./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1515193355

<...>
Warning: Permanently added '10.128.10.3' (ECDSA) to the list of known hosts.
execve("./syz-executor1515193355", ["./syz-executor1515193355"], 0x7ffee72c6fa0 /* 10 vars */) = 0
brk(NULL)                               = 0x555556924000
brk(0x555556924d00)                     = 0x555556924d00
arch_prctl(ARCH_SET_FS, 0x5555569243c0) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1515193355", 4096) = 28
brk(0x555556945d00)                     = 0x555556945d00
brk(0x555556946000)                     = 0x555556946000
mprotect(0x7f9a659d5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f9a65927300, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f9a659275f0}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f9a65927300, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f9a659275f0}, NULL, 8) = 0
mkdir("./file0", 0777)                  = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
syzkaller login: [   40.674535][ T3608] ==================================================================
[   40.682620][ T3608] BUG: KASAN: use-after-free in rdma_close+0xaf/0xc0
[   40.689295][ T3608] Read of size 8 at addr ffff888016c73408 by task syz-executor151/3608
[   40.697516][ T3608] 
[   40.699826][ T3608] CPU: 0 PID: 3608 Comm: syz-executor151 Not tainted 6.0.0-rc6-next-20220921-syzkaller #0
[   40.709697][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2022
[   40.719736][ T3608] Call Trace:
[   40.723000][ T3608]  <TASK>
[   40.725919][ T3608]  dump_stack_lvl+0xcd/0x134
[   40.730503][ T3608]  print_report+0x15e/0x45d
[   40.734995][ T3608]  ? __phys_addr+0xc4/0x140
[   40.739486][ T3608]  ? rdma_close+0xaf/0xc0
[   40.743809][ T3608]  kasan_report+0xbb/0x1f0
[   40.748217][ T3608]  ? rdma_close+0xaf/0xc0
[   40.752556][ T3608]  rdma_close+0xaf/0xc0
[   40.756700][ T3608]  p9_client_destroy+0xbe/0x370
[   40.761631][ T3608]  ? p9_fid_destroy+0xd0/0xd0
[   40.766338][ T3608]  ? p9_client_create+0x78c/0xf20
[   40.771388][ T3608]  ? __kmem_cache_free+0xab/0x3b0
[   40.776437][ T3608]  p9_client_create+0x728/0xf20
[   40.781305][ T3608]  ? p9_client_rpc+0xd70/0xd70
[   40.786086][ T3608]  ? lockdep_init_map_type+0x21a/0x7f0
[   40.791557][ T3608]  ? __kasan_kmalloc+0xa1/0xb0
[   40.796336][ T3608]  ? __raw_spin_lock_init+0x36/0x110
[   40.801633][ T3608]  v9fs_session_init+0x1e2/0x1810
[   40.806666][ T3608]  ? lock_acquire+0x4fc/0x630
[   40.811355][ T3608]  ? rcu_read_lock_sched_held+0xd/0x70
[   40.816835][ T3608]  ? lock_release+0x5cb/0x810
[   40.821519][ T3608]  ? __kmem_cache_alloc_node+0x48/0x3d0
[   40.827081][ T3608]  ? lock_downgrade+0x6e0/0x6e0
[   40.831938][ T3608]  ? v9fs_show_options+0x780/0x780
[   40.837071][ T3608]  ? __kmem_cache_alloc_node+0x1d8/0x3d0
[   40.842722][ T3608]  ? v9fs_mount+0x9b/0xc90
[   40.847158][ T3608]  v9fs_mount+0xba/0xc90
[   40.851435][ T3608]  ? rcu_read_lock_sched_held+0xd/0x70
