./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3694549158 <...> Warning: Permanently added '10.128.1.137' (ED25519) to the list of known hosts. execve("./syz-executor3694549158", ["./syz-executor3694549158"], 0x7ffd73730a90 /* 10 vars */) = 0 brk(NULL) = 0x555575d5e000 brk(0x555575d5ed00) = 0x555575d5ed00 arch_prctl(ARCH_SET_FS, 0x555575d5e380) = 0 set_tid_address(0x555575d5e650) = 5845 set_robust_list(0x555575d5e660, 24) = 0 rseq(0x555575d5eca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3694549158", 4096) = 28 getrandom("\xc1\x57\xce\x03\x53\x75\xb4\x15", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555575d5ed00 brk(0x555575d7fd00) = 0x555575d7fd00 brk(0x555575d80000) = 0x555575d80000 mprotect(0x7f99cc90f000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5848 attached , child_tidptr=0x555575d5e650) = 5848 [pid 5848] set_robust_list(0x555575d5e660, 24) = 0 [pid 5848] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5848] getppid() = 0 [pid 5848] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5848] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5848] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [ 91.978088][ T848] cfg80211: failed to load regulatory.db [pid 5848] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5848] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5848] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5848] unshare(CLONE_NEWNS) = 0 [pid 5848] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5848] unshare(CLONE_NEWIPC) = 0 [pid 5848] unshare(CLONE_NEWCGROUP) = 0 [pid 5848] unshare(CLONE_NEWUTS) = 0 [pid 5848] unshare(CLONE_SYSVSEM) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "16777216", 8) = 8 [pid 5848] close(3) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "536870912", 9) = 9 [pid 5848] close(3) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "1024", 4) = 4 [pid 5848] close(3) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "8192", 4) = 4 [pid 5848] close(3) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "1024", 4) = 4 [pid 5848] close(3) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "1024", 4) = 4 [pid 5848] close(3) = 0 [pid 5848] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5848] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5848] close(3) = 0 [pid 5848] getpid() = 1 [pid 5848] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 107.622288][ T5848] dump_stack_lvl+0x189/0x250 [ 107.622313][ T5848] ? __virt_addr_valid+0x1c8/0x5c0 [ 107.622327][ T5848] ? rcu_is_watching+0x15/0xb0 [ 107.622349][ T5848] ? __kasan_check_byte+0x12/0x40 [ 107.622367][ T5848] ? __pfx_dump_stack_lvl+0x10/0x10 [ 107.622388][ T5848] ? rcu_is_watching+0x15/0xb0 [ 107.622410][ T5848] ? lock_release+0x4b/0x3e0 [ 107.622431][ T5848] ? __virt_addr_valid+0x1c8/0x5c0 [ 107.622444][ T5848] ? __virt_addr_valid+0x4a5/0x5c0 [ 107.622459][ T5848] print_report+0xd2/0x2b0 [ 107.622478][ T5848] ? pause_parse_request+0x40/0x160 [ 107.622494][ T5848] kasan_report+0x118/0x150 [ 107.622509][ T5848] ? pause_parse_request+0x40/0x160 [ 107.622527][ T5848] ? __pfx_pause_parse_request+0x10/0x10 [ 107.622543][ T5848] pause_parse_request+0x40/0x160 [ 107.622560][ T5848] ? __pfx_pause_parse_request+0x10/0x10 [ 107.622575][ T5848] ethnl_default_set_doit+0x2c1/0xa40 [ 107.622596][ T5848] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 107.622613][ T5848] genl_family_rcv_msg_doit+0x215/0x300 [ 