./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3107989281

<...>
DUID 00:04:cd:7d:74:7d:04:96:3f:c0:f2:1a:da:5a:49:b1:9f:fb
forked to background, child pid 4817
[   29.120832][ T4818] 8021q: adding VLAN 0 to HW filter on device bond0
[   29.134995][ T4818] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.23' (ECDSA) to the list of known hosts.
execve("./syz-executor3107989281", ["./syz-executor3107989281"], 0x7ffcad4b5b30 /* 10 vars */) = 0
brk(NULL)                               = 0x555555992000
brk(0x555555992c40)                     = 0x555555992c40
arch_prctl(ARCH_SET_FS, 0x555555992300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3107989281", 4096) = 28
brk(0x5555559b3c40)                     = 0x5555559b3c40
brk(0x5555559b4000)                     = 0x5555559b4000
mprotect(0x7fde9cc0f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5239 attached
, child_tidptr=0x5555559925d0) = 5239
[pid  5239] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5239] setpgid(0, 0)               = 0
[pid  5239] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5239] write(3, "1000", 4)         = 4
[pid  5239] close(3)                    = 0
[pid  5239] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 0
[pid  5239] shmat(0, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5239] exit_group(0)               = ?
[pid  5239] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5239, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555559925d0) = 5240
./strace-static-x86_64: Process 5240 attached
[pid  5240] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5240] setpgid(0, 0)               = 0
[pid  5240] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5240] write(3, "1000", 4)         = 4
[pid  5240] close(3)                    = 0
[pid  5240] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 1
[pid  5240] shmat(1, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5240] exit_group(0)               = ?
[pid  5240] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5240, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555559925d0) = 5241
./strace-static-x86_64: Process 5241 attached
[pid  5241] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5241] setpgid(0, 0)               = 0
[pid  5241] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5241] write(3, "1000", 4)         = 4
[pid  5241] close(3)                    = 0
[pid  5241] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 2
syzkaller login: [   53.033696][   T27] audit: type=1800 audit(1668188589.269:2): pid=5239 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0
[   53.060866][   T27] audit: type=1800 audit(1668188589.299:3): pid=5240 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0
[pid  5241] shmat(2, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5241] exit_group(0)               = ?
[pid  5241] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5241, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5242 attached
, child_tidptr=0x5555559925d0) = 5242
[pid  5242] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5242] setpgid(0, 0)               = 0
[pid  5242] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5242] write(3, "1000", 4)         = 4
[pid  5242] close(3)                    = 0
[pid  5242] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 3
[pid  5242] shmat(3, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5242] exit_group(0)               = ?
[pid  5242] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5242, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5243 attached
, child_tidptr=0x5555559925d0) = 5243
[pid  5243] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5243] setpgid(0, 0)               = 0
[pid  5243] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5243] write(3, "1000", 4)         = 4
[pid  5243] close(3)                    = 0
[pid  5243] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 4
[   53.102350][   T27] audit: type=1800 audit(1668188589.339:4): pid=5241 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=2 res=0 errno=0
[   53.128701][   T27] audit: type=1800 audit(1668188589.369:5): pid=5242 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=3 res=0 errno=0
[pid  5243] shmat(4, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5243] exit_group(0)               = ?
[pid  5243] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5243, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555559925d0) = 5244
./strace-static-x86_64: Process 5244 attached
[pid  5244] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5244] setpgid(0, 0)               = 0
[pid  5244] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5244] write(3, "1000", 4)         = 4
[pid  5244] close(3)                    = 0
[pid  5244] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 5
[pid  5244] shmat(5, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5244] exit_group(0)               = ?
[pid  5244] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5244, si_uid=0, si_status=0, si_utime=0, si_stime=1} ---
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555559925d0) = 5245
./strace-static-x86_64: Process 5245 attached
[pid  5245] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5245] setpgid(0, 0)               = 0
[   53.169258][   T27] audit: type=1800 audit(1668188589.409:6): pid=5243 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=4 res=0 errno=0
[pid  5245] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5245] write(3, "1000", 4)         = 4
[pid  5245] close(3)                    = 0
[pid  5245] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 6
[pid  5245] shmat(6, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5245] exit_group(0)               = ?
[pid  5245] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5245, si_uid=0, si_status=0, si_utime=0, si_stime=1} ---
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555559925d0) = 5246
./strace-static-x86_64: Process 5246 attached
[pid  5246] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5246] setpgid(0, 0)               = 0
[pid  5246] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5246] write(3, "1000", 4)         = 4
[pid  5246] close(3)                    = 0
[pid  5246] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 7
[pid  5246] shmat(7, 0x20000000, SHM_REMAP|SHM_EXEC|0xffff0fff) = 0x20000000
[pid  5246] exit_group(0)               = ?
