Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts.
2021/11/30 08:01:07 fuzzer started
2021/11/30 08:01:07 connecting to host at 10.128.0.169:34751
2021/11/30 08:01:07 checking machine...
2021/11/30 08:01:07 checking revisions...
2021/11/30 08:01:07 testing simple program...
syzkaller login: [ 76.351267][ T6534] cgroup: Unknown subsys name 'net'
[ 76.358242][ T6534]
[ 76.360582][ T6534] =========================
[ 76.365062][ T6534] WARNING: held lock freed!
[ 76.369955][ T6534] 5.16.0-rc3-next-20211130-syzkaller #0 Not tainted
[ 76.376528][ T6534] -------------------------
[ 76.381018][ T6534] syz-executor/6534 is freeing memory ffff888017c57400-ffff888017c575ff, with a lock still held there!
[ 76.392338][ T6534] ffff888017c57548 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_destroy_root+0x81/0xb0
[ 76.402092][ T6534] 2 locks held by syz-executor/6534:
[ 76.407452][ T6534] #0: ffffffff8bbc50c8 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock_and_drain_offline+0xa5/0x900
[ 76.417992][ T6534] #1: ffff888017c57548 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_destroy_root+0x81/0xb0
[ 76.428163][ T6534]
[ 76.428163][ T6534] stack backtrace:
[ 76.434065][ T6534] CPU: 1 PID: 6534 Comm: syz-executor Not tainted 5.16.0-rc3-next-20211130-syzkaller #0
[ 76.443801][ T6534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 76.454205][ T6534] Call Trace:
[ 76.457480][ T6534]
[ 76.460591][ T6534] dump_stack_lvl+0xcd/0x134
[ 76.465202][ T6534] debug_check_no_locks_freed.cold+0x9d/0xa9
[ 76.471453][ T6534] ? lockdep_hardirqs_on+0x79/0x100
[ 76.476752][ T6534] slab_free_freelist_hook+0x73/0x1c0
[ 76.482392][ T6534] ? kernfs_put.part.0+0x331/0x540
[ 76.487629][ T6534] kfree+0xe0/0x430
[ 76.491657][ T6534] ? kmem_cache_free+0xba/0x4a0
[ 76.496511][ T6534] ? rwlock_bug.part.0+0x90/0x90
[ 76.501454][ T6534] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70
[ 76.508011][ T6534] kernfs_put.part.0+0x331/0x540
[ 76.513045][ T6534] kernfs_put+0x42/0x50
[ 76.517209][ T6534] __kernfs_remove+0x7a3/0xb20
[ 76.521981][ T6534] ? kernfs_next_descendant_post+0x2f0/0x2f0
[ 76.527975][ T6534] ? down_write+0xde/0x150
[ 76.532392][ T6534] ? down_write_killable_nested+0x180/0x180
[ 76.538284][ T6534] kernfs_destroy_root+0x89/0xb0
[ 76.543223][ T6534] cgroup_setup_root+0x3a6/0xad0
[ 76.548255][ T6534] ? rebind_subsystems+0x10e0/0x10e0
[ 76.553539][ T6534] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 76.559822][ T6534] cgroup1_get_tree+0xd33/0x1390
[ 76.564764][ T6534] vfs_get_tree+0x89/0x2f0
[ 76.569461][ T6534] path_mount+0x1320/0x1fa0
[ 76.573978][ T6534] ? kmem_cache_free+0xba/0x4a0
[ 76.578835][ T6534] ? finish_automount+0xaf0/0xaf0
[ 76.583989][ T6534] ? putname+0xfe/0x140
[ 76.588225][ T6534] __x64_sys_mount+0x27f/0x300
[ 76.593294][ T6534] ? copy_mnt_ns+0xae0/0xae0
[ 76.598011][ T6534] ? syscall_enter_from_user_mode+0x21/0x70
[ 76.604047][ T6534] do_syscall_64+0x35/0xb0
[ 76.608475][ T6534] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 76.614361][ T6534] RIP: 0033:0x7f7dc773f01a
[ 76.618774][ T6534] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 76.638477][ T6534] RSP: 002b:00007ffe67cb9918 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 76.646943][ T6534] RAX: ffffffffffffffda RBX: 00007ffe67cb9aa8 RCX: 00007f7dc773f01a
