./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4285445195
<...>
DUID 00:04:e6:bc:8e:bc:c3:7a:f3:fc:35:c5:a5:4f:9b:64:01:ce
forked to background, child pid 3178
[ 27.597852][ T3179] 8021q: adding VLAN 0 to HW filter on device bond0
[ 27.613196][ T3179] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.1.122' (ECDSA) to the list of known hosts.
execve("./syz-executor4285445195", ["./syz-executor4285445195"], 0x7fff89e321c0 /* 10 vars */) = 0
brk(NULL) = 0x55555705e000
brk(0x55555705ec40) = 0x55555705ec40
arch_prctl(ARCH_SET_FS, 0x55555705e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4285445195", 4096) = 28
brk(0x55555707fc40) = 0x55555707fc40
brk(0x555557080000) = 0x555557080000
mprotect(0x7fb2ef035000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555705e5d0) = 3608
./strace-static-x86_64: Process 3608 attached
[pid 3608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3608] setpgid(0, 0) = 0
[pid 3608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3608] write(3, "1000", 4) = 4
[pid 3608] close(3) = 0
[pid 3608] memfd_create("\x59\xff\xff", MFD_CLOEXEC|MFD_HUGETLB) = 3
[pid 3608] mmap(0x20200000, 4194327, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_LOCKED, 3, 0) = 0x20200000
[pid 3608] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid 3608] write(4, "6", 1) = 1
[pid 3608] mbind(0x20000000, 6291456, MPOL_INTERLEAVE|MPOL_F_STATIC_NODES, [0x0000000000000009], 8, MPOL_MF_STRICT|MPOL_MF_MOVE) = -1 ENOMEM (Cannot allocate memory)
[pid 3608] exit_group(0) = ?
syzkaller login: [ 51.952467][ T3608] ------------[ cut here ]------------
[ 51.958123][ T3608] page_counter underflow: -512 nr_pages=1536
[ 51.964311][ T3608] WARNING: CPU: 0 PID: 3608 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0
[ 51.973754][ T3608] Modules linked in:
[ 51.977738][ T3608] CPU: 0 PID: 3608 Comm: syz-executor428 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 51.987917][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 51.998046][ T3608] RIP: 0010:page_counter_cancel+0xcf/0xe0
[ 52.003920][ T3608] Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 2a 36 ae ff 4c 89 ea 48 89 ee 48 c7 c7 a0 55 da 89 c6 05 26 90 db 0b 01 e8 bb bb 67 07 <0f> 0b eb a8 4c 89 e7 e8 65 3b fa ff eb c7 0f 1f 00 41 56 41 55 49
[ 52.023655][ T3608] RSP: 0018:ffffc9000302fb28 EFLAGS: 00010282
[ 52.029788][ T3608] RAX: 0000000000000000 RBX: ffff888140159268 RCX: 0000000000000000
[ 52.037820][ T3608] RDX: ffff88801ea81d40 RSI: ffffffff81610608 RDI: fffff52000605f57
[ 52.045880][ T3608] RBP: fffffffffffffe00 R08: 0000000000000005 R09: 0000000000000000
[ 52.053865][ T3608] R10: 0000000080000000 R11: 0000000000000001 R12: ffff888140159268
[ 52.061889][ T3608] R13: 0000000000000600 R14: 0000000000000000 R15: 0000000000000000
[ 52.069921][ T3608] FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 52.078923][ T3608] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 52.085583][ T3608] CR2: 00007fb2ef03c290 CR3: 000000002234d000 CR4: 00000000003506f0
[ 52.093574][ T3608] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 52.101594][ T3608] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 52.109635][ T3608] Call Trace:
[ 52.112943][ T3608]
[ 52.115916][ T3608] page_counter_uncharge+0x2e/0x60
[ 52.121069][ T3608] hugetlb_cgroup_uncharge_counter+0xcc/0x3d0
[ 52.127217][ T3608] hugetlb_vm_op_close+0x424/0x6b0
[ 52.132373][ T3608] ? hugepage_subpool_put_pages.part.0+0x410/0x410
[ 52.138934][ T3608] remove_vma+0x81/0x130
[ 52.143200][ T3608] exit_mmap+0x288/0x720
[ 52.147513][ T3608] ? __ia32_sys_remap_file_pages+0x150/0x150
[ 52.153562][ T3608] __mmput+0x128/0x4c0
[ 52.157717][ T3608] mmput+0x5c/0x70
[ 52.161542][ T3608] do_exit+0xa09/0x29f0
[ 52.166045][ T3608] ? lock_downgrade+0x6e0/0x6e0
[ 52.170918][ T3608] ? mm_update_next_owner+0x7b0/0x7b0
[ 52.176366][ T3608] ? _raw_spin_unlock_irq+0x1f/0x40
[ 52.181610][ T3608] ? _raw_spin_unlock_irq+0x1f/0x40
[ 52.186886][ T3608] do_group_exit+0xd2/0x2f0
[ 52.191433][ T3608] __x64_sys_exit_group+0x3a/0x50
[ 52.196526][ T3608] do_syscall_64+0x35/0xb0
[ 52.200958][ T3608] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 52.206923][ T3608] RIP: 0033:0x7fb2eefc6d39
[ 52.211367][ T3608] Code: Unable to access opcode bytes at RIP 0x7fb2eefc6d0f.
