Warning: Permanently added '10.128.10.34' (ED25519) to the list of known hosts. 2024/07/18 01:06:43 ignoring optional flag "sandboxArg"="0" 2024/07/18 01:06:43 parsed 1 programs [ 49.266143][ T23] kauditd_printk_skb: 19 callbacks suppressed [ 49.266155][ T23] audit: type=1400 audit(1721264803.260:95): avc: denied { unlink } for pid=412 comm="syz-executor" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" 2024/07/18 01:06:43 executed programs: 0 [ 49.352390][ T412] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 49.426326][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.433283][ T418] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.441440][ T418] device bridge_slave_0 entered promiscuous mode [ 49.448558][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.455389][ T418] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.463104][ T418] device bridge_slave_1 entered promiscuous mode [ 49.519140][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.526335][ T418] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.533606][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.540593][ T418] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.566443][ T108] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.574515][ T108] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.583804][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 49.591644][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.606217][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.614492][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.621454][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.628743][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.637055][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.644148][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.655986][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.675776][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.684012][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.695793][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.716164][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.724807][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.734669][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.761865][ T424] kernel profiling enabled (shift: 7) [ 49.925468][ C0] ================================================================== [ 49.933386][ C0] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 [ 49.940505][ C0] Read of size 8 at addr ffff8881d9d07820 by task udevd/420 [ 49.947722][ C0] [ 49.950014][ C0] CPU: 0 PID: 420 Comm: udevd Not tainted 5.4.276-syzkaller-04920-g3ffe89ed1bf9 #0 [ 49.959465][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 49.969543][ C0] Call Trace: [ 49.972752][ C0] [ 49.975540][ C0] dump_stack+0x1d8/0x241 [ 49.979895][ C0] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 49.986028][ C0] ? printk+0xd1/0x111 [ 49.990127][ C0] ? profile_pc+0xa4/0xe0 [ 49.994811][ C0] ? wake_up_klogd+0xb2/0xf0 [ 49.999463][ C0] ? profile_pc+0xa4/0xe0 [ 50.003603][ C0] print_address_description+0x8c/0x600 [ 50.008992][ C0] ? panic+0x89d/0x89d [ 50.013020][ C0] ? profile_pc+0xa4/0xe0 [ 50.017245][ C0] __kasan_report+0xf3/0x120 [ 50.021759][ C0] ? profile_pc+0xa4/0xe0 [ 50.026009][ C0] ? _raw_spin_lock+0xa9/0x1b0 [ 50.030779][ C0] kasan_report+0x30/0x60 [ 50.035151][ C0] profile_pc+0xa4/0xe0 [ 50.039217][ C0] profile_tick+0xb9/0x100 [ 50.043788][ C0] tick_sched_timer+0x237/0x3c0 [ 50.048995][ C0] ? tick_setup_sched_timer+0x460/0x460 [ 50.054410][ C0] __hrtimer_run_queues+0x3e9/0xb90 [ 50.059464][ C0] ? hrtimer_interrupt+0x890/0x890 [ 50.064654][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 50.069692][ C0] ? sched_clock+0x36/0x40 [ 50.073942][ C0] ? ktime_get+0xf9/0x130 [ 50.078112][ C0] ? ktime_get_update_offsets_now+0x26c/0x280 [ 50.084002][ C0] hrtimer_interrupt+0x38a/0x890 [ 50.088833][ C0] smp_apic_timer_interrupt+0x110/0x460 [ 50.094174][ C0] apic_timer_interrupt+0xf/0x20 [ 50.099032][ C0] [ 50.101980][ C0] RIP: 0010:_raw_spin_lock+0xa9/0x1b0 [ 50.107167][ C0] Code: 00 00 00 c7 44 24 20 00 00 00 00 4c 89 ef be 04 00 00 00 e8 29 dc 42 fd 4c 89 ff be 04 00 00 00 e8 1c dc 42 fd 43 0f b6 04 26 <84> c0 0f 85 aa 00 00 00 8b 44 24 20 b9 01 00 00 00 f0 41 0f b1 4d [ 50.126976][ C0] RSP: 0018:ffff8881d9d07820 EFLAGS: 00000297 ORIG_RAX: ffffffffffffff13 [ 50.135435][ C0] RAX: 0000000000000004 RBX: 1ffff1103b3a0f04 RCX: ffffffff84511504 [ 50.143251][ C0] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff8881d9d07840 [ 50.151059][ C0] RBP: ffff8881d9d078c0 R08: dffffc0000000000 R09: 0000000000000003 [ 50.159092][ C0] R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000 [ 50.167031][ C0] R13: ffff8881da96ec08 R14: 1ffff1103b3a0f08 R15: ffff8881d9d07840 [ 50.174963][ C0] ? _raw_spin_lock+0xa4/0x1b0 [ 50.179549][ C0] ? _raw_spin_trylock_bh+0x190/0x190 [ 50.184762][ C0] ? fast_dput+0x7a/0x280 [ 50.189007][ C0] ? _raw_spin_trylock+0xcd/0x1a0 [ 50.193871][ C0] __dentry_kill+0x4a3/0x630 [ 50.198561][ C0] dentry_kill+0xb8/0x280 [ 50.202969][ C0] dput+0x3c/0x80 [ 50.206380][ C0] terminate_walk+0x192/0x450 [ 50.211021][ C0] path_lookupat+0x27c/0x3f0 [ 50.215448][ C0] filename_lookup+0x253/0x6e0 [ 50.220304][ C0] ? hashlen_string+0x110/0x110 [ 50.225139][ C0] ? getname_flags+0x1ec/0x4e0 [ 50.229777][ C0] vfs_statx+0x115/0x210 [ 50.233840][ C0] ? vfs_statx_fd+0xb0/0xb0 [ 50.238181][ C0] ? hashlen_string+0x110/0x110 [ 50.242875][ C0] __se_sys_newfstatat+0xce/0x770 [ 50.247890][ C0] ? __x64_sys_newfstatat+0xa0/0xa0 [ 50.253037][ C0] ? mntput_no_expire+0x108/0x6d0 [ 50.257903][ C0] ? lockref_put_return+0xbf/0xe0 [ 50.262764][ C0] ? vfs_submount+0xb0/0xb0 [ 50.267094][ C0] ? fast_dput+0x7a/0x280 [ 50.271270][ C0] ? getname_flags+0x1ec/0x4e0 [ 50.276151][ C0] do_syscall_64+0xca/0x1c0 [ 50.280574][ C0] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 50.286312][ C0] RIP: 0033:0x7f3693f3f5f4 [ 50.290650][ C0] Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8 [ 50.310658][ C0] RSP: 002b:00007ffd09702288 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 [ 50.319285][ C0] RAX: ffffffffffffffda RBX: 0000564b5327a3e0 RCX: 00007f3693f3f5f4 [ 50.327166][ C0] RDX: 00007ffd09702298 RSI: 00007ffd09702728 RDI: 00000000ffffff9c [ 50.334976][ C0] RBP: 00007ffd09702328 R08: 0000000000000000 R09: 0000000000000000 [ 50.342873][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd09702728 [ 50.350857][ C0] R13: 00007ffd09702298 R14: 0000564b532442c0 R15: 0000564b5289da04 [ 50.358759][ C0] [ 50.360920][ C0] The buggy address belongs to the page: [ 50.366407][ C0] page:ffffea00076741c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 50.375423][ C0] flags: 0x8000000000000000() [ 50.379945][ C0] raw: 8000000000000000 ffffea00076741c8 ffffea00076741c8 0000000000000000 [ 50.388618][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 50.397543][ C0] page dumped because: kasan: bad access detected [ 50.403956][ C0] page_owner tracks the page as allocated [ 50.409514][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT) [ 50.421354][ C0] prep_new_page+0x18f/0x370 [ 50.425766][ C0] get_page_from_freelist+0x2d13/0x2d90 [ 50.431587][ C0] __alloc_pages_nodemask+0x393/0x840 [ 50.436804][ C0] dup_task_struct+0x85/0x600 [ 50.441423][ C0] copy_process+0x56d/0x3230 [ 50.445979][ C0] _do_fork+0x197/0x900 [ 50.450027][ C0] __x64_sys_clone+0x26b/0x2c0 [ 50.454713][ C0] do_syscall_64+0xca/0x1c0 [ 50.459061][ C0] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 50.464757][ C0] page_owner free stack trace missing [ 50.470078][ C0] [ 50.472228][ C0] addr ffff8881d9d07820 is located in stack of task udevd/420 at offset 0 in frame: [ 50.481443][ C0] _raw_spin_lock+0x0/0x1b0 [ 50.485760][ C0] [ 50.487944][ C0] this frame has 1 object: [ 50.492189][ C0] [32, 36) 'val.i.i.i' [ 50.492193][ C0] [ 50.498439][ C0] Memory state around the buggy address: [ 50.504016][ C0] ffff8881d9d07700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.512008][ C0] ffff8881d9d07780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.520132][ C0] >ffff8881d9d07800: 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 [ 50.527964][ C0] ^ [ 50.533043][ C0] ffff8881d9d07880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.541038][ C0] ffff8881d9d07900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 50.549167][ C0] ================================================================== [ 50.557068][ C0] Disabling lock debugging due to kernel taint 2024/07/18 01:06:48 executed programs: 542 2024/07/18 01:06:53 executed programs: 1154