[ 76.655181][ T6534] RDX: 00007f7dc77a1fe2 RSI: 00007f7dc779829a RDI: 00007f7dc7796d71
[ 76.663153][ T6534] RBP: 00007f7dc779829a R08: 00007f7dc77983f7 R09: 0000000000000026
[ 76.671139][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe67cb9920
[ 76.679362][ T6534] R13: 00007ffe67cb9ac8 R14: 00007ffe67cb99f0 R15: 00007f7dc77983f1
[ 76.687330][ T6534]
[ 76.692140][ T6534] ==================================================================
[ 76.700221][ T6534] BUG: KASAN: use-after-free in up_write+0x3ac/0x470
[ 76.707047][ T6534] Read of size 8 at addr ffff888017c57540 by task syz-executor/6534
[ 76.715132][ T6534]
[ 76.717442][ T6534] CPU: 0 PID: 6534 Comm: syz-executor Not tainted 5.16.0-rc3-next-20211130-syzkaller #0
[ 76.727231][ T6534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 76.737290][ T6534] Call Trace:
[ 76.740557][ T6534]
[ 76.743487][ T6534] dump_stack_lvl+0xcd/0x134
[ 76.748069][ T6534] print_address_description.constprop.0.cold+0xa5/0x3ed
[ 76.755088][ T6534] ? up_write+0x3ac/0x470
[ 76.759578][ T6534] ? up_write+0x3ac/0x470
[ 76.763916][ T6534] kasan_report.cold+0x83/0xdf
[ 76.768696][ T6534] ? up_write+0x3ac/0x470
[ 76.773013][ T6534] up_write+0x3ac/0x470
[ 76.777152][ T6534] cgroup_setup_root+0x3a6/0xad0
[ 76.782082][ T6534] ? rebind_subsystems+0x10e0/0x10e0
[ 76.787386][ T6534] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 76.793904][ T6534] cgroup1_get_tree+0xd33/0x1390
[ 76.799028][ T6534] vfs_get_tree+0x89/0x2f0
[ 76.803575][ T6534] path_mount+0x1320/0x1fa0
[ 76.808197][ T6534] ? kmem_cache_free+0xba/0x4a0
[ 76.813232][ T6534] ? finish_automount+0xaf0/0xaf0
[ 76.818605][ T6534] ? putname+0xfe/0x140
[ 76.822890][ T6534] __x64_sys_mount+0x27f/0x300
[ 76.827656][ T6534] ? copy_mnt_ns+0xae0/0xae0
[ 76.832367][ T6534] ? syscall_enter_from_user_mode+0x21/0x70
[ 76.838500][ T6534] do_syscall_64+0x35/0xb0
[ 76.842972][ T6534] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 76.848864][ T6534] RIP: 0033:0x7f7dc773f01a
[ 76.853296][ T6534] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 76.872899][ T6534] RSP: 002b:00007ffe67cb9918 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 76.881501][ T6534] RAX: ffffffffffffffda RBX: 00007ffe67cb9aa8 RCX: 00007f7dc773f01a
[ 76.889491][ T6534] RDX: 00007f7dc77a1fe2 RSI: 00007f7dc779829a RDI: 00007f7dc7796d71
[ 76.897612][ T6534] RBP: 00007f7dc779829a R08: 00007f7dc77983f7 R09: 0000000000000026
[ 76.905589][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe67cb9920
[ 76.913781][ T6534] R13: 00007ffe67cb9ac8 R14: 00007ffe67cb99f0 R15: 00007f7dc77983f1
[ 76.922222][ T6534]
[ 76.925233][ T6534]
[ 76.927623][ T6534] Allocated by task 6534:
[ 76.932011][ T6534] kasan_save_stack+0x1e/0x50
[ 76.936887][ T6534] __kasan_kmalloc+0xa9/0xd0
[ 76.941564][ T6534] kernfs_create_root+0x4c/0x410
[ 76.946498][ T6534] cgroup_setup_root+0x243/0xad0
[ 76.951434][ T6534] cgroup1_get_tree+0xd33/0x1390
[ 76.956479][ T6534] vfs_get_tree+0x89/0x2f0
[ 76.960892][ T6534] path_mount+0x1320/0x1fa0
[ 76.965401][ T6534] __x64_sys_mount+0x27f/0x300
[ 76.970157][ T6534] do_syscall_64+0x35/0xb0
[ 76.974562][ T6534] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 76.980447][ T6534]
[ 76.983202][ T6534] Freed by task 6534:
[ 76.987487][ T6534] kasan_save_stack+0x1e/0x50
[ 76.992193][ T6534] kasan_set_track+0x21/0x30
