./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2680234103 <...> Warning: Permanently added '10.128.1.111' (ED25519) to the list of known hosts. execve("./syz-executor2680234103", ["./syz-executor2680234103"], 0x7fffc9400460 /* 10 vars */) = 0 brk(NULL) = 0x55555723a000 brk(0x55555723ad00) = 0x55555723ad00 arch_prctl(ARCH_SET_FS, 0x55555723a380) = 0 set_tid_address(0x55555723a650) = 5005 set_robust_list(0x55555723a660, 24) = 0 rseq(0x55555723aca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2680234103", 4096) = 28 getrandom("\x84\x2d\xc1\x15\xd1\x9e\x18\x17", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555723ad00 brk(0x55555725bd00) = 0x55555725bd00 brk(0x55555725c000) = 0x55555725c000 mprotect(0x7f4a11bfe000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555723a650) = 5006 ./strace-static-x86_64: Process 5006 attached [pid 5006] set_robust_list(0x55555723a660, 24) = 0 [pid 5006] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5006] setpgid(0, 0) = 0 [pid 5006] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5006] write(3, "1000", 4) = 4 [pid 5006] close(3) = 0 [pid 5006] openat(AT_FDCWD, "/dev/kvm", O_RDONLY) = 3 [pid 5006] ioctl(3, KVM_CREATE_VM, 0) = 4 [pid 5006] dup(4) = 5 [pid 5006] ioctl(5, KVM_CREATE_VCPU, 0) = 6 [pid 5006] ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=0, flags=KVM_MEM_READONLY, guest_phys_addr=0, memory_size=8192, userspace_addr=0x20000000}) = 0 [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=0, flags=0, guest_phys_addr=0, memory_size=4096, userspace_addr=0x20000000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=1, flags=0, guest_phys_addr=0x1000, memory_size=4096, userspace_addr=0x20001000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=2, flags=0, guest_phys_addr=0x2000, memory_size=4096, userspace_addr=0x20002000}) = -1 EBADF (Bad file descriptor) [ 142.742934][ T5006] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=3, flags=0, guest_phys_addr=0x3000, memory_size=4096, userspace_addr=0x20003000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=4, flags=0, guest_phys_addr=0x4000, memory_size=4096, userspace_addr=0x20004000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=5, flags=0, guest_phys_addr=0x5000, memory_size=4096, userspace_addr=0x20005000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=6, flags=0, guest_phys_addr=0x6000, memory_size=4096, userspace_addr=0x20006000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=7, flags=0, guest_phys_addr=0x7000, memory_size=4096, userspace_addr=0x20007000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=8, flags=0, guest_phys_addr=0x8000, memory_size=4096, userspace_addr=0x20008000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=9, flags=0, guest_phys_addr=0x9000, memory_size=4096, userspace_addr=0x20009000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=10, flags=0, guest_phys_addr=0xfec00000, memory_size=4096, userspace_addr=0x2000a000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=11, flags=0, guest_phys_addr=0xb000, memory_size=4096, userspace_addr=0x2000b000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=12, flags=0, guest_phys_addr=0xc000, memory_size=4096, userspace_addr=0x2000c000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=13, flags=0, guest_phys_addr=0xd000, memory_size=4096, userspace_addr=0x2000d000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=14, flags=0, guest_phys_addr=0xe000, memory_size=4096, userspace_addr=0x2000e000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=15, flags=0, guest_phys_addr=0xf000, memory_size=4096, userspace_addr=0x