107.622629][ T5848] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 107.622647][ T5848] ? bpf_lsm_capable+0x9/0x20 [ 107.622660][ T5848] ? security_capable+0x7e/0x2e0 [ 107.622680][ T5848] genl_rcv_msg+0x60e/0x790 [ 107.622695][ T5848] ? __pfx_genl_rcv_msg+0x10/0x10 [ 107.622706][ T5848] ? ref_tracker_free+0x63a/0x7d0 [ 107.622725][ T5848] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 107.622746][ T5848] ? __pfx_ref_tracker_free+0x10/0x10 [ 107.622773][ T5848] netlink_rcv_skb+0x205/0x470 [ 107.622790][ T5848] ? __pfx_genl_rcv_msg+0x10/0x10 [ 107.622803][ T5848] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 107.622827][ T5848] ? down_read+0x1ad/0x2e0 [ 107.622850][ T5848] genl_rcv+0x28/0x40 [ 107.622871][ T5848] netlink_unicast+0x758/0x8d0 [ 107.622890][ T5848] netlink_sendmsg+0x805/0xb30 [ 107.622912][ T5848] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.622932][ T5848] ? aa_sock_msg_perm+0x94/0x160 [ 107.622951][ T5848] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 107.622969][ T5848] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.622987][ T5848] __sock_sendmsg+0x21c/0x270 [ 107.623004][ T5848] ____sys_sendmsg+0x505/0x830 [ 107.623027][ T5848] ? __pfx_____sys_sendmsg+0x10/0x10 [ 107.623051][ T5848] ? import_iovec+0x74/0xa0 [ 107.623066][ T5848] ___sys_sendmsg+0x21f/0x2a0 [ 107.623087][ T5848] ? __pfx____sys_sendmsg+0x10/0x10 [ 107.623110][ T5848] ? do_raw_spin_lock+0x121/0x290 [ 107.623141][ T5848] __x64_sys_sendmsg+0x19b/0x260 [ 107.623162][ T5848] ? _raw_spin_unlock_irq+0x2e/0x50 [ 107.623177][ T5848] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 107.623202][ T5848] ? rcu_is_watching+0x15/0xb0 [ 107.623227][ T5848] do_syscall_64+0xfa/0x3b0 [ 107.623244][ T5848] ? lockdep_hardirqs_on+0x9c/0x150 [ 107.623260][ T5848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.623274][ T5848] ? clear_bhb_loop+0x60/0xb0 [ 107.623290][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.623303][ T5848] RIP: 0033:0x7f99cc8969d9 [ 107.623331][ T5848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 107.623343][ T5848] RSP: 002b:00007ffdf8e93908 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 107.623358][ T5848] RAX: ffffffffffffffda RBX: 00007f99cc8e44ad RCX: 00007f99cc8969d9 [ 107.623380][ T5848] RDX: 0000000000000040 RSI: 0000200000000000 RDI: 0000000000000003 [ 107.623388][ T5848] RBP: 00007f99cc8e447d R08: 0000000000000000 R09: 0000555500000000 [ 107.623397][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99cc8e43e5 [ 107.623405][ T5848] R13: 0000000000000001 R14: 00007ffdf8e93950 R15: 0000000000000003 [ 107.623419][ T5848] [ 107.623423][ T5848] [ 108.002224][ T5848] Allocated by task 5848: [ 108.006555][ T5848] kasan_save_track+0x3e/0x80 [ 108.011261][ T5848] __kasan_kmalloc+0x93/0xb0 [ 108.015864][ T5848] __kmalloc_noprof+0x27a/0x4f0 [ 108.020717][ T5848] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 108.026795][ T5848] genl_family_rcv_msg_doit+0xb8/0x300 [ 108.032265][ T5848] genl_rcv_msg+0x60e/0x790 [ 108.036770][ T5848] netlink_rcv_skb+0x205/0x470 [ 108.041539][ T5848] genl_rcv+0x28/0x40 [ 108.045537][ T5848] netlink_unicast+0x758/0x8d0 [ 108.050303][ T5848] netlink_sendmsg+0x805/0xb30 [ 108.055072][ T5848] __sock_sendmsg+0x21c/0x270 [ 108.059763][ T5848] ____sys_sendmsg+0x505/0x830 [ 108.064648][ T5848] ___sys_sendmsg+0x21f/0x2a0 [ 108.069330][ T5848] __x64_sys_sendmsg+0x19b/0x260 [ 108.074280][ T5848] do_syscall_64+0xfa/0x3b0 [ 108.078796][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.084691][ T5848] [ 108.087015][ T5848] The buggy address belongs to the object at ffff888034301500 [ 108.087015][ T5848] which belongs to the cache kmalloc-64 of size 64 [ 108.100896][ T5848] The buggy address is located 8 bytes to the right of [ 108.100896][ T5848] allocated 40-byte region [ffff888034301500, ffff888034301528) [ 108.115303][ T5848] [ 108.117630][ T5848] The buggy address belongs to the physical page: [ 108.124045][ T5848] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34301 [ 108.132816][ T5848] ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 108.140284][ T5848] page_type: f5(slab) [ 108.144266][ T5848] raw: 00fff00000000000 ffff88801a4418c0 ffffea00009e8e40 dead000000000003 [ 108.152938][ T5848] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 [ 108.161520][ T5848] page dumped because: kasan: bad access detected [ 108.167940][ T5848] page_owner tracks the page as allocated [ 108.173658][ T5848] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1153, tgid 1153 (kworker/u8:6), ts 27371323863, free_ts 0 [ 108.192065][ T5848] post_alloc_hook+0x240/0x2a0 [ 108.196835][ T5848] get_page_from_freelist+0x21e4/0x22c0 [ 108.202402][ T5848] __alloc_frozen_pages_noprof+0x181/0x370 [ 108.208211][ T5848] alloc_pages_mpol+0x232/0x4a0 [ 108.213068][ T5848] allocate_slab+0x8a/0x3b0 [ 108.217578][ T5848] ___slab_alloc+0xbfc/0x1480 [ 108.222258][ T5848] __kmalloc_noprof+0x305/0x4f0 [ 108.227108][ T5848] security_task_alloc+0x4d/0x360 [ 108.232136][ T5848] copy_process+0x1530/0x3c00 [ 108.236813][ T5848] kernel_clone+0x21e/0x870 [ 108.241323][ T5848] user_mode_thread+0xdd/0x140 [ 108.246088][ T5848] call_usermodehelper_exec_work+0x5c/0x230 [ 108.251993][ T5848] process_scheduled_works+0xae1/0x17b0 [ 108.257554][ T5848] worker_thread+0x8a0/0xda0 [ 108.262146][ T5848] kthread+0x70e/0x8a0 [ 108.266218][ T5848] ret_from_fork+0x3f9/0x770 [ 108.270815][ T5848] page_owner free stack trace missing [ 108.276176][ T5848] [ 108.278497][ T5848] Memory state around the buggy address: [ 108.284123][ T5848] ffff888034301400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 108.292186][ T5848] ffff888034301480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 108.300262][ T5848] >ffff888034301500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 108.308318][ T5848] ^ [ 108.313944][ T5848] ffff888034301580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 108.322009][ T5848] ffff888034301600: 00 00 00 00 00 00 05 fc fc fc fc fc fc fc fc fc [ 108.330063][ T5848] ================================================================== [ 108.349544][ T5848] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 108.356773][ T5848] CPU: 0 UID: 0 PID: 5848 Comm: syz-executor369 Not tainted 6.16.0-rc2-syzkaller-00867-ga9b24b3583ae #0 PREEMPT(full) [ 108.369191][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 108.379239][ T5848] Call Trace: [ 108.382513][ T5848] [ 108.385441][ T5848] dump_stack_lvl+0x99/0x250 [ 108.390037][ T5848] ? __asan_memcpy+0x40/0x70 [ 108.394639][ T5848] ? __pfx_dump_stack_lvl+0x10/0x10 [ 108.399839][ T5848] ? __pfx__printk+0x10/0x10 [ 108.404433][ T5848] panic+0x2db/0x790 [ 108.408330][ T5848] ? __pfx_panic+0x10/0x10 [ 108.412752][ T5848] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 108.418642][ T5848] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 