[ 76.997015][ T6534] kasan_set_free_info+0x20/0x30
[ 77.002250][ T6534] __kasan_slab_free+0x103/0x170
[ 77.007368][ T6534] slab_free_freelist_hook+0x8b/0x1c0
[ 77.012865][ T6534] kfree+0xe0/0x430
[ 77.016675][ T6534] kernfs_put.part.0+0x331/0x540
[ 77.021603][ T6534] kernfs_put+0x42/0x50
[ 77.025768][ T6534] __kernfs_remove+0x7a3/0xb20
[ 77.030517][ T6534] kernfs_destroy_root+0x89/0xb0
[ 77.035452][ T6534] cgroup_setup_root+0x3a6/0xad0
[ 77.040463][ T6534] cgroup1_get_tree+0xd33/0x1390
[ 77.045564][ T6534] vfs_get_tree+0x89/0x2f0
[ 77.050114][ T6534] path_mount+0x1320/0x1fa0
[ 77.054615][ T6534] __x64_sys_mount+0x27f/0x300
[ 77.059468][ T6534] do_syscall_64+0x35/0xb0
[ 77.063895][ T6534] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 77.069775][ T6534]
[ 77.072088][ T6534] The buggy address belongs to the object at ffff888017c57400
[ 77.072088][ T6534] which belongs to the cache kmalloc-512 of size 512
[ 77.086327][ T6534] The buggy address is located 320 bytes inside of
[ 77.086327][ T6534] 512-byte region [ffff888017c57400, ffff888017c57600)
[ 77.100008][ T6534] The buggy address belongs to the page:
[ 77.105626][ T6534] page:ffffea00005f1500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17c54
[ 77.115788][ T6534] head:ffffea00005f1500 order:2 compound_mapcount:0 compound_pincount:0
[ 77.124186][ T6534] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 77.132154][ T6534] raw: 00fff00000010200 ffffea0000571200 dead000000000002 ffff888010c41c80
[ 77.140739][ T6534] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 77.149389][ T6534] page dumped because: kasan: bad access detected
[ 77.156046][ T6534] page_owner tracks the page as allocated
[ 77.161752][ T6534] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 135, ts 7148001922, free_ts 0
[ 77.179895][ T6534] get_page_from_freelist+0xa72/0x2f40
[ 77.185352][ T6534] __alloc_pages+0x1b2/0x500
[ 77.189940][ T6534] alloc_pages+0x1a7/0x300
[ 77.194463][ T6534] new_slab+0x261/0x460
[ 77.198605][ T6534] ___slab_alloc+0x798/0xf30
[ 77.203181][ T6534] __slab_alloc.constprop.0+0x4d/0xa0
[ 77.208615][ T6534] kmem_cache_alloc_trace+0x289/0x2c0
[ 77.214078][ T6534] cryptomgr_notify+0x4ba/0xbe0
[ 77.218999][ T6534] notifier_call_chain+0xb5/0x200
[ 77.224019][ T6534] blocking_notifier_call_chain+0x67/0x90
[ 77.229769][ T6534] crypto_wait_for_test+0x49/0x110
[ 77.235087][ T6534] crypto_larval_wait+0x268/0x330
[ 77.240110][ T6534] crypto_alg_mod_lookup+0x299/0x4d0
[ 77.245386][ T6534] crypto_grab_spawn+0x82/0x400
[ 77.250399][ T6534] hmac_create+0x159/0x7d0
[ 77.255213][ T6534] cryptomgr_probe+0xb0/0x1f0
[ 77.259912][ T6534] page_owner free stack trace missing
[ 77.265438][ T6534]
[ 77.267749][ T6534] Memory state around the buggy address:
[ 77.273369][ T6534] ffff888017c57400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.281423][ T6534] ffff888017c57480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.289464][ T6534] >ffff888017c57500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.297685][ T6534] ^
[ 77.303909][ T6534] ffff888017c57580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.311950][ T6534] ffff888017c57600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.319987][ T6534] ==================================================================
[ 77.331713][ T6534] Kernel panic - not syncing: panic_on_warn set ...
