./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1456499082
<...>
DUID 00:04:b0:cd:33:f9:4f:8a:55:45:4d:7b:3b:ee:3a:71:f0:8b
forked to background, child pid 4660
[ 29.186427][ T4661] 8021q: adding VLAN 0 to HW filter on device bond0
[ 29.197198][ T4661] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.5' (ECDSA) to the list of known hosts.
execve("./syz-executor1456499082", ["./syz-executor1456499082"], 0x7ffee5eee1f0 /* 10 vars */) = 0
brk(NULL) = 0x5555567a7000
brk(0x5555567a7c40) = 0x5555567a7c40
arch_prctl(ARCH_SET_FS, 0x5555567a7300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1456499082", 4096) = 28
brk(0x5555567c8c40) = 0x5555567c8c40
brk(0x5555567c9000) = 0x5555567c9000
mprotect(0x7fbb808b3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
mkdir("./bus", 000) = 0
open("./file0", O_RDWR|O_CREAT|O_SYNC|O_NOATIME, 000) = 3
mkdir("./file1", 000) = 0
mount(NULL, "./bus", "overlay", 0, "upperdir=./bus,workdir=./file1,lowerdir=.") = 0
chdir("./bus") = 0
open("./file0", O_RDONLY) = 4
open("./file0", O_RDWR|O_CREAT|O_SYNC|O_NOATIME, 000) = 5
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
write(6, "4", 1) = 1
syzkaller login: [ 54.452395][ T27] audit: type=1804 audit(1687877094.711:2): pid=4991 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor145" name="/root/bus/file0" dev="overlay" ino=1928 res=1 errno=0
[ 54.474833][ T4991] FAULT_INJECTION: forcing a failure.
[ 54.474833][ T4991] name failslab, interval 1, probability 0, space 0, times 1
[ 54.487739][ T4991] CPU: 0 PID: 4991 Comm: syz-executor145 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0
[ 54.497792][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 54.507836][ T4991] Call Trace:
[ 54.511100][ T4991]
[ 54.514014][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 54.518707][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 54.524158][ T4991] ? panic+0x770/0x770
[ 54.528211][ T4991] ? __might_sleep+0xc0/0xc0
[ 54.532882][ T4991] should_fail_ex+0x3aa/0x4e0
[ 54.537544][ T4991] should_failslab+0x9/0x20
[ 54.542039][ T4991] slab_pre_alloc_hook+0x59/0x2b0
[ 54.547049][ T4991] kmem_cache_alloc+0x52/0x2e0
[ 54.551791][ T4991] ? security_file_alloc+0x28/0x120
[ 54.556972][ T4991] security_file_alloc+0x28/0x120
[ 54.561980][ T4991] init_file+0xa0/0x200
[ 54.566130][ T4991] alloc_empty_backing_file+0x67/0xd0
[ 54.571506][ T4991] backing_file_open+0x26/0x100
[ 54.576358][ T4991] ovl_open_realfile+0x1f6/0x350
[ 54.581297][ T4991] ovl_splice_read+0x7cc/0x8c0
[ 54.586058][ T4991] ? ovl_splice_write+0x650/0x650
[ 54.591072][ T4991] ? vfs_splice_read+0x24d/0x3b0
[ 54.595988][ T4991] ? ovl_splice_write+0x650/0x650
[ 54.601001][ T4991] splice_direct_to_actor+0x2a8/0x9a0
[ 54.606372][ T4991] ? do_splice_direct+0x3d0/0x3d0
[ 54.611392][ T4991] ? warn_unsupported+0xc0/0xc0
[ 54.616238][ T4991] ? fsnotify_perm+0x63/0x5a0
[ 54.620909][ T4991] ? security_file_permission+0x79/0xa0
[ 54.626473][ T4991] do_splice_direct+0x286/0x3d0
[ 54.631332][ T4991] ? splice_direct_to_actor+0x9a0/0x9a0
[ 54.636868][ T4991] ? rcu_read_lock_any_held+0xb7/0x160
[ 54.642340][ T4991] do_sendfile+0x623/0x1070
[ 54.646859][ T4991] ? do_pwritev+0x360/0x360
[ 54.651355][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50
[ 54.656542][ T4991] ? ptrace_notify+0x278/0x380
[ 54.661295][ T4991] __se_sys_sendfile64+0x17c/0x1e0
[ 54.666389][ T4991] ? __x64_sys_sendfile64+0xb0/0xb0
[ 54.671572][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 54.677540][ T4991] ? syscall_enter_from_user_mode+0x8c/0x230
