FAULT_INJECTION: forcing a failure. name fail_usercopy, interval 1, probability 0, space 0, times 0 ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ syz.3.986/9634 is trying to acquire lock: ffffffff8e2d6a00 (console_owner){-.-.}-{0:0}, at: console_lock_spinning_enable+0x61/0x80 kernel/printk/printk.c:1900 but task is already holding lock: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:647 [inline] ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:632 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&rq->__lock){-.-.}-{2:2}: _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:639 raw_spin_rq_lock kernel/sched/sched.h:1558 [inline] task_rq_lock+0xcf/0x490 kernel/sched/core.c:739 cgroup_move_task+0x81/0x2a0 kernel/sched/psi.c:1170 css_set_move_task+0x288/0x5f0 kernel/cgroup/cgroup.c:951 cgroup_post_fork+0x201/0x9e0 kernel/cgroup/cgroup.c:6913 copy_process+0x51d3/0x74e0 kernel/fork.c:2422 kernel_clone+0xfc/0x910 kernel/fork.c:2608 user_mode_thread+0xc8/0x110 kernel/fork.c:2684 rest_init+0x23/0x2b0 init/main.c:722 start_kernel+0x3f6/0x4d0 init/main.c:1111 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x130/0x190 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x148 -> #3 (&p->pi_lock){-.-.}-{2:2}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:557 [inline] try_to_wake_up+0xb7/0x1860 kernel/sched/core.c:4106 __wake_up_common+0x135/0x1f0 kernel/sched/wait.c:108 __wake_up_common_lock kernel/sched/wait.c:125 [inline] __wake_up+0x31/0x60 kernel/sched/wait.c:146 tty_port_default_wakeup+0x4d/0x60 drivers/tty/tty_port.c:67 serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1719 serial8250_handle_irq+0x761/0xcb0 drivers/tty/serial/8250/8250_port.c:1827 serial8250_default_handle_irq+0x9e/0x270 drivers/tty/serial/8250/8250_port.c:1846 serial8250_interrupt+0xf8/0x1d0 drivers/tty/serial/8250/8250_core.c:82 __handle_irq_event_percpu+0x236/0x890 kernel/irq/handle.c:211 handle_irq_event_percpu kernel/irq/handle.c:248 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:265 handle_edge_irq+0x3ca/0x9e0 kernel/irq/chip.c:855 generic_handle_irq_desc include/linux/irqdesc.h:172 [inline] handle_irq arch/x86/kernel/irq.c:255 [inline] call_irq_handler arch/x86/kernel/irq.c:311 [inline] __common_interrupt+0xd0/0x2f0 arch/x86/kernel/irq.c:326 common_interrupt+0x61/0xe0 arch/x86/kernel/irq.c:319 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688 variable_ffs arch/x86/include/asm/bitops.h:312 [inline] handle_softirqs+0x1dd/0x8b0 kernel/softirq.c:610 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 console_flush_one_record+0x995/0xc60 kernel/printk/printk.c:3216 console_flush_all kernel/printk/printk.c:3289 [inline] __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0xef/0x240 kernel/printk/printk.c:3359 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426 _printk+0xc7/0x100 kernel/printk/printk.c:2451 kauditd_printk_skb kernel/audit.c:583 [inline] kauditd_hold_skb+0x205/0x250 kernel/audit.c:618 kauditd_send_queue+0x239/0x290 kernel/audit.c:803 kauditd_thread+0x621/0xb30 kernel/audit.c:927 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 -> #2 (&tty->write_wait){-.-.