ci-upstream-net-this-kasan-gce/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-net-this-kasan-gce/syz-executor924230985 <...> Warning: Permanently added '10.128.10.37' (ED25519) to the list of known hosts. execve("ci-upstream-net-this-kasan-gce/syz-executor924230985", ["ci-upstream-net-this-kasan-gce/syz-executor924230985"], 0x7ffcbdd7f850 /* 10 vars */) = 0 brk(NULL) = 0x55559476b000 brk(0x55559476bd80) = 0x55559476bd80 arch_prctl(ARCH_SET_FS, 0x55559476b400) = 0 set_tid_address(0x55559476b6d0) = 5630 set_robust_list(0x55559476b6e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-net-this-kasan-gce/syz-executor924230985", 4096) = 58 getrandom("\xec\x03\x93\x1f\xad\x00\xab\x57", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55559476bd80 brk(0x55559478cd80) = 0x55559478cd80 brk(0x55559478d000) = 0x55559478d000 mprotect(0x7f01a754f000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5632 attached , child_tidptr=0x55559476b6d0) = 5632 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5632] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5632] <... set_robust_list resumed>) = 0 [pid 5632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5632] setpgid(0, 0) = 0 [pid 5632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5632] write(3, "1000", 4) = 4 [pid 5632] close(3) = 0 [pid 5632] write(1, "executing program\n", 18) = 18 [pid 5632] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 executing program [pid 5632] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5632] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5632}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5632] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5632}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5632] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5632] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5632] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5632] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5632] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5632] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [ 87.328323][ T988] cfg80211: failed to load regulatory.db [pid 5632] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5632] exit_group(0) = ? [ 87.400401][ T5632] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5632 [ 87.400432][ T5632] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.400501][ T5632] CPU: 0 UID: 0 PID: 5632 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 87.400524][ T5632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.400536][ T5632] Call Trace: [ 87.400544][ T5632] [pid 5632] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5632, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5634 attached [ 87.400554][ T5632] dump_stack_lvl+0xe8/0x150 [ 87.400586][ T5632] check_preemption_disabled+0xcd/0xd0 [ 87.400613][ T5632] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.400645][ T5632] ? tun_queue_purge+0x4f/0xb0 [ 87.400675][ T5632] trace_kfree_skb+0x1d1/0x210 [ 87.400708][ T5632] sk_skb_reason_drop+0xdd/0x110 [ 87.400736][ T5632] tun_queue_purge+0x4f/0xb0 [ 87.400760][ T5632] __tun_detach+0xcd5/0x1900 , child_tidptr=0x55559476b6d0) = 5634 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5634] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5634] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5634] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5634] setpgid(0, 0) = 0 [pid 5634] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5634] write(3, "1000", 4) = 4 executing program [pid 5634] close(3) = 0 [pid 5634] write(1, "executing program\n", 18) = 18 [pid 5634] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5634] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5634] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5634}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5634] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5634}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5634] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5634] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5634] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5634] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 87.400803][ T5632] tun_chr_close+0x10a/0x1c0 [ 87.400823][ T5632] ? __pfx_tun_chr_close+0x10/0x10 [ 87.400843][ T5632] __fput+0x418/0xa50 [ 87.400878][ T5632] task_work_run+0x1d9/0x270 [ 87.400905][ T5632] ? __pfx_task_work_run+0x10/0x10 [ 87.400926][ T5632] ? do_raw_spin_unlock+0xf5/0x200 [ 87.400962][ T5632] do_exit+0x73a/0x2360 [ 87.400991][ T5632] ? __pfx_do_exit+0x10/0x10 [ 87.401008][ T5632] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.401042][ T5632] ? _raw_spin_unlock_irq+0x23/0x50 [pid 5634] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5634] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5634] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5634] exit_group(0) = ? [ 87.401071][ T5632] do_group_exit+0x22d/0x2f0 [ 87.401093][ T5632] __x64_sys_exit_group+0x3f/0x40 [ 87.401110][ T5632] x64_sys_call+0x18c6/0x18d0 [ 87.401125][ T5632] do_syscall_64+0x166/0x520 [ 87.401143][ T5632] ? trace_irq_disable+0x3b/0x140 [ 87.401160][ T5632] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.401177][ T5632] ? clear_bhb_loop+0x70/0xc0 [ 87.401198][ T5632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.401214][ T5632] RIP: 0033:0x7f01a74bbbe5 [ 87.401230][ T5632] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 87.401238][ T5632] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 87.401258][ T5632] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 87.401270][ T5632] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 87.401282][ T5632] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 87.401292][ T5632] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 87.401302][ T5632] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 87.401328][ T5632] [ 87.401547][ T5632] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5632 [ 87.401562][ T5632] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.401591][ T5632] CPU: 0 UID: 0 PID: 5632 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 87.401610][ T5632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.401619][ T5632] Call Trace: [ 87.401626][ T5632] [pid 5634] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5634, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5638 attached , child_tidptr=0x55559476b6d0) = 5638 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 87.401632][ T5632] dump_stack_lvl+0xe8/0x150 [ 87.401657][ T5632] check_preemption_disabled+0xcd/0xd0 [ 87.401679][ T5632] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.401724][ T5632] ? tun_queue_purge+0x4f/0xb0 [ 87.401744][ T5632] trace_kfree_skb+0x1d1/0x210 [ 87.401767][ T5632] sk_skb_reason_drop+0xdd/0x110 [ 87.401789][ T5632] tun_queue_purge+0x4f/0xb0 [ 87.401809][ T5632] __tun_detach+0xcd5/0x1900 [ 87.401844][ T5632] tun_chr_close+0x10a/0x1c0 [pid 5638] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5638] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5638] setpgid(0, 0) = 0 [pid 5638] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5638] write(3, "1000", 4) = 4 [ 87.401861][ T5632] ? __pfx_tun_chr_close+0x10/0x10 [ 87.401877][ T5632] __fput+0x418/0xa50 [ 87.401905][ T5632] task_work_run+0x1d9/0x270 [ 87.401925][ T5632] ? __pfx_task_work_run+0x10/0x10 [ 87.401942][ T5632] ? do_raw_spin_unlock+0xf5/0x200 [ 87.401973][ T5632] do_exit+0x73a/0x2360 [ 87.401997][ T5632] ? __pfx_do_exit+0x10/0x10 [ 87.402011][ T5632] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.402043][ T5632] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.402071][ T5632] do_group_exit+0x22d/0x2f0 [pid 5638] close(3) = 0 [pid 5638] write(1, "executing program\n", 18) = 18 executing program [pid 5638] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5638] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5638] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5638}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5638] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5638] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5638] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5638] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5638] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 87.402098][ T5632] __x64_sys_exit_group+0x3f/0x40 [ 87.402118][ T5632] x64_sys_call+0x18c6/0x18d0 [ 87.402135][ T5632] do_syscall_64+0x166/0x520 [ 87.402154][ T5632] ? trace_irq_disable+0x3b/0x140 [ 87.402174][ T5632] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.402195][ T5632] ? clear_bhb_loop+0x70/0xc0 [ 87.402220][ T5632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.402240][ T5632] RIP: 0033:0x7f01a74bbbe5 [ 87.402258][ T5632] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [pid 5638] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5638] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5638] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5638] exit_group(0) = ? [ 87.402267][ T5632] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 87.402289][ T5632] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 87.402303][ T5632] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 87.402315][ T5632] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 87.402327][ T5632] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 87.402339][ T5632] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 87.402373][ T5632] [ 87.597802][ T5634] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5634 [ 87.597826][ T5634] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.597863][ T5634] CPU: 0 UID: 0 PID: 5634 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 87.597884][ T5634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.597895][ T5634] Call Trace: [ 87.597902][ T5634] [ 87.597910][ T5634] dump_stack_lvl+0xe8/0x150 [ 87.597943][ T5634] check_preemption_disabled+0xcd/0xd0 [ 87.597969][ T5634] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.597998][ T5634] ? tun_queue_purge+0x4f/0xb0 [ 87.598021][ T5634] trace_kfree_skb+0x1d1/0x210 [ 87.598090][ T5634] sk_skb_reason_drop+0xdd/0x110 [ 87.598184][ T5634] tun_queue_purge+0x4f/0xb0 [ 87.598214][ T5634] __tun_detach+0xcd5/0x1900 [ 87.598254][ T5634] tun_chr_close+0x10a/0x1c0 [ 87.598273][ T5634] ? __pfx_tun_chr_close+0x10/0x10 [pid 5638] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5638, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 87.598291][ T5634] __fput+0x418/0xa50 [ 87.598323][ T5634] task_work_run+0x1d9/0x270 [ 87.598348][ T5634] ? __pfx_task_work_run+0x10/0x10 [ 87.598369][ T5634] ? do_raw_spin_unlock+0xf5/0x200 [ 87.598402][ T5634] do_exit+0x73a/0x2360 [ 87.598430][ T5634] ? __pfx_do_exit+0x10/0x10 [ 87.598445][ T5634] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.598599][ T5634] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.598633][ T5634] do_group_exit+0x22d/0x2f0 [ 87.598658][ T5634] __x64_sys_exit_group+0x3f/0x40 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5644 attached , child_tidptr=0x55559476b6d0) = 5644 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5644] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5644] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 87.598677][ T5634] x64_sys_call+0x18c6/0x18d0 [ 87.598693][ T5634] do_syscall_64+0x166/0x520 [ 87.598713][ T5634] ? trace_irq_disable+0x3b/0x140 [ 87.598731][ T5634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.598750][ T5634] ? clear_bhb_loop+0x70/0xc0 [ 87.598773][ T5634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.598792][ T5634] RIP: 0033:0x7f01a74bbbe5 [ 87.598810][ T5634] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [pid 5644] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5644] setpgid(0, 0) = 0 [pid 