================================================================================ UBSAN: array-index-out-of-bounds in kernel/pid.c:244:15 index 1 is out of range for type 'upid [1]' CPU: 0 PID: 5009 Comm: syz-executor.0 Not tainted 6.4.0-syzkaller-07066-g1b722407a13b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0xd5/0x140 lib/ubsan.c:348 alloc_pid+0xbe5/0xdd0 kernel/pid.c:244 copy_process+0x4589/0x7620 kernel/fork.c:2519 kernel_clone+0xeb/0x890 kernel/fork.c:2911 __do_compat_sys_ia32_clone+0x9e/0xd0 arch/x86/kernel/sys_ia32.c:254 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] do_int80_syscall_32+0x4a/0x90 arch/x86/entry/common.c:132 entry_INT80_compat+0x8f/0xa0 arch/x86/entry/entry_64_compat.S:353 RIP: 0023:0xf725c8e4 Code: 8b 44 24 04 89 41 08 c7 41 04 00 00 00 00 53 56 57 8b 74 24 24 8b 54 24 20 8b 5c 24 18 8b 7c 24 28 b8 78 00 00 00 89 19 cd 80 <5f> 5e 5b 85 c0 0f 8c 61 81 00 00 74 01 c3 89 f5 ff d3 e8 00 00 00 RSP: 002b:00000000ffa8b8a0 EFLAGS: 00000292 ORIG_RAX: 0000000000000078 RAX: ffffffffffffffda RBX: 0000000030000000 RCX: 00000000f749ffa4 RDX: 00000000f73a0000 RSI: 0000000000001000 RDI: 0000000000000000 RBP: 00000000ffa8bd88 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ================================================================================ ---------------- Code disassembly (best guess): 0: 8b 44 24 04 mov 0x4(%rsp),%eax 4: 89 41 08 mov %eax,0x8(%rcx) 7: c7 41 04 00 00 00 00 movl $0x0,0x4(%rcx) e: 53 push %rbx f: 56 push %rsi 10: 57 push %rdi 11: 8b 74 24 24 mov 0x24(%rsp),%esi 15: 8b 54 24 20 mov 0x20(%rsp),%edx 19: 8b 5c 24 18 mov 0x18(%rsp),%ebx 1d: 8b 7c 24 28 mov 0x28(%rsp),%edi 21: b8 78 00 00 00 mov $0x78,%eax 26: 89 19 mov %ebx,(%rcx) 28: cd 80 int $0x80 * 2a: 5f pop %rdi <-- trapping instruction 2b: 5e pop %rsi 2c: 5b pop %rbx 2d: 85 c0 test %eax,%eax 2f: 0f 8c 61 81 00 00 jl 0x8196 35: 74 01 je 0x38 37: c3 retq 38: 89 f5 mov %esi,%ebp 3a: ff d3 callq *%rbx 3c: e8 .byte 0xe8 3d: 00 00 add %al,(%rax)