}-{3:3}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 __wake_up_common_lock kernel/sched/wait.c:124 [inline] __wake_up+0x1c/0x60 kernel/sched/wait.c:146 tty_port_default_wakeup+0x4d/0x60 drivers/tty/tty_port.c:67 serial8250_tx_chars+0x68e/0x860 drivers/tty/serial/8250/8250_port.c:1719 serial8250_handle_irq+0x761/0xcb0 drivers/tty/serial/8250/8250_port.c:1827 serial8250_default_handle_irq+0x9e/0x270 drivers/tty/serial/8250/8250_port.c:1846 serial8250_interrupt+0xf8/0x1d0 drivers/tty/serial/8250/8250_core.c:82 __handle_irq_event_percpu+0x236/0x890 kernel/irq/handle.c:211 handle_irq_event_percpu kernel/irq/handle.c:248 [inline] handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:265 handle_edge_irq+0x3ca/0x9e0 kernel/irq/chip.c:855 generic_handle_irq_desc include/linux/irqdesc.h:172 [inline] handle_irq arch/x86/kernel/irq.c:255 [inline] call_irq_handler arch/x86/kernel/irq.c:311 [inline] __common_interrupt+0xd0/0x2f0 arch/x86/kernel/irq.c:326 common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:319 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688 get_current arch/x86/include/asm/current.h:25 [inline] finish_task_switch.isra.0+0x210/0xbd0 kernel/sched/core.c:5114 context_switch kernel/sched/core.c:5259 [inline] __schedule+0x1141/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 worker_thread+0x2e5/0xf10 kernel/workqueue.c:3436 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 -> #1 (&port_lock_key){-.-.}-{3:3}: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 uart_port_lock_irqsave include/linux/serial_core.h:717 [inline] serial8250_console_write+0x181/0x1890 drivers/tty/serial/8250/8250_port.c:3301 console_emit_next_record kernel/printk/printk.c:3129 [inline] console_flush_one_record+0x796/0xc60 kernel/printk/printk.c:3215 console_flush_all kernel/printk/printk.c:3289 [inline] __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0xef/0x240 kernel/printk/printk.c:3359 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426 _printk+0xc7/0x100 kernel/printk/printk.c:2451 register_console+0x823/0x1210 kernel/printk/printk.c:4170 univ8250_console_init+0x5f/0x90 drivers/tty/serial/8250/8250_core.c:511 console_init+0x152/0x600 kernel/printk/printk.c:4369 start_kernel+0x29f/0x4d0 init/main.c:1048 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x130/0x190 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x148 -> #0 (console_owner){-.-.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x1542/0x22f0 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x179/0x330 kernel/locking/lockdep.c:5825 console_lock_spinning_enable+0x72/0x80 kernel/printk/printk.c:1900 console_emit_next_record kernel/printk/printk.c:3123 [inline] console_flush_one_record+0x73f/0xc60 kernel/printk/printk.c:3215 console_flush_all kernel/printk/printk.c:3289 [inline] __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0xef/0x240 kernel/printk/printk.c:3359 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426 _printk+0xc7/0x100 kernel/printk/printk.c:2451 fail_dump lib/fault-inject.c:66 [inline] should_fail_ex+0x4e7/0x640 lib/fault-inject.c:174 strncpy_from_user+0x3b/0x2e0 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:192 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:214 [inline] ____bpf_probe_read_user_str kernel/trace/bpf_trace.c:223 [inline] bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:220 bpf_prog_356b86beefa38338+0x43/0x49 bpf_dispatcher_nop_func include/linux/bpf.h:1376 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] bpf_trace_run4+0x252/0x5e0 kernel/trace/bpf_trace.c:2118 __bpf_trace_sched_switch+0x145/0x190 include/trace/events/sched.h:220 __traceiter_sched_switch+0x6f/0xc0 include/trace/events/sched.h:220 __do_trace_sched_switch include/trace/events/sched.h:220 [inline] trace_sched_switch include/trace/events/sched.h:220 [inline] __schedule+0x1a41/0x6150 kernel/sched/core.c:6860 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7190 irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 __mutex_unlock_slowpath+0x0/0x790 usercopy_64.c:-1 fdput_pos include/linux/file.h:79 [inline] class_fd_pos_destructor include/linux/file.h:85 [inline] ksys_write+0x190/0x250 