./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor352620433
<...>
Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts.
execve("./syz-executor352620433", ["./syz-executor352620433"], 0x7ffce642cc00 /* 10 vars */) = 0
brk(NULL) = 0x5555556b9000
brk(0x5555556b9d00) = 0x5555556b9d00
arch_prctl(ARCH_SET_FS, 0x5555556b9380) = 0
set_tid_address(0x5555556b9650) = 5014
set_robust_list(0x5555556b9660, 24) = 0
rseq(0x5555556b9ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor352620433", 4096) = 27
getrandom("\x10\xf1\x36\x61\x6b\xad\x7c\x6c", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555556b9d00
brk(0x5555556dad00) = 0x5555556dad00
brk(0x5555556db000) = 0x5555556db000
mprotect(0x7f3dddb69000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/profiling", O_WRONLY) = 3
[ 68.092506][ T5014] kernel profiling enabled (shift: 0)
[ 68.317601][ C1] ==================================================================
[ 68.325714][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa8/0xe0
[ 68.332849][ C1] Read of size 8 at addr ffffc90003b9f400 by task syz-executor352/5014
[ 68.341074][ C1]
[ 68.343391][ C1] CPU: 1 PID: 5014 Comm: syz-executor352 Not tainted 6.5.0-rc6-syzkaller #0
[ 68.352055][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 68.362104][ C1] Call Trace:
[ 68.365400][ C1]
[ 68.368244][ C1] dump_stack_lvl+0x1e7/0x2d0
[ 68.372928][ C1] ? nf_tcp_handle_invalid+0x650/0x650
[ 68.378386][ C1] ? panic+0x770/0x770
[ 68.382454][ C1] ? _printk+0xd5/0x120
[ 68.386610][ C1] print_report+0x163/0x540
[ 68.391114][ C1] ? rcu_read_lock_sched_held+0x8d/0x130
[ 68.396754][ C1] ? __virt_addr_valid+0xbd/0x2e0
[ 68.401815][ C1] ? profile_pc+0xa8/0xe0
[ 68.406139][ C1] kasan_report+0x175/0x1b0
[ 68.410667][ C1] ? profile_pc+0xa8/0xe0
[ 68.415096][ C1] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 68.421001][ C1] profile_pc+0xa8/0xe0
[ 68.425181][ C1] profile_tick+0xd8/0x130
[ 68.429611][ C1] tick_sched_timer+0x383/0x550
[ 68.434470][ C1] ? tick_setup_sched_timer+0x2f0/0x2f0
[ 68.440038][ C1] __hrtimer_run_queues+0x562/0xd10
[ 68.445252][ C1] ? hrtimer_interrupt+0x980/0x980
[ 68.450369][ C1] ? ktime_get_update_offsets_now+0x40b/0x420
[ 68.456449][ C1] hrtimer_interrupt+0x396/0x980
[ 68.461405][ C1] __sysvec_apic_timer_interrupt+0x13f/0x480
[ 68.467400][ C1] sysvec_apic_timer_interrupt+0x90/0xb0
[ 68.473043][ C1]
[ 68.475996][ C1]
[ 68.478929][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 68.484915][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140
[ 68.491428][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ee c5 1d f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 b3 19 98 f6 65 8b 05 d4 f0 3c 75 85 c0 74 3f 48 c7 04 24 0e 36
[ 68.511039][ C1] RSP: 0018:ffffc90003b9f400 EFLAGS: 00000206
[ 68.517112][ C1] RAX: 357465eb72c61400 RBX: 1ffff92000773e84 RCX: ffffffff816bdd8a
[ 68.525084][ C1] RDX: dffffc0000000000 RSI: ffffffff8b0a97c0 RDI: 0000000000000001
[ 68.533056][ C1] RBP: ffffc90003b9f490 R08: ffffffff907b4307 R09: 1ffffffff20f6860
[ 68.541032][ C1] R10: dffffc0000000000 R11: fffffbfff20f6861 R12: dffffc0000000000
[ 68.549029][ C1] R13: 1ffff92000773e80 R14: ffffc90003b9f420 R15: 0000000000000246
[ 68.557010][ C1] ? mark_lock+0x9a/0x340
[ 68.561355][ C1] ? _raw_spin_unlock+0x40/0x40
[ 68.566215][ C1] ? __mod_zone_page_state+0xda/0x140
