./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3408078530 <...> Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts. execve("./syz-executor3408078530", ["./syz-executor3408078530"], 0x7ffcf5b19300 /* 10 vars */) = 0 brk(NULL) = 0x555555e2a000 brk(0x555555e2ae00) = 0x555555e2ae00 arch_prctl(ARCH_SET_FS, 0x555555e2a480) = 0 set_tid_address(0x555555e2a750) = 5067 set_robust_list(0x555555e2a760, 24) = 0 rseq(0x555555e2ada0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3408078530", 4096) = 28 getrandom("\x97\x10\x30\x3d\xce\xb6\x5d\x48", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555e2ae00 brk(0x555555e4be00) = 0x555555e4be00 brk(0x555555e4c000) = 0x555555e4c000 mprotect(0x7f31addfc000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f31add55bf0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f31add5cee0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f31add55bf0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f31add5cee0}, NULL, 8) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- openat(AT_FDCWD, "/dev/snd/midiC2D0", O_WRONLY|O_NOCTTY|O_SYNC|O_NOATIME) = 3 dup(3) = 4 openat(AT_FDCWD, "/dev/dri/card0", O_RDONLY) = 5 ioctl(5, DRM_IOCTL_MODE_CREATE_DUMB, 0x20000100) = 0 mmap(0x20ffd000, 8192, PROT_EXEC|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED, 5, 0x100000000) = 0x20ffd000 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- ioctl(-1, DRM_IOCTL_MODE_CREATE_DUMB, 0) = -1 EBADF (Bad file descriptor) [ 72.708291][ T5067] ------------[ cut here ]------------ [ 72.713935][ T5067] kernel BUG at mm/memory.c:2216! [ 72.719075][ T5067] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 72.725161][ T5067] CPU: 1 PID: 5067 Comm: syz-executor340 Not tainted 6.6.0-syzkaller-14651-gd2f51b3516da #0 [ 72.735222][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 72.745272][ T5067] RIP: 0010:vmf_insert_pfn_prot+0x247/0x430 [ 72.751187][ T5067] Code: 0f 0b e8 7c e6 bd ff 49 89 ef bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 f8 e1 bd ff 49 83 ff 20 0f 85 aa fe ff ff e8 59 e6 bd ff <0f> 0b 48 bd ff ff ff ff ff ff 0f 00 e8 48 e6 bd ff 4c 89 f6 48 89 [ 72.770792][ T5067] RSP: 0018:ffffc90003bbf758 EFLAGS: 00010293 [ 72.776856][ T5067] RAX: 0000000000000000 RBX: ffff88802847ec00 RCX: ffffffff81cab618 [ 72.784930][ T5067] RDX: ffff888015bd1dc0 RSI: ffffffff81cab627 RDI: 0000000000000007 [ 72.792984][ T5067] RBP: 000000000c040474 R08: 0000000000000007 R09: 0000000000000020 [ 72.800950][ T5067] R10: 0000000000000020 R11: 0000000000000009 R12: 0000000020ffd000 [ 72.808916][ T5067] R13: 1ffff92000777eec R14: 000000000001e529 R15: 0000000000000020 [ 72.816884][ T5067] FS: 0000555555e2a480(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 72.825812][ T5067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.832407][ T5067] CR2: 0000000020ffd000 CR3: 000000002aae7000 CR4: 00000000003506f0 [ 72.840379][ T5067] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 72.848605][ T5067] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 72.856569][ T5067] Call Trace: [ 72.859844][ T5067] [ 72.862775][ T5067] ? show_regs+0x8f/0xa0 [ 72.867021][ T5067] ? die+0x36/0xa0 [ 72.870739][ T5067] ? do_trap+0x22b/0x420 [ 72.874994][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.880287][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.885577][ T5067] ? do_error_trap+0xf4/0x230 [ 72.890256][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.895543][ T5067] ? handle_invalid_op+0x34/0x40 [ 72.900491][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.905777][ T5067] ? exc_invalid_op+0x2d/0x40 [ 72.910657][ T5067] ? asm_exc_invalid_op+0x1a/0x20 [ 72.915692][ T5067] ? vmf_insert_pfn_prot+0x238/0x430 [ 72.920979][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.926267][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.931642][ T5067] ? vmf_insert_pfn_prot+0x247/0x430 [ 72.936935][ T5067] ? insert_pfn+0x830/0x830 [ 72.941437][ T5067] ? preempt_count_sub+0x150/0x150 [ 72.946547][ T5067] drm_gem_shmem_fault+0x207/0x400 [ 72.951659][ T5067] __do_fault+0x107/0x5f0 [ 72.955988][ T5067] __handle_mm_fault+0x2682/0x3d60 [ 72.961118][ T5067] ? vm_iomap_memory+0x170/0x170 [ 72.966151][ T5067] ? find_vma+0x10e/0x1b0 [ 72.970480][ T5067] ? can_vma_merge_before+0x3a0/0x3a0 [ 72.975845][ T5067] handle_mm_fault+0x478/0xa00 [ 72.980612][ T5067] ? lock_mm_and_find_vma+0xa6/0x760 [ 72.985916][ T5067] do_user_addr_fault+0x3d1/0x1000 [ 72.991029][ T5067] ? rcu_is_watching+0x12/0xb0 [ 72.995791][ T5067] exc_page_fault+0x5c/0xd0 [ 73.000315][ T5067] asm_exc_page_fault+0x26/0x30 [ 73.005174][ T5067] RIP: 0010:rep_movs_alternative+0x4a/0x70 [ 73.010979][ T5067] Code: 75 f1 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 89 c8 48 c1 e9 03 83 e0 07 f3 48 a5 89 c1 85 c9 75 b3 [ 73.030585][ T5067] RSP: 0018:ffffc90003bbfb50 EFLAGS: 00050206 [ 73.036648][ T5067] RAX: 0000000000000001 RBX: 0000000020ffd000 RCX: 0000000000001000 [ 73.044619][ T5067] RDX: 0000000000000000 RSI: 0000000020ffd000 RDI: ffff888018796000 [ 73.052586][ T5067] RBP: 0000000000001000 R08: 0000000000000001 R09: ffffed10030f2dff [ 73.060657][ T5067] R10: ffff888018796fff R11: 0000000000000000 R12: 0000000020ffe000 [ 73.068642][ T5067] R13: ffff888018796000 R14: 0000000000000000 R15: 0000000020ffd000 [ 73.076625][ T5067] _copy_from_user+0xc2/0xf0 [ 73.081229][ T5067] snd_rawmidi_kernel_write1+0x360/0x860 [ 73.086963][ T5067] snd_rawmidi_write+0x26e/0xc00 [ 73.092082][ T5067] ? snd_rawmidi_control_ioctl+0x310/0x310 [ 73.097896][ T5067] ? wake_up_state+0x10/0x10 [ 73.102568][ T5067] ? bpf_lsm_file_permission+0x9/0x10 [ 73.107951][ T5067] ? security_file_permission+0x94/0x100 [ 73.113584][ T5067] vfs_write+0x2a4/0xdf0 [ 73.117832][ T5067] ? snd_rawmidi_control_ioctl+0x310/0x310 [ 73.123641][ T5067] ? kernel_write+0x6c0/0x6c0 [ 73.128318][ T5067] ? ptrace_stop.part.0+0x61a/0x900 [ 73.133513][ T5067] ? find_held_lock+0x2d/0x110 [ 73.138277][ T5067] ? ptrace_notify+0xf4/0x130 [ 73.142946][ T5067] ? reacquire_held_locks+0x4b0/0x4b0 [ 73.148325][ T5067] ? __fget_light+0x1fc/0x260 [ 73.153005][ T5067] ksys_write+0x1f0/0x250 [ 73.157337][ T5067] ? __ia32_sys_read+0xb0/0xb0 [ 73.162104][ T5067] ? lockdep_hardirqs_on+0x7d/0x100 [ 73.167306][ T5067] ? _raw_spin_unlock_irq+0x2e/0x50 [ 73.172503][ T5067] ? ptrace_notify+0xf4/0x130 [ 73.177179][ T5067] do_syscall_64+0x3f/0x110 [ 73.181710][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 73.187629][ T5067] RIP: 0033:0x7f31add88d69 [ 73.192056][ T5067] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 73.212183][ T5067] RSP: 002b:00007ffdd9a49ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 73.220592][ T5067] RAX: ffffffffffffffda RBX: 00007ffdd9a49f00 RCX: 00007f31add88d69 [ 73.228556][ T5067] RDX: 00000000fffffd2c RSI: 0000000020000000 RDI: 0000000000000004 [ 73.236785][ T5067] RBP: 00007ffdd9a49f08 R08: 0000000000000000 R09: 0000000000000000 [ 73.244753][ T5067] R10: 00007ffdd9a49f08 R11: 0000000000000246 R12: 0000000000000000 [ 73.252717][ T5067] R13: 00007ffdd9a4a168 R14: 0000000000000001 R15: 0000000000000001 [ 73.260692][ T5067] [ 73.263703][ T5067] Modules linked in: [ 73.267800][ T5067] ---[ end trace 0000000000000000 ]--- [ 73.273263][ T5067] RIP: 0010:vmf_insert_pfn_prot+0x247/0x430 [ 73.279247][ T5067] Code: 0f 0b e8 7c e6 bd ff 49 89 ef bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 f8 e1 bd ff 49 83 ff 20 0f 85 aa fe ff ff e8 59 e6 bd ff <0f> 0b 48 bd ff ff ff ff ff ff 0f 00 e8 48 e6 bd ff 4c 89 f6 48 89 [ 73.298936][ T5067] RSP: 0018:ffffc90003bbf758 EFLAGS: 00010293 [ 73.305014][ T5067] RAX: 0000000000000000 RBX: ffff88802847ec00 RCX: ffffffff81cab618 [ 73.313056][ T5067] RDX: ffff888015bd1dc0 RSI: ffffffff81cab627 RDI: 0000000000000007 [ 73.321093][ T5067] RBP: 000000000c040474 R08: 0000000000000007 R09: 0000000000000020 [ 73.329130][ T5067] R10: 0000000000000020 R11: 0000000000000009 R12: 0000000020ffd000 [ 73.337105][ T5067] R13: 1ffff92000777eec R14: 000000000001e529 R15: 0000000000000020 [ 73.345116][ T5067] FS: 0000555555e2a480(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 73.354079][ T5067] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.360786][ T5067] CR2: 0000000020acb000 CR3: 000000002aae7000 CR4: 00000000003506f0 [ 73.368789][ T5067] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 73.376833][ T5067] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 73.384847][ T5067] Kernel panic - not syncing: Fatal exception [ 73.391269][ T5067] Kernel Offset: disabled [ 73.395612][ T5067] Rebooting in 86400 seconds..