ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor1875000530 <...> Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor1875000530", ["ci2-android-5-15/syz-executor1875000530"], 0x7ffe736337b0 /* 10 vars */) = 0 brk(NULL) = 0x555581523000 brk(0x555581523e00) = 0x555581523e00 arch_prctl(ARCH_SET_FS, 0x555581523480) = 0 set_tid_address(0x555581523750) = 303 set_robust_list(0x555581523760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor1875000530", 4096) = 45 getrandom("\x40\x2a\x0b\x6d\x65\xda\x7d\xa5", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555581523e00 brk(0x555581544e00) = 0x555581544e00 brk(0x555581545000) = 0x555581545000 mprotect(0x7f1098765000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f10986b7020, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f10986be290}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f10986b7020, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f10986be290}, NULL, 8) = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555581523750) = 304 rt_sigprocmask(SIG_SETMASK, []ci2-android-5-15/strace-static-x86_64: Process 304 attached , NULL, 8) = 0 [pid 304] set_robust_list(0x555581523760, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] getppid() = 0 [pid 304] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 304] unshare(CLONE_NEWNS) = 0 [pid 304] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 304] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 304] unshare(CLONE_NEWCGROUP) = 0 [pid 304] unshare(CLONE_NEWUTS) = 0 [pid 304] unshare(CLONE_SYSVSEM) = 0 [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] getpid() = 1 [pid 304] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 26.596639][ T304] __dump_stack+0x21/0x30 [ 26.600988][ T304] dump_stack_lvl+0x110/0x170 [ 26.605665][ T304] ? show_regs_print_info+0x20/0x20 [ 26.610871][ T304] ? load_image+0x3f0/0x3f0 [ 26.615367][ T304] ? __xfrm_route_forward+0x37e/0x540 [ 26.620744][ T304] print_address_description+0x7f/0x2c0 [ 26.626297][ T304] ? __ipv6_addr_type+0x272/0x2f0 [ 26.631336][ T304] kasan_report+0x10f/0x150 [ 26.635835][ T304] ? __ipv6_addr_type+0x272/0x2f0 [ 26.640857][ T304] __asan_report_load4_noabort+0x14/0x20 [ 26.646504][ T304] __ipv6_addr_type+0x272/0x2f0 [ 26.651363][ T304] ip6_forward+0xdb2/0x1ba0 [ 26.655862][ T304] ? dst_output+0x80/0x80 [ 26.660185][ T304] ? sk_setup_caps+0x400/0x400 [ 26.664952][ T304] ip6_rcv_finish+0x18f/0x360 [ 26.669622][ T304] ipv6_rcv+0xed/0x230 [ 26.673685][ T304] ? ip6_rcv_finish+0x360/0x360 [ 26.678537][ T304] ? __alloc_skb+0x459/0x730 [ 26.683134][ T304] ? ip6_rcv_finish+0x360/0x360 [ 26.687994][ T304] __netif_receive_skb+0xc8/0x280 [ 26.693105][ T304] netif_receive_skb+0x98/0x3e0 [ 26.697966][ T304] ? netif_receive_skb_core+0x100/0x100 [ 26.703555][ T304] ? copy_page_from_iter+0x2e1/0x680 [ 26.708843][ T304] tun_rx_batched+0x600/0x750 [ 26.713650][ T304] ? local_bh_enable+0x30/0x30 [ 26.718540][ T304] tun_get_user+0x284f/0x34c0 [ 26.723232][ T304] ? tun_do_read+0x1d70/0x1d70 [ 26.728004][ T304] ? __switch_to+0x56c/0x1070 [ 26.732691][ T304] ? irqentry_exit+0x37/0x40 [ 26.737284][ T304] ? sysvec_apic_timer_interrupt+0x64/0xc0 [ 