[ 68.571592][ C1] __rmqueue_pcplist+0x1e3e/0x2150
[ 68.576728][ C1] ? zone_watermark_fast+0x240/0x240
[ 68.582022][ C1] get_page_from_freelist+0x780/0x3370
[ 68.587497][ C1] ? __alloc_pages+0x165/0x670
[ 68.592272][ C1] ? __might_sleep+0xc0/0xc0
[ 68.596879][ C1] ? __alloc_pages+0x670/0x670
[ 68.601649][ C1] ? prepare_alloc_pages+0x1d9/0x5b0
[ 68.606944][ C1] __alloc_pages+0x255/0x670
[ 68.611546][ C1] ? zone_statistics+0x170/0x170
[ 68.616513][ C1] ? _raw_spin_unlock+0x28/0x40
[ 68.621380][ C1] ? alloc_pages+0x510/0x780
[ 68.625975][ C1] __vmalloc_node_range+0x9a3/0x1490
[ 68.631285][ C1] ? free_vm_area+0x50/0x50
[ 68.635804][ C1] ? profile_init+0xee/0x130
[ 68.640409][ C1] ? sysfs_kf_read+0x310/0x310
[ 68.645181][ C1] vzalloc+0x79/0x90
[ 68.649089][ C1] ? profile_init+0xee/0x130
[ 68.653712][ C1] profile_init+0xee/0x130
[ 68.658139][ C1] profiling_store+0x5e/0xc0
[ 68.662741][ C1] kernfs_fop_write_iter+0x3a6/0x4f0
[ 68.668046][ C1] vfs_write+0x782/0xaf0
[ 68.672302][ C1] ? file_end_write+0x250/0x250
[ 68.677168][ C1] ? lockdep_hardirqs_on+0x98/0x140
[ 68.682379][ C1] ? __fdget_pos+0x2c7/0x340
[ 68.686981][ C1] ksys_write+0x1a0/0x2c0
[ 68.691344][ C1] ? __ia32_sys_read+0x90/0x90
[ 68.696136][ C1] ? syscall_enter_from_user_mode+0x32/0x230
[ 68.702127][ C1] ? syscall_enter_from_user_mode+0x8c/0x230
[ 68.708119][ C1] do_syscall_64+0x41/0xc0
[ 68.712543][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 68.718538][ C1] RIP: 0033:0x7f3dddaf6529
[ 68.722957][ C1] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 68.742569][ C1] RSP: 002b:00007ffca604d208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 68.751080][ C1] RAX: ffffffffffffffda RBX: 00007ffca604d3d8 RCX: 00007f3dddaf6529
[ 68.759059][ C1] RDX: 0000000000000012 RSI: 0000000020000380 RDI: 0000000000000003
[ 68.767033][ C1] RBP: 00007f3dddb69610 R08: 00007ffca604cfa7 R09: 00007ffca604d3d8
[ 68.775095][ C1] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001
[ 68.783069][ C1] R13: 00007ffca604d3c8 R14: 0000000000000001 R15: 0000000000000001
[ 68.791052][ C1]
[ 68.794089][ C1]
[ 68.796411][ C1] The buggy address belongs to stack of task syz-executor352/5014
[ 68.804209][ C1] and is located at offset 0 in frame:
[ 68.809766][ C1] _raw_spin_unlock_irqrestore+0x0/0x140
[ 68.815414][ C1]
[ 68.817736][ C1] This frame has 1 object:
[ 68.822158][ C1] [32, 40) 'flags.i.i.i.i'
[ 68.822170][ C1]
[ 68.828985][ C1] The buggy address belongs to the virtual mapping at
[ 68.828985][ C1] [ffffc90003b98000, ffffc90003ba1000) created by:
[ 68.828985][ C1] copy_process+0x5c8/0x4290
[ 68.846613][ C1]
[ 68.848937][ C1] The buggy address belongs to the physical page:
[ 68.855346][ C1] page:ffffea0000a53e80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x294fa
[ 68.865500][ C1] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 68.872722][ C1] page_type: 0xffffffff()
[ 68.877077][ C1] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
[ 68.885664][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 68.894243][ C1] page dumped because: kasan: bad access detected
[ 68.900656][ C1] page_owner tracks the page as allocated
[ 68.906363][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5011, tgid 5011 (strace-static-x), ts 68060559280, free_ts 42709275393
[ 68.925811][ C1] post_alloc_hook+0x1e6/0x210