5644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5644] write(3, "1000", 4) = 4 [pid 5644] close(3) = 0 [pid 5644] write(1, "executing program\n", 18) = 18 executing program [pid 5644] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5644] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [ 87.598819][ T5634] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 87.598841][ T5634] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 87.598855][ T5634] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 87.598866][ T5634] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 87.598877][ T5634] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 87.598888][ T5634] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [pid 5644] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5644}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5644] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5644}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5644] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5644] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5644] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5644] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 87.598917][ T5634] [ 87.599021][ T5634] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5634 [ 87.599048][ T5634] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.599080][ T5634] CPU: 0 UID: 0 PID: 5634 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 87.599101][ T5634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.599111][ T5634] Call Trace: [pid 5644] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5644] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5644] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5644] exit_group(0) = ? [ 87.599119][ T5634] [ 87.599126][ T5634] dump_stack_lvl+0xe8/0x150 [ 87.599153][ T5634] check_preemption_disabled+0xcd/0xd0 [ 87.599178][ T5634] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 87.599208][ T5634] ? tun_queue_purge+0x4f/0xb0 [ 87.599230][ T5634] trace_kfree_skb+0x1d1/0x210 [ 87.599257][ T5634] sk_skb_reason_drop+0xdd/0x110 [ 87.599282][ T5634] tun_queue_purge+0x4f/0xb0 [ 87.599309][ T5634] __tun_detach+0xcd5/0x1900 [ 87.599347][ T5634] tun_chr_close+0x10a/0x1c0 [ 87.599366][ T5634] ? __pfx_tun_chr_close+0x10/0x10 [ 87.599385][ T5634] __fput+0x418/0xa50 [ 87.599416][ T5634] task_work_run+0x1d9/0x270 [ 87.599439][ T5634] ? __pfx_task_work_run+0x10/0x10 [ 87.599459][ T5634] ? do_raw_spin_unlock+0xf5/0x200 [ 87.599492][ T5634] do_exit+0x73a/0x2360 [ 87.599519][ T5634] ? __pfx_do_exit+0x10/0x10 [ 87.599535][ T5634] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.599571][ T5634] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.599602][ T5634] do_group_exit+0x22d/0x2f0 [ 87.599626][ T5634] __x64_sys_exit_group+0x3f/0x40 [ 87.599645][ T5634] x64_sys_call+0x18c6/0x18d0 [ 87.599661][ T5634] do_syscall_64+0x166/0x520 [ 87.599680][ T5634] ? trace_irq_disable+0x3b/0x140 [ 87.599697][ T5634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.599716][ T5634] ? clear_bhb_loop+0x70/0xc0 [ 87.599739][ T5634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.599758][ T5634] RIP: 0033:0x7f01a74bbbe5 [ 87.599774][ T5634] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 87.599783][ T5634] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 87.599912][ T5634] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 87.599929][ T5634] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 87.599941][ T5634] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 87.599951][ T5634] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 87.599962][ T5634] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 87.599994][ T5634] [ 88.243131][ T5644] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5644 [ 88.243156][ T5644] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 88.243197][ T5644] CPU: 0 UID: 0 PID: 5644 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [pid 5644] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5644, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 88.243228][ T5644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.243240][ T5644] Call Trace: [ 88.243249][ T5644] [ 88.243256][ T5644] dump_stack_lvl+0xe8/0x150 [ 88.243287][ T5644] check_preemption_disabled+0xcd/0xd0 [ 88.243313][ T5644] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 88.243342][ T5644] ? tun_queue_purge+0x4f/0xb0 [ 88.243366][ T5644] trace_kfree_skb+0x1d1/0x210 [ 88.243394][ T5644] sk_skb_reason_drop+0xdd/0x110 [ 88.243419][ T5644] tun_queue_purge+0x4f/0xb0 [ 88.243441][ T5644] __tun_detach+0xcd5/0x1900 [ 88.243479][ T5644] tun_chr_close+0x10a/0x1c0 [ 88.243498][ T5644] ? __pfx_tun_chr_close+0x10/0x10 [ 88.243516][ T5644] __fput+0x418/0xa50 [ 88.243548][ T5644] task_work_run+0x1d9/0x270 [ 88.243573][ T5644] ? __pfx_task_work_run+0x10/0x10 [ 88.243593][ T5644] ? do_raw_spin_unlock+0xf5/0x200 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 88.243626][ T5644] do_exit+0x73a/0x2360 [ 88.243654][ T5644] ? __pfx_do_exit+0x10/0x10 [ 88.243670][ T5644] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.243705][ T5644] ? _raw_spin_unlock_irq+0x23/0x50 [ 88.243736][ T5644] do_group_exit+0x22d/0x2f0 [ 88.243760][ T5644] __x64_sys_exit_group+0x3f/0x40 [ 88.243779][ T5644] x64_sys_call+0x18c6/0x18d0 [ 88.243796][ T5644] do_syscall_64+0x166/0x520 [ 88.243815][ T5644] ? trace_irq_disable+0x3b/0x140 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5654 attached , child_tidptr=0x55559476b6d0) = 5654 [ 88.243834][ T5644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.243854][ T5644] ? clear_bhb_loop+0x70/0xc0 [ 88.243877][ T5644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.243895][ T5644] RIP: 0033:0x7f01a74bbbe5 [ 88.243912][ T5644] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 88.243921][ T5644] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 88.243943][ T5644] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5654] set_robust_list(0x55559476b6e0, 24) = 0 [ 88.243956][ T5644] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 88.243968][ T5644] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 88.243978][ T5644] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 88.243989][ T5644] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 88.244019][ T5644] [ 88.246081][ T5644] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5644 [pid 5654] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 88.246103][ T5644] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 88.246135][ T5644] CPU: 0 UID: 0 PID: 5644 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 88.246156][ T5644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.246166][ T5644] Call Trace: [ 88.246174][ T5644] [ 88.246181][ T5644] dump_stack_lvl+0xe8/0x150 [ 88.246217][ T5644] check_preemption_disabled+0xcd/0xd0 [pid 5654] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 88.246242][ T5644] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 88.246272][ T5644] ? tun_queue_purge+0x4f/0xb0 [ 88.246293][ T5644] trace_kfree_skb+0x1d1/0x210 [ 88.246320][ T5644] sk_skb_reason_drop+0xdd/0x110 [ 88.246345][ T5644] tun_queue_purge+0x4f/0xb0 [ 88.246367][ T5644] __tun_detach+0xcd5/0x1900 [ 88.246406][ T5644] tun_chr_close+0x10a/0x1c0 [ 88.246424][ T5644] ? __pfx_tun_chr_close+0x10/0x10 [ 88.246443][ T5644] __fput+0x418/0xa50 [pid 5654] setpgid(0, 0) = 0 [ 88.246475][ T5644] task_work_run+0x1d9/0x270 [ 88.246503][ T5644] ? __pfx_task_work_run+0x10/0x10 [ 88.246523][ T5644] ? do_raw_spin_unlock+0xf5/0x200 [ 88.246556][ T5644] do_exit+0x73a/0x2360 [ 88.246583][ T5644] ? __pfx_do_exit+0x10/0x10 [ 88.246599][ T5644] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.246634][ T5644] ? _raw_spin_unlock_irq+0x23/0x50 [ 88.246665][ T5644] do_group_exit+0x22d/0x2f0 [ 88.246688][ T5644] __x64_sys_exit_group+0x3f/0x40 [pid 5654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 executing program [pid 5654] write(3, "1000", 4) = 4 [pid 5654] close(3) = 0 [pid 5654] write(1, "executing program\n", 18) = 18 [pid 5654] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5654] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [ 88.246707][ T5644] x64_sys_call+0x18c6/0x18d0 [ 88.246723][ T5644] do_syscall_64+0x166/0x520 [ 88.246742][ T5644] ? trace_irq_disable+0x3b/0x140 [ 88.246761][ T5644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.246780][ T5644] ? clear_bhb_loop+0x70/0xc0 [ 88.246803][ T5644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.246821][ T5644] RIP: 0033:0x7f01a74bbbe5 [ 88.246838][ T5644] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [pid 5654] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5654}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5654] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5654}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5654] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5654] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5654] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5654] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5654] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5654] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [ 88.246847][ T5644] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 88.246867][ T5644] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 88.246880][ T5644] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 88.246892][ T5644] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 88.246902][ T5644] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [pid 5654] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5654] exit_group(0) = ? [ 88.246913][ T5644] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 88.246942][ T5644] [pid 5654] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5654, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5665 attached [pid 5665] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5665] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5665 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5665] <... prctl resumed>) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5665] setpgid(0, 0) = 0 [pid 5665] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5665] write(3, "1000", 4) = 4 [pid 5665] close(3) = 0 executing program [pid 5665] write(1, "executing program\n", 18) = 18 [pid 5665] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5665] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5665] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5665}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5665] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5665}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5665] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5665] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5665] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5665] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5665] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5665] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5665] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5665] exit_group(0) = ? [ 89.148194][ T5665] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5665 [ 89.148235][ T5665] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 89.148279][ T5665] CPU: 1 UID: 0 PID: 5665 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 89.148302][ T5665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.148315][ T5665] Call Trace: [ 89.148323][ T5665] [pid 5665] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5665, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5669 attached , child_tidptr=0x55559476b6d0) = 5669 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5669] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5669] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5669] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5669] setpgid(0, 