26.743101][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 26.748142][ T304] vfs_write+0x831/0xfd0 [ 26.752389][ T304] ? file_end_write+0x1b0/0x1b0 [ 26.757242][ T304] ? _raw_spin_unlock_irq+0x4e/0x70 [ 26.762555][ T304] ? cgroup_leave_frozen+0x165/0x2a0 [ 26.767851][ T304] ? __kasan_check_read+0x11/0x20 [ 26.772888][ T304] ? __fdget_pos+0x1f7/0x380 [ 26.777478][ T304] ksys_write+0x14a/0x260 [ 26.781815][ T304] ? __ia32_sys_read+0x90/0x90 [ 26.786581][ T304] ? __kasan_check_write+0x14/0x20 [ 26.791825][ T304] ? switch_fpu_return+0x15d/0x2c0 [ 26.796949][ T304] __x64_sys_write+0x7b/0x90 [ 26.801550][ T304] x64_sys_call+0x8ef/0x9a0 [ 26.806217][ T304] do_syscall_64+0x4c/0xa0 [ 26.810703][ T304] ? clear_bhb_loop+0x50/0xa0 [ 26.815387][ T304] ? clear_bhb_loop+0x50/0xa0 [ 26.820063][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.825964][ T304] RIP: 0033:0x7f10986d85c9 [ 26.830470][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.850088][ T304] RSP: 002b:00007ffd931e4558 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 26.858506][ T304] RAX: ffffffffffffffda RBX: 00007f1098739500 RCX: 00007f10986d85c9 [ 26.866481][ T304] RDX: 000000000000ffdd RSI: 0000200000000000 RDI: 0000000000000005 [ 26.874454][ T304] RBP: 00007f10987394d0 R08: 00007ffd931e4580 R09: 00007ffd931e4580 [ 26.882426][ T304] R10: 00007ffd931e4580 R11: 0000000000000246 R12: 00007f1098739438 [ 26.890397][ T304] R13: 0000000000000001 R14: 00007ffd931e45b0 R15: 0000000000000003 [ 26.898371][ T304] [ 26.901404][ T304] [ 26.903722][ T304] Allocated by task 304: [ 26.907954][ T304] __kasan_kmalloc+0xd4/0x100 [ 26.912636][ T304] __kmalloc_track_caller+0x13c/0x2c0 [ 26.918008][ T304] __alloc_skb+0x210/0x730 [ 26.922421][ T304] alloc_skb_with_frags+0xa8/0x620 [ 26.927538][ T304] sock_alloc_send_pskb+0x87f/0x9a0 [ 26.932771][ T304] tun_get_user+0xaa2/0x34c0 [ 26.937379][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 26.942440][ T304] vfs_write+0x831/0xfd0 [ 26.946692][ T304] ksys_write+0x14a/0x260 [ 26.951031][ T304] __x64_sys_write+0x7b/0x90 [ 26.955631][ T304] x64_sys_call+0x8ef/0x9a0 [ 26.960148][ T304] do_syscall_64+0x4c/0xa0 [ 26.964766][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.970688][ T304] [ 26.973026][ T304] Freed by task 304: [ 26.976931][ T304] kasan_set_track+0x4a/0x70 [ 26.981535][ T304] kasan_set_free_info+0x23/0x40 [ 26.986481][ T304] ____kasan_slab_free+0x125/0x160 [ 26.991605][ T304] __kasan_slab_free+0x11/0x20 [ 26.996556][ T304] slab_free_freelist_hook+0xc2/0x190 [ 27.001947][ T304] kfree+0xc4/0x270 [ 27.005787][ T304] pskb_expand_head+0x394/0x1280 [ 27.010743][ T304] __pskb_pull_tail+0xba/0x1570 [ 27.015606][ T304] __xfrm_decode_session+0x5b0/0x1de0 [ 27.020993][ T304] __xfrm_route_forward+0x115/0x540 [ 27.026202][ T304] ip6_forward+0xca5/0x1ba0 [ 27.030716][ T304] ip6_rcv_finish+0x18f/0x360 [ 27.035406][ T304] ipv6_rcv+0xed/0x230 [ 27.039490][ T304] __netif_receive_skb+0xc8/0x280 [ 27.044534][ T304] netif_receive_skb+0x98/0x3e0 [ 27.049427][ T304] tun_rx_batched+0x600/0x750 [ 27.054115][ T304] tun_get_user+0x284f/0x34c0 [ 27.058813][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 27.063847][ T304] vfs_write+0x831/0xfd0 [ 27.068097][ T304] ksys_write+0x14a/0x260 [ 27.072442][ T304] __x64_sys_write+0x7b/0x90 [ 27.077302][ T304] x64_sys_call+0x8ef/0x9a0 [ 27.081823][ T304] do_syscall_64+0x4c/0xa0 [ 27.086249][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.092164][ T304] [ 27.094500][ T304] The buggy address belongs to the object at ffff88810e086800 [ 27.094500][ T304] which belongs to the cache kmalloc-512 of size 512 [ 27.108582][ T304] The buggy address is located 72 bytes inside of [ 27.108582][ T304] 512-byte region [ffff88810e086800, ffff88810e086a00) [ 27.121807][ T304] The buggy address belongs to the page: [ 27.127461][ T304] page:ffffea0004382100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e084 [ 27.137720][ T304] head:ffffea0004382100 order:2 compound_mapcount:0 compound_pincount:0 [ 27.146049][ T304] flags: 0x4000000000010200(slab|head|zone=1) [ 27.152154][ T304] raw: 4000000000010200 ffffea0004377700 0000000400000004 ffff888100042f00 [ 27.160758][ T304] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.169430][ T304] page dumped because: kasan: bad access detected [ 27.175847][ T304] page_owner tracks the page as allocated [ 27.181579][ T304] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 102, ts 5576100434, free_ts 0 [ 27.199657][ T304] post_alloc_hook+0x192/0x1b0 [ 27.204443][ T304] prep_new_page+0x1c/0x110 [ 27.208956][ T304] get_page_from_freelist+0x2c3a/0x2cd0 [ 27.214518][ T304] __alloc_pages+0x1a2/0x460 [ 27.219127][ T304] new_slab+0xa0/0x4d0 [ 27.223231][ T304] ___slab_alloc+0x3ac/0x840 [ 27.227838][ T304] __slab_alloc+0x49/0x90 [ 27.232177][ T304] __kmalloc_track_caller+0x169/0x2c0 [ 27.237565][ T304] __alloc_skb+0x210/0x730 [ 27.241993][ T304] alloc_uevent_skb+0x85/0x240 [ 27.246772][ T304] kobject_uevent_net_broadcast+0x335/0x5a0 [ 27.252685][ T304] kobject_uevent_env+0x52b/0x700 [ 27.257722][ T304] kobject_synth_uevent+0x457/0x940 [ 27.262934][ T304] uevent_store+0x4b/0x70 [ 27.267286][ T304] drv_attr_store+0x79/0xa0 [ 27.271817][ T304] sysfs_kf_write+0x129/0x150 [ 27.276518][ T304] page_owner free stack trace missing [ 27.281894][ T304] [ 27.284239][ T304] Memory state around the buggy address: [ 27.289870][ T304] ffff88810e086700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.297938][ T304] ffff88810e086780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.306004][ T304] >ffff88810e086800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.314073][ T304] ^ [ 27.320493][ T304] ffff88810e086880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.328581][ T304] ffff88810e086900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.336649][ T304] ================================================================== [pid 304] write(5, "\x1e\x03\x08\x00\x4d\x6b\x71\xef\x28\x85\x63\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x79\x7a\x6b\x61\x6c\x6c\x65\x72\x30\x00\x00\x00\x00\x00\x00\x01\x71\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65501) = 65501 [pid 304] exit_group(1) = ? [ 27.344726][ T304] Disabling lock debugging due to kernel taint [pid 304] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=304, si_uid=0, si_status=1, si_utime=0, si_stime=36 /* 0.36 s */} --- exit_group(0) = ? +++ exited with 0 +++