Warning: Permanently added '10.128.1.104' (ED25519) to the list of known hosts. 2024/07/18 02:14:09 ignoring optional flag "sandboxArg"="0" 2024/07/18 02:14:09 parsed 1 programs [ 43.125283][ T23] kauditd_printk_skb: 19 callbacks suppressed [ 43.125296][ T23] audit: type=1400 audit(1721268849.990:95): avc: denied { unlink } for pid=406 comm="syz-executor" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" 2024/07/18 02:14:10 executed programs: 0 [ 43.189294][ T406] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 43.265419][ T412] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.272492][ T412] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.280173][ T412] device bridge_slave_0 entered promiscuous mode [ 43.287385][ T412] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.294251][ T412] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.302565][ T412] device bridge_slave_1 entered promiscuous mode [ 43.356887][ T412] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.364194][ T412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.371598][ T412] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.378510][ T412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.403760][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.411136][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.419405][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.427475][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.442331][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.451091][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.458852][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.467432][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.476329][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.483829][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.495175][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.511965][ T13] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.523158][ T372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.542426][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.550563][ T366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.568161][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.577268][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.602543][ T419] kernel profiling enabled (shift: 3) [ 44.451781][ C1] ================================================================== [ 44.459829][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 [ 44.466910][ C1] Read of size 8 at addr ffff8881d94d7800 by task udevd/414 [ 44.474200][ C1] [ 44.476372][ C1] CPU: 1 PID: 414 Comm: udevd Not tainted 5.4.276-syzkaller-04920-g3ffe89ed1bf9 #0 [ 44.485476][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 44.496136][ C1] Call Trace: [ 44.499488][ C1] [ 44.502365][ C1] dump_stack+0x1d8/0x241 [ 44.506716][ C1] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 44.512435][ C1] ? printk+0xd1/0x111 [ 44.516330][ C1] ? profile_pc+0xa4/0xe0 [ 44.520499][ C1] ? wake_up_klogd+0xb2/0xf0 [ 44.525019][ C1] ? profile_pc+0xa4/0xe0 [ 44.529183][ C1] print_address_description+0x8c/0x600 [ 44.534768][ C1] ? panic+0x89d/0x89d [ 44.539180][ C1] ? profile_pc+0xa4/0xe0 [ 44.543346][ C1] __kasan_report+0xf3/0x120 [ 44.547996][ C1] ? profile_pc+0xa4/0xe0 [ 44.552157][ C1] ? _raw_spin_lock+0xc0/0x1b0 [ 44.557268][ C1] kasan_report+0x30/0x60 [ 44.561444][ C1] profile_pc+0xa4/0xe0 [ 44.565522][ C1] profile_tick+0xb9/0x100 [ 44.569864][ C1] tick_sched_timer+0x237/0x3c0 [ 44.574839][ C1] ? tick_setup_sched_timer+0x460/0x460 [ 44.580359][ C1] __hrtimer_run_queues+0x3e9/0xb90 [ 44.585517][ C1] ? hrtimer_interrupt+0x890/0x890 [ 44.590809][ C1] ? kvm_sched_clock_read+0x14/0x40 [ 44.596621][ C1] ? sched_clock+0x36/0x40 [ 44.600978][ C1] ? sched_clock_cpu+0x18/0x3a0 [ 44.605645][ C1] ? ktime_get_update_offsets_now+0x26c/0x280 [ 44.611799][ C1] hrtimer_interrupt+0x38a/0x890 [ 44.616834][ C1] smp_apic_timer_interrupt+0x110/0x460 [ 44.622718][ C1] apic_timer_interrupt+0xf/0x20 [ 44.627568][ C1] [ 44.630485][ C1] RIP: 0010:_raw_spin_lock+0xc0/0x1b0 [ 44.636023][ C1] Code: fd 4c 89 ff be 04 00 00 00 e8 1c dc 42 fd 43 0f b6 04 26 84 c0 0f 85 aa 00 00 00 8b 44 24 20 b9 01 00 00 00 f0 41 0f b1 4d 00 <75> 33 48 c7 04 24 0e 36 e0 45 49 c7 04 1c 00 00 