./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor352620433 <...> Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. execve("./syz-executor352620433", ["./syz-executor352620433"], 0x7ffce642cc00 /* 10 vars */) = 0 brk(NULL) = 0x5555556b9000 brk(0x5555556b9d00) = 0x5555556b9d00 arch_prctl(ARCH_SET_FS, 0x5555556b9380) = 0 set_tid_address(0x5555556b9650) = 5014 set_robust_list(0x5555556b9660, 24) = 0 rseq(0x5555556b9ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor352620433", 4096) = 27 getrandom("\x10\xf1\x36\x61\x6b\xad\x7c\x6c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555556b9d00 brk(0x5555556dad00) = 0x5555556dad00 brk(0x5555556db000) = 0x5555556db000 mprotect(0x7f3dddb69000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/sys/kernel/profiling", O_WRONLY) = 3 [ 68.092506][ T5014] kernel profiling enabled (shift: 0) [ 68.317601][ C1] ================================================================== [ 68.325714][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa8/0xe0 [ 68.332849][ C1] Read of size 8 at addr ffffc90003b9f400 by task syz-executor352/5014 [ 68.341074][ C1] [ 68.343391][ C1] CPU: 1 PID: 5014 Comm: syz-executor352 Not tainted 6.5.0-rc6-syzkaller #0 [ 68.352055][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 68.362104][ C1] Call Trace: [ 68.365400][ C1] [ 68.368244][ C1] dump_stack_lvl+0x1e7/0x2d0 [ 68.372928][ C1] ? nf_tcp_handle_invalid+0x650/0x650 [ 68.378386][ C1] ? panic+0x770/0x770 [ 68.382454][ C1] ? _printk+0xd5/0x120 [ 68.386610][ C1] print_report+0x163/0x540 [ 68.391114][ C1] ? rcu_read_lock_sched_held+0x8d/0x130 [ 68.396754][ C1] ? __virt_addr_valid+0xbd/0x2e0 [ 68.401815][ C1] ? profile_pc+0xa8/0xe0 [ 68.406139][ C1] kasan_report+0x175/0x1b0 [ 68.410667][ C1] ? profile_pc+0xa8/0xe0 [ 68.415096][ C1] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 68.421001][ C1] profile_pc+0xa8/0xe0 [ 68.425181][ C1] profile_tick+0xd8/0x130 [ 68.429611][ C1] tick_sched_timer+0x383/0x550 [ 68.434470][ C1] ? tick_setup_sched_timer+0x2f0/0x2f0 [ 68.440038][ C1] __hrtimer_run_queues+0x562/0xd10 [ 68.445252][ C1] ? hrtimer_interrupt+0x980/0x980 [ 68.450369][ C1] ? ktime_get_update_offsets_now+0x40b/0x420 [ 68.456449][ C1] hrtimer_interrupt+0x396/0x980 [ 68.461405][ C1] __sysvec_apic_timer_interrupt+0x13f/0x480 [ 68.467400][ C1] sysvec_apic_timer_interrupt+0x90/0xb0 [ 68.473043][ C1] [ 68.475996][ C1] [ 68.478929][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 68.484915][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 [ 68.491428][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ee c5 1d f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 b3 19 98 f6 65 8b 05 d4 f0 3c 75 85 c0 74 3f 48 c7 04 24 0e 36 [ 68.511039][ C1] RSP: 0018:ffffc90003b9f400 EFLAGS: 00000206 [ 68.517112][ C1] RAX: 357465eb72c61400 RBX: 1ffff92000773e84 RCX: ffffffff816bdd8a [ 68.525084][ C1] RDX: dffffc0000000000 RSI: ffffffff8b0a97c0 RDI: 0000000000000001 [ 68.533056][ C1] RBP: ffffc90003b9f490 R08: ffffffff907b4307 R09: 1ffffffff20f6860 [ 68.541032][ C1] R10: dffffc0000000000 R11: fffffbfff20f6861 R12: dffffc0000000000 [ 68.549029][ C1] R13: 1ffff92000773e80 R14: ffffc90003b9f420 R15: 0000000000000246 [ 68.557010][ C1] ? mark_lock+0x9a/0x340 [ 68.561355][ C1] ? _raw_spin_unlock+0x40/0x40 [ 68.566215][ C1] ? __mod_zone_page_state+0xda/0x140 [ 68.571592][ C1] __rmqueue_pcplist+0x1e3e/0x2150 [ 68.576728][ C1] ? zone_watermark_fast+0x240/0x240 [ 68.582022][ C1] get_page_from_freelist+0x780/0x3370 [ 68.587497][ C1] ? __alloc_pages+0x165/0x670 [ 68.592272][ C1] ? __might_sleep+0xc0/0xc0 [ 68.596879][ C1] ? __alloc_pages+0x670/0x670 [ 68.601649][ C1] ? prepare_alloc_pages+0x1d9/0x5b0 [ 68.606944][ C1] __alloc_pages+0x255/0x670 [ 68.611546][ C1] ? zone_statistics+0x170/0x170 [ 68.616513][ C1] ? _raw_spin_unlock+0x28/0x40 [ 68.621380][ C1] ? alloc_pages+0x510/0x780 [ 68.625975][ C1] __vmalloc_node_range+0x9a3/0x1490 [ 68.631285][ C1] ? free_vm_area+0x50/0x50 [ 68.635804][ C1] ? profile_init+0xee/0x130 [ 68.640409][ C1] ? sysfs_kf_read+0x310/0x310 [ 68.645181][ C1] vzalloc+0x79/0x90 [ 68.649089][ C1] ? profile_init+0xee/0x130 [ 68.653712][ C1] profile_init+0xee/0x130 [ 68.658139][ C1] profiling_store+0x5e/0xc0 [ 68.662741][ C1] kernfs_fop_write_iter+0x3a6/0x4f0 [ 68.668046][ C1] vfs_write+0x782/0xaf0 [ 68.672302][ C1] ? file_end_write+0x250/0x250 [ 68.677168][ C1] ? lockdep_hardirqs_on+0x98/0x140 [ 68.682379][ C1] ? __fdget_pos+0x2c7/0x340 [ 68.686981][ C1] ksys_write+0x1a0/0x2c0 [ 68.691344][ C1] ? __ia32_sys_read+0x90/0x90 [ 68.696136][ C1] ? syscall_enter_from_user_mode+0x32/0x230 [ 68.702127][ C1] ? syscall_enter_from_user_mode+0x8c/0x230 [ 68.708119][ C1] do_syscall_64+0x41/0xc0 [ 68.712543][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 68.718538][ C1] RIP: 0033:0x7f3dddaf6529 [ 68.722957][ C1] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 68.742569][ C1] RSP: 002b:00007ffca604d208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 68.751080][ C1] RAX: ffffffffffffffda RBX: 00007ffca604d3d8 RCX: 00007f3dddaf6529 [ 68.759059][ C1] RDX: 0000000000000012 RSI: 0000000020000380 RDI: 0000000000000003 [ 68.767033][ C1] RBP: 00007f3dddb69610 R08: 00007ffca604cfa7 R09: 00007ffca604d3d8 [ 68.775095][ C1] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 68.783069][ C1] R13: 00007ffca604d3c8 R14: 0000000000000001 R15: 0000000000000001 [ 68.791052][ C1] [ 68.794089][ C1] [ 68.796411][ C1] The buggy address belongs to stack of task syz-executor352/5014 [ 68.804209][ C1] and is located at offset 0 in frame: [ 68.809766][ C1] _raw_spin_unlock_irqrestore+0x0/0x140 [ 68.815414][ C1] [ 68.817736][ C1] This frame has 1 object: [ 68.822158][ C1] [32, 40) 'flags.i.i.i.i' [ 68.822170][ C1] [ 68.828985][ C1] The buggy address belongs to the virtual mapping at [ 68.828985][ C1] [ffffc90003b98000, ffffc90003ba1000) created by: [ 68.828985][ C1] copy_process+0x5c8/0x4290 [ 68.846613][ C1] [ 68.848937][ C1] The buggy address belongs to the physical page: [ 68.855346][ C1] page:ffffea0000a53e80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x294fa [ 68.865500][ C1] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 68.872722][ C1] page_type: 0xffffffff() [ 68.877077][ C1] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 68.885664][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 68.894243][ C1] page dumped because: kasan: bad access detected [ 68.900656][ C1] page_owner tracks the page as allocated [ 68.906363][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5011, tgid 5011 (strace-static-x), ts 68060559280, free_ts 42709275393 [ 68.925811][ C1] post_alloc_hook+0x1e6/0x210 [ 68.930579][ C1] get_page_from_freelist+0x31e8/0x3370 [ 68.936131][ C1] __alloc_pages+0x255/0x670 [ 68.940730][ C1] __vmalloc_node_range+0x9a3/0x1490 [ 68.946025][ C1] dup_task_struct+0x3e5/0x7d0 [ 68.950880][ C1] copy_process+0x5c8/0x4290 [ 68.955471][ C1] kernel_clone+0x222/0x800 [ 68.960089][ C1] __x64_sys_clone+0x258/0x2a0 [ 68.964854][ C1] do_syscall_64+0x41/0xc0 [ 68.969271][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 68.975175][ C1] page last free stack trace: [ 68.979841][ C1] free_unref_page_prepare+0x903/0xa30 [ 68.985302][ C1] free_unref_page+0x37/0x3f0 [ 68.989983][ C1] __slab_free+0x2f6/0x390 [ 68.994414][ C1] qlist_free_all+0x22/0x60 [ 68.998925][ C1] kasan_quarantine_reduce+0x14b/0x160 [ 69.004390][ C1] __kasan_slab_alloc+0x23/0x70 [ 69.009263][ C1] slab_post_alloc_hook+0x6c/0x3b0 [ 69.014386][ C1] kmem_cache_alloc_node+0x149/0x330 [ 69.019680][ C1] __alloc_skb+0x181/0x420 [ 69.024120][ C1] alloc_skb_with_frags+0xa8/0x750 [ 69.029238][ C1] sock_alloc_send_pskb+0x919/0xa50 [ 69.034444][ C1] unix_dgram_sendmsg+0x659/0x2070 [ 69.039577][ C1] sock_write_iter+0x39a/0x520 [ 69.044357][ C1] do_iter_write+0x84f/0xde0 [ 69.048983][ C1] do_writev+0x27f/0x470 [ 69.053230][ C1] do_syscall_64+0x41/0xc0 [ 69.057661][ C1] [ 69.059982][ C1] Memory state around the buggy address: [ 69.065608][ C1] ffffc90003b9f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 69.073689][ C1] ffffc90003b9f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 69.081755][ C1] >ffffc90003b9f400: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 [ 69.089811][ C1] ^ [ 69.093879][ C1] ffffc90003b9f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 69.101966][ C1] ffffc90003b9f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 69.110033][ C1] ================================================================== [ 69.118094][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 69.125281][ C1] CPU: 1 PID: 5014 Comm: syz-executor352 Not tainted 6.5.0-rc6-syzkaller #0 [ 69.133962][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 69.144018][ C1] Call Trace: [ 69.147387][ C1] [ 69.150241][ C1] dump_stack_lvl+0x1e7/0x2d0 [ 69.155015][ C1] ? nf_tcp_handle_invalid+0x650/0x650 [ 69.160482][ C1] ? panic+0x770/0x770 [ 69.164692][ C1] ? rcu_is_watching+0x15/0xb0 [ 69.169487][ C1] ? lock_release+0xbf/0x9d0 [ 69.174189][ C1] ? vscnprintf+0x5d/0x80 [ 69.178565][ C1] panic+0x30f/0x770 [ 69.182487][ C1] ? vprintk_emit+0x10d/0x1f0 [ 69.187197][ C1] ? check_panic_on_warn+0x21/0xa0 [ 69.192328][ C1] ? __memcpy_flushcache+0x2b0/0x2b0 [ 69.197719][ C1] ? do_raw_spin_unlock+0x13b/0x8b0 [ 69.202937][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 69.208841][ C1] ? _raw_spin_unlock+0x40/0x40 [ 69.213726][ C1] check_panic_on_warn+0x82/0xa0 [ 69.218692][ C1] ? profile_pc+0xa8/0xe0 [ 69.223034][ C1] end_report+0x6e/0x130 [ 69.227290][ C1] kasan_report+0x186/0x1b0 [ 69.231799][ C1] ? profile_pc+0xa8/0xe0 [ 69.236142][ C1] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 69.242045][ C1] profile_pc+0xa8/0xe0 [ 69.246298][ C1] profile_tick+0xd8/0x130 [ 69.250726][ C1] tick_sched_timer+0x383/0x550 [ 69.255591][ C1] ? tick_setup_sched_timer+0x2f0/0x2f0 [ 69.261143][ C1] __hrtimer_run_queues+0x562/0xd10 [ 69.266386][ C1] ? hrtimer_interrupt+0x980/0x980 [ 69.271508][ C1] ? ktime_get_update_offsets_now+0x40b/0x420 [ 69.277595][ C1] hrtimer_interrupt+0x396/0x980 [ 69.282555][ C1] __sysvec_apic_timer_interrupt+0x13f/0x480 [ 69.288544][ C1] sysvec_apic_timer_interrupt+0x90/0xb0 [ 69.294308][ C1] [ 69.297250][ C1] [ 69.300191][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 69.306190][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 [ 69.312711][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 ee c5 1d f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 b3 19 98 f6 65 8b 05 d4 f0 3c 75 85 c0 74 3f 48 c7 04 24 0e 36 [ 69.334578][ C1] RSP: 0018:ffffc90003b9f400 EFLAGS: 00000206 [ 69.340672][ C1] RAX: 357465eb72c61400 RBX: 1ffff92000773e84 RCX: ffffffff816bdd8a [ 69.348647][ C1] RDX: dffffc0000000000 RSI: ffffffff8b0a97c0 RDI: 0000000000000001 [ 69.356625][ C1] RBP: ffffc90003b9f490 R08: ffffffff907b4307 R09: 1ffffffff20f6860 [ 69.364616][ C1] R10: dffffc0000000000 R11: fffffbfff20f6861 R12: dffffc0000000000 [ 69.372594][ C1] R13: 1ffff92000773e80 R14: ffffc90003b9f420 R15: 0000000000000246 [ 69.380594][ C1] ? mark_lock+0x9a/0x340 [ 69.384964][ C1] ? _raw_spin_unlock+0x40/0x40 [ 69.389830][ C1] ? __mod_zone_page_state+0xda/0x140 [ 69.395644][ C1] __rmqueue_pcplist+0x1e3e/0x2150 [ 69.400788][ C1] ? zone_watermark_fast+0x240/0x240 [ 69.406171][ C1] get_page_from_freelist+0x780/0x3370 [ 69.411736][ C1] ? __alloc_pages+0x165/0x670 [ 69.416510][ C1] ? __might_sleep+0xc0/0xc0 [ 69.421139][ C1] ? __alloc_pages+0x670/0x670 [ 69.425909][ C1] ? prepare_alloc_pages+0x1d9/0x5b0 [ 69.431204][ C1] __alloc_pages+0x255/0x670 [ 69.435803][ C1] ? zone_statistics+0x170/0x170 [ 69.440753][ C1] ? _raw_spin_unlock+0x28/0x40 [ 69.445614][ C1] ? alloc_pages+0x510/0x780 [ 69.450236][ C1] __vmalloc_node_range+0x9a3/0x1490 [ 69.455548][ C1] ? free_vm_area+0x50/0x50 [ 69.460089][ C1] ? profile_init+0xee/0x130 [ 69.464690][ C1] ? sysfs_kf_read+0x310/0x310 [ 69.469486][ C1] vzalloc+0x79/0x90 [ 69.473401][ C1] ? profile_init+0xee/0x130 [ 69.478011][ C1] profile_init+0xee/0x130 [ 69.482440][ C1] profiling_store+0x5e/0xc0 [ 69.487044][ C1] kernfs_fop_write_iter+0x3a6/0x4f0 [ 69.492339][ C1] vfs_write+0x782/0xaf0 [ 69.496605][ C1] ? file_end_write+0x250/0x250 [ 69.501476][ C1] ? lockdep_hardirqs_on+0x98/0x140 [ 69.506784][ C1] ? __fdget_pos+0x2c7/0x340 [ 69.511478][ C1] ksys_write+0x1a0/0x2c0 [ 69.515826][ C1] ? __ia32_sys_read+0x90/0x90 [ 69.520696][ C1] ? syscall_enter_from_user_mode+0x32/0x230 [ 69.526688][ C1] ? syscall_enter_from_user_mode+0x8c/0x230 [ 69.532769][ C1] do_syscall_64+0x41/0xc0 [ 69.537190][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 69.543095][ C1] RIP: 0033:0x7f3dddaf6529 [ 69.547514][ C1] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 69.567143][ C1] RSP: 002b:00007ffca604d208 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 69.575563][ C1] RAX: ffffffffffffffda RBX: 00007ffca604d3d8 RCX: 00007f3dddaf6529 [ 69.583549][ C1] RDX: 0000000000000012 RSI: 0000000020000380 RDI: 0000000000000003 [ 69.591537][ C1] RBP: 00007f3dddb69610 R08: 00007ffca604cfa7 R09: 00007ffca604d3d8 [ 69.599509][ C1] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 69.607580][ C1] R13: 00007ffca604d3c8 R14: 0000000000000001 R15: 0000000000000001 [ 69.615655][ C1] [ 69.618983][ C1] Kernel Offset: disabled [ 69.623309][ C1] Rebooting in 86400 seconds..