ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor20516209 <...> Warning: Permanently added '10.128.1.34' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor20516209", ["ci2-android-5-15/syz-executor20516209"], 0x7fff42518c30 /* 10 vars */) = 0 brk(NULL) = 0x555572873000 brk(0x555572873e00) = 0x555572873e00 arch_prctl(ARCH_SET_FS, 0x555572873480) = 0 set_tid_address(0x555572873750) = 303 set_robust_list(0x555572873760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor20516209", 4096) = 43 getrandom("\x78\xcb\xa0\xaa\x28\x97\x35\x7a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555572873e00 brk(0x555572894e00) = 0x555572894e00 brk(0x555572895000) = 0x555572895000 mprotect(0x7fac1fc5b000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7fac1fbad020, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fac1fbb4290}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7fac1fbad020, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fac1fbb4290}, NULL, 8) = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572873750) = 304 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x555572873760, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] getppid() = 0 [pid 304] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 304] unshare(CLONE_NEWNS) = 0 [pid 304] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 304] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 304] unshare(CLONE_NEWCGROUP) = 0 [pid 304] unshare(CLONE_NEWUTS) = 0 [pid 304] unshare(CLONE_SYSVSEM) = 0 [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] getpid() = 1 [pid 304] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 25.289469][ T304] __dump_stack+0x21/0x30 [ 25.293773][ T304] dump_stack_lvl+0x110/0x170 [ 25.298438][ T304] ? show_regs_print_info+0x20/0x20 [ 25.303608][ T304] ? load_image+0x3f0/0x3f0 [ 25.308097][ T304] ? __xfrm_route_forward+0x37e/0x540 [ 25.313444][ T304] print_address_description+0x7f/0x2c0 [ 25.318973][ T304] ? __ipv6_addr_type+0x272/0x2f0 [ 25.323977][ T304] kasan_report+0x10f/0x150 [ 25.328461][ T304] ? __ipv6_addr_type+0x272/0x2f0 [ 25.333466][ T304] __asan_report_load4_noabort+0x14/0x20 [ 25.339076][ T304] __ipv6_addr_type+0x272/0x2f0 [ 25.343911][ T304] ip6_forward+0xdb2/0x1ba0 [ 25.348395][ T304] ? dst_output+0x80/0x80 [ 25.352712][ T304] ? sk_setup_caps+0x400/0x400 [ 25.357476][ T304] ip6_rcv_finish+0x18f/0x360 [ 25.362130][ T304] ipv6_rcv+0xed/0x230 [ 25.366177][ T304] ? ip6_rcv_finish+0x360/0x360 [ 25.371007][ T304] ? __alloc_skb+0x459/0x730 [ 25.375574][ T304] ? ip6_rcv_finish+0x360/0x360 [ 25.380403][ T304] __netif_receive_skb+0xc8/0x280 [ 25.385404][ T304] netif_receive_skb+0x98/0x3e0 [ 25.390233][ T304] ? netif_receive_skb_core+0x100/0x100 [ 25.395762][ T304] ? copy_page_from_iter+0x2e1/0x680 [ 25.401048][ T304] tun_rx_batched+0x600/0x750 [ 25.405706][ T304] ? local_bh_enable+0x30/0x30 [ 25.410454][ T304] tun_get_user+0x284f/0x34c0 [ 25.415122][ T304] ? tun_do_read+0x1d70/0x1d70 [ 25.419875][ T304] ? __switch_to+0x56c/0x1070 [ 25.424531][ T304] ? avc_policy_seqno+0x1b/0x70 [ 25.429360][ T304] ? selinux_file_permission+0x2aa/0x510 [ 25.434971][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 25.439976][ T304] vfs_write+0x831/0xfd0 [ 25.444198][ T304] ? file_end_write+0x1b0/0x1b0 [ 25.449027][ T304] ? _raw_spin_unlock_irq+0x4e/0x70 [ 25.454211][ T304] ? cgroup_leave_frozen+0x165/0x2a0 [ 25.459478][ T304] ? __kasan_check_read+0x11/0x20 [ 25.464481][ T304] ? __fdget_pos+0x1f7/0x380 [ 25.469048][ T304] ksys_write+0x14a/0x260 [ 25.473371][ T304] ? __ia32_sys_read+0x90/0x90 [ 25.478111][ T304] ? __kasan_check_write+0x14/0x20 [ 25.483199][ T304] ? switch_fpu_return+0x15d/0x2c0 [ 25.488300][ T304] __x64_sys_write+0x7b/0x90 [ 25.492872][ T304] x64_sys_call+0x8ef/0x9a0 [ 25.497352][ T304] do_syscall_64+0x4c/0xa0 [ 25.501764][ T304] ? clear_bhb_loop+0x50/0xa0 [ 25.506422][ T304] ? clear_bhb_loop+0x50/0xa0 [ 25.511076][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.516946][ T304] RIP: 0033:0x7fac1fbce5c9 [ 25.521356][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.540938][ T304] RSP: 002b:00007fff1d6a7018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 25.549332][ T304] RAX: ffffffffffffffda RBX: 00007fac1fc2f500 RCX: 00007fac1fbce5c9 [ 25.557282][ T304] RDX: 000000000000ffdd RSI: 0000200000000000 RDI: 0000000000000005 [ 25.565234][ T304] RBP: 00007fac1fc2f4d0 R08: 00007fff1d6a7040 R09: 00007fff1d6a7040 [ 25.573186][ T304] R10: 00007fff1d6a7040 R11: 0000000000000246 R12: 00007fac1fc2f438 [ 25.581140][ T304] R13: 0000000000000001 R14: 00007fff1d6a7070 R15: 0000000000000003 [ 25.589092][ T304] [ 25.592100][ T304] [ 25.594400][ T304] Allocated by task 304: [ 25.598614][ T304] __kasan_kmalloc+0xd4/0x100 [ 25.603271][ T304] __kmalloc_track_caller+0x13c/0x2c0 [ 25.608626][ T304] __alloc_skb+0x210/0x730 [ 25.613017][ T304] alloc_skb_with_frags+0xa8/0x620 [ 25.618105][ T304] sock_alloc_send_pskb+0x87f/0x9a0 [ 25.623282][ T304] tun_get_user+0xaa2/0x34c0 [ 25.627856][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 25.632857][ T304] vfs_write+0x831/0xfd0 [ 25.637075][ T304] ksys_write+0x14a/0x260 [ 25.641378][ T304] __x64_sys_write+0x7b/0x90 [ 25.645942][ T304] x64_sys_call+0x8ef/0x9a0 [ 25.650426][ T304] do_syscall_64+0x4c/0xa0 [ 25.654818][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.660689][ T304] [ 25.662989][ T304] Freed by task 304: [ 25.666854][ T304] kasan_set_track+0x4a/0x70 [ 25.671423][ T304] kasan_set_free_info+0x23/0x40 [ 25.676336][ T304] ____kasan_slab_free+0x125/0x160 [ 25.681422][ T304] __kasan_slab_free+0x11/0x20 [ 25.686163][ T304] slab_free_freelist_hook+0xc2/0x190 [ 25.691511][ T304] kfree+0xc4/0x270 [ 25.695300][ T304] pskb_expand_head+0x394/0x1280 [ 25.700215][ T304] __pskb_pull_tail+0xba/0x1570 [ 25.705041][ T304] __xfrm_decode_session+0x5b0/0x1de0 [ 25.710395][ T304] __xfrm_route_forward+0x115/0x540 [ 25.715571][ T304] ip6_forward+0xca5/0x1ba0 [ 25.720057][ T304] ip6_rcv_finish+0x18f/0x360 [ 25.724725][ T304] ipv6_rcv+0xed/0x230 [ 25.728788][ T304] __netif_receive_skb+0xc8/0x280 [ 25.733800][ T304] netif_receive_skb+0x98/0x3e0 [ 25.738635][ T304] tun_rx_batched+0x600/0x750 [ 25.743298][ T304] tun_get_user+0x284f/0x34c0 [ 25.747958][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 25.752966][ T304] vfs_write+0x831/0xfd0 [ 25.757192][ T304] ksys_write+0x14a/0x260 [ 25.761503][ T304] __x64_sys_write+0x7b/0x90 [ 25.766073][ T304] x64_sys_call+0x8ef/0x9a0 [ 25.770557][ T304] do_syscall_64+0x4c/0xa0 [ 25.774954][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.780865][ T304] [ 25.783176][ T304] The buggy address belongs to the object at ffff88811d76b000 [ 25.783176][ T304] which belongs to the cache kmalloc-512 of size 512 [ 25.797205][ T304] The buggy address is located 72 bytes inside of [ 25.797205][ T304] 