./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3484344527 <...> DUID 00:04:8a:84:28:17:ce:93:6d:14:d5:a0:40:fa:67:36:71:42 forked to background, child pid 3189 [ 25.579861][ T3190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 25.582412][ T3190] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.65' (ECDSA) to the list of known hosts. execve("./syz-executor3484344527", ["./syz-executor3484344527"], 0x7ffe4492b980 /* 10 vars */) = 0 brk(NULL) = 0x55555733c000 brk(0x55555733cc40) = 0x55555733cc40 arch_prctl(ARCH_SET_FS, 0x55555733c300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x55555733c5d0) = 3610 set_robust_list(0x55555733c5e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f281e93d4c0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f281e93db90}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f281e93d560, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f281e93db90}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3484344527", 4096) = 28 brk(0x55555735dc40) = 0x55555735dc40 brk(0x55555735e000) = 0x55555735e000 mprotect(0x7f281e9ff000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 chmod("/dev/raw-gadget", 0666) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3611 attached , child_tidptr=0x55555733c5d0) = 3611 [pid 3611] set_robust_list(0x55555733c5e0, 24) = 0 [pid 3611] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 3611] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 3611] setsid() = 1 [pid 3611] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0 [pid 3611] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 3611] unshare(CLONE_NEWNS) = 0 [pid 3611] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 3611] unshare(CLONE_NEWIPC) = 0 [pid 3611] unshare(CLONE_NEWCGROUP) = 0 [pid 3611] unshare(CLONE_NEWUTS) = 0 [pid 3611] unshare(CLONE_SYSVSEM) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "16777216", 8) = 8 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "536870912", 9) = 9 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "8192", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024", 4) = 4 [pid 3611] close(3) = 0 [pid 3611] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 3611] write(3, "1024 1048576 500 1024", 21) = 21 [pid 3611] close(3) = 0 [pid 3611] getpid() = 1 [pid 3611] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 3627] set_robust_list(0x7f281e92a9e0, 24 [pid 3611] <... clone resumed>, parent_tid=[2], tls=0x7f281e92a700, child_tidptr=0x7f281e92a9d0) = 2 [pid 3627] <... set_robust_list resumed>) = 0 [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 3627] openat(AT_FDCWD, "/dev/net/tun", O_RDONLY [pid 3611] <... futex resumed>) = 0 [pid 3627] <... openat resumed>) = 3 [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3611] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 3627] futex(0x7f281ea054e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 3627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 3611] <... futex resumed>) = 0 [pid 3627] ioctl(3, TUNSETIFF, 0x20000200 [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3627] <... ioctl resumed>) = 0 [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3611] <... futex resumed>) = 0 [pid 3627] futex(0x7f281ea054e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 3627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 3611] <... futex resumed>) = 0 [pid 3627] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3627] <... socket resumed>) = 4 [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3611] <... futex resumed>) = 0 [pid 3627] futex(0x7f281ea054e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 3627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 3611] <... futex resumed>) = 0 [pid 3627] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL) [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3627] <... socket resumed>) = 5 [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3611] <... futex resumed>) = 0 [pid 3627] ioctl(3, TUNSETQUEUE, 0x20000000 [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3627] <... ioctl resumed>) = 0 [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3611] <... futex resumed>) = 0 [pid 3627] futex(0x7f281ea054e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 