[ 68.930579][ C1] get_page_from_freelist+0x31e8/0x3370
[ 68.936131][ C1] __alloc_pages+0x255/0x670
[ 68.940730][ C1] __vmalloc_node_range+0x9a3/0x1490
[ 68.946025][ C1] dup_task_struct+0x3e5/0x7d0
[ 68.950880][ C1] copy_process+0x5c8/0x4290
[ 68.955471][ C1] kernel_clone+0x222/0x800
[ 68.960089][ C1] __x64_sys_clone+0x258/0x2a0
[ 68.964854][ C1] do_syscall_64+0x41/0xc0
[ 68.969271][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 68.975175][ C1] page last free stack trace:
[ 68.979841][ C1] free_unref_page_prepare+0x903/0xa30
[ 68.985302][ C1] free_unref_page+0x37/0x3f0
[ 68.989983][ C1] __slab_free+0x2f6/0x390
[ 68.994414][ C1] qlist_free_all+0x22/0x60
[ 68.998925][ C1] kasan_quarantine_reduce+0x14b/0x160
[ 69.004390][ C1] __kasan_slab_alloc+0x23/0x70
[ 69.009263][ C1] slab_post_alloc_hook+0x6c/0x3b0
[ 69.014386][ C1] kmem_cache_alloc_node+0x149/0x330
[ 69.019680][ C1] __alloc_skb+0x181/0x420
[ 69.024120][ C1] alloc_skb_with_frags+0xa8/0x750
[ 69.029238][ C1] sock_alloc_send_pskb+0x919/0xa50
[ 69.034444][ C1] unix_dgram_sendmsg+0x659/0x2070
[ 69.039577][ C1] sock_write_iter+0x39a/0x520
[ 69.044357][ C1] do_iter_write+0x84f/0xde0
[ 69.048983][ C1] do_writev+0x27f/0x470
[ 69.053230][ C1] do_syscall_64+0x41/0xc0
[ 69.057661][ C1]
[ 69.059982][ C1] Memory state around the buggy address:
[ 69.065608][ C1] ffffc90003b9f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 69.073689][ C1] ffffc90003b9f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 69.081755][ C1] >ffffc90003b9f400: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00
[ 69.089811][ C1] ^
[ 69.093879][ C1] ffffc90003b9f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 69.101966][ C1] ffffc90003b9f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 69.110033][ C1] ==================================================================
[ 69.118094][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 69.125281][ C1] CPU: 1 PID: 5014 Comm: syz-executor352 Not tainted 6.5.0-rc6-syzkaller #0
[ 69.133962][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 69.144018][ C1] Call Trace:
[ 69.147387][ C1]
[ 69.150241][ C1] dump_stack_lvl+0x1e7/0x2d0
[ 69.155015][ C1] ? nf_tcp_handle_invalid+0x650/0x650
[ 69.160482][ C1] ? panic+0x770/0x770
[ 69.164692][ C1] ? rcu_is_watching+0x15/0xb0
[ 69.169487][ C1] ? lock_release+0xbf/0x9d0
[ 69.174189][ C1] ? vscnprintf+0x5d/0x80
[ 69.178565][ C1] panic+0x30f/0x770
[ 69.182487][ C1] ? vprintk_emit+0x10d/0x1f0
[ 69.187197][ C1] ? check_panic_on_warn+0x21/0xa0
[ 69.192328][ C1] ? __memcpy_flushcache+0x2b0/0x2b0
[ 69.197719][ C1] ? do_raw_spin_unlock+0x13b/0x8b0
[ 69.202937][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 69.208841][ C1] ? _raw_spin_unlock+0x40/0x40
[ 69.213726][ C1] check_panic_on_warn+0x82/0xa0
[ 69.218692][ C1] ? profile_pc+0xa8/0xe0
[ 69.223034][ C1] end_report+0x6e/0x130
[ 69.227290][ C1] kasan_report+0x186/0x1b0
[ 69.231799][ C1] ? profile_pc+0xa8/0xe0
[ 69.236142][ C1] ? _raw_spin_unlock_irqrestore+0xd8/0x140
[ 69.242045][ C1] profile_pc+0xa8/0xe0
[ 69.246298][ C1] profile_tick+0xd8/0x130
[ 69.250726][ C1] tick_sched_timer+0x383/0x550
[ 69.255591][ C1] ? tick_setup_sched_timer+0x2f0/0x2f0
[ 69.261143][ C1] __hrtimer_run_queues+0x562/0xd10
[ 69.266386][ C1] ? hrtimer_interrupt+0x980/0x980
[ 69.271508][ C1] ? ktime_get_update_offsets_now+0x40b/0x420
