumed>) = 4 [pid 3621] +++ exited with 0 +++ [pid 3629] close(3) = 0 [pid 3615] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3621, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3629] mkdir("./file0", 0777 [pid 3615] restart_syscall(<... resuming interrupted clone ...> [pid 3629] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3615] <... restart_syscall resumed>) = 0 [pid 3629] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3629] pipe2([3, 4], 0) = 0 [pid 3629] dup(4 [pid 3615] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 3629] <... dup resumed>) = 5 [pid 3615] <... openat resumed>) = 3 [pid 3629] mount(NULL, NULL, NULL, 0, NULL [pid 3615] ioctl(3, LOOP_CLR_FD [pid 3629] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3615] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3629] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3615] close(3) = 0 [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3630 ./strace-static-x86_64: Process 3630 attached [pid 3630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3630] setpgid(0, 0) = 0 [pid 3630] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3630] write(3, "1000", 4) = 4 [pid 3624] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3630] close(3 [pid 3624] exit_group(0 [pid 3630] <... close resumed>) = 0 [pid 3624] <... exit_group resumed>) = ? [pid 3630] mkdir("./file0", 0777 [pid 3624] +++ exited with 0 +++ [pid 3630] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3622] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3624, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3630] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3622] restart_syscall(<... resuming interrupted clone ...> [pid 3630] pipe2( [pid 3622] <... restart_syscall resumed>) = 0 [pid 3630] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3630] dup(4) = 5 [pid 3622] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 3630] mount(NULL, NULL, NULL, 0, NULL [pid 3622] <... openat resumed>) = 3 [pid 3630] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3622] ioctl(3, LOOP_CLR_FD [pid 3630] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3622] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3622] close(3) = 0 [pid 3622] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3631 [pid 3626] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3626] exit_group(0) = ? [pid 3626] +++ exited with 0 +++ [pid 3617] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3626, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3617] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 3617] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 3617] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 3617] close(3) = 0 [pid 3617] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3632 ./strace-static-x86_64: Process 3632 attached [pid 3632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3632] setpgid(0, 0) = 0 [pid 3632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3632] write(3, "1000", 4./strace-static-x86_64: Process 3631 attached ) = 4 [pid 3632] close(3 [pid 3631] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 3632] <... close resumed>) = 0 [pid 3632] mkdir("./file0", 0777 [pid 3631] <... prctl resumed>) = 0 [pid 3632] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3632] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3632] pipe2([3, 4], 0) = 0 [pid 3632] dup(4) = 5 [pid 3631] setpgid(0, 0 [pid 3632] mount(NULL, NULL, NULL, 0, NULL [pid 3631] <... setpgid resumed>) = 0 [pid 3632] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3631] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 3632] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3625] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3631] <... openat resumed>) = 3 [pid 