[ 52.218792][ T3608] RSP: 002b:00007ffc35614978 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 52.227257][ T3608] RAX: ffffffffffffffda RBX: 00007fb2ef03b3f0 RCX: 00007fb2eefc6d39
[ 52.235293][ T3608] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 52.243274][ T3608] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000003
[ 52.251293][ T3608] R10: 0000000020000000 R11: 0000000000000246 R12: 00007fb2ef03b3f0
[ 52.259323][ T3608] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 52.267368][ T3608]
[ 52.270391][ T3608] Kernel panic - not syncing: panic_on_warn set ...
[ 52.276959][ T3608] CPU: 0 PID: 3608 Comm: syz-executor428 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 52.287534][ T3608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 52.297588][ T3608] Call Trace:
[ 52.300867][ T3608]
[ 52.303965][ T3608] dump_stack_lvl+0xcd/0x134
[ 52.308649][ T3608] panic+0x2d7/0x636
[ 52.312560][ T3608] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 52.318557][ T3608] ? __warn.cold+0x248/0x2c4
[ 52.323168][ T3608] ? page_counter_cancel+0xcf/0xe0
[ 52.328287][ T3608] __warn.cold+0x259/0x2c4
[ 52.332734][ T3608] ? page_counter_cancel+0xcf/0xe0
[ 52.337860][ T3608] report_bug+0x1bc/0x210
[ 52.342206][ T3608] handle_bug+0x3c/0x60
[ 52.346395][ T3608] exc_invalid_op+0x14/0x40
[ 52.350912][ T3608] asm_exc_invalid_op+0x1b/0x20
[ 52.355765][ T3608] RIP: 0010:page_counter_cancel+0xcf/0xe0
[ 52.361486][ T3608] Code: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 2a 36 ae ff 4c 89 ea 48 89 ee 48 c7 c7 a0 55 da 89 c6 05 26 90 db 0b 01 e8 bb bb 67 07 <0f> 0b eb a8 4c 89 e7 e8 65 3b fa ff eb c7 0f 1f 00 41 56 41 55 49
[ 52.381097][ T3608] RSP: 0018:ffffc9000302fb28 EFLAGS: 00010282
[ 52.387167][ T3608] RAX: 0000000000000000 RBX: ffff888140159268 RCX: 0000000000000000
[ 52.395138][ T3608] RDX: ffff88801ea81d40 RSI: ffffffff81610608 RDI: fffff52000605f57
[ 52.403124][ T3608] RBP: fffffffffffffe00 R08: 0000000000000005 R09: 0000000000000000
[ 52.411186][ T3608] R10: 0000000080000000 R11: 0000000000000001 R12: ffff888140159268
[ 52.419330][ T3608] R13: 0000000000000600 R14: 0000000000000000 R15: 0000000000000000
[ 52.427319][ T3608] ? vprintk+0x88/0x90
[ 52.431407][ T3608] ? page_counter_cancel+0xcf/0xe0
[ 52.436523][ T3608] page_counter_uncharge+0x2e/0x60
[ 52.441641][ T3608] hugetlb_cgroup_uncharge_counter+0xcc/0x3d0
[ 52.447714][ T3608] hugetlb_vm_op_close+0x424/0x6b0
[ 52.452835][ T3608] ? hugepage_subpool_put_pages.part.0+0x410/0x410
[ 52.459342][ T3608] remove_vma+0x81/0x130
[ 52.463583][ T3608] exit_mmap+0x288/0x720
[ 52.467846][ T3608] ? __ia32_sys_remap_file_pages+0x150/0x150
[ 52.473856][ T3608] __mmput+0x128/0x4c0
[ 52.477929][ T3608] mmput+0x5c/0x70
[ 52.481650][ T3608] do_exit+0xa09/0x29f0
[ 52.485805][ T3608] ? lock_downgrade+0x6e0/0x6e0
[ 52.490664][ T3608] ? mm_update_next_owner+0x7b0/0x7b0
[ 52.496036][ T3608] ? _raw_spin_unlock_irq+0x1f/0x40
[ 52.501241][ T3608] ? _raw_spin_unlock_irq+0x1f/0x40
[ 52.506453][ T3608] do_group_exit+0xd2/0x2f0
[ 52.510972][ T3608] __x64_sys_exit_group+0x3a/0x50
[ 52.516018][ T3608] do_syscall_64+0x35/0xb0
[ 52.520439][ T3608] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 52.526330][ T3608] RIP: 0033:0x7fb2eefc6d39
[ 52.530745][ T3608] Code: Unable to access opcode bytes at RIP 0x7fb2eefc6d0f.
[ 52.538099][ T3608] RSP: 002b:00007ffc35614978 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 52.546686][ T3608] RAX: ffffffffffffffda RBX: 00007fb2ef03b3f0 RCX: 00007fb2eefc6d39
[ 52.554665][ T3608] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
[ 52.562635][ T3608] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000003
[ 52.570601][ T3608] R10: 0000000020000000 R11: 0000000000000246 R12: 00007fb2ef03b3f0
[ 52.578570][ T3608] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[ 52.586550][ T3608]
[ 52.589848][ T3608] Kernel Offset: disabled
[ 52.594247][ T3608] Rebooting in 86400 seconds..