[ 54.683503][ T4991] do_syscall_64+0x41/0xc0
[ 54.687902][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.693779][ T4991] RIP: 0033:0x7fbb808467a9
[ 54.698180][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.717769][ T4991] RSP: 002b:00007ffdc0c78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 54.726167][ T4991] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbb808467a9
[ 54.734125][ T4991] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005
[ 54.742080][ T4991] RBP: 00007ffdc0c78ff0 R08: 0000000000000001 R09: 00007fbb80800034
[ 54.750034][ T4991] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000006
[ 54.757992][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 54.765984][ T4991]
[ 54.769504][ T4991] ==================================================================
[ 54.777575][ T4991] BUG: KASAN: invalid-free in init_file+0x195/0x200
[ 54.784152][ T4991] Free of addr ffff88801ea5a800 by task syz-executor145/4991
[ 54.791496][ T4991]
[ 54.793798][ T4991] CPU: 0 PID: 4991 Comm: syz-executor145 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0
[ 54.803834][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 54.813865][ T4991] Call Trace:
[ 54.817127][ T4991]
[ 54.820043][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 54.824721][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 54.830178][ T4991] ? panic+0x770/0x770
[ 54.834241][ T4991] ? _printk+0xd5/0x120
[ 54.838463][ T4991] ? init_file+0x195/0x200
[ 54.842862][ T4991] print_report+0x163/0x540
[ 54.847346][ T4991] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 54.853220][ T4991] ? __virt_addr_valid+0x22f/0x2e0
[ 54.858311][ T4991] ? __phys_addr+0xba/0x170
[ 54.862793][ T4991] ? init_file+0x195/0x200
[ 54.867184][ T4991] ? init_file+0x195/0x200
[ 54.871580][ T4991] kasan_report_invalid_free+0xeb/0x100
[ 54.877108][ T4991] ? init_file+0x195/0x200
[ 54.881505][ T4991] ____kasan_slab_free+0xfb/0x120
[ 54.886508][ T4991] kmem_cache_free+0x297/0x520
[ 54.891249][ T4991] ? init_file+0x195/0x200
[ 54.895639][ T4991] init_file+0x195/0x200
[ 54.899860][ T4991] alloc_empty_backing_file+0x67/0xd0
[ 54.905207][ T4991] backing_file_open+0x26/0x100
[ 54.910036][ T4991] ovl_open_realfile+0x1f6/0x350
[ 54.914963][ T4991] ovl_splice_read+0x7cc/0x8c0
[ 54.919882][ T4991] ? ovl_splice_write+0x650/0x650
[ 54.924888][ T4991] ? vfs_splice_read+0x24d/0x3b0
[ 54.929803][ T4991] ? ovl_splice_write+0x650/0x650
[ 54.934809][ T4991] splice_direct_to_actor+0x2a8/0x9a0
[ 54.940165][ T4991] ? do_splice_direct+0x3d0/0x3d0
[ 54.945164][ T4991] ? warn_unsupported+0xc0/0xc0
[ 54.949990][ T4991] ? fsnotify_perm+0x63/0x5a0
[ 54.954644][ T4991] ? security_file_permission+0x79/0xa0
[ 54.960170][ T4991] do_splice_direct+0x286/0x3d0
[ 54.965001][ T4991] ? splice_direct_to_actor+0x9a0/0x9a0
[ 54.970527][ T4991] ? rcu_read_lock_any_held+0xb7/0x160
[ 54.975967][ T4991] do_sendfile+0x623/0x1070
[ 54.980451][ T4991] ? do_pwritev+0x360/0x360
[ 54.984937][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50
[ 54.990113][ T4991] ? ptrace_notify+0x278/0x380
[ 54.994857][ T4991] __se_sys_sendfile64+0x17c/0x1e0
[ 54.999946][ T4991] ? __x64_sys_sendfile64+0xb0/0xb0
[ 55.005118][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 55.011073][ T4991] ? syscall_enter_from_user_mode+0x8c/0x230
[ 55.017029][ T4991] do_syscall_64+0x41/0xc0
[ 55.021429][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.027302][ T4991] RIP: 0033:0x7fbb808467a9