fs/read_write.c:729 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: console_owner --> &p->pi_lock --> &rq->__lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&rq->__lock); lock(&p->pi_lock); lock(&rq->__lock); lock(console_owner); *** DEADLOCK *** 5 locks held by syz.3.986/9634: #0: ffff888032808478 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a2/0x370 fs/file.c:1255 #1: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:647 [inline] #1: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:632 #2: ffffffff8e3c9460 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e3c9460 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #2: ffffffff8e3c9460 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2074 [inline] #2: ffffffff8e3c9460 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x1d5/0x5e0 kernel/trace/bpf_trace.c:2118 #3: ffffffff8e3b6e40 (console_lock){+.+.}-{0:0}, at: _printk+0xc7/0x100 kernel/printk/printk.c:2451 #4: ffffffff8e3b6eb8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:336 [inline] #4: ffffffff8e3b6eb8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:409 [inline] #4: ffffffff8e3b6eb8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:289 [inline] #4: ffffffff8e3b6eb8 (console_srcu){....}-{0:0}, at: console_flush_one_record+0x103/0xc60 kernel/printk/printk.c:3192 stack backtrace: CPU: 1 UID: 0 PID: 9634 Comm: syz.3.986 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_circular_bug+0x2db/0x410 kernel/locking/lockdep.c:2043 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x1542/0x22f0 kernel/locking/lockdep.c:5237 lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x179/0x330 kernel/locking/lockdep.c:5825 console_lock_spinning_enable+0x72/0x80 kernel/printk/printk.c:1900 console_emit_next_record kernel/printk/printk.c:3123 [inline] console_flush_one_record+0x73f/0xc60 kernel/printk/printk.c:3215 console_flush_all kernel/printk/printk.c:3289 [inline] __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0xef/0x240 kernel/printk/printk.c:3359 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426 _printk+0xc7/0x100 kernel/printk/printk.c:2451 fail_dump lib/fault-inject.c:66 [inline] should_fail_ex+0x4e7/0x640 lib/fault-inject.c:174 strncpy_from_user+0x3b/0x2e0 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:192 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:214 [inline] ____bpf_probe_read_user_str kernel/trace/bpf_trace.c:223 [inline] bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:220 bpf_prog_356b86beefa38338+0x43/0x49 bpf_dispatcher_nop_func include/linux/bpf.h:1376 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] bpf_trace_run4+0x252/0x5e0 kernel/trace/bpf_trace.c:2118 __bpf_trace_sched_switch+0x145/0x190 include/trace/events/sched.h:220 __traceiter_sched_switch+0x6f/0xc0 include/trace/events/sched.h:220 __do_trace_sched_switch include/trace/events/sched.h:220 [inline] trace_sched_switch include/trace/events/sched.h:220 [inline] __schedule+0x1a41/0x6150 kernel/sched/core.c:6860 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7190 irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__mutex_unlock_slowpath+0x0/0x790 kernel/locking/mutex.c:932 Code: 39 ff ff ff 48 c7 c7 70 81 87 90 e8 ca 63 be f6 eb aa 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 57 49 89 ff 48 83 c7 68 41 56 41 55 41 54 55 53 48 bb 00 00 00 RSP: 0018:ffffc900046bfe78 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff888032808383 RCX: ffffffff823aa71e RDX: ffff888036f40000 RSI: ffffffff823aa730 RDI: ffff888032808410 RBP: ffff888032808380 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 1ffff11006e7f52a R12: 1ffff920008d7fd0 R13: 0000000000000001 