2000f000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=16, flags=0, guest_phys_addr=0x10000, memory_size=4096, userspace_addr=0x20010000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=17, flags=0, guest_phys_addr=0x11000, memory_size=4096, userspace_addr=0x20011000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=18, flags=0, guest_phys_addr=0x12000, memory_size=4096, userspace_addr=0x20012000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=19, flags=0, guest_phys_addr=0x13000, memory_size=4096, userspace_addr=0x20013000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=20, flags=0, guest_phys_addr=0x14000, memory_size=4096, userspace_addr=0x20014000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=21, flags=0, guest_phys_addr=0x15000, memory_size=4096, userspace_addr=0x20015000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=22, flags=0, guest_phys_addr=0x16000, memory_size=4096, userspace_addr=0x20016000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=23, flags=0, guest_phys_addr=0x17000, memory_size=4096, userspace_addr=0x20017000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(-1, KVM_SET_USER_MEMORY_REGION, {slot=65537, flags=0, guest_phys_addr=0x30000, memory_size=65536, userspace_addr=0x20000000}) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(6, KVM_GET_SREGS, {cs={base=0xffff0000, limit=65535, selector=61440, type=11, present=1, dpl=0, db=0, s=1, l=0, g=0, avl=0}, ...}) = 0 [pid 5006] openat(AT_FDCWD, "/dev/kvm", O_RDWR) = 7 [pid 5006] ioctl(7, KVM_GET_SUPPORTED_CPUID, {nent=31, entries=[...]}) = 0 [pid 5006] ioctl(6, KVM_SET_CPUID2, {nent=31, entries=[...]}) = 0 [pid 5006] close(7) = 0 [pid 5006] ioctl(6, KVM_SET_SREGS, {cs={base=0, limit=1048575, selector=16, type=11, present=1, dpl=0, db=0, s=1, l=0, g=0, avl=0}, ...}) = 0 [pid 5006] ioctl(6, KVM_SET_REGS, {rax=0, ..., rsp=0xf80, rbp=0, ..., rip=0, rflags=0x2}) = 0 [pid 5006] sendmsg(-1, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=68}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EBADF (Bad file descriptor) [pid 5006] ioctl(4, KVM_REGISTER_COALESCED_MMIO, 0x200001c0) = 0 [pid 5006] ioctl(6, KVM_NMI, 0) = 0 [ 142.880002][ T5006] ===================================================== [ 142.887268][ T5006] BUG: KMSAN: uninit-value in em_ret_far+0x332/0x340 [ 142.894289][ T5006] em_ret_far+0x332/0x340 [ 142.898779][ T5006] x86_emulate_insn+0x1d81/0x5800 [ 142.904084][ T5006] x86_emulate_instruction+0x13c5/0x3090 [ 142.909975][ T5006] kvm_mmu_page_fault+0x100a/0x1120 [ 142.915534][ T5006] handle_ept_violation+0x4ef/0x7e0 [ 142.920975][ T5006] vmx_handle_exit+0x1b01/0x2130 [ 142.926071][ T5006] kvm_arch_vcpu_ioctl_run+0x9d4f/0xc680 [ 142.931991][ T5006] kvm_vcpu_ioctl+0xbfc/0x1770 [ 142.936915][ T5006] __se_sys_ioctl+0x225/0x410 [ 142.942000][ T5006] __x64_sys_ioctl+0x96/0xe0 [ 142.946763][ T5006] do_syscall_64+0x44/0x110 [ 142.951522][ T5006] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 142.957633][ T5006] [ 142.960042][ T5006] Local variable eip created at: [ 142.965260][ T5006] em_ret_far+0x3a/0x340 [ 142.969672][ T5006] x86_emulate_insn+0x1d81/0x5800 [ 142.975024][ T5006] [ 142.977527][ T5006] CPU: 1 PID: 5006 Comm: syz-executor268 Not tainted 6.6.0-syzkaller-14263-gaea6bf908d73 #0 [ 142.987909][ T5006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 142.998229][ T5006] ===================================================== [ 143.005388][ T5006] Disabling lock debugging due to kernel taint [ 143.011815][ T5006] Kernel panic - not syncing: kmsan.panic set ... [ 143.018331][ T5006] CPU: 1 PID: 5006 Comm: syz-executor268 