0) = 0 [ 89.148333][ T5665] dump_stack_lvl+0xe8/0x150 [ 89.148368][ T5665] check_preemption_disabled+0xcd/0xd0 [ 89.148398][ T5665] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 89.148430][ T5665] ? tun_queue_purge+0x4f/0xb0 [ 89.148456][ T5665] trace_kfree_skb+0x1d1/0x210 [ 89.148487][ T5665] sk_skb_reason_drop+0xdd/0x110 [ 89.148515][ T5665] tun_queue_purge+0x4f/0xb0 [ 89.148540][ T5665] __tun_detach+0xcd5/0x1900 [ 89.148583][ T5665] tun_chr_close+0x10a/0x1c0 [pid 5669] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5669] write(3, "1000", 4) = 4 [pid 5669] close(3) = 0 [pid 5669] write(1, "executing program\n", 18) = 18 executing program [pid 5669] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5669] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5669] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5669}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5669] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5669}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5669] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5669] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5669] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5669] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5669] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [ 89.148604][ T5665] ? __pfx_tun_chr_close+0x10/0x10 [ 89.148625][ T5665] __fput+0x418/0xa50 [ 89.148661][ T5665] task_work_run+0x1d9/0x270 [ 89.148688][ T5665] ? __pfx_task_work_run+0x10/0x10 [ 89.148709][ T5665] ? do_raw_spin_unlock+0xf5/0x200 [ 89.148746][ T5665] do_exit+0x73a/0x2360 [ 89.148782][ T5665] ? __pfx_do_exit+0x10/0x10 [ 89.148801][ T5665] ? do_raw_spin_lock+0x12b/0x2f0 [ 89.148841][ T5665] ? _raw_spin_unlock_irq+0x23/0x50 [pid 5669] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5669] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5669] exit_group(0) = ? [ 89.148875][ T5665] do_group_exit+0x22d/0x2f0 [ 89.148901][ T5665] __x64_sys_exit_group+0x3f/0x40 [ 89.148922][ T5665] x64_sys_call+0x18c6/0x18d0 [ 89.148941][ T5665] do_syscall_64+0x166/0x520 [ 89.148962][ T5665] ? trace_irq_disable+0x3b/0x140 [ 89.148983][ T5665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.149004][ T5665] ? clear_bhb_loop+0x70/0xc0 [ 89.149030][ T5665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.149050][ T5665] RIP: 0033:0x7f01a74bbbe5 [ 89.149069][ T5665] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 89.149079][ T5665] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 89.149104][ T5665] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 89.149119][ T5665] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 89.149133][ T5665] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 89.149145][ T5665] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 89.149157][ T5665] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 89.149192][ T5665] [ 89.149293][ T5665] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5665 [ 89.149311][ T5665] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 89.149342][ T5665] CPU: 1 UID: 0 PID: 5665 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 89.149362][ T5665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [pid 5669] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5669, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 89.149373][ T5665] Call Trace: [ 89.149381][ T5665] [ 89.149389][ T5665] dump_stack_lvl+0xe8/0x150 [ 89.149419][ T5665] check_preemption_disabled+0xcd/0xd0 [ 89.149445][ T5665] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 89.149477][ T5665] ? tun_queue_purge+0x4f/0xb0 [ 89.149499][ T5665] trace_kfree_skb+0x1d1/0x210 [ 89.149527][ T5665] sk_skb_reason_drop+0xdd/0x110 [ 89.149553][ T5665] tun_queue_purge+0x4f/0xb0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5675 attached , child_tidptr=0x55559476b6d0) = 5675 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 89.149581][ T5665] __tun_detach+0xcd5/0x1900 [ 89.149624][ T5665] tun_chr_close+0x10a/0x1c0 [ 89.149643][ T5665] ? __pfx_tun_chr_close+0x10/0x10 [ 89.149663][ T5665] __fput+0x418/0xa50 [ 89.149695][ T5665] task_work_run+0x1d9/0x270 [ 89.149718][ T5665] ? __pfx_task_work_run+0x10/0x10 [ 89.149739][ T5665] ? do_raw_spin_unlock+0xf5/0x200 [ 89.149775][ T5665] do_exit+0x73a/0x2360 [ 89.149803][ T5665] ? __pfx_do_exit+0x10/0x10 [ 89.149821][ T5665] ? do_raw_spin_lock+0x12b/0x2f0 [pid 5675] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5675] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5675] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5675] setpgid(0, 0) = 0 [pid 5675] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5675] write(3, "1000", 4) = 4 [pid 5675] close(3) = 0 [pid 5675] write(1, "executing program\n", 18) = 18 executing program [pid 5675] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5675] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5675] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5675}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5675] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5675}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5675] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5675] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5675] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [ 89.149862][ T5665] ? _raw_spin_unlock_irq+0x23/0x50 [ 89.149895][ T5665] do_group_exit+0x22d/0x2f0 [ 89.149921][ T5665] __x64_sys_exit_group+0x3f/0x40 [ 89.149941][ T5665] x64_sys_call+0x18c6/0x18d0 [ 89.149959][ T5665] do_syscall_64+0x166/0x520 [ 89.149980][ T5665] ? trace_irq_disable+0x3b/0x140 [ 89.150000][ T5665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.150021][ T5665] ? clear_bhb_loop+0x70/0xc0 [pid 5675] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5675] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5675] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5675] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5675] exit_group(0) = ? [ 89.150047][ T5665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.150067][ T5665] RIP: 0033:0x7f01a74bbbe5 [ 89.150085][ T5665] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 89.150095][ T5665] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 89.150117][ T5665] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 89.150131][ T5665] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 89.150144][ T5665] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 89.150155][ T5665] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 89.150167][ T5665] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 89.150200][ T5665] [pid 5675] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5675, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5681 attached [pid 5681] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5681] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5681] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5681 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5681] <... prctl resumed>) = 0 [pid 5681] setpgid(0, 0) = 0 [pid 5681] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5681] write(3, "1000", 4) = 4 [pid 5681] close(3) = 0 [pid 5681] write(1, "executing program\n", 18) = 18 [pid 5681] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 executing program [pid 5681] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5681] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5681}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5681] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5681}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5681] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5681] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5681] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5681] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5681] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5681] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5681] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5681] exit_group(0) = ? [pid 5681] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5681, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5687 attached , child_tidptr=0x55559476b6d0) = 5687 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5687] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5687] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5687] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5687] setpgid(0, 0) = 0 [pid 5687] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5687] write(3, "1000", 4) = 4 [pid 5687] close(3) = 0 [pid 5687] write(1, "executing program\n", 18) = 18 executing program [pid 5687] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5687] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5687] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5687}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5687] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5687}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5687] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5687] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5687] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5687] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5687] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5687] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5687] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5687] exit_group(0) = ? [ 90.091181][ T5687] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5687 [ 90.091210][ T5687] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 90.091251][ T5687] CPU: 0 UID: 0 PID: 5687 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 90.091274][ T5687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.091286][ T5687] Call Trace: [ 90.091295][ T5687] [ 90.091304][ T5687] dump_stack_lvl+0xe8/0x150 [ 90.091338][ T5687] check_preemption_disabled+0xcd/0xd0 [ 90.091367][ T5687] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 90.091399][ T5687] ? tun_queue_purge+0x4f/0xb0 [ 90.091425][ T5687] trace_kfree_skb+0x1d1/0x210 [ 90.091455][ T5687] sk_skb_reason_drop+0xdd/0x110 [ 90.091482][ T5687] tun_queue_purge+0x4f/0xb0 [ 90.091506][ T5687] __tun_detach+0xcd5/0x1900 [ 90.091548][ T5687] tun_chr_close+0x10a/0x1c0 [ 90.091569][ T5687] ? __pfx_tun_chr_close+0x10/0x10 [ 90.091589][ T5687] __fput+0x418/0xa50 [ 90.091637][ T5687] task_work_run+0x1d9/0x270 [ 90.091661][ T5687] ? __pfx_task_work_run+0x10/0x10 [ 90.091682][ T5687] ? do_raw_spin_unlock+0xf5/0x200 [ 90.091717][ T5687] do_exit+0x73a/0x2360 [ 90.091749][ T5687] ? __pfx_do_exit+0x10/0x10 [ 90.091767][ T5687] ? do_raw_spin_lock+0x12b/0x2f0 [ 90.091806][ T5687] ? _raw_spin_unlock_irq+0x23/0x50 [ 90.091841][ T5687] do_group_exit+0x22d/0x2f0 [ 90.091867][ T5687] __x64_sys_exit_group+0x3f/0x40 [ 90.091888][ T5687] x64_sys_call+0x18c6/0x18d0 [ 90.091907][ T5687] do_syscall_64+0x166/0x520 [ 90.091928][ T5687] ? trace_irq_disable+0x3b/0x140 [ 90.091948][ T5687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.091968][ T5687] ? clear_bhb_loop+0x70/0xc0 [ 90.091991][ T5687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.092011][ T5687] RIP: 0033:0x7f01a74bbbe5 [ 90.092028][ T5687] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [pid 5687] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5687, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5697 attached , child_tidptr=0x55559476b6d0) = 5697 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 90.092037][ T5687] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 90.092060][ T5687] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 90.092075][ T5687] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 90.092087][ T5687] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 90.092098][ T5687] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [pid 5697] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5697] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5697] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5697] setpgid(0, 0) = 0 [pid 5697] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5697] write(3, "1000", 4) = 4 [pid 5697] close(3) = 0 executing program [pid 5697] write(1, "executing program\n", 18) = 18 [pid 5697] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5697] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [ 90.092110][ T5687] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 90.092216][ T5687] [ 90.157537][ T5687] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5687 [ 90.157564][ T5687] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 90.157611][ T5687] CPU: 0 UID: 0 PID: 5687 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [pid 5697] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5697}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5697] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5697}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5697] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5697] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5697] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5697] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 90.157634][ T5687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.157646][ T5687] Call Trace: [ 90.157654][ T5687] [ 90.157663][ T5687] dump_stack_lvl+0xe8/0x150 [ 90.157696][ T5687] check_preemption_disabled+0xcd/0xd0 [ 90.157725][ T5687] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 90.157758][ T5687] ? tun_queue_purge+0x4f/0xb0 [ 90.157783][ T5687] trace_kfree_skb+0x1d1/0x210 [ 90.157812][ T5687] sk_skb_reason_drop+0xdd/0x110 [pid 5697] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5697] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5697] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5697] exit_group(0) = ? [ 90.157840][ T5687] tun_queue_purge+0x4f/0xb0 [ 90.157863][ T5687] __tun_detach+0xcd5/0x1900 [ 90.157907][ T5687] tun_chr_close+0x10a/0x1c0 [ 90.157928][ T5687] ? __pfx_tun_chr_close+0x10/0x10 [ 90.157949][ T5687] __fput+0x418/0xa50 [ 90.157984][ T5687] task_work_run+0x1d9/0x270 [ 90.158010][ T5687] ? __pfx_task_work_run+0x10/0x10 [ 90.158031][ T5687] ? do_raw_spin_unlock+0xf5/0x200 [ 90.158068][ T5687] do_exit+0x73a/0x2360 [ 90.158099][ T5687] ? __pfx_do_exit+0x10/0x10 [ 90.158117][ T5687] ? do_raw_spin_lock+0x12b/0x2f0 [ 90.158156][ T5687] ? _raw_spin_unlock_irq+0x23/0x50 [ 90.158191][ T5687] do_group_exit+0x22d/0x2f0 [ 90.158217][ T5687] __x64_sys_exit_group+0x3f/0x40 [ 90.158239][ T5687] x64_sys_call+0x18c6/0x18d0 [ 90.158257][ T5687] do_syscall_64+0x166/0x520 [ 90.158278][ T5687] ? trace_irq_disable+0x3b/0x140 [ 90.158298][ T5687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.158319][ T5687] ? clear_bhb_loop+0x70/0xc0 [ 90.158344][ T5687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.158364][ T5687] RIP: 0033:0x7f01a74bbbe5 [ 90.158383][ T5687] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 90.158392][ T5687] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 90.158416][ T5687] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 90.158431][ T5687] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [pid 5697] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5697, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5702 attached , child_tidptr=0x55559476b6d0) = 5702 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5702] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5702] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5702] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5702] setpgid(0, 0) = 0 [ 90.158444][ T5687] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 90.158456][ T5687] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 90.158468][ T5687] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 90.158501][ T5687] [pid 5702] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5702] write(3, "1000", 4) = 4 [pid 5702] close(3) = 0 executing program [pid 5702] write(1, "executing program\n", 18) = 18 [pid 5702] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5702] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5702] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5702}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5702] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5702}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5702] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5702] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5702] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5702] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5702] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5702] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5702] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5702] exit_group(0) = ? [pid 5702] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5702, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5711 attached [pid 5711] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5711] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5711 [pid 5711] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5711] <... prctl resumed>) = 0 [pid 5711] setpgid(0, 0) = 0 [pid 5711] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5711] write(3, "1000", 4) = 4 [pid 5711] close(3) = 0 [pid 5711] write(1, "executing program\n", 18) = 18 executing program [pid 5711] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5711] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5711] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5711}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5711] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5711}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5711] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5711] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5711] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5711] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5711] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5711] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5711] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5711] exit_group(0) = ? [pid 5711] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5711, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5720 attached , child_tidptr=0x55559476b6d0) = 5720 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5720] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5720] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5720] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5720] setpgid(0, 0) = 0 [pid 5720] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5720] write(3, "1000", 4) = 4 [pid 5720] close(3) = 0 executing program [pid 5720] write(1, "executing program\n", 18) = 18 [pid 5720] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5720] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5720] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5720}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5720] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5720}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5720] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5720] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5720] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5720] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5720] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5720] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5720] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5720] exit_group(0) = ? [pid 5720] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5720, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55559476b6d0) = 5728 ci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5728 attached [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5728] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5728] <... set_robust_list resumed>) = 0 [pid 5728] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5728] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5728] setpgid(0, 0) = 0 [pid 5728] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5728] write(3, "1000", 4) = 4 [pid 5728] close(3) = 0 [pid 5728] write(1, "executing program\n", 18) = 18 executing program [pid 5728] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5728] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5728] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5728}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5728] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5728}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5728] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5728] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5728] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5728] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5728] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5728] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5728] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5728] exit_group(0) = ? [pid 5728] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5728, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5736 attached [pid 5736] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5736] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5736 [pid 5736] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5736] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5736] <... prctl resumed>) = 0 [pid 5736] setpgid(0, 0) = 0 [pid 5736] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5736] write(3, "1000", 4) = 4 [pid 5736] close(3) = 0 executing program [pid 5736] write(1, "executing program\n", 18) = 18 [pid 5736] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5736] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5736] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5736}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5736] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5736}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5736] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5736] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5736] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5736] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5736] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5736] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5736] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5736] exit_group(0) = ? [pid 5736] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5736, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5737 attached , child_tidptr=0x55559476b6d0) = 5737 [pid 5737] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5737] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5737] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5737] setpgid(0, 0) = 0 executing program [pid 5737] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5737] write(3, "1000", 4) = 4 [pid 5737] close(3) = 0 [pid 5737] write(1, "executing program\n", 18) = 18 [pid 5737] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5737] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5737] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5737}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5737] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5737}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5737] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5737] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5737] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5737] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5737] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5737] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5737] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5737] exit_group(0) = ? [pid 