3631] write(3, "1000", 4 [pid 3625] exit_group(0 [pid 3631] <... write resumed>) = 4 [pid 3625] <... exit_group resumed>) = ? [pid 3631] close(3) = 0 [pid 3631] mkdir("./file0", 0777 [pid 3625] +++ exited with 0 +++ [pid 3631] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 3631] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3620] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3625, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3631] pipe2( [pid 3620] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 3631] <... pipe2 resumed>[3, 4], 0) = 0 [pid 3620] <... openat resumed>) = 3 [pid 3631] dup(4 [pid 3620] ioctl(3, LOOP_CLR_FD [pid 3631] <... dup resumed>) = 5 [pid 3620] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 3631] mount(NULL, NULL, NULL, 0, NULL [pid 3620] close(3 [pid 3631] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3620] <... close resumed>) = 0 [pid 3620] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3633 [pid 3631] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004,"./strace-static-x86_64: Process 3633 attached [pid 3633] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3633] setpgid(0, 0) = 0 [pid 3633] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3628] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3633] write(3, "1000", 4 [pid 3628] exit_group(0 [pid 3633] <... write resumed>) = 4 [pid 3628] <... exit_group resumed>) = ? [pid 3633] close(3 [pid 3628] +++ exited with 0 +++ [pid 3633] <... close resumed>) = 0 [pid 3633] mkdir("./file0", 0777) = -1 EEXIST (File exists) [pid 3614] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3628, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3633] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3633] pipe2([3, 4], 0) = 0 [pid 3633] dup(4) = 5 [pid 3633] mount(NULL, NULL, NULL, 0, NULL) = -1 EFAULT (Bad address) [pid 3633] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3614] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 3614] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 3614] close(3) = 0 [pid 3614] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3634 ./strace-static-x86_64: Process 3634 attached [pid 3634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3634] setpgid(0, 0) = 0 [pid 3634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3634] write(3, "1000", 4) = 4 [pid 3634] close(3 [pid 3630] <... mount resumed>) = -1 EFAULT (Bad address) [pid 3630] exit_group(0) = ? [pid 3630] +++ exited with 0 +++ [pid 3615] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3630, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 3615] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 3615] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 3615] close(3) = 0 [pid 3615] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c92690) = 3635 [pid 3634] <... close resumed>) = 0 [pid 3634] mkdir("./file0", 0777) = -1 EEXIST (File exists) [pid 3634] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3634] pipe2([3, 4], 0) = 0 [pid 3634] dup(4) = 5 syzkaller login: [ 43.147580][ T3632] ================================================================== [ 43.155689][ T3632] BUG: KASAN: use-after-free in __kernfs_remove+0xf2d/0x1180 [ 43.163095][ T3632] Read of size 2 at addr ffff8881451f2b78 by task syz-executor260/3632 [ 43.171320][ T3632] [ 43.173632][ T3632] CPU: 1 PID: 3632 Comm: syz-executor260 Not tainted 6.0.0-rc5-syzkaller-00097-g38eddeedbbea #0 [ 43.184023][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 43.194067][ T3632] Call Trace: [ 43.197337][ T3632] [ 43.200258][ T3632] dump_stack_lvl+0x1e3/0x2cb [ 43.204938][ T3632] ? io_alloc_page_table+0x110/0x110 [ 43.210207][ T3632] ? _printk+0xcf/0x10f [ 43.214351][ T3632] ? __wake_up_klogd+0xd6/0x100 [ 43.219190][ T3632] ? __wake_up_klogd+0xcd/0x100 [ 