[   40.856920][ T3608]  ? v9fs_statfs+0x4d0/0x4d0
[   40.861540][ T3608]  ? apparmor_capable+0x1d8/0x460
[   40.866591][ T3608]  ? v9fs_statfs+0x4d0/0x4d0
[   40.871198][ T3608]  legacy_get_tree+0x105/0x220
[   40.875973][ T3608]  vfs_get_tree+0x89/0x2f0
[   40.880394][ T3608]  path_mount+0x1326/0x1e20
[   40.884907][ T3608]  ? kmem_cache_free+0xea/0x5b0
[   40.889775][ T3608]  ? finish_automount+0x960/0x960
[   40.894817][ T3608]  ? putname+0xfe/0x140
[   40.898991][ T3608]  __x64_sys_mount+0x27f/0x300
[   40.903767][ T3608]  ? copy_mnt_ns+0xae0/0xae0
[   40.908364][ T3608]  ? _raw_spin_unlock_irq+0x2a/0x40
[   40.913844][ T3608]  ? ptrace_notify+0xfa/0x140
[   40.918531][ T3608]  do_syscall_64+0x35/0xb0
[   40.922986][ T3608]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   40.929075][ T3608] RIP: 0033:0x7f9a65969039
[   40.933493][ T3608] Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   40.953284][ T3608] RSP: 002b:00007ffda4b921e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   40.961708][ T3608] RAX: ffffffffffffffda RBX: 00007ffda4b921f8 RCX: 00007f9a65969039
[   40.969686][ T3608] RDX: 0000000020000080 RSI: 0000000020000040 RDI: 0000000020000000
[   40.977833][ T3608] RBP: 00007ffda4b921f0 R08: 00000000200000c0 R09: 00007f9a65927300
[   40.985807][ T3608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   40.993780][ T3608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   41.001764][ T3608]  </TASK>
[   41.004784][ T3608] 
[   41.007099][ T3608] Allocated by task 3608:
[   41.011427][ T3608]  kasan_save_stack+0x1e/0x40
[   41.016132][ T3608]  kasan_set_track+0x21/0x30
[   41.020744][ T3608]  __kasan_kmalloc+0xa1/0xb0
[   41.025352][ T3608]  rdma_create_trans+0x24f/0x13d0
[   41.030391][ T3608]  p9_client_create+0x7ef/0xf20
[   41.035253][ T3608]  v9fs_session_init+0x1e2/0x1810
[   41.040283][ T3608]  v9fs_mount+0xba/0xc90
[   41.044539][ T3608]  legacy_get_tree+0x105/0x220
[   41.049307][ T3608]  vfs_get_tree+0x89/0x2f0
[   41.053721][ T3608]  path_mount+0x1326/0x1e20
[   41.058224][ T3608]  __x64_sys_mount+0x27f/0x300
[   41.062991][ T3608]  do_syscall_64+0x35/0xb0
[   41.067426][ T3608]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   41.073333][ T3608] 
[   41.075649][ T3608] Freed by task 3608:
[   41.079620][ T3608]  kasan_save_stack+0x1e/0x40
[   41.084319][ T3608]  kasan_set_track+0x21/0x30
[   41.088918][ T3608]  kasan_save_free_info+0x2a/0x40
[   41.093949][ T3608]  ____kasan_slab_free+0x160/0x1c0
[   41.099070][ T3608]  slab_free_freelist_hook+0x8b/0x1c0
[   41.104452][ T3608]  __kmem_cache_free+0xab/0x3b0
[   41.109311][ T3608]  rdma_destroy_trans+0x196/0x210
[   41.114347][ T3608]  rdma_create_trans+0x1076/0x13d0
[   41.119472][ T3608]  p9_client_create+0x7ef/0xf20
[   41.124327][ T3608]  v9fs_session_init+0x1e2/0x1810
[   41.129354][ T3608]  v9fs_mount+0xba/0xc90
[   41.133610][ T3608]  legacy_get_tree+0x105/0x220
[   41.138374][ T3608]  vfs_get_tree+0x89/0x2f0
