./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3064246227 <...> DUID 00:04:03:2c:e5:fc:a2:19:b8:8b:c5:bf:62:63:19:3a:75:c6 forked to background, child pid 4693 [ 31.801341][ T4694] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.811082][ T4694] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.131' (ECDSA) to the list of known hosts. execve("./syz-executor3064246227", ["./syz-executor3064246227"], 0x7ffe9ff51330 /* 10 vars */) = 0 brk(NULL) = 0x555556049000 brk(0x555556049c40) = 0x555556049c40 arch_prctl(ARCH_SET_FS, 0x555556049300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3064246227", 4096) = 28 brk(0x55555606ac40) = 0x55555606ac40 brk(0x55555606b000) = 0x55555606b000 mprotect(0x7f0be1112000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_ALG, SOCK_SEQPACKET, 0) = 3 bind(3, {sa_family=AF_ALG, salg_type="hash", salg_feat=0, salg_mask=0, salg_name="ghash-clmulni"}, 88) = 0 setsockopt(3, SOL_ALG, ALG_SET_KEY, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16) = 0 accept4(3, NULL, NULL, 0) = 4 sendmmsg(4, [{msg_hdr={msg_name=NULL, msg_namelen=0, msg_iov=NULL, msg_iovlen=0, msg_controllen=0, msg_flags=0}, msg_len=0}], 1, MSG_PEEK|MSG_PROBE|MSG_MORE|MSG_FASTOPEN) = 1 syzkaller login: [ 56.256734][ T5024] general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN [ 56.268472][ T5024] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] [ 56.276883][ T5024] CPU: 0 PID: 5024 Comm: syz-executor306 Not tainted 6.4.0-rc6-next-20230616-syzkaller #0 [ 56.286761][ T5024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 56.296804][ T5024] RIP: 0010:shash_ahash_update+0x126/0x210 [ 56.302619][ T5024] Code: 8c 00 00 00 e8 2b d5 a3 fd 48 8b 04 24 48 8b 6c 24 40 80 38 00 0f 85 c3 00 00 00 4d 8b 75 00 49 8d 7e 20 48 89 fa 48 c1 ea 03 <80> 3c 1a 00 0f 85 c1 00 00 00 4d 8b 7e 20 49 8d 7f 2c 48 89 fa 48 [ 56.322215][ T5024] RSP: 0018:ffffc900039df948 EFLAGS: 00010202 [ 56.328265][ T5024] RAX: ffffed100fd2336b RBX: dffffc0000000000 RCX: 0000000000000000 [ 56.336310][ T5024] RDX: 0000000000000004 RSI: ffffffff83e08cf5 RDI: 0000000000000020 [ 56.344262][ T5024] RBP: ffff888073e51100 R08: 0000000000000005 R09: 0000000000000000 [ 56.352307][ T5024] R10: 0000000000000f00 R11: 0000000000000001 R12: 0000000000000f00 [ 56.360261][ T5024] R13: ffff88807e919b58 R14: 0000000000000000 R15: 1ffff9200073bf2b [ 56.368215][ T5024] FS: 0000555556049300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 56.377130][ T5024] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.383696][ T5024] CR2: 00007f791348a440 CR3: 000000007292d000 CR4: 00000000003506f0 [ 56.391738][ T5024] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.399698][ T5024] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.407654][ T5024] Call Trace: [ 56.410931][ T5024] [ 56.413862][ T5024] ? die_addr+0x3c/0xa0 [ 56.418041][ T5024] ? exc_general_protection+0x129/0x230 [ 56.423599][ T5024] ? asm_exc_general_protection+0x26/0x30 [ 56.429311][ T5024] ? shash_ahash_update+0x105/0x210 [ 56.434497][ T5024] ? shash_ahash_update+0x126/0x210 [ 56.439693][ T5024] ? shash_ahash_update+0x105/0x210 [ 56.444875][ T5024] ? crypto_shash_finup+0x160/0x160 [ 56.450063][ T5024] ? mark_held_locks+0x9f/0xe0 [ 56.454822][ T5024] ghash_async_update+0x136/0x170 [ 56.459838][ T5024] hash_sendmsg+0x434/0xde0 [ 56.464335][ T5024] ? hash_accept_nokey+0x90/0x90 [ 56.469296][ T5024] sock_sendmsg+0xde/0x190 [ 56.473709][ T5024] ____sys_sendmsg+0x739/0x920 [ 56.478475][ T5024] ? copy_msghdr_from_user+0xfc/0x150 [ 56.483840][ T5024] ? kernel_sendmsg+0x50/0x50 [ 56.488513][ T5024] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 56.494506][ T5024] ___sys_sendmsg+0x110/0x1b0 [ 56.499170][ T5024] ? do_recvmmsg+0x6f0/0x6f0 [ 56.503747][ T5024] ? lock_sync+0x190/0x190 [ 56.508151][ T5024] ? rcu_is_watching+0x12/0xb0 [ 56.512901][ T5024] ? do_raw_spin_lock+0x124/0x2b0 [ 56.517915][ T5024] ? spin_bug+0x1c0/0x1c0 [ 56.522322][ T5024] ? lock_acquire+0x32/0xc0 [ 56.526821][ T5024] ? ptrace_stop.part.0+0x4e3/0x8e0 [ 56.532020][ T5024] ? __fget_light+0x201/0x270 [ 56.536699][ T5024] __sys_sendmsg+0xf7/0x1c0 [ 56.541301][ T5024] ? __sys_sendmsg_sock+0x40/0x40 [ 56.546410][ T5024] ? lock_downgrade+0x690/0x690 [ 56.551263][ T5024] ? lockdep_hardirqs_on+0x7d/0x100 [ 56.556554][ T5024] ? _raw_spin_unlock_irq+0x2e/0x50 [ 56.561751][ T5024] ? ptrace_notify+0xfe/0x140 [ 56.566428][ T5024] do_syscall_64+0x39/0xb0 [ 56.570945][ T5024] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.576831][ T5024] RIP: 0033:0x7f0be10a5cb9 [ 56.581328][ T5024] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 56.601096][ T5024] RSP: 002b:00007fff02443a98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 56.609508][ T5024] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0be10a5cb9 [ 56.617476][ T5024] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000004 [ 56.625438][ T5024] RBP: 00007f0be1069e60 R08: 0000000000000000 R09: 0000000000000000 [ 56.633392][ T5024] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0be1069ef0 [ 56.641346][ T5024] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 56.649305][ T5024] [ 56.652309][ T5024] Modules linked in: [ 56.658592][ T5024] ---[ end trace 0000000000000000 ]--- [ 56.664791][ T5024] RIP: 0010:shash_ahash_update+0x126/0x210 [ 56.670595][ T5024] Code: 8c 00 00 00 e8 2b d5 a3 fd 48 8b 04 24 48 8b 6c 24 40 80 38 00 0f 85 c3 00 00 00 4d 8b 75 00 49 8d 7e 20 48 89 fa 48 c1 ea 03 <80> 3c 1a 00 0f 85 c1 00 00 00 4d 8b 7e 20 49 8d 7f 2c 48 89 fa 48 [ 56.690576][ T5024] RSP: 0018:ffffc900039df948 EFLAGS: 00010202 [ 56.696825][ T5024] RAX: ffffed100fd2336b RBX: dffffc0000000000 RCX: 0000000000000000 [ 56.704845][ T5024] RDX: 0000000000000004 RSI: ffffffff83e08cf5 RDI: 0000000000000020 [ 56.712823][ T5024] RBP: ffff888073e51100 R08: 0000000000000005 R09: 0000000000000000 [ 56.720896][ T5024] R10: 0000000000000f00 R11: 0000000000000001 R12: 0000000000000f00 [ 56.728901][ T5024] R13: ffff88807e919b58 R14: 0000000000000000 R15: 1ffff9200073bf2b [ 56.736888][ T5024] FS: 0000555556049300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 56.745847][ T5024] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.752549][ T5024] CR2: 00007ff1e2ff2304 CR3: 000000007292d000 CR4: 00000000003506e0 [ 56.760630][ T5024] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.768749][ T5024] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.776755][ T5024] Kernel panic - not syncing: Fatal exception [ 56.782962][ T5024] Kernel Offset: disabled [ 56.787290][ T5024] Rebooting in 86400 seconds..