[pid  5246] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5246, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555559925d0) = 5247
./strace-static-x86_64: Process 5247 attached
[pid  5247] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5247] setpgid(0, 0)               = 0
[pid  5247] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5247] write(3, "1000", 4)         = 4
[pid  5247] close(3)                    = 0
[pid  5247] shmget(IPC_PRIVATE, 16384, SHM_HUGETLB|SHM_NORESERVE|21<<SHM_HUGE_SHIFT|000) = 8
[   53.204818][   T27] audit: type=1800 audit(1668188589.439:7): pid=5244 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=5 res=0 errno=0
[   53.226209][   T27] audit: type=1800 audit(1668188589.459:8): pid=5245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=6 res=0 errno=0
[   53.247185][   T27] audit: type=1800 audit(1668188589.479:9): pid=5246 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=7 res=0 errno=0
[   53.275225][   T27] audit: type=1800 audit(1668188589.509:10): pid=5247 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor310" name="SYSV00000000" dev="hugetlbfs" ino=8 res=0 errno=0
[   53.276082][ T5247] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
[   53.307697][ T5247] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
[   53.316100][ T5247] CPU: 0 PID: 5247 Comm: syz-executor310 Not tainted 6.1.0-rc4-next-20221111-syzkaller #0
[   53.325983][ T5247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   53.336032][ T5247] RIP: 0010:shm_close+0xbf/0x740
[   53.341001][ T5247] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 1c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5d 18 48 8d 7b 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 db 05 00 00 48 8b 5b 08 48 85 db 74 0a e8 99 7c
[   53.360604][ T5247] RSP: 0018:ffffc90003e0fba0 EFLAGS: 00010202
[   53.366665][ T5247] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   53.374630][ T5247] RDX: 0000000000000001 RSI: ffffffff83bf5016 RDI: 0000000000000008
[   53.382594][ T5247] RBP: ffff8880296a2d40 R08: 0000000000000005 R09: 0000000000000000
[   53.390562][ T5247] R10: 00000000fffffff4 R11: 0000000000000000 R12: ffff8880263fb1c0
[   53.398533][ T5247] R13: ffffffff8c7a97a0 R14: 0000000000000008 R15: ffffc90003e0fca0
[   53.406504][ T5247] FS:  0000555555992300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[   53.415435][ T5247] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   53.422023][ T5247] CR2: 00007fde9cc15348 CR3: 0000000025865000 CR4: 00000000003506f0
[   53.429993][ T5247] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   53.437958][ T5247] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   53.445922][ T5247] Call Trace:
[   53.449194][ T5247]  <TASK>
[   53.452123][ T5247]  shm_mmap+0x1c2/0x230
[   53.456281][ T5247]  mmap_region+0x6bf/0x1dc0
[   53.460787][ T5247]  ? do_munmap+0x100/0x100
[   53.465207][ T5247]  ? security_mmap_addr+0x73/0x90
[   53.470240][ T5247]  ? get_unmapped_area+0x1e4/0x3c0
[   53.475360][ T5247]  do_mmap+0x825/0xf50
[   53.479428][ T5247]  do_shmat+0xe33/0x10c0
[   53.483672][ T5247]  ? __x64_compat_sys_old_shmctl+0xc0/0xc0
[   53.489479][ T5247]  __x64_sys_shmat+0xcc/0x160
[   53.494152][ T5247]  ? do_shmat+0x10c0/0x10c0
[   53.498651][ T5247]  ? _raw_spin_unlock_irq+0x2a/0x40
[   53.503845][ T5247]  ? ptrace_notify+0xfa/0x140
[   53.508520][ T5247]  ? syscall_trace_enter.constprop.0+0xb0/0x250
[   53.514763][ T5247]  do_syscall_64+0x35/0xb0
[   53.519179][ T5247]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   53.525082][ T5247] RIP: 0033:0x7fde9cba2cf9
[   53.529495][ T5247] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[   53.549102][ T5247] RSP: 002b:00007fff3ed491f8 EFLAGS: 00000246 ORIG_RAX: 000000000000001e
[   53.557511][ T5247] RAX: ffffffffffffffda RBX: 000000000000cfd6 RCX: 00007fde9cba2cf9
[   53.565478][ T5247] RDX: ffffffffffffcfff RSI: 0000000020000000 RDI: 0000000000000008
[   53.573447][ T5247] RBP: 0000000000000000 R08: 00007fff3ed49398 R09: 00007fff3ed49398
[   53.581414][ T5247] R10: 00007fff3ed48c70 R11: 0000000000000246 R12: 00007fff3ed4920c
[   53.589379][ T5247] R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
[   53.597352][ T5247]  </TASK>
[   53.600367][ T5247] Modules linked in:
[   53.604540][ T5247] ---[ end trace 0000000000000000 ]---
[   53.610070][ T5247] RIP: 0010:shm_close+0xbf/0x740
[   53.615011][ T5247] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 1c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 5d 18 48 8d 7b 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 db 05 00 00 48 8b 5b 08 48 85 db 74 0a e8 99 7c
[   53.634653][ T5247] RSP: 0018:ffffc90003e0fba0 EFLAGS: 00010202
[   53.640741][ T5247] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   53.648731][ T5247] RDX: 0000000000000001 RSI: ffffffff83bf5016 RDI: 0000000000000008
[   53.656734][ T5247] RBP: ffff8880296a2d40 R08: 0000000000000005 R09: 0000000000000000
[   53.664699][ T5247] R10: 00000000fffffff4 R11: 0000000000000000 R12: ffff8880263fb1c0
[   53.672689][ T5247] R13: ffffffff8c7a97a0 R14: 0000000000000008 R15: ffffc90003e0fca0
[   53.680682][ T5247] FS:  0000555555992300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
[   53.689647][ T5247] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   53.696243][ T5247] CR2: 00007fff3ed491d8 CR3: 0000000025865000 CR4: 00000000003506e0
[   53.704242][ T5247] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   53.712344][ T5247] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   53.720346][ T5247] Kernel panic - not syncing: Fatal exception
[   53.726567][ T5247] Kernel Offset: disabled
[   53.730886][ T5247] Rebooting in 86400 seconds..