[ 55.031699][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.051285][ T4991] RSP: 002b:00007ffdc0c78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 55.059676][ T4991] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbb808467a9
[ 55.067626][ T4991] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005
[ 55.075579][ T4991] RBP: 00007ffdc0c78ff0 R08: 0000000000000001 R09: 00007fbb80800034
[ 55.083532][ T4991] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000006
[ 55.091479][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 55.099433][ T4991]
[ 55.102430][ T4991]
[ 55.104729][ T4991] Allocated by task 4991:
[ 55.109033][ T4991] kasan_set_track+0x4f/0x70
[ 55.113604][ T4991] __kasan_kmalloc+0x98/0xb0
[ 55.118171][ T4991] alloc_empty_backing_file+0x52/0xd0
[ 55.123525][ T4991] backing_file_open+0x26/0x100
[ 55.128357][ T4991] ovl_open_realfile+0x1f6/0x350
[ 55.133272][ T4991] ovl_splice_read+0x7cc/0x8c0
[ 55.138016][ T4991] splice_direct_to_actor+0x2a8/0x9a0
[ 55.143370][ T4991] do_splice_direct+0x286/0x3d0
[ 55.148194][ T4991] do_sendfile+0x623/0x1070
[ 55.152671][ T4991] __se_sys_sendfile64+0x17c/0x1e0
[ 55.157755][ T4991] do_syscall_64+0x41/0xc0
[ 55.162151][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.168195][ T4991]
[ 55.170503][ T4991] The buggy address belongs to the object at ffff88801ea5a800
[ 55.170503][ T4991] which belongs to the cache kmalloc-512 of size 512
[ 55.184534][ T4991] The buggy address is located 0 bytes inside of
[ 55.184534][ T4991] 480-byte region [ffff88801ea5a800, ffff88801ea5a9e0)
[ 55.197608][ T4991]
[ 55.199912][ T4991] The buggy address belongs to the physical page:
[ 55.206295][ T4991] page:ffffea00007a9600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ea58
[ 55.216418][ T4991] head:ffffea00007a9600 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 55.225326][ T4991] anon flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 55.233715][ T4991] page_type: 0xffffffff()
[ 55.238026][ T4991] raw: 00fff00000010200 ffff888012441c80 0000000000000000 dead000000000001
[ 55.246589][ T4991] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 55.255146][ T4991] page dumped because: kasan: bad access detected
[ 55.261533][ T4991] page_owner tracks the page as allocated
[ 55.267220][ T4991] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 733, tgid 733 (kworker/u4:0), ts 6534177535, free_ts 0
[ 55.287430][ T4991] post_alloc_hook+0x1e6/0x210
[ 55.292181][ T4991] get_page_from_freelist+0x320e/0x3390
[ 55.297708][ T4991] __alloc_pages+0x255/0x670
[ 55.302281][ T4991] alloc_slab_page+0x6a/0x160
[ 55.306935][ T4991] new_slab+0x84/0x2f0
[ 55.310984][ T4991] ___slab_alloc+0xa85/0x10a0
[ 55.315640][ T4991] __kmem_cache_alloc_node+0x1b8/0x290
[ 55.321089][ T4991] kmalloc_trace+0x2a/0xe0
[ 55.325502][ T4991] alloc_bprm+0x56/0x900
[ 55.329825][ T4991] kernel_execve+0x96/0xa10
[ 55.334334][ T4991] call_usermodehelper_exec_async+0x233/0x370
[ 55.340396][ T4991] ret_from_fork+0x1f/0x30
[ 55.344798][ T4991] page_owner free stack trace missing
[ 55.350142][ T4991]
[ 55.352447][ T4991] Memory state around the buggy address:
[ 55.358070][ T4991] ffff88801ea5a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 55.366116][ T4991] ffff88801ea5a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 55.374170][ T4991] >ffff88801ea5a800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 55.382218][ T4991] ^
[ 55.386266][ T4991] ffff88801ea5a880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 55.394306][ T4991] ffff88801ea5a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 55.402342][ T4991] ==================================================================