R14: 0000000000000002 R15: 0000000000000000 fdput_pos include/linux/file.h:79 [inline] class_fd_pos_destructor include/linux/file.h:85 [inline] ksys_write+0x190/0x250 fs/read_write.c:729 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb69fd8e1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007fb6a0c0e030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fb69fd8e1ff RDX: 0000000000000001 RSI: 00007fb6a0c0e090 RDI: 0000000000000006 RBP: 00007fb6a0c0e090 R08: 0000000000000000 R09: 00007fb6a0c0ddf7 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 R13: 00007fb69ffe6038 R14: 00007fb69ffe5fa0 R15: 00007fff78a84f88 CPU: 1 UID: 0 PID: 9634 Comm: syz.3.986 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 fail_dump lib/fault-inject.c:73 [inline] should_fail_ex+0x512/0x640 lib/fault-inject.c:174 strncpy_from_user+0x3b/0x2e0 lib/strncpy_from_user.c:118 strncpy_from_user_nofault+0x7f/0x180 mm/maccess.c:192 bpf_probe_read_user_str_common kernel/trace/bpf_trace.c:214 [inline] ____bpf_probe_read_user_str kernel/trace/bpf_trace.c:223 [inline] bpf_probe_read_user_str+0x26/0x70 kernel/trace/bpf_trace.c:220 bpf_prog_356b86beefa38338+0x43/0x49 bpf_dispatcher_nop_func include/linux/bpf.h:1376 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2075 [inline] bpf_trace_run4+0x252/0x5e0 kernel/trace/bpf_trace.c:2118 __bpf_trace_sched_switch+0x145/0x190 include/trace/events/sched.h:220 __traceiter_sched_switch+0x6f/0xc0 include/trace/events/sched.h:220 __do_trace_sched_switch include/trace/events/sched.h:220 [inline] trace_sched_switch include/trace/events/sched.h:220 [inline] __schedule+0x1a41/0x6150 kernel/sched/core.c:6860 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7190 irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__mutex_unlock_slowpath+0x0/0x790 kernel/locking/mutex.c:932 Code: 39 ff ff ff 48 c7 c7 70 81 87 90 e8 ca 63 be f6 eb aa 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 57 49 89 ff 48 83 c7 68 41 56 41 55 41 54 55 53 48 bb 00 00 00 RSP: 0018:ffffc900046bfe78 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffff888032808383 RCX: ffffffff823aa71e RDX: ffff888036f40000 RSI: ffffffff823aa730 RDI: ffff888032808410 RBP: ffff888032808380 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000002 R11: 1ffff11006e7f52a R12: 1ffff920008d7fd0 R13: 0000000000000001 R14: 0000000000000002 R15: 0000000000000000 fdput_pos include/linux/file.h:79 [inline] class_fd_pos_destructor include/linux/file.h:85 [inline] ksys_write+0x190/0x250 fs/read_write.c:729 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb69fd8e1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007fb6a0c0e030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fb69fd8e1ff RDX: 0000000000000001 RSI: 00007fb6a0c0e090 RDI: 0000000000000006 RBP: 00007fb6a0c0e090 R08: 0000000000000000 R09: 00007fb6a0c0ddf7 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 R13: 00007fb69ffe6038 R14: 00007fb69ffe5fa0 R15: 00007fff78a84f88 netlink: 'syz.3.986': attribute type 2 has an invalid length. netlink: 244 bytes leftover after parsing attributes in process `syz.3.986'. ---------------- Code disassembly (best guess), 4 bytes skipped: 0: 48 c7 c7 70 81 87 90 mov $0xffffffff90878170,%rdi 7: e8 ca 63 be f6 call 0xf6be63d6 c: eb aa jmp 0xffffffb8 e: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 15: 00 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: 90 nop 25: 90 nop * 26: 41 57 push %r15 <-- trapping instruction 28: 49 89 ff mov %rdi,%r15 2b: 48 83 c7 68 add $0x68,%rdi 2f: 41 56 push %r14 31: 41 55 push %r13 33: 41 54 push %r12 35: 55 push %rbp 36: 53 push %rbx 37: 48 rex.W 38: bb .byte 0xbb 39: 00 00 add %al,(%rax)