./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2818859187 <...> DUID 00:04:06:88:74:a7:04:75:62:cb:55:93:34:09:94:90:e1:fe forked to background, child pid 4646 [ 34.832786][ T4647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 34.843170][ T4647] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.133' (ECDSA) to the list of known hosts. execve("./syz-executor2818859187", ["./syz-executor2818859187"], 0x7ffd7cf64830 /* 10 vars */) = 0 brk(NULL) = 0x555555c85000 brk(0x555555c85c40) = 0x555555c85c40 arch_prctl(ARCH_SET_FS, 0x555555c85300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2818859187", 4096) = 28 brk(0x555555ca6c40) = 0x555555ca6c40 brk(0x555555ca7000) = 0x555555ca7000 mprotect(0x7fdc6f4ce000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/vhost-vsock", O_RDWR) = 3 ioctl(-1, BTRFS_IOC_GET_DEV_STATS, {devid=makedev(0, 0), nr_items=0, flags=0}) = -1 EBADF (Bad file descriptor) ioctl(3, VHOST_SET_OWNER, 0) = 0 ioctl(3, VHOST_SET_VRING_BASE, 0x20000180) = 0 eventfd(0) = 4 ioctl(3, VHOST_SET_LOG_FD, 0x200001c0) = 0 ioctl(3, VHOST_SET_VRING_KICK, 0x20000040) = 0 ioctl(3, VHOST_SET_VRING_ADDR, 0x20000140) = 0 ioctl(3, VHOST_SET_VRING_ADDR, 0x20000280) = 0 ioctl(3, VHOST_SET_MEM_TABLE, 0x20000880) = 0 ioctl(3, VHOST_VSOCK_SET_RUNNING, 0x20000340) = 0 sendmsg(-1, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=139}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EBADF (Bad file descriptor) openat(AT_FDCWD, "blkio.bfq.io_service_bytes_recursive", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 write(5, "\x62\x6c\x6b\x69\x6f\x2e\x62\x66\x71\x2e\x69\x6f\x5f\x73\x65\x72\x76\x69\x63\x65\x5f\x62\x79\x74\x65\x73\x5f\x72\x65\x63\x75\x72\x73\x69\x76\x65\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 16777152 mmap(0x20000000, 11755520, PROT_READ|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x20000000 exit_group(0) = ? syzkaller login: [ 54.231255][ T5072] skbuff: skb_over_panic: text:ffffffff8768d6f1 len:25109 put:25109 head:ffff88802b5ac000 data:ffff88802b5ac02c tail:0x6241 end:0xc0 dev: [ 54.246734][ T5072] ------------[ cut here ]------------ [ 54.252611][ T5072] kernel BUG at net/core/skbuff.c:121! [ 54.258185][ T5072] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 54.264341][ T5072] CPU: 0 PID: 5072 Comm: vhost-5071 Not tainted 6.2.0-rc1-next-20221226-syzkaller #0 [ 54.273877][ T5072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 54.283924][ T5072] RIP: 0010:skb_panic+0x16c/0x16e [ 54.288948][ T5072] Code: f7 4c 8b 4c 24 10 8b 4b 70 41 56 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 40 04 5b 8b ff 74 24 10 ff 74 24 20 e8 09 8e bf ff <0f> 0b e8 1a 67 82 f7 4c 8b 64 24 18 e8 80 3d d0 f7 48 c7 c1 40 12 [ 54.308536][ T5072] RSP: 0018:ffffc90003cefca0 EFLAGS: 00010282 [ 54.314583][ T5072] RAX: 000000000000008d RBX: ffff88802b674500 RCX: 0000000000000000 [ 54.322538][ T5072] RDX: ffff8880236bba80 RSI: ffffffff81663b9c RDI: fffff5200079df86 [ 54.330488][ T5072] RBP: ffffffff8b5b1280 R08: 000000000000008d R09: 0000000000000000 [ 54.338460][ T5072] R10: 0000000080000000 R11: 0000000000000000 R12: ffffffff8768d6f1 [ 54.346430][ T5072] R13: 0000000000006215 R14: ffffffff8b5b0400 R15: 00000000000000c0 [ 54.354424][ T5072] FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 54.363370][ T5072] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.369954][ T5072] CR2: 0000000020000380 CR3: 000000002985f000 CR4: 00000000003506f0 [ 54.377922][ T5072] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.385885][ T5072] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.393850][ T5072] Call Trace: [ 54.397121][ T5072] [ 54.400052][ T5072] ? vhost_vsock_handle_tx_kick+0xad1/0xd00 [ 54.405948][ T5072] skb_put.cold+0x24/0x24 [ 54.410460][ T5072] vhost_vsock_handle_tx_kick+0xad1/0xd00 [ 54.416195][ T5072] ? vhost_vsock_chr_read_iter+0xb0/0xb0 [ 54.421827][ T5072] ? rwlock_bug.part.0+0x90/0x90 [ 54.426766][ T5072] ? lockdep_hardirqs_on+0x7d/0x100 [ 54.431963][ T5072] vhost_worker+0x241/0x3e0 [ 54.436468][ T5072] ? vq_meta_prefetch+0x280/0x280 [ 54.441495][ T5072] kthread+0x2e8/0x3a0 [ 54.445558][ T5072] ? kthread_complete_and_exit+0x40/0x40 [ 54.451192][ T5072] ret_from_fork+0x1f/0x30 [ 54.455736][ T5072] [ 54.458746][ T5072] Modules linked in: [ 54.462788][ T5072] ---[ end trace 0000000000000000 ]--- [ 54.468340][ T5072] RIP: 0010:skb_panic+0x16c/0x16e [ 54.473389][ T5072] Code: f7 4c 8b 4c 24 10 8b 4b 70 41 56 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 40 04 5b 8b ff 74 24 10 ff 74 24 20 e8 09 8e bf ff <0f> 0b e8 1a 67 82 f7 4c 8b 64 24 18 e8 80 3d d0 f7 48 c7 c1 40 12 [ 54.493743][ T5072] RSP: 0018:ffffc90003cefca0 EFLAGS: 00010282 [ 54.499838][ T5072] RAX: 000000000000008d RBX: ffff88802b674500 RCX: 0000000000000000 [ 54.507827][ T5072] RDX: ffff8880236bba80 RSI: ffffffff81663b9c RDI: fffff5200079df86 [ 54.515804][ T5072] RBP: ffffffff8b5b1280 R08: 000000000000008d R09: 0000000000000000 [ 54.523795][ T5072] R10: 0000000080000000 R11: 0000000000000000 R12: ffffffff8768d6f1 [ 54.531897][ T5072] R13: 0000000000006215 R14: ffffffff8b5b0400 R15: 00000000000000c0 [ 54.540238][ T5072] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 54.549347][ T5072] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.555956][ T5072] CR2: 00007fdc6f4a4298 CR3: 000000002985f000 CR4: 00000000003506e0 [ 54.564426][ T5072] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 54.572940][ T5072] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 54.581107][ T5072] Kernel panic - not syncing: Fatal exception [ 54.587436][ T5072] Kernel Offset: disabled [ 54.591756][ T5072] Rebooting in 86400 seconds..