00 00 65 48 8b 04 [ 44.656189][ C1] RSP: 0018:ffff8881d94d7800 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 44.665479][ C1] RAX: 0000000000000000 RBX: 1ffff1103b29af00 RCX: 0000000000000001 [ 44.674506][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff8881d94d7820 [ 44.682753][ C1] RBP: ffff8881d94d78a0 R08: dffffc0000000000 R09: 0000000000000003 [ 44.690659][ C1] R10: ffffffffffffffff R11: dffffc0000000001 R12: dffffc0000000000 [ 44.698788][ C1] R13: ffff8881ee03e5c0 R14: 1ffff1103b29af04 R15: ffff8881d94d7820 [ 44.706913][ C1] ? _raw_spin_trylock_bh+0x190/0x190 [ 44.712903][ C1] ? inode_init_always+0x66b/0x8a0 [ 44.718104][ C1] ? _raw_spin_unlock+0x49/0x60 [ 44.722864][ C1] new_inode+0x66/0x1d0 [ 44.726891][ C1] shmem_get_inode+0x10b/0x620 [ 44.731856][ C1] shmem_mknod+0x54/0x1a0 [ 44.735985][ C1] ? shmem_create+0x12/0x30 [ 44.740420][ C1] ? shmem_fallocate+0xd00/0xd00 [ 44.745195][ C1] path_openat+0x184a/0x34b0 [ 44.749796][ C1] ? do_filp_open+0x450/0x450 [ 44.754299][ C1] ? do_sys_open+0x357/0x810 [ 44.758723][ C1] ? do_syscall_64+0xca/0x1c0 [ 44.763242][ C1] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 44.769143][ C1] do_filp_open+0x20b/0x450 [ 44.773483][ C1] ? vfs_tmpfile+0x2c0/0x2c0 [ 44.777907][ C1] ? _raw_spin_unlock+0x49/0x60 [ 44.782703][ C1] ? __alloc_fd+0x4c1/0x560 [ 44.787173][ C1] do_sys_open+0x39c/0x810 [ 44.792234][ C1] ? check_preemption_disabled+0x153/0x320 [ 44.798164][ C1] ? file_open_root+0x490/0x490 [ 44.803030][ C1] do_syscall_64+0xca/0x1c0 [ 44.807714][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 44.813454][ C1] RIP: 0033:0x7f94e1bca9a4 [ 44.817687][ C1] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83 [ 44.837519][ C1] RSP: 002b:00007fffedfd8490 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 44.846420][ C1] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f94e1bca9a4 [ 44.854317][ C1] RDX: 0000000000080241 RSI: 00007fffedfd89d8 RDI: 00000000ffffff9c [ 44.862225][ C1] RBP: 00007fffedfd89d8 R08: 0000000000000004 R09: 0000000000000001 [ 44.870208][ C1] R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000080241 [ 44.878373][ C1] R13: 000055ba1d61b72e R14: 0000000000000001 R15: 000055ba1d636160 [ 44.886192][ C1] [ 44.888348][ C1] The buggy address belongs to the page: [ 44.893921][ C1] page:ffffea00076535c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 44.903203][ C1] flags: 0x8000000000000000() [ 44.907984][ C1] raw: 8000000000000000 ffffea00076535c8 ffffea00076535c8 0000000000000000 [ 44.916408][ C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 44.925252][ C1] page dumped because: kasan: bad access detected [ 44.931582][ C1] page_owner tracks the page as allocated [ 44.937234][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT) [ 44.948977][ C1] prep_new_page+0x18f/0x370 [ 44.953608][ C1] get_page_from_freelist+0x2d13/0x2d90 [ 44.959064][ C1] __alloc_pages_nodemask+0x393/0x840 [ 44.964448][ C1] dup_task_struct+0x85/0x600 [ 44.969052][ C1] copy_process+0x56d/0x3230 [ 44.973733][ C1] _do_fork+0x197/0x900 [ 44.978010][ C1] __x64_sys_clone+0x26b/0x2c0 [ 44.983081][ C1] do_syscall_64+0xca/0x1c0 [ 44.988016][ C1] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 44.993744][ C1] page_owner free stack trace missing [ 44.999340][ C1] [ 45.001510][ C1] addr ffff8881d94d7800 is located in stack of task udevd/414 at offset 0 in frame: [ 45.010812][ C1] _raw_spin_lock+0x0/0x1b0 [ 45.015318][ C1] [ 45.017479][ C1] this frame has 1 object: [ 45.021731][ C1] [32, 36) 'val.i.i.i' [ 45.021732][ C1] [ 45.028071][ C1] Memory state around the buggy address: [ 45.033667][ C1] ffff8881d94d7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.041655][ C1] ffff8881d94d7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.049801][ C1] >ffff8881d94d7800: f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00 [ 45.057857][ C1] ^ [ 45.061854][ C1] ffff8881d94d7880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.070034][ C1] ffff8881d94d7900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.077937][ C1] ================================================================== [ 45.086173][ C1] Disabling lock debugging due to kernel taint 2024/07/18 02:14:15 executed programs: 466 2024/07/18 02:14:20 executed programs: 1086