5737] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5737, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5740 attached , child_tidptr=0x55559476b6d0) = 5740 [pid 5740] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5740] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5740] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5740] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5740] setpgid(0, 0) = 0 [pid 5740] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5740] write(3, "1000", 4) = 4 [pid 5740] close(3) = 0 executing program [pid 5740] write(1, "executing program\n", 18) = 18 [pid 5740] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5740] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5740] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5740}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5740] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5740}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5740] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5740] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5740] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5740] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5740] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5740] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5740] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5740] exit_group(0) = ? [pid 5740] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5740, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5743 attached [pid 5743] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5743] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5743 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5743] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5743] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5743] setpgid(0, 0) = 0 [pid 5743] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 executing program [pid 5743] write(3, "1000", 4) = 4 [pid 5743] close(3) = 0 [pid 5743] write(1, "executing program\n", 18) = 18 [pid 5743] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5743] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5743] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5743}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5743] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5743}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5743] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5743] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5743] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5743] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5743] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5743] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5743] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5743] exit_group(0) = ? [pid 5743] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5743, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5752 attached [pid 5752] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5752 [pid 5752] <... set_robust_list resumed>) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5752] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5752] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5752] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5752] setpgid(0, 0) = 0 [pid 5752] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5752] write(3, "1000", 4) = 4 [pid 5752] close(3) = 0 executing program [pid 5752] write(1, "executing program\n", 18) = 18 [pid 5752] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5752] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5752] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5752}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5752] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5752}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5752] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5752] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5752] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5752] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5752] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5752] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5752] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5752] exit_group(0) = ? [pid 5752] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5752, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5759 attached [pid 5759] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5759 [pid 5759] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5759] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5759] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5759] setpgid(0, 0) = 0 [pid 5759] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5759] write(3, "1000", 4) = 4 [pid 5759] close(3) = 0 executing program [pid 5759] write(1, "executing program\n", 18) = 18 [pid 5759] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5759] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5759] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5759}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5759] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5759}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5759] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5759] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5759] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5759] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5759] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5759] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5759] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5759] exit_group(0) = ? [pid 5759] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5759, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5766 attached , child_tidptr=0x55559476b6d0) = 5766 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5766] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5766] <... set_robust_list resumed>) = 0 [pid 5766] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5766] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5766] setpgid(0, 0) = 0 [pid 5766] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5766] write(3, "1000", 4) = 4 [pid 5766] close(3) = 0 [pid 5766] write(1, "executing program\n", 18) = 18 [pid 5766] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 executing program [pid 5766] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5766] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5766}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5766] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5766}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5766] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5766] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5766] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5766] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5766] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5766] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5766] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5766] exit_group(0) = ? [pid 5766] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5766, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5774 attached [pid 5774] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5774] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5774 [pid 5774] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5774] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5774] <... prctl resumed>) = 0 [pid 5774] setpgid(0, 0) = 0 [pid 5774] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5774] write(3, "1000", 4) = 4 [pid 5774] close(3) = 0 [pid 5774] write(1, "executing program\n", 18) = 18 executing program [pid 5774] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5774] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5774] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5774}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5774] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5774}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5774] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5774] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5774] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5774] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5774] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5774] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5774] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5774] exit_group(0) = ? [pid 5774] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5774, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5781 attached [pid 5781] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5781] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5781 [pid 5781] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5781] <... prctl resumed>) = 0 [pid 5781] setpgid(0, 0) = 0 [pid 5781] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5781] write(3, "1000", 4) = 4 [pid 5781] close(3) = 0 executing program [pid 5781] write(1, "executing program\n", 18) = 18 [pid 5781] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5781] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5781] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5781}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5781] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5781}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5781] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5781] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5781] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5781] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5781] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5781] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5781] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5781] exit_group(0) = ? [pid 5781] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5781, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5789 attached [pid 5789] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5789 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5789] <... set_robust_list resumed>) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5789] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5789] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5789] setpgid(0, 0) = 0 [pid 5789] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5789] write(3, "1000", 4) = 4 [pid 5789] close(3) = 0 executing program [pid 5789] write(1, "executing program\n", 18) = 18 [pid 5789] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5789] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5789] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5789}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5789] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5789}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5789] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5789] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5789] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5789] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5789] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5789] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5789] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5789] exit_group(0) = ? [pid 5789] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5789, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5796 attached , child_tidptr=0x55559476b6d0) = 5796 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5796] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5796] <... set_robust_list resumed>) = 0 [pid 5796] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5796] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5796] setpgid(0, 