[ 55.411318][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 55.418524][ T4991] CPU: 0 PID: 4991 Comm: syz-executor145 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0
[ 55.428593][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 55.438627][ T4991] Call Trace:
[ 55.441885][ T4991]
[ 55.444794][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 55.449454][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 55.454889][ T4991] ? panic+0x770/0x770
[ 55.458931][ T4991] ? preempt_schedule_common+0x83/0xc0
[ 55.464367][ T4991] ? vscnprintf+0x5d/0x80
[ 55.468672][ T4991] ? init_file+0xe0/0x200
[ 55.472980][ T4991] panic+0x30f/0x770
[ 55.476851][ T4991] ? check_panic_on_warn+0x21/0xa0
[ 55.481939][ T4991] ? __memcpy_flushcache+0x2b0/0x2b0
[ 55.487197][ T4991] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 55.493155][ T4991] ? _raw_spin_unlock+0x40/0x40
[ 55.498000][ T4991] ? init_file+0x195/0x200
[ 55.502406][ T4991] check_panic_on_warn+0x82/0xa0
[ 55.507329][ T4991] ? init_file+0x195/0x200
[ 55.511725][ T4991] end_report+0x63/0x110
[ 55.515954][ T4991] kasan_report_invalid_free+0xf6/0x100
[ 55.521481][ T4991] ? init_file+0x195/0x200
[ 55.525911][ T4991] ____kasan_slab_free+0xfb/0x120
[ 55.530933][ T4991] kmem_cache_free+0x297/0x520
[ 55.535701][ T4991] ? init_file+0x195/0x200
[ 55.540099][ T4991] init_file+0x195/0x200
[ 55.544318][ T4991] alloc_empty_backing_file+0x67/0xd0
[ 55.549670][ T4991] backing_file_open+0x26/0x100
[ 55.554503][ T4991] ovl_open_realfile+0x1f6/0x350
[ 55.559425][ T4991] ovl_splice_read+0x7cc/0x8c0
[ 55.564171][ T4991] ? ovl_splice_write+0x650/0x650
[ 55.569175][ T4991] ? vfs_splice_read+0x24d/0x3b0
[ 55.574108][ T4991] ? ovl_splice_write+0x650/0x650
[ 55.579201][ T4991] splice_direct_to_actor+0x2a8/0x9a0
[ 55.584555][ T4991] ? do_splice_direct+0x3d0/0x3d0
[ 55.589556][ T4991] ? warn_unsupported+0xc0/0xc0
[ 55.594382][ T4991] ? fsnotify_perm+0x63/0x5a0
[ 55.599036][ T4991] ? security_file_permission+0x79/0xa0
[ 55.604555][ T4991] do_splice_direct+0x286/0x3d0
[ 55.609384][ T4991] ? splice_direct_to_actor+0x9a0/0x9a0
[ 55.614908][ T4991] ? rcu_read_lock_any_held+0xb7/0x160
[ 55.620348][ T4991] do_sendfile+0x623/0x1070
[ 55.624831][ T4991] ? do_pwritev+0x360/0x360
[ 55.629309][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50
[ 55.634495][ T4991] ? ptrace_notify+0x278/0x380
[ 55.639237][ T4991] __se_sys_sendfile64+0x17c/0x1e0
[ 55.644324][ T4991] ? __x64_sys_sendfile64+0xb0/0xb0
[ 55.649499][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 55.655467][ T4991] ? syscall_enter_from_user_mode+0x8c/0x230
[ 55.661420][ T4991] do_syscall_64+0x41/0xc0
[ 55.665819][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.671688][ T4991] RIP: 0033:0x7fbb808467a9
[ 55.676081][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.695663][ T4991] RSP: 002b:00007ffdc0c78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 55.704053][ T4991] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fbb808467a9
[ 55.712003][ T4991] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005
[ 55.719952][ T4991] RBP: 00007ffdc0c78ff0 R08: 0000000000000001 R09: 00007fbb80800034
[ 55.727900][ T4991] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000006
[ 55.735850][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 55.743801][ T4991]
[ 55.747050][ T4991] Kernel Offset: disabled
[ 55.751362][ T4991] Rebooting in 86400 seconds..