Tainted: G B 6.6.0-syzkaller-14263-gaea6bf908d73 #0 [ 143.030026][ T5006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 143.040181][ T5006] Call Trace: [ 143.043552][ T5006] [ 143.046575][ T5006] dump_stack_lvl+0x1bf/0x240 [ 143.051471][ T5006] dump_stack+0x1e/0x20 [ 143.055768][ T5006] panic+0x4de/0xc90 [ 143.059847][ T5006] ? add_taint+0x108/0x1a0 [ 143.064429][ T5006] kmsan_report+0x2d0/0x2d0 [ 143.069137][ T5006] ? __msan_warning+0x96/0x110 [ 143.074026][ T5006] ? em_ret_far+0x332/0x340 [ 143.078620][ T5006] ? x86_emulate_insn+0x1d81/0x5800 [ 143.083936][ T5006] ? x86_emulate_instruction+0x13c5/0x3090 [ 143.089912][ T5006] ? kvm_mmu_page_fault+0x100a/0x1120 [ 143.095452][ T5006] ? handle_ept_violation+0x4ef/0x7e0 [ 143.100995][ T5006] ? vmx_handle_exit+0x1b01/0x2130 [ 143.106290][ T5006] ? kvm_arch_vcpu_ioctl_run+0x9d4f/0xc680 [ 143.112289][ T5006] ? kvm_vcpu_ioctl+0xbfc/0x1770 [ 143.117387][ T5006] ? __se_sys_ioctl+0x225/0x410 [ 143.122421][ T5006] ? __x64_sys_ioctl+0x96/0xe0 [ 143.127311][ T5006] ? do_syscall_64+0x44/0x110 [ 143.132185][ T5006] ? entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 143.138473][ T5006] ? vmx_set_segment+0x24b/0x270 [ 143.143772][ T5006] ? emulator_set_segment+0x3bf/0x4b0 [ 143.149309][ T5006] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 143.155302][ T5006] ? __load_segment_descriptor+0x394/0x1b70 [ 143.161418][ T5006] ? emulate_pop+0x9ed/0xb50 [ 143.166167][ T5006] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 143.172117][ T5006] __msan_warning+0x96/0x110 [ 143.176894][ T5006] em_ret_far+0x332/0x340 [ 143.181399][ T5006] ? em_lseg+0x350/0x3e0 [ 143.185799][ T5006] x86_emulate_insn+0x1d81/0x5800 [ 143.190995][ T5006] ? em_ret_far_imm+0x4f0/0x4f0 [ 143.195992][ T5006] x86_emulate_instruction+0x13c5/0x3090 [ 143.201823][ T5006] kvm_mmu_page_fault+0x100a/0x1120 [ 143.207166][ T5006] handle_ept_violation+0x4ef/0x7e0 [ 143.212566][ T5006] ? handle_desc+0xc0/0xc0 [ 143.217157][ T5006] vmx_handle_exit+0x1b01/0x2130 [ 143.222241][ T5006] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 143.228201][ T5006] kvm_arch_vcpu_ioctl_run+0x9d4f/0xc680 [ 143.233973][ T5006] ? kmsan_internal_set_shadow_origin+0x66/0xe0 [ 143.240544][ T5006] ? tomoyo_path_number_perm+0x82d/0x8e0 [ 143.246933][ T5006] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 143.252945][ T5006] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 143.258974][ T5006] ? put_pid+0xd8/0x150 [ 143.263289][ T5006] ? kvm_vcpu_ioctl+0x174c/0x1770 [ 143.268455][ T5006] kvm_vcpu_ioctl+0xbfc/0x1770 [ 143.273344][ T5006] ? kmsan_get_shadow_origin_ptr+0x4d/0xa0 [ 143.279365][ T5006] ? xa_release+0x60/0x60 [ 143.283780][ T5006] __se_sys_ioctl+0x225/0x410 [ 143.288580][ T5006] __x64_sys_ioctl+0x96/0xe0 [ 143.293353][ T5006] do_syscall_64+0x44/0x110 [ 143.298146][ T5006] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 143.304254][ T5006] RIP: 0033:0x7f4a11b8a839 [ 143.308816][ T5006] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 143.328610][ T5006] RSP: 002b:00007ffe558799b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 143.337218][ T5006] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4a11b8a839 [ 143.345321][ T5006] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 143.353388][ T5006] RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000006 [ 143.361576][ T5006] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000003a28 [ 143.369922][ T5006] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 [ 143.378013][ T5006] [ 143.381312][ T5006] Kernel Offset: disabled [ 143.385692][ T5006] Rebooting in 86400 seconds..