108.424966][ T5848] ? print_memory_metadata+0x314/0x400 [ 108.430421][ T5848] ? pause_parse_request+0x40/0x160 [ 108.435620][ T5848] check_panic_on_warn+0x89/0xb0 [ 108.440556][ T5848] ? pause_parse_request+0x40/0x160 [ 108.445749][ T5848] end_report+0x78/0x160 [ 108.449992][ T5848] kasan_report+0x129/0x150 [ 108.454491][ T5848] ? pause_parse_request+0x40/0x160 [ 108.459696][ T5848] ? __pfx_pause_parse_request+0x10/0x10 [ 108.465332][ T5848] pause_parse_request+0x40/0x160 [ 108.470351][ T5848] ? __pfx_pause_parse_request+0x10/0x10 [ 108.475985][ T5848] ethnl_default_set_doit+0x2c1/0xa40 [ 108.481357][ T5848] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 108.487679][ T5848] genl_family_rcv_msg_doit+0x215/0x300 [ 108.493230][ T5848] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 108.499295][ T5848] ? bpf_lsm_capable+0x9/0x20 [ 108.503967][ T5848] ? security_capable+0x7e/0x2e0 [ 108.508909][ T5848] genl_rcv_msg+0x60e/0x790 [ 108.513445][ T5848] ? __pfx_genl_rcv_msg+0x10/0x10 [ 108.518463][ T5848] ? ref_tracker_free+0x63a/0x7d0 [ 108.523489][ T5848] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 108.529383][ T5848] ? __pfx_ref_tracker_free+0x10/0x10 [ 108.534760][ T5848] netlink_rcv_skb+0x205/0x470 [ 108.539522][ T5848] ? __pfx_genl_rcv_msg+0x10/0x10 [ 108.544545][ T5848] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 108.549834][ T5848] ? down_read+0x1ad/0x2e0 [ 108.554249][ T5848] genl_rcv+0x28/0x40 [ 108.558231][ T5848] netlink_unicast+0x758/0x8d0 [ 108.562996][ T5848] netlink_sendmsg+0x805/0xb30 [ 108.567764][ T5848] ? __pfx_netlink_sendmsg+0x10/0x10 [ 108.573050][ T5848] ? aa_sock_msg_perm+0x94/0x160 [ 108.578013][ T5848] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 108.583300][ T5848] ? __pfx_netlink_sendmsg+0x10/0x10 [ 108.588600][ T5848] __sock_sendmsg+0x21c/0x270 [ 108.593275][ T5848] ____sys_sendmsg+0x505/0x830 [ 108.598055][ T5848] ? __pfx_____sys_sendmsg+0x10/0x10 [ 108.603347][ T5848] ? import_iovec+0x74/0xa0 [ 108.607861][ T5848] ___sys_sendmsg+0x21f/0x2a0 [ 108.612553][ T5848] ? __pfx____sys_sendmsg+0x10/0x10 [ 108.617760][ T5848] ? do_raw_spin_lock+0x121/0x290 [ 108.622822][ T5848] __x64_sys_sendmsg+0x19b/0x260 [ 108.627782][ T5848] ? _raw_spin_unlock_irq+0x2e/0x50 [ 108.632977][ T5848] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 108.638440][ T5848] ? rcu_is_watching+0x15/0xb0 [ 108.643211][ T5848] do_syscall_64+0xfa/0x3b0 [ 108.647717][ T5848] ? lockdep_hardirqs_on+0x9c/0x150 [ 108.652916][ T5848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.658987][ T5848] ? clear_bhb_loop+0x60/0xb0 [ 108.663661][ T5848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.669577][ T5848] RIP: 0033:0x7f99cc8969d9 [ 108.673995][ T5848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 108.693595][ T5848] RSP: 002b:00007ffdf8e93908 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 108.702007][ T5848] RAX: ffffffffffffffda RBX: 00007f99cc8e44ad RCX: 00007f99cc8969d9 [ 108.709976][ T5848] RDX: 0000000000000040 RSI: 0000200000000000 RDI: 0000000000000003 [ 108.717940][ T5848] RBP: 00007f99cc8e447d R08: 0000000000000000 R09: 0000555500000000 [ 108.725907][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99cc8e43e5 [ 108.733871][ T5848] R13: 0000000000000001 R14: 00007ffdf8e93950 R15: 0000000000000003 [ 108.741844][ T5848] [ 108.745178][ T5848] Kernel Offset: disabled [ 108.749508][ T5848] Rebooting in 86400 seconds..