3627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 3611] <... futex resumed>) = 0 [pid 3627] ioctl(5, SIOCGIFINDEX, {ifr_name="rose0" [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3627] <... ioctl resumed>, ifr_ifindex=69}) = 0 [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 3611] <... futex resumed>) = 0 [pid 3627] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x34\x00\x00\x00\x11\x00\x01\xe9\x0d\x7d\x1f\x07\xde\x1c\x8b\x3e\xec\x45\xb2\xfc\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=52}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0 [pid 3611] futex(0x7f281ea054e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3611] futex(0x7f281ea054ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 3611] futex(0x7f281ea054fc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3611] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f281e8e9000 [pid 3611] mprotect(0x7f281e8ea000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 3611] clone(child_stack=0x7f281e9093f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 3628 attached , parent_tid=[3], tls=0x7f281e909700, child_tidptr=0x7f281e9099d0) = 3 [pid 3611] futex(0x7f281ea054f8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3611] futex(0x7f281ea054fc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 3628] set_robust_list(0x7f281e9099e0, 24) = 0 [ 51.137594][ T3627] netlink: 20 bytes leftover after parsing attributes in process `syz-executor348'. [pid 3628] ioctl(3, TUNSETIFF, 0x20000200 [pid 3627] <... sendmsg resumed>) = 52 [pid 3627] futex(0x7f281ea054ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 3627] futex(0x7f281ea054e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 3611] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 51.200382][ T3628] ------------[ cut here ]------------ [ 51.200388][ T3628] WARNING: CPU: 1 PID: 3628 at net/core/dev.c:6374 netif_napi_add_weight+0x8de/0xb00 [ 51.223059][ T3628] Modules linked in: [ 51.227882][ T3628] CPU: 0 PID: 3628 Comm: syz-executor348 Not tainted 5.19.0-rc2-syzkaller-00312-g4875d94c69d5 #0 [ 51.238754][ T3628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.248970][ T3628] RIP: 0010:netif_napi_add_weight+0x8de/0xb00 [ 51.255489][ T3628] Code: 08 84 c0 0f 85 b5 00 00 00 48 8b 04 24 80 a0 b1 0b 00 00 fd e9 6c fd ff ff e8 6e 01 27 fa 0f 0b e9 98 fc ff ff e8 62 01 27 fa <0f> 0b e9 54 fd ff ff e8 f6 c5 73 fa e9 40 fe ff ff e8 dc c5 73 fa [ 51.275323][ T3628] RSP: 0018:ffffc9000318fb18 EFLAGS: 00010293 [ 51.281424][ T3628] RAX: 0000000000000000 RBX: ffff88807ef6a000 RCX: 0000000000000000 [ 51.289842][ T3628] RDX: ffff88801ea21d80 RSI: ffffffff8753709e RDI: 0000000000000001 [ 51.297992][ T3628] RBP: ffff88807ef6a5e8 R08: 0000000000000001 R09: 0000000000000000 [ 51.306506][ T3628] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880711a4001 [ 51.314703][ T3628] R13: ffff88807ef6a5d8 R14: ffff8880711a4c80 R15: 0000000000000000 [ 51.322702][ T3628] FS: 00007f281e909700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 [ 51.331838][ T3628] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.338968][ T3628] CR2: 00007ffe03727080 CR3: 000000007365f000 CR4: 00000000003506f0 [ 51.347314][ T3628] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.355408][ T3628] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.363392][ T3628] Call Trace: [ 51.366742][ T3628] [ 51.369696][ T3628] ? owner_show+0x130/0x130 [ 51.375196][ T3628] tun_attach.isra.0+0x1096/0x16c0 [ 51.380355][ T3628] tun_net_init+0x45e/0x660 [ 51.385501][ T3628] ? tun_attach.isra.0+0x16c0/0x16c0 [ 51.390830][ T3628] register_netdevice+0x57d/0x15b0 [ 51.396038][ T3628] ? netdev_change_features+0xb0/0xb0 [pid 3611] exit_group(1 [pid 3627] <... futex resumed>) = ? [pid 3611] <... exit_group resumed>) = ? [pid 3627] +++ exited with 1 +++ [ 51.401426][ T3628] ? dev_addr_mod+0x2c9/0x3f0 [ 51.406272][ T3628] __tun_chr_ioctl+0x2a19/0x3da0 [ 51.412102][ T3628] ? tun_chr_read_iter+0x270/0x270 [ 51.417320][ T3628] ? calibrate_delay+0xd83/0x1120 [ 51.422377][ T3628] ? __fget_files+0x26a/0x440 [ 51.425175][ T3611] syz-executor348 (3611) used greatest stack depth: 22488 bytes left [ 51.427587][ T3628] ? bpf_lsm_file_ioctl+0x5/0x10 [ 51.440773][ T3628] ? tun_chr_compat_ioctl+0x30/0x30 [ 51.446190][ T3628] __x64_sys_ioctl+0x193/0x200 [ 51.450988][ T3628] do_syscall_64+0x35/0xb0 [ 51.455530][ T3628] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 51.461471][ T3628] RIP: 0033:0x7f281e97c109 [ 51.466656][ T3628] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 51.486490][ T3628] RSP: 002b:00007f281e909308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 51.495095][ T3628] RAX: ffffffffffffffda RBX: 00007f281ea054f8 RCX: 00007f281e97c109 [ 51.503098][ T3628] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003 [ 51.511284][ T3628] RBP: 00007f281ea054f0 R08: 00007f281e909700 R09: 0000000000000000 [ 51.519367][ T3628] R10: 00007f281e909700 R11: 0000000000000246 R12: 00007f281ea054fc [ 51.527425][ T3628] R13: 00007f281e9d2004 R14: 74656e2f7665642f R15: 0000000000022000 [ 51.535483][ T3628] [ 51.538509][ T3628] Kernel panic - not syncing: panic_on_warn set ... [ 51.545090][ T3628] CPU: 0 PID: 3628 Comm: syz-executor348 Not tainted 5.19.0-rc2-syzkaller-00312-g4875d94c69d5 #0 [ 51.555599][ T3628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 51.565660][ T3628] Call Trace: [ 51.568931][ T3628] [ 51.571856][ T3628] dump_stack_lvl+0xcd/0x134 [ 51.576450][ T3628] panic+0x2d7/0x636 [ 51.580335][ T3628] ? panic_print_sys_info.part.0+0x10b/0x10b [ 51.586311][ T3628] ? __warn.cold+0x1d9/0x2cd [ 51.590910][ T3628] ? netif_napi_add_weight+0x8de/0xb00 [ 51.596362][ T3628] __warn.cold+0x1ea/0x2cd [ 51.600798][ T3628] ? netif_napi_add_weight+0x8de/0xb00 [ 51.606254][ T3628] report_bug+0x1bc/0x210 [ 51.610582][ T3628] handle_bug+0x3c/0x60 [ 51.614827][ T3628] exc_invalid_op+0x14/0x40 [ 51.619330][ T3628] asm_exc_invalid_op+0x1b/0x20 [ 51.624193][ T3628] RIP: 0010:netif_napi_add_weight+0x8de/0xb00 [ 51.630287][ T3628] Code: 08 84 c0 0f 85 b5 00 00 00 48 8b 04 24 80 a0 b1 0b 00 00 fd e9 6c fd ff ff e8 6e 01 27 fa 0f 0b e9 98 fc ff ff e8 62 01 27 fa <0f> 0b e9 54 fd ff ff e8 f6 c5 73 fa e9 40 fe ff ff e8 dc c5 73 fa [ 51.649894][ T3628] RSP: 0018:ffffc9000318fb18 EFLAGS: 00010293 [ 51.655958][ T3628] RAX: 0000000000000000 RBX: ffff88807ef6a000 RCX: 0000000000000000 [ 51.663928][ T3628] RDX: ffff88801ea21d80 RSI: ffffffff8753709e RDI: 0000000000000001 [ 51.671915][ T3628] RBP: ffff88807ef6a5e8 R08: 0000000000000001 R09: 0000000000000000 [ 51.679906][ T3628] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880711a4001 [ 51.687879][ T3628] R13: ffff88807ef6a5d8 R14: ffff8880711a4c80 R15: 0000000000000000 [ 51.695853][ T3628] ? netif_napi_add_weight+0x8de/0xb00 [ 51.701327][ T3628] ? netif_napi_add_weight+0x8de/0xb00 [ 51.706889][ T3628] ? owner_show+0x130/0x130 [ 51.711412][ T3628] tun_attach.isra.0+0x1096/0x16c0 [ 51.716532][ T3628] tun_net_init+0x45e/0x660 [ 51.721036][ T3628] ? tun_attach.isra.0+0x16c0/0x16c0 [ 51.726316][ T3628] register_netdevice+0x57d/0x15b0 [ 51.731446][ T3628] ? netdev_change_features+0xb0/0xb0 [ 51.736853][ T3628] ? dev_addr_mod+0x2c9/0x3f0 [ 51.741530][ T3628] __tun_chr_ioctl+0x2a19/0x3da0 [ 51.746467][ T3628] ? tun_chr_read_iter+0x270/0x270 [ 51.751586][ T3628] ? calibrate_delay+0xd83/0x1120 [ 51.756622][ T3628] ? __fget_files+0x26a/0x440 [ 51.761294][ T3628] ? bpf_lsm_file_ioctl+0x5/0x10 [ 51.766226][ T3628] ? tun_chr_compat_ioctl+0x30/0x30 [ 51.771416][ T3628] __x64_sys_ioctl+0x193/0x200 [ 51.776175][ T3628] do_syscall_64+0x35/0xb0 [ 51.780587][ T3628] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 51.786472][ T3628] RIP: 0033:0x7f281e97c109 [ 51.790892][ T3628] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 51.810581][ T3628] RSP: 002b:00007f281e909308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 51.818996][ T3628] RAX: ffffffffffffffda RBX: 00007f281ea054f8 RCX: 00007f281e97c109 [ 51.826963][ T3628] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003 [ 51.834946][ T3628] RBP: 00007f281ea054f0 R08: 00007f281e909700 R09: 0000000000000000 [ 51.842909][ T3628] R10: 00007f281e909700 R11: 0000000000000246 R12: 00007f281ea054fc [ 51.850870][ T3628] R13: 00007f281e9d2004 R14: 74656e2f7665642f R15: 0000000000022000 [ 51.858846][ T3628] [ 51.862129][ T3628] Kernel Offset: disabled [ 51.866529][ T3628] Rebooting in 86400 seconds..