audit: type=1804 audit(1644771921.006:10): pid=11541 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir357010002/syzkaller.reFIC7/132/file0" dev="sda1" ino=14161 res=1 kasan: GPF could be caused by NULL-ptr deref or user memory access audit: type=1804 audit(1644771921.076:11): pid=11551 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir089902213/syzkaller.f1CXfm/141/file0" dev="sda1" ino=14154 res=1 general protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 11539 Comm: syz-executor.5 Not tainted 4.14.266-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff888091f90240 task.stack: ffff888046318000 RIP: 0010:ipt_init_target+0x97/0x250 net/sched/act_ipt.c:46 RSP: 0018:ffff88804631f160 EFLAGS: 00010202 audit: type=1804 audit(1644771921.096:12): pid=11555 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir453005344/syzkaller.lAGfC0/139/file0" dev="sda1" ino=14161 res=1 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000007 RSI: ffffffff85d447a1 RDI: 000000000000002f RBP: 0000000000000010 R08: 0000000000000001 R09: ffffed101659bcc0 R10: ffff8880b2cde606 R11: 0000000000000000 R12: 1ffff11008c63e2f R13: ffff88804631f1e8 R14: 0000000000000010 R15: ffff8880a95cc080 FS: 00007fdbe47b2700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff1758f8000 CR3: 0000000098ebc000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __tcf_ipt_init+0x48d/0xc00 net/sched/act_ipt.c:168 tcf_ipt_init+0x43/0x50 net/sched/act_ipt.c:202 tcf_action_init_1+0x51a/0x9e0 net/sched/act_api.c:682 tcf_action_init+0x26d/0x400 net/sched/act_api.c:751 tcf_action_add net/sched/act_api.c:1079 [inline] tc_ctl_action+0x2e3/0x510 net/sched/act_api.c:1131 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4322 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2446 netlink_unicast_kernel net/netlink/af_netlink.c:1294 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1320 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fdbe5e3d059 RSP: 002b:00007fdbe47b2168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdbe5f4ff60 RCX: 00007fdbe5e3d059 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00007fdbe5e9708d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9525930f R14: 00007fdbe47b2300 R15: 0000000000022000 Code: e8 0f f8 80 fb 31 c0 b9 0e 00 00 00 4c 8d ac 24 88 00 00 00 4c 89 ef f3 48 ab 48 8d 7d 1f 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <0f> b6 04 18 38 d0 7f 08 84 c0 0f 85 67 01 00 00 0f b6 55 1f 48 RIP: ipt_init_target+0x97/0x250 net/sched/act_ipt.c:46 RSP: ffff88804631f160 ---[ end trace dd992c22b9fd5311 ]--- ---------------- Code disassembly (best guess): 0: e8 0f f8 80 fb callq 0xfb80f814 5: 31 c0 xor %eax,%eax 7: b9 0e 00 00 00 mov $0xe,%ecx c: 4c 8d ac 24 88 00 00 lea 0x88(%rsp),%r13 13: 00 14: 4c 89 ef mov %r13,%rdi 17: f3 48 ab rep stos %rax,%es:(%rdi) 1a: 48 8d 7d 1f lea 0x1f(%rbp),%rdi 1e: 48 89 f8 mov %rdi,%rax 21: 48 89 fa mov %rdi,%rdx 24: 48 c1 e8 03 shr $0x3,%rax 28: 83 e2 07 and $0x7,%edx * 2b: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax <-- trapping instruction 2f: 38 d0 cmp %dl,%al 31: 7f 08 jg 0x3b 33: 84 c0 test %al,%al 35: 0f 85 67 01 00 00 jne 0x1a2 3b: 0f b6 55 1f movzbl 0x1f(%rbp),%edx 3f: 48 rex.W