43.224022][ T3632] ? panic+0x76b/0x76b [ 43.228079][ T3632] ? _printk+0xcf/0x10f [ 43.232224][ T3632] print_address_description+0x65/0x4b0 [ 43.237761][ T3632] print_report+0x108/0x220 [ 43.242252][ T3632] ? kernfs_put+0x340/0x490 [ 43.246744][ T3632] ? kmem_cache_free+0x95/0x1d0 [ 43.251589][ T3632] ? __kernfs_remove+0xf2d/0x1180 [ 43.256603][ T3632] kasan_report+0xfb/0x130 [ 43.261007][ T3632] ? __kernfs_remove+0xf2d/0x1180 [ 43.266020][ T3632] __kernfs_remove+0xf2d/0x1180 [ 43.270861][ T3632] ? kernfs_iop_rename+0x7d0/0x7d0 [ 43.275969][ T3632] ? kernfs_find_ns+0x4d6/0x550 [ 43.280810][ T3632] kernfs_remove_by_name_ns+0x96/0xe0 [ 43.286170][ T3632] sysfs_slab_add+0x54/0x270 [ 43.290750][ T3632] __kmem_cache_create+0x34/0x170 [ 43.295772][ T3632] kmem_cache_create_usercopy+0x1a6/0x340 [ 43.301486][ T3632] p9_client_create+0xbbe/0x1030 [ 43.306416][ T3632] ? do_trace_9p_fid_put+0x20/0x20 [ 43.311515][ T3632] ? lockdep_softirqs_off+0x420/0x420 [ 43.316880][ T3632] ? __raw_spin_lock_init+0x41/0x100 [ 43.322158][ T3632] v9fs_session_init+0x1e3/0x1990 [ 43.327179][ T3632] ? v9fs_show_options+0x600/0x600 [ 43.332283][ T3632] ? kmem_cache_alloc_trace+0x97/0x310 [ 43.337727][ T3632] ? v9fs_mount+0xae/0xcb0 [ 43.342133][ T3632] v9fs_mount+0xd2/0xcb0 [ 43.346372][ T3632] ? xfs_fs_commit_blocks+0x8d0/0x8d0 [ 43.351729][ T3632] ? legacy_init_fs_context+0x4d/0xb0 [ 43.357088][ T3632] ? smack_sb_eat_lsm_opts+0x3cd/0x990 [ 43.362534][ T3632] ? cap_capable+0x1b5/0x250 [ 43.367115][ T3632] legacy_get_tree+0xea/0x180 [ 43.371778][ T3632] ? xfs_fs_commit_blocks+0x8d0/0x8d0 [ 43.377139][ T3632] vfs_get_tree+0x88/0x270 [ 43.381556][ T3632] do_new_mount+0x289/0xad0 [ 43.386045][ T3632] ? do_move_mount_old+0x160/0x160 [ 43.391143][ T3632] ? user_path_at_empty+0x149/0x1a0 [ 43.396340][ T3632] __se_sys_mount+0x2e3/0x3d0 [ 43.401005][ T3632] ? __x64_sys_mount+0xc0/0xc0 [ 43.405753][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 43.411723][ T3632] ? __x64_sys_mount+0x1c/0xc0 [ 43.416473][ T3632] do_syscall_64+0x2b/0x70 [ 43.420885][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.426767][ T3632] RIP: 0033:0x7f1b840cef69 [ 43.431168][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.450848][ T3632] RSP: 002b:00007ffcb2d9e1e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 43.459276][ T3632] RAX: ffffffffffffffda RBX: 00007ffcb2d9e220 RCX: 00007f1b840cef69 [ 43.467248][ T3632] RDX: 0000000020000140 RSI: 0000000020000200 RDI: 0000000000000000 [ 43.475211][ T3632] RBP: 0000000000000000 R08: 0000000020000380 R09: 000000000000a68e [ 43.483177][ T3632] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000f4240 [ 43.491157][ T3632] R13: 000000000000a68e R14: 00007ffcb2d9e20c R15: 00007ffcb2d9e210 [ 43.499135][ T3632] [ 43.502148][ T3632] [ 43.504462][ T3632] Allocated by task 3630: [ 43.508791][ T3632] __kasan_slab_alloc+0xb2/0xe0 [ 43.513634][ T3632] kmem_cache_alloc+0x1a6/0x310 [ 43.518474][ T3632] __kernfs_new_node+0xdb/0x730 [ 43.523327][ T3632] kernfs_create_dir_ns+0x90/0x220 [ 43.528431][ T3632] sysfs_create_dir_ns+0x181/0x390 [ 43.533535][ T3632] kobject_add_internal+0x6dd/0xd10 [ 43.538720][ T3632] kobject_init_and_add+0x123/0x190 [ 43.543899][ T3632] sysfs_slab_add+0x140/0x270 [ 43.548561][ T3632] __kmem_cache_create+0x34/0x170 [ 43.553573][ T3632] kmem_cache_create_usercopy+0x1a6/0x340 [ 43.559281][ T3632] p9_client_create+0xbbe/0x1030 [ 43.564215][ T3632] v9fs_session_init+0x1e3/0x1990 [ 43.569224][ T3632] v9fs_mount+0xd2/0xcb0 [ 43.573452][ T3632] legacy_get_tree+0xea/0x180 [ 43.578117][ T3632] vfs_get_tree+0x88/0x270 [ 43.582528][ T3632] do_new_mount+0x289/0xad0 [ 43.587062][ T3632] __se_sys_mount+0x2e3/0x3d0 [ 43.591730][ T3632] do_syscall_64+0x2b/0x70 [ 43.596144][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.602031][ T3632] [ 43.604355][ T3632] Freed by task 3632: [ 43.608318][ T3632] kasan_set_track+0x4c/0x70 [ 43.612892][ T3632] kasan_set_free_info+0x1f/0x40 [ 43.617817][ T3632] ____kasan_slab_free+0xd8/0x120 [ 43.622827][ T3632] slab_free_freelist_hook+0x12e/0x1a0 [ 43.628270][ T3632] kmem_cache_free+0x95/0x1d0 [ 43.632929][ T3632] kernfs_put+0x340/0x490 [ 43.637246][ T3632] __kernfs_remove+0xec0/0x1180 [ 43.642096][ T3632] kernfs_remove_by_name_ns+0x96/0xe0 [ 43.647468][ T3632] sysfs_slab_add+0x54/0x270 [ 43.652042][ T3632] __kmem_cache_create+0x34/0x170 [ 43.657049][ T3632] kmem_cache_create_usercopy+0x1a6/0x340 [ 43.662773][ T3632] p9_client_create+0xbbe/0x1030 [ 43.667696][ T3632] v9fs_session_init+0x1e3/0x1990 [ 43.672705][ T3632] v9fs_mount+0xd2/0xcb0 [ 43.676932][ T3632] legacy_get_tree+0xea/0x180 [ 43.681593][ T3632] vfs_get_tree+0x88/0x270 [ 43.685991][ T3632] do_new_mount+0x289/0xad0 [ 43.690475][ T3632] __se_sys_mount+0x2e3/0x3d0 [ 43.695136][ T3632] do_syscall_64+0x2b/0x70 [ 43.699539][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.705428][ T3632] [ 43.707746][ T3632] The buggy address belongs to the object at ffff8881451f2ae0 [ 43.707746][ T3632] which belongs to the cache kernfs_node_cache of size 168 [ 43.722318][ T3632] The buggy address is located 152 bytes inside of [ 43.722318][ T3632] 168-byte region [ffff8881451f2ae0, ffff8881451f2b88) [ 43.735578][ T3632] [ 43.737886][ T3632] The buggy address belongs to the physical page: [ 43.744293][ T3632] page:ffffea0005147c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1451f2 [ 43.754512][ T3632] flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) [ 43.762145][ T3632] raw: 057ff00000000200 ffffea0005147d80 dead000000000005 ffff888140007c80 [ 43.770734][ T3632] raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000 [ 43.779329][ T3632] page dumped because: kasan: bad access detected [ 43.785756][ T3632] page_owner tracks the page as allocated [ 43.791461][ T3632] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 1984006442, free_ts 0 [ 43.808030][ T3632] get_page_from_freelist+0x72b/0x7a0 [ 43.813414][ T3632] __alloc_pages+0x259/0x560 [ 43.817989][ T3632] alloc_page_interleave+0x22/0x1c0 [ 43.823173][ T3632] alloc_slab_page+0x70/0xf0 [ 43.827749][ T3632] allocate_slab+0x5e/0x520 [ 43.832238][ T3632] ___slab_alloc+0x42e/0xce0 [ 43.836813][ T3632] kmem_cache_alloc+0x25d/0x310 [ 43.841660][ T3632] __kernfs_new_node+0xdb/0x730 [ 43.846515][ T3632] kernfs_new_node+0x95/0x160 [ 43.851173][ T3632] __kernfs_create_file+0x45/0x2e0 [ 43.856271][ T3632] sysfs_add_file_mode_ns+0x21d/0x330 [ 43.861644][ T3632] internal_create_group+0x55c/0xf50 [ 43.866914][ T3632] kernel_add_sysfs_param+0xe8/0x126 [ 43.872186][ T3632] param_sysfs_builtin+0x16a/0x1e2 [ 43.877287][ T3632] param_sysfs_init+0x68/0x6c [ 43.881948][ T3632] do_one_initcall+0xbd/0x2b0 [ 43.886610][ T3632] page_owner free stack trace missing [ 43.891959][ T3632] [ 43.894282][ T3632] Memory state around the buggy address: [ 43.899918][ T3632] ffff8881451f2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.907970][ T3632] ffff8881451f2a80: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb [ 43.916025][ T3632] >ffff8881451f2b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.924072][ T3632] ^ [ 43.932029][ T3632] ffff8881451f2b80: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb [ 43.940071][ T3632] ffff8881451f2c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [pid 3634] mount(NULL, NULL, NULL, 0, NULL./strace-static-x86_64: Process 3635 attached [pid 3635] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3635] setpgid(0, 0) = 0 [pid 3635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 3635] write(3, "1000", 4) = 4 [pid 3635] close(3) = 0 [pid 3635] mkdir("./file0", 0777) = -1 EEXIST (File exists) [pid 3635] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 3635] pipe2([3, 4], 0) = 0 [pid 3635] dup(4) = 5 [pid 3635] mount(NULL, NULL, NULL, 0, NULL) = -1 EFAULT (Bad address) [pid 3635] mount(NULL, "./file0", "9p", 0, "trans=fd,rfdno=0x0000000000000003,wfdno=0x0000000000000004," [pid 3634] <... mount resumed>) = -1 EFAULT (Bad address) [ 43.948111][ T3632] ================================================================== [ 43.958565][ T3632] Kernel panic - not syncing: panic_on_warn set ... [ 43.965182][ T3632] CPU: 0 PID: 3632 Comm: syz-executor260 Not tainted 6.0.0-rc5-syzkaller-00097-g38eddeedbbea #0 [ 43.975598][ T3632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 43.985673][ T3632] Call Trace: [ 43.988964][ T3632] [ 43.991899][ T3632] dump_stack_lvl+0x1e3/0x2cb [ 43.996590][ T3632] ? io_alloc_page_table+0x110/0x110 [ 44.001880][ T3632] ? panic+0x76b/0x76b [ 44.005952][ T3632] ? preempt_schedule_common+0xb7/0xe0 [ 44.011417][ T3632] ? preempt_schedule+0xd9/0xe0 [ 44.016279][ T3632] ? vscnprintf+0x59/0x80 [ 44.020611][ T3632] panic+0x316/0x76b [ 44.024512][ T3632] ? fb_is_primary_device+0xcc/0xcc [ 44.029713][ T3632] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 44.035704][ T3632] ? __kernfs_remove+0xf2d/0x1180 [ 44.040734][ T3632] end_report+0x91/0xa0 [ 44.044920][ T3632] kasan_report+0x108/0x130 [ 44.049426][ T3632] ? __kernfs_remove+0xf2d/0x1180 [ 44.054455][ T3632] __kernfs_remove+0xf2d/0x1180 [ 44.059312][ T3632] ? kernfs_iop_rename+0x7d0/0x7d0 [ 44.064440][ T3632] ? kernfs_find_ns+0x4d6/0x550 [ 44.069298][ T3632] kernfs_remove_by_name_ns+0x96/0xe0 [ 44.074679][ T3632] sysfs_slab_add+0x54/0x270 [ 44.079276][ T3632] __kmem_cache_create+0x34/0x170 [ 44.084306][ T3632] kmem_cache_create_usercopy+0x1a6/0x340 [ 44.090034][ T3632] p9_client_create+0xbbe/0x1030 [ 44.094984][ T3632] ? do_trace_9p_fid_put+0x20/0x20 [ 44.100101][ T3632] ? lockdep_softirqs_off+0x420/0x420 [ 44.105509][ T3632] ? __raw_spin_lock_init+0x41/0x100 [ 44.110807][ T3632] v9fs_session_init+0x1e3/0x1990 [ 44.115848][ T3632] ? v9fs_show_options+0x600/0x600 [ 44.120970][ T3632] ? kmem_cache_alloc_trace+0x97/0x310 [ 44.126432][ T3632] ? v9fs_mount+0xae/0xcb0 [ 44.130856][ T3632] v9fs_mount+0xd2/0xcb0 [ 44.135105][ T3632] ? xfs_fs_commit_blocks+0x8d0/0x8d0 [ 44.140481][ T3632] ? legacy_init_fs_context+0x4d/0xb0 [ 44.145860][ T3632] ? smack_sb_eat_lsm_opts+0x3cd/0x990 [ 44.151329][ T3632] ? cap_capable+0x1b5/0x250 [ 44.155923][ T3632] legacy_get_tree+0xea/0x180 [ 44.160604][ T3632] ? xfs_fs_commit_blocks+0x8d0/0x8d0 [ 44.165983][ T3632] vfs_get_tree+0x88/0x270 [ 44.170407][ T3632] do_new_mount+0x289/0xad0 [ 44.174919][ T3632] ? do_move_mount_old+0x160/0x160 [ 44.180034][ T3632] ? user_path_at_empty+0x149/0x1a0 [ 44.185236][ T3632] __se_sys_mount+0x2e3/0x3d0 [ 44.189917][ T3632] ? __x64_sys_mount+0xc0/0xc0 [ 44.194681][ T3632] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 44.200663][ T3632] ? __x64_sys_mount+0x1c/0xc0 [ 44.205429][ T3632] do_syscall_64+0x2b/0x70 [ 44.209852][ T3632] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 44.215755][ T3632] RIP: 0033:0x7f1b840cef69 [ 44.220173][ T3632] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 44.239790][ T3632] RSP: 002b:00007ffcb2d9e1e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 44.248214][ T3632] RAX: ffffffffffffffda RBX: 00007ffcb2d9e220 RCX: 00007f1b840cef69 [ 44.256194][ T3632] RDX: 0000000020000140 RSI: 0000000020000200 RDI: 0000000000000000 [ 44.264171][ T3632] RBP: 0000000000000000 R08: 0000000020000380 R09: 000000000000a68e [ 44.272148][ T3632] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000f4240 [ 44.280116][ T3632] R13: 000000000000a68e R14: 00007ffcb2d9e20c R15: 00007ffcb2d9e210 [ 44.288102][ T3632] [ 44.291298][ T3632] Kernel Offset: disabled [ 44.295620][ T3632] Rebooting in 86400 seconds..