[ 77.338324][ T6534] CPU: 0 PID: 6534 Comm: syz-executor Tainted: G B 5.16.0-rc3-next-20211130-syzkaller #0
[ 77.349441][ T6534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 77.359512][ T6534] Call Trace:
[ 77.362793][ T6534]
[ 77.365736][ T6534] dump_stack_lvl+0xcd/0x134
[ 77.370344][ T6534] panic+0x2b0/0x6dd
[ 77.374254][ T6534] ? __warn_printk+0xf3/0xf3
[ 77.378951][ T6534] ? preempt_schedule_common+0x59/0xc0
[ 77.384437][ T6534] ? up_write+0x3ac/0x470
[ 77.388877][ T6534] ? preempt_schedule_thunk+0x16/0x18
[ 77.394311][ T6534] ? trace_hardirqs_on+0x38/0x1c0
[ 77.399320][ T6534] ? trace_hardirqs_on+0x51/0x1c0
[ 77.404328][ T6534] ? up_write+0x3ac/0x470
[ 77.408640][ T6534] ? up_write+0x3ac/0x470
[ 77.412958][ T6534] end_report.cold+0x63/0x6f
[ 77.417536][ T6534] kasan_report.cold+0x71/0xdf
[ 77.422300][ T6534] ? up_write+0x3ac/0x470
[ 77.426630][ T6534] up_write+0x3ac/0x470
[ 77.430791][ T6534] cgroup_setup_root+0x3a6/0xad0
[ 77.435857][ T6534] ? rebind_subsystems+0x10e0/0x10e0
[ 77.441269][ T6534] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80
[ 77.447518][ T6534] cgroup1_get_tree+0xd33/0x1390
[ 77.452579][ T6534] vfs_get_tree+0x89/0x2f0
[ 77.456997][ T6534] path_mount+0x1320/0x1fa0
[ 77.461510][ T6534] ? kmem_cache_free+0xba/0x4a0
[ 77.466548][ T6534] ? finish_automount+0xaf0/0xaf0
[ 77.471580][ T6534] ? putname+0xfe/0x140
[ 77.475753][ T6534] __x64_sys_mount+0x27f/0x300
[ 77.480507][ T6534] ? copy_mnt_ns+0xae0/0xae0
[ 77.485183][ T6534] ? syscall_enter_from_user_mode+0x21/0x70
[ 77.491341][ T6534] do_syscall_64+0x35/0xb0
[ 77.495850][ T6534] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 77.501913][ T6534] RIP: 0033:0x7f7dc773f01a
[ 77.506506][ T6534] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 77.527025][ T6534] RSP: 002b:00007ffe67cb9918 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 77.535609][ T6534] RAX: ffffffffffffffda RBX: 00007ffe67cb9aa8 RCX: 00007f7dc773f01a
[ 77.543587][ T6534] RDX: 00007f7dc77a1fe2 RSI: 00007f7dc779829a RDI: 00007f7dc7796d71
[ 77.551968][ T6534] RBP: 00007f7dc779829a R08: 00007f7dc77983f7 R09: 0000000000000026
[ 77.560282][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe67cb9920
[ 77.568456][ T6534] R13: 00007ffe67cb9ac8 R14: 00007ffe67cb99f0 R15: 00007f7dc77983f1
[ 77.576672][ T6534]
[ 77.580027][ T6534] Kernel Offset: disabled
[ 77.584347][ T6534] Rebooting in 86400 seconds..