[   41.142806][ T3608]  path_mount+0x1326/0x1e20
[   41.147308][ T3608]  __x64_sys_mount+0x27f/0x300
[   41.152072][ T3608]  do_syscall_64+0x35/0xb0
[   41.156498][ T3608]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   41.162401][ T3608] 
[   41.164718][ T3608] The buggy address belongs to the object at ffff888016c73400
[   41.164718][ T3608]  which belongs to the cache kmalloc-512 of size 512
[   41.178771][ T3608] The buggy address is located 8 bytes inside of
[   41.178771][ T3608]  512-byte region [ffff888016c73400, ffff888016c73600)
[   41.191871][ T3608] 
[   41.194191][ T3608] The buggy address belongs to the physical page:
[   41.200596][ T3608] page:ffffea00005b1c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x16c70
[   41.210744][ T3608] head:ffffea00005b1c00 order:2 compound_mapcount:0 compound_pincount:0
[   41.219068][ T3608] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   41.227052][ T3608] raw: 00fff00000010200 ffff888011841c80 dead000080100010 0000000000000000
[   41.235636][ T3608] raw: 0000000000000000 dead000000000001 00000001ffffffff 0000000000000000
[   41.244215][ T3608] page dumped because: kasan: bad access detected
[   41.250624][ T3608] page_owner tracks the page as allocated
[   41.256331][ T3608] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2303057531, free_ts 0
[   41.275961][ T3608]  get_page_from_freelist+0x1092/0x2d20
[   41.281511][ T3608]  __alloc_pages+0x1c7/0x5a0
[   41.286104][ T3608]  alloc_page_interleave+0x1e/0x200
[   41.291311][ T3608]  alloc_pages+0x22f/0x270
[   41.295737][ T3608]  allocate_slab+0x213/0x300
[   41.300332][ T3608]  ___slab_alloc+0xac1/0x1430
[   41.305019][ T3608]  __slab_alloc.constprop.0+0x4d/0xa0
[   41.310403][ T3608]  __kmem_cache_alloc_node+0x18a/0x3d0
[   41.315871][ T3608]  __kmalloc+0x44/0xc0
[   41.319943][ T3608]  alloc_workqueue+0x14b/0x1020
[   41.324803][ T3608]  padata_alloc+0xc8/0x4d0
[   41.329235][ T3608]  pcrypt_init_padata+0x1b/0xf5
[   41.334094][ T3608]  pcrypt_init+0x70/0xef
[   41.338345][ T3608]  do_one_initcall+0x13d/0x780
[   41.343225][ T3608]  kernel_init_freeable+0x6ff/0x788
[   41.348443][ T3608]  kernel_init+0x1a/0x1d0
[   41.352785][ T3608] page_owner free stack trace missing
[   41.358142][ T3608] 
[   41.360464][ T3608] Memory state around the buggy address:
[   41.366115][ T3608]  ffff888016c73300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.374189][ T3608]  ffff888016c73380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   41.382256][ T3608] >ffff888016c73400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   41.390324][ T3608]                       ^
[   41.394662][ T3608]  ffff888016c73480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   41.402724][ T3608]  ffff888016c73500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   41.410780][ T3608] ==================================================================
[   41.419545][ T3608] Kernel panic - not syncing: panic_on_warn set ...