512-byte region [ffff88811d76b000, ffff88811d76b200) [ 25.810376][ T304] The buggy address belongs to the page: [ 25.815997][ T304] page:ffffea000475da00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d768 [ 25.826229][ T304] head:ffffea000475da00 order:2 compound_mapcount:0 compound_pincount:0 [ 25.834529][ T304] flags: 0x4000000000010200(slab|head|zone=1) [ 25.840593][ T304] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 25.849153][ T304] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.857713][ T304] page dumped because: kasan: bad access detected [ 25.864098][ T304] page_owner tracks the page as allocated [ 25.869796][ T304] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 304, ts 25205705096, free_ts 24500535815 [ 25.888783][ T304] post_alloc_hook+0x192/0x1b0 [ 25.893533][ T304] prep_new_page+0x1c/0x110 [ 25.898015][ T304] get_page_from_freelist+0x2c3a/0x2cd0 [ 25.903537][ T304] __alloc_pages+0x1a2/0x460 [ 25.908106][ T304] new_slab+0xa0/0x4d0 [ 25.912151][ T304] ___slab_alloc+0x3ac/0x840 [ 25.916721][ T304] __slab_alloc+0x49/0x90 [ 25.921027][ T304] __kmalloc+0x16a/0x2c0 [ 25.925251][ T304] __register_sysctl_table+0xa35/0x1240 [ 25.930781][ T304] register_net_sysctl+0x21d/0x230 [ 25.935872][ T304] __devinet_sysctl_register+0x2bd/0x390 [ 25.941485][ T304] devinet_sysctl_register+0x169/0x1e0 [ 25.946922][ T304] inetdev_init+0x2b2/0x500 [ 25.951405][ T304] inetdev_event+0x1f4/0x1060 [ 25.956059][ T304] raw_notifier_call_chain+0x90/0x100 [ 25.961407][ T304] call_netdevice_notifiers+0x119/0x190 [ 25.966934][ T304] page last free stack trace: [ 25.971585][ T304] free_unref_page_prepare+0x5fa/0x600 [ 25.977023][ T304] free_unref_page+0xae/0x540 [ 25.981677][ T304] free_compound_page+0x78/0xa0 [ 25.986503][ T304] __put_compound_page+0x77/0xb0 [ 25.991417][ T304] __put_page+0xbc/0xe0 [ 25.995549][ T304] page_to_skb+0x755/0xb60 [ 25.999944][ T304] receive_buf+0xcd3/0x4bc0 [ 26.004423][ T304] virtnet_poll+0x5cd/0xfb0 [ 26.008915][ T304] __napi_poll+0xbb/0x580 [ 26.013222][ T304] net_rx_action+0x37f/0x910 [ 26.017790][ T304] handle_softirqs+0x250/0x560 [ 26.022619][ T304] __irq_exit_rcu+0x52/0xf0 [ 26.027361][ T304] irq_exit_rcu+0x9/0x10 [ 26.031581][ T304] common_interrupt+0xbe/0xe0 [ 26.036239][ T304] asm_common_interrupt+0x27/0x40 [ 26.041246][ T304] [ 26.043554][ T304] Memory state around the buggy address: [ 26.049158][ T304] ffff88811d76af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [pid 304] write(5, "\x1e\x03\x08\x00\x4d\x6b\x71\xef\x28\x85\x63\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x79\x7a\x6b\x61\x6c\x6c\x65\x72\x30\x00\x00\x00\x00\x00\x00\x01\x71\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65501) = 65501 [pid 304] exit_group(1) = ? [ 26.057196][ T304] ffff88811d76af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.065232][ T304] >ffff88811d76b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.073269][ T304] ^ [ 26.079656][ T304] ffff88811d76b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.087690][ T304] ffff88811d76b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.095724][ T304] ================================================================== [ 26.103777][ T304] Disabling lock debugging due to kernel taint [pid 304] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=304, si_uid=0, si_status=1, si_utime=0, si_stime=26 /* 0.26 s */} --- exit_group(0) = ? +++ exited with 0 +++