0) = 0 [pid 5796] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5796] write(3, "1000", 4) = 4 [pid 5796] close(3) = 0 executing program [pid 5796] write(1, "executing program\n", 18) = 18 [pid 5796] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5796] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5796] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5796}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5796] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5796}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5796] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5796] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5796] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5796] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5796] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5796] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5796] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5796] exit_group(0) = ? [pid 5796] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5796, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5804 attached , child_tidptr=0x55559476b6d0) = 5804 [pid 5804] set_robust_list(0x55559476b6e0, 24 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5804] <... set_robust_list resumed>) = 0 [pid 5804] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5804] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5804] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5804] setpgid(0, 0) = 0 [pid 5804] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5804] write(3, "1000", 4) = 4 [pid 5804] close(3) = 0 executing program [pid 5804] write(1, "executing program\n", 18) = 18 [pid 5804] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5804] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5804] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5804}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5804] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5804}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5804] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5804] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5804] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5804] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5804] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5804] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5804] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5804] exit_group(0) = ? [ 93.765724][ T5804] check_preemption_disabled: 13 callbacks suppressed [ 93.765749][ T5804] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5804 [ 93.765768][ T5804] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 93.765808][ T5804] CPU: 0 UID: 0 PID: 5804 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 93.765831][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.765843][ T5804] Call Trace: [ 93.765851][ T5804] [ 93.765860][ T5804] dump_stack_lvl+0xe8/0x150 [ 93.765892][ T5804] check_preemption_disabled+0xcd/0xd0 [ 93.765920][ T5804] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 93.765953][ T5804] ? tun_queue_purge+0x4f/0xb0 [ 93.765989][ T5804] trace_kfree_skb+0x1d1/0x210 [ 93.766018][ T5804] sk_skb_reason_drop+0xdd/0x110 [ 93.766046][ T5804] tun_queue_purge+0x4f/0xb0 [ 93.766071][ T5804] __tun_detach+0xcd5/0x1900 [ 93.766111][ T5804] tun_chr_close+0x10a/0x1c0 [ 93.766132][ T5804] ? __pfx_tun_chr_close+0x10/0x10 [ 93.766152][ T5804] __fput+0x418/0xa50 [ 93.766185][ T5804] task_work_run+0x1d9/0x270 [ 93.766211][ T5804] ? __pfx_task_work_run+0x10/0x10 [ 93.766232][ T5804] ? do_raw_spin_unlock+0xf5/0x200 [ 93.766269][ T5804] do_exit+0x73a/0x2360 [ 93.766299][ T5804] ? __pfx_do_exit+0x10/0x10 [ 93.766453][ T5804] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.766499][ T5804] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.766536][ T5804] do_group_exit+0x22d/0x2f0 [pid 5804] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5804, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5810 attached , child_tidptr=0x55559476b6d0) = 5810 [pid 5810] set_robust_list(0x55559476b6e0, 24 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5810] <... set_robust_list resumed>) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5810] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5810] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5810] setpgid(0, 0) = 0 [pid 5810] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5810] write(3, "1000", 4) = 4 [pid 5810] close(3) = 0 [pid 5810] write(1, "executing program\n", 18) = 18 [pid 5810] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 executing program [ 93.766561][ T5804] __x64_sys_exit_group+0x3f/0x40 [ 93.766583][ T5804] x64_sys_call+0x18c6/0x18d0 [ 93.766601][ T5804] do_syscall_64+0x166/0x520 [ 93.766621][ T5804] ? trace_irq_disable+0x3b/0x140 [ 93.766641][ T5804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.766662][ T5804] ? clear_bhb_loop+0x70/0xc0 [ 93.766685][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.766705][ T5804] RIP: 0033:0x7f01a74bbbe5 [pid 5810] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5810] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5810}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5810] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5810}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5810] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5810] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5810] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5810] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5810] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5810] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5810] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5810] exit_group(0) = ? [ 93.766724][ T5804] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 93.766735][ T5804] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 93.766759][ T5804] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 93.766773][ T5804] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 93.766786][ T5804] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 93.766798][ T5804] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 93.766810][ T5804] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 93.766842][ T5804] [ 93.766915][ T5804] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5804 [ 93.766934][ T5804] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 93.766965][ T5804] CPU: 0 UID: 0 PID: 5804 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 93.766986][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.766997][ T5804] Call Trace: [ 93.767006][ T5804] [ 93.767015][ T5804] dump_stack_lvl+0xe8/0x150 [ 93.767046][ T5804] check_preemption_disabled+0xcd/0xd0 [ 93.767074][ T5804] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 93.767106][ T5804] ? tun_queue_purge+0x4f/0xb0 [ 93.767131][ T5804] trace_kfree_skb+0x1d1/0x210 [ 93.767172][ T5804] sk_skb_reason_drop+0xdd/0x110 [ 93.767200][ T5804] tun_queue_purge+0x4f/0xb0 [ 93.767225][ T5804] __tun_detach+0xcd5/0x1900 [ 93.767266][ T5804] tun_chr_close+0x10a/0x1c0 [ 93.767287][ T5804] ? __pfx_tun_chr_close+0x10/0x10 [ 93.767308][ T5804] __fput+0x418/0xa50 [ 93.767341][ T5804] task_work_run+0x1d9/0x270 [ 93.767366][ T5804] ? __pfx_task_work_run+0x10/0x10 [ 93.767388][ T5804] ? do_raw_spin_unlock+0xf5/0x200 [ 93.767424][ T5804] do_exit+0x73a/0x2360 [ 93.767497][ T5804] ? __pfx_do_exit+0x10/0x10 [ 93.767515][ T5804] ? do_raw_spin_lock+0x12b/0x2f0 [pid 5810] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5810, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 93.767553][ T5804] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.767588][ T5804] do_group_exit+0x22d/0x2f0 [ 93.767613][ T5804] __x64_sys_exit_group+0x3f/0x40 [ 93.767634][ T5804] x64_sys_call+0x18c6/0x18d0 [ 93.767653][ T5804] do_syscall_64+0x166/0x520 [ 93.767674][ T5804] ? trace_irq_disable+0x3b/0x140 [ 93.767694][ T5804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.767714][ T5804] ? clear_bhb_loop+0x70/0xc0 [ 93.767739][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.767759][ T5804] RIP: 0033:0x7f01a74bbbe5 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5816 attached [pid 5816] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5816 [pid 5816] <... set_robust_list resumed>) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5816] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5816] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5816] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5816] setpgid(0, 0) = 0 [pid 5816] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5816] write(3, "1000", 4) = 4 [pid 5816] close(3) = 0 [pid 5816] write(1, "executing program\n", 18) = 18 [pid 5816] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 executing program [pid 5816] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5816] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5816}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5816] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5816}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5816] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5816] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [ 93.767777][ T5804] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 93.767787][ T5804] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 93.767809][ T5804] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 93.767824][ T5804] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 93.767837][ T5804] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [pid 5816] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5816] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5816] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5816] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5816] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5816] exit_group(0) = ? [ 93.767847][ T5804] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 93.767860][ T5804] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 93.767893][ T5804] [ 94.315362][ T5816] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5816 [ 94.315397][ T5816] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.315441][ T5816] CPU: 1 UID: 0 PID: 5816 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 94.315464][ T5816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.315476][ T5816] Call Trace: [ 94.315485][ T5816] [ 94.315495][ T5816] dump_stack_lvl+0xe8/0x150 [ 94.315529][ T5816] check_preemption_disabled+0xcd/0xd0 [ 94.315559][ T5816] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.315591][ T5816] ? tun_queue_purge+0x4f/0xb0 [ 94.315618][ T5816] trace_kfree_skb+0x1d1/0x210 [ 94.315653][ T5816] sk_skb_reason_drop+0xdd/0x110 [ 94.315682][ T5816] tun_queue_purge+0x4f/0xb0 [ 94.315706][ T5816] __tun_detach+0xcd5/0x1900 [ 94.315750][ T5816] tun_chr_close+0x10a/0x1c0 [pid 5816] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5816, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5819 attached , child_tidptr=0x55559476b6d0) = 5819 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5819] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5819] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5819] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5819] setpgid(0, 0) = 0 [pid 5819] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5819] write(3, "1000", 4) = 4 [pid 5819] close(3) = 0 [pid 5819] write(1, "executing program\n", 18) = 18 executing program [ 94.315771][ T5816] ? __pfx_tun_chr_close+0x10/0x10 [ 94.315791][ T5816] __fput+0x418/0xa50 [ 94.315826][ T5816] task_work_run+0x1d9/0x270 [ 94.315853][ T5816] ? __pfx_task_work_run+0x10/0x10 [ 94.315876][ T5816] ? do_raw_spin_unlock+0xf5/0x200 [ 94.315913][ T5816] do_exit+0x73a/0x2360 [ 94.315944][ T5816] ? __pfx_do_exit+0x10/0x10 [ 94.315962][ T5816] ? do_raw_spin_lock+0x12b/0x2f0 [pid 5819] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5819] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5819] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5819}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5819] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5819}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5819] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5819] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5819] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5819] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 94.316002][ T5816] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.316038][ T5816] do_group_exit+0x22d/0x2f0 [ 94.316064][ T5816] __x64_sys_exit_group+0x3f/0x40 [ 94.316085][ T5816] x64_sys_call+0x18c6/0x18d0 [ 94.316104][ T5816] do_syscall_64+0x166/0x520 [ 94.316126][ T5816] ? trace_irq_disable+0x3b/0x140 [ 94.316146][ T5816] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.316168][ T5816] ? clear_bhb_loop+0x70/0xc0 [ 94.316194][ T5816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [pid 5819] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5819] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5819] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5819] exit_group(0) = ? [ 94.316215][ T5816] RIP: 0033:0x7f01a74bbbe5 [ 94.316234][ T5816] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 94.316244][ T5816] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 94.316268][ T5816] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 94.316283][ T5816] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 94.316307][ T5816] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 94.316319][ T5816] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 94.316331][ T5816] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 94.316365][ T5816] [ 94.316656][ T5816] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5816 [ 94.316674][ T5816] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.316703][ T5816] CPU: 1 UID: 0 PID: 5816 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 94.316725][ T5816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.316735][ T5816] Call Trace: [ 94.316741][ T5816] [ 94.316747][ T5816] dump_stack_lvl+0xe8/0x150 [ 94.316771][ T5816] check_preemption_disabled+0xcd/0xd0 [ 94.316793][ T5816] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.316820][ T5816] ? tun_queue_purge+0x4f/0xb0 [ 94.316839][ T5816] trace_kfree_skb+0x1d1/0x210 [ 94.316862][ T5816] sk_skb_reason_drop+0xdd/0x110 [ 94.316884][ T5816] tun_queue_purge+0x4f/0xb0 [ 94.316904][ T5816] __tun_detach+0xcd5/0x1900 [ 94.316937][ T5816] tun_chr_close+0x10a/0x1c0 [ 94.316953][ T5816] ? __pfx_tun_chr_close+0x10/0x10 [ 94.316970][ T5816] __fput+0x418/0xa50 [ 94.316996][ T5816] task_work_run+0x1d9/0x270 [ 94.317016][ T5816] ? __pfx_task_work_run+0x10/0x10 [ 94.317033][ T5816] ? do_raw_spin_unlock+0xf5/0x200 [ 94.317062][ T5816] do_exit+0x73a/0x2360 [ 94.317086][ T5816] ? __pfx_do_exit+0x10/0x10 [ 94.317099][ T5816] ? do_raw_spin_lock+0x12b/0x2f0 [pid 5819] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5819, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55559476b6d0) = 5824 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5824 attached [ 94.317131][ T5816] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.317159][ T5816] do_group_exit+0x22d/0x2f0 [ 94.317180][ T5816] __x64_sys_exit_group+0x3f/0x40 [ 94.317196][ T5816] x64_sys_call+0x18c6/0x18d0 [ 94.317210][ T5816] do_syscall_64+0x166/0x520 [ 94.317227][ T5816] ? trace_irq_disable+0x3b/0x140 [ 94.317242][ T5816] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.317258][ T5816] ? clear_bhb_loop+0x70/0xc0 [ 94.317278][ T5816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [pid 5824] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5824] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 94.317302][ T5816] RIP: 0033:0x7f01a74bbbe5 [ 94.317316][ T5816] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 94.317324][ T5816] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 94.317340][ T5816] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 94.317351][ T5816] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 94.317362][ T5816] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [pid 5824] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5824] setpgid(0, 0) = 0 [pid 5824] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5824] write(3, "1000", 4) = 4 [pid 5824] close(3) = 0 executing program [pid 5824] write(1, "executing program\n", 18) = 18 [pid 5824] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5824] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5824] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5824}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5824] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5824}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5824] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5824] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5824] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5824] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 94.317371][ T5816] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 94.317381][ T5816] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 94.317406][ T5816] [pid 5824] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5824] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5824] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5824] exit_group(0) = ? [ 94.910244][ T5824] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5824 [ 94.910276][ T5824] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.910335][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 94.910359][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.910372][ T5824] Call Trace: [ 94.910380][ T5824] [ 94.910390][ T5824] dump_stack_lvl+0xe8/0x150 [ 94.910424][ T5824] check_preemption_disabled+0xcd/0xd0 [ 94.910454][ T5824] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.910487][ T5824] ? tun_queue_purge+0x4f/0xb0 [ 94.910513][ T5824] trace_kfree_skb+0x1d1/0x210 [ 94.910543][ T5824] sk_skb_reason_drop+0xdd/0x110 [ 94.910575][ T5824] tun_queue_purge+0x4f/0xb0 [ 94.910600][ T5824] __tun_detach+0xcd5/0x1900 [pid 5824] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5824, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5830 attached [pid 5830] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5830] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5830 [pid 5830] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5830] <... prctl resumed>) = 0 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5830] setpgid(0, 0) = 0 [pid 5830] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 executing program [pid 5830] write(3, "1000", 4) = 4 [pid 5830] close(3) = 0 [pid 5830] write(1, "executing program\n", 18) = 18 [pid 5830] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5830] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [ 94.910644][ T5824] tun_chr_close+0x10a/0x1c0 [ 94.910665][ T5824] ? __pfx_tun_chr_close+0x10/0x10 [ 94.910686][ T5824] __fput+0x418/0xa50 [ 94.910720][ T5824] task_work_run+0x1d9/0x270 [ 94.910748][ T5824] ? __pfx_task_work_run+0x10/0x10 [ 94.910770][ T5824] ? do_raw_spin_unlock+0xf5/0x200 [ 94.910807][ T5824] do_exit+0x73a/0x2360 [ 94.910839][ T5824] ? __pfx_do_exit+0x10/0x10 [ 94.910857][ T5824] ? do_raw_spin_lock+0x12b/0x2f0 [pid 5830] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5830}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5830] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5830}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5830] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5830] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5830] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5830] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5830] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5830] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5830] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [ 94.910896][ T5824] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.910931][ T5824] do_group_exit+0x22d/0x2f0 [ 94.910958][ T5824] __x64_sys_exit_group+0x3f/0x40 [ 94.910979][ T5824] x64_sys_call+0x18c6/0x18d0 [ 94.910998][ T5824] do_syscall_64+0x166/0x520 [ 94.911019][ T5824] ? trace_irq_disable+0x3b/0x140 [ 94.911039][ T5824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.911060][ T5824] ? clear_bhb_loop+0x70/0xc0 [ 94.911086][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [pid 5830] exit_group(0) = ? [ 94.911107][ T5824] RIP: 0033:0x7f01a74bbbe5 [ 94.911127][ T5824] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 94.911137][ T5824] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 94.911160][ T5824] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 94.911174][ T5824] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 94.911187][ T5824] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 94.911197][ T5824] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 94.911209][ T5824] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 94.911249][ T5824] [ 94.911918][ T5824] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5824 [ 94.911936][ T5824] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.911966][ T5824] CPU: 1 UID: 0 PID: 5824 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 94.911986][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.911997][ T5824] Call Trace: [ 94.912003][ T5824] [ 94.912010][ T5824] dump_stack_lvl+0xe8/0x150 [ 94.912038][ T5824] check_preemption_disabled+0xcd/0xd0 [ 94.912082][ T5824] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 94.912113][ T5824] ? tun_queue_purge+0x4f/0xb0 [ 94.912135][ T5824] trace_kfree_skb+0x1d1/0x210 [ 94.912161][ T5824] sk_skb_reason_drop+0xdd/0x110 [ 94.912186][ T5824] tun_queue_purge+0x4f/0xb0 [ 94.912209][ T5824] __tun_detach+0xcd5/0x1900 [ 94.912262][ T5824] tun_chr_close+0x10a/0x1c0 [ 94.912283][ T5824] ? __pfx_tun_chr_close+0x10/0x10 [ 94.912304][ T5824] __fput+0x418/0xa50 [ 94.912339][ T5824] task_work_run+0x1d9/0x270 [ 94.912365][ T5824] ? __pfx_task_work_run+0x10/0x10 [ 94.912387][ T5824] ? do_raw_spin_unlock+0xf5/0x200 [ 94.912424][ T5824] do_exit+0x73a/0x2360 [pid 5830] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5830, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5837 attached [pid 5837] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5837] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5837] setpgid(0, 0) = 0 [ 94.912455][ T5824] ? __pfx_do_exit+0x10/0x10 [ 94.912472][ T5824] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.912512][ T5824] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.912547][ T5824] do_group_exit+0x22d/0x2f0 [ 94.912574][ T5824] __x64_sys_exit_group+0x3f/0x40 [ 94.912595][ T5824] x64_sys_call+0x18c6/0x18d0 [ 94.912613][ T5824] do_syscall_64+0x166/0x520 [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5837 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5837] <... openat resumed>) = 3 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5837] write(3, "1000", 4) = 4 [pid 5837] close(3) = 0 [pid 5837] write(1, "executing program\n", 18) = 18 executing program [pid 5837] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5837] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5837] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5837}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5837] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5837}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5837] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5837] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5837] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [ 94.912634][ T5824] ? trace_irq_disable+0x3b/0x140 [ 94.912655][ T5824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.912677][ T5824] ? clear_bhb_loop+0x70/0xc0 [ 94.912703][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.912722][ T5824] RIP: 0033:0x7f01a74bbbe5 [ 94.912741][ T5824] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [pid 5837] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5837] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5837] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5837] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5837] exit_group(0) = ? [ 94.912751][ T5824] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 94.912774][ T5824] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 94.912789][ T5824] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 94.912802][ T5824] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 94.912814][ T5824] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [pid 5837] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5837, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 94.912826][ T5824] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 94.912861][ T5824] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5840 attached , child_tidptr=0x55559476b6d0) = 5840 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5840] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5840] <... set_robust_list resumed>) = 0 [pid 5840] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5840] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5840] setpgid(0, 0) = 0 [pid 5840] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5840] write(3, "1000", 4) = 4 [pid 5840] close(3) = 0 [pid 5840] write(1, "executing program\n", 18) = 18 executing program [pid 5840] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5840] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5840] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5840}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5840] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5840}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5840] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5840] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5840] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5840] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5840] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5840] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5840] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5840] exit_group(0) = ? [pid 5840] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5840, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5849 attached [pid 5849] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5849] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5849 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5849] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5849] setpgid(0, 0) = 0 [pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5849] write(3, "1000", 4) = 4 [pid 5849] close(3) = 0 executing program [pid 5849] write(1, "executing program\n", 18) = 18 [pid 5849] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5849] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5849] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5849}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5849] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5849}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5849] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5849] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5849] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5849] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5849] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5849] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5849] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5849] exit_group(0) = ? [pid 5849] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5849, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5858 attached , child_tidptr=0x55559476b6d0) = 5858 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5858] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5858] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5858] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5858] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5858] setpgid(0, 0) = 0 [pid 5858] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5858] write(3, "1000", 4) = 4 [pid 5858] close(3) = 0 executing program [pid 5858] write(1, "executing program\n", 18) = 18 [pid 5858] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5858] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5858] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5858}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5858] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5858}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5858] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5858] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5858] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5858] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5858] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5858] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5858] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5858] exit_group(0) = ? [ 96.217459][ T5858] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5858 [ 96.217492][ T5858] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 96.217534][ T5858] CPU: 0 UID: 0 PID: 5858 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 96.217558][ T5858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.217570][ T5858] Call Trace: [ 96.217579][ T5858] [ 96.217588][ T5858] dump_stack_lvl+0xe8/0x150 [ 96.217621][ T5858] check_preemption_disabled+0xcd/0xd0 [ 96.217651][ T5858] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 96.217683][ T5858] ? tun_queue_purge+0x4f/0xb0 [ 96.217709][ T5858] trace_kfree_skb+0x1d1/0x210 [ 96.217738][ T5858] sk_skb_reason_drop+0xdd/0x110 [ 96.217766][ T5858] tun_queue_purge+0x4f/0xb0 [ 96.217791][ T5858] __tun_detach+0xcd5/0x1900 [ 96.217834][ T5858] tun_chr_close+0x10a/0x1c0 [ 96.217854][ T5858] ? __pfx_tun_chr_close+0x10/0x10 [ 96.217874][ T5858] __fput+0x418/0xa50 [ 96.217915][ T5858] task_work_run+0x1d9/0x270 [ 96.217940][ T5858] ? __pfx_task_work_run+0x10/0x10 [ 96.217961][ T5858] ? do_raw_spin_unlock+0xf5/0x200 [ 96.217998][ T5858] do_exit+0x73a/0x2360 [ 96.218028][ T5858] ? __pfx_do_exit+0x10/0x10 [ 96.218056][ T5858] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.218096][ T5858] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.218131][ T5858] do_group_exit+0x22d/0x2f0 [ 96.218156][ T5858] __x64_sys_exit_group+0x3f/0x40 [ 96.218175][ T5858] x64_sys_call+0x18c6/0x18d0 [ 96.218193][ T5858] do_syscall_64+0x166/0x520 [ 96.218214][ T5858] ? trace_irq_disable+0x3b/0x140 [ 96.218236][ T5858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.218257][ T5858] ? clear_bhb_loop+0x70/0xc0 [ 96.218284][ T5858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.218304][ T5858] RIP: 0033:0x7f01a74bbbe5 [ 96.218323][ T5858] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 96.218340][ T5858] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 96.218363][ T5858] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 96.218378][ T5858] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 96.218392][ T5858] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 96.218403][ T5858] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 96.218415][ T5858] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 96.218445][ T5858] [ 96.218763][ T5858] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5858 [ 96.218781][ T5858] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 96.218809][ T5858] CPU: 0 UID: 0 PID: 5858 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 96.218830][ T5858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.218841][ T5858] Call Trace: [ 96.218849][ T5858] [ 96.218856][ T5858] dump_stack_lvl+0xe8/0x150 [ 96.218885][ T5858] check_preemption_disabled+0xcd/0xd0 [ 96.218912][ T5858] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 96.218944][ T5858] ? tun_queue_purge+0x4f/0xb0 [ 96.218966][ T5858] trace_kfree_skb+0x1d1/0x210 [ 96.218992][ T5858] sk_skb_reason_drop+0xdd/0x110 [ 96.219018][ T5858] tun_queue_purge+0x4f/0xb0 [ 96.219050][ T5858] __tun_detach+0xcd5/0x1900 [ 96.219092][ T5858] tun_chr_close+0x10a/0x1c0 [ 96.219112][ T5858] ? __pfx_tun_chr_close+0x10/0x10 [ 96.219132][ T5858] __fput+0x418/0xa50 [ 96.219167][ T5858] task_work_run+0x1d9/0x270 [ 96.219193][ T5858] ? __pfx_task_work_run+0x10/0x10 [ 96.219215][ T5858] ? do_raw_spin_unlock+0xf5/0x200 [ 96.219252][ T5858] do_exit+0x73a/0x2360 [pid 5858] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5858, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- [ 96.219292][ T5858] ? __pfx_do_exit+0x10/0x10 [ 96.219310][ T5858] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.219351][ T5858] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.219386][ T5858] do_group_exit+0x22d/0x2f0 [ 96.219413][ T5858] __x64_sys_exit_group+0x3f/0x40 [ 96.219434][ T5858] x64_sys_call+0x18c6/0x18d0 [ 96.219452][ T5858] do_syscall_64+0x166/0x520 [ 96.219474][ T5858] ? trace_irq_disable+0x3b/0x140 [ 96.219494][ T5858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.219515][ T5858] ? clear_bhb_loop+0x70/0xc0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5868 attached [ 96.219540][ T5858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.219561][ T5858] RIP: 0033:0x7f01a74bbbe5 [ 96.219580][ T5858] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 96.219590][ T5858] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 96.219613][ T5858] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [pid 5868] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... clone resumed>, child_tidptr=0x55559476b6d0) = 5868 [pid 5868] <... set_robust_list resumed>) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5868] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5868] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5868] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5868] setpgid(0, 0) = 0 [pid 5868] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5868] write(3, "1000", 4) = 4 [pid 5868] close(3) = 0 executing program [pid 5868] write(1, "executing program\n", 18) = 18 [pid 5868] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5868] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5868] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5868}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5868] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5868}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5868] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5868] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5868] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5868] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [ 96.219627][ T5858] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 96.219641][ T5858] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 96.219653][ T5858] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 96.219665][ T5858] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 96.219701][ T5858] [pid 5868] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5868] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5868] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5868] exit_group(0) = ? [pid 5868] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5868, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5874 attached , child_tidptr=0x55559476b6d0) = 5874 [pid 5630] rt_sigprocmask(SIG_