[   41.426165][ T3608] CPU: 1 PID: 3608 Comm: syz-executor151 Not tainted 6.0.0-rc6-next-20220921-syzkaller #0
[   41.436065][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2022
[   41.446105][ T3608] Call Trace:
[   41.449370][ T3608]  <TASK>
[   41.452288][ T3608]  dump_stack_lvl+0xcd/0x134
[   41.456876][ T3608]  panic+0x2c8/0x622
[   41.461026][ T3608]  ? panic_print_sys_info.part.0+0x110/0x110
[   41.467086][ T3608]  ? preempt_schedule_common+0x59/0xc0
[   41.472532][ T3608]  ? preempt_schedule_thunk+0x16/0x18
[   41.477988][ T3608]  end_report.part.0+0x3f/0x7c
[   41.482742][ T3608]  ? rdma_close+0xaf/0xc0
[   41.487063][ T3608]  kasan_report.cold+0xa/0xf
[   41.491644][ T3608]  ? rdma_close+0xaf/0xc0
[   41.495968][ T3608]  rdma_close+0xaf/0xc0
[   41.500115][ T3608]  p9_client_destroy+0xbe/0x370
[   41.504961][ T3608]  ? p9_fid_destroy+0xd0/0xd0
[   41.509628][ T3608]  ? p9_client_create+0x78c/0xf20
[   41.514729][ T3608]  ? __kmem_cache_free+0xab/0x3b0
[   41.519752][ T3608]  p9_client_create+0x728/0xf20
[   41.524594][ T3608]  ? p9_client_rpc+0xd70/0xd70
[   41.529365][ T3608]  ? lockdep_init_map_type+0x21a/0x7f0
[   41.534815][ T3608]  ? __kasan_kmalloc+0xa1/0xb0
[   41.539752][ T3608]  ? __raw_spin_lock_init+0x36/0x110
[   41.545032][ T3608]  v9fs_session_init+0x1e2/0x1810
[   41.550046][ T3608]  ? lock_acquire+0x4fc/0x630
[   41.554714][ T3608]  ? rcu_read_lock_sched_held+0xd/0x70
[   41.560166][ T3608]  ? lock_release+0x5cb/0x810
[   41.564829][ T3608]  ? __kmem_cache_alloc_node+0x48/0x3d0
[   41.570368][ T3608]  ? lock_downgrade+0x6e0/0x6e0
[   41.575206][ T3608]  ? v9fs_show_options+0x780/0x780
[   41.580315][ T3608]  ? __kmem_cache_alloc_node+0x1d8/0x3d0
[   41.585940][ T3608]  ? v9fs_mount+0x9b/0xc90
[   41.590353][ T3608]  v9fs_mount+0xba/0xc90
[   41.594593][ T3608]  ? rcu_read_lock_sched_held+0xd/0x70
[   41.600045][ T3608]  ? v9fs_statfs+0x4d0/0x4d0
[   41.604625][ T3608]  ? apparmor_capable+0x1d8/0x460
[   41.609655][ T3608]  ? v9fs_statfs+0x4d0/0x4d0
[   41.614238][ T3608]  legacy_get_tree+0x105/0x220
[   41.618991][ T3608]  vfs_get_tree+0x89/0x2f0
[   41.623392][ T3608]  path_mount+0x1326/0x1e20
[   41.627882][ T3608]  ? kmem_cache_free+0xea/0x5b0
[   41.632724][ T3608]  ? finish_automount+0x960/0x960
[   41.637743][ T3608]  ? putname+0xfe/0x140
[   41.641887][ T3608]  __x64_sys_mount+0x27f/0x300
[   41.646648][ T3608]  ? copy_mnt_ns+0xae0/0xae0
[   41.651229][ T3608]  ? _raw_spin_unlock_irq+0x2a/0x40
[   41.656422][ T3608]  ? ptrace_notify+0xfa/0x140
[   41.661086][ T3608]  do_syscall_64+0x35/0xb0
[   41.665496][ T3608]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   41.671384][ T3608] RIP: 0033:0x7f9a65969039
[   41.675787][ T3608] Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   41.695385][ T3608] RSP: 002b:00007ffda4b921e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   41.703782][ T3608] RAX: ffffffffffffffda RBX: 00007ffda4b921f8 RCX: 00007f9a65969039
[   41.711742][ T3608] RDX: 0000000020000080 RSI: 0000000020000040 RDI: 0000000020000000
[   41.719699][ T3608] RBP: 00007ffda4b921f0 R08: 00000000200000c0 R09: 00007f9a65927300
[   41.727654][ T3608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   41.735615][ T3608] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   41.743600][ T3608]  </TASK>
[   41.746900][ T3608] Kernel Offset: disabled
[   41.751218][ T3608] Rebooting in 86400 seconds..