[ 69.277595][ C1] hrtimer_interrupt+0x396/0x980
[ 69.282555][ C1] __sysvec_apic_timer_interrupt+0x13f/0x480
[ 69.288544][ C1] sysvec_apic_timer_interrupt+0x90/0xb0
[ 69.294308][ C1]
[ 69.297250][ C1]
[ 69.300191][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 69.306190][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140
[ 69.312711][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ee c5 1d f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 b3 19 98 f6 65 8b 05 d4 f0 3c 75 85 c0 74 3f 48 c7 04 24 0e 36
[ 69.334578][ C1] RSP: 0018:ffffc90003b9f400 EFLAGS: 00000206
[ 69.340672][ C1] RAX: 357465eb72c61400 RBX: 1ffff92000773e84 RCX: ffffffff816bdd8a
[ 69.348647][ C1] RDX: dffffc0000000000 RSI: ffffffff8b0a97c0 RDI: 0000000000000001
[ 69.356625][ C1] RBP: ffffc90003b9f490 R08: ffffffff907b4307 R09: 1ffffffff20f6860
[ 69.364616][ C1] R10: dffffc0000000000 R11: fffffbfff20f6861 R12: dffffc0000000000
[ 69.372594][ C1] R13: 1ffff92000773e80 R14: ffffc90003b9f420 R15: 0000000000000246
[ 69.380594][ C1] ? mark_lock+0x9a/0x340
[ 69.384964][ C1] ? _raw_spin_unlock+0x40/0x40
[ 69.389830][ C1] ? __mod_zone_page_state+0xda/0x140
[ 69.395644][ C1] __rmqueue_pcplist+0x1e3e/0x2150
[ 69.400788][ C1] ? zone_watermark_fast+0x240/0x240
[ 69.406171][ C1] get_page_from_freelist+0x780/0x3370
[ 69.411736][ C1] ? __alloc_pages+0x165/0x670
[ 69.416510][ C1] ? __might_sleep+0xc0/0xc0
[ 69.421139][ C1] ? __alloc_pages+0x670/0x670
[ 69.425909][ C1] ? prepare_alloc_pages+0x1d9/0x5b0
[ 69.431204][ C1] __alloc_pages+0x255/0x670
[ 69.435803][ C1] ? zone_statistics+0x170/0x170
[ 69.440753][ C1] ? _raw_spin_unlock+0x28/0x40
[ 69.445614][ C1] ? alloc_pages+0x510/0x780
[ 69.450236][ C1] __vmalloc_node_range+0x9a3/0x1490
[ 69.455548][ C1] ? free_vm_area+0x50/0x50
[ 69.460089][ C1] ? profile_init+0xee/0x130
[ 69.464690][ C1] ? sysfs_kf_read+0x310/0x310
[ 69.469486][ C1] vzalloc+0x79/0x90
[ 69.473401][ C1] ? profile_init+0xee/0x130
[ 69.478011][ C1] profile_init+0xee/0x130
[ 69.482440][ C1] profiling_store+0x5e/0xc0
[ 69.487044][ C1] kernfs_fop_write_iter+0x3a6/0x4f0
[ 69.492339][ C1] vfs_write+0x782/0xaf0
[ 69.496605][ C1] ? file_end_write+0x250/0x250
[ 69.501476][ C1] ? lockdep_hardirqs_on+0x98/0x140
[ 69.506784][ C1] ? __fdget_pos+0x2c7/0x340
[ 69.511478][ C1] ksys_write+0x1a0/0x2c0
[ 69.515826][ C1] ? __ia32_sys_read+0x90/0x90
[ 69.520696][ C1] ? syscall_enter_from_user_mode+0x32/0x230
[ 69.526688][ C1] ? syscall_enter_from_user_mode+0x8c/0x230
[ 69.532769][ C1] do_syscall_64+0x41/0xc0
[ 69.537190][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 69.543095][ C1] RIP: 0033:0x7f3dddaf6529
[ 69.547514][ C1] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 69.567143][ C1] RSP: 002b:00007ffca604d208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 69.575563][ C1] RAX: ffffffffffffffda RBX: 00007ffca604d3d8 RCX: 00007f3dddaf6529
[ 69.583549][ C1] RDX: 0000000000000012 RSI: 0000000020000380 RDI: 0000000000000003
[ 69.591537][ C1] RBP: 00007f3dddb69610 R08: 00007ffca604cfa7 R09: 00007ffca604d3d8
[ 69.599509][ C1] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001
[ 69.607580][ C1] R13: 00007ffca604d3c8 R14: 0000000000000001 R15: 0000000000000001
[ 69.615655][ C1]
[ 69.618983][ C1] Kernel Offset: disabled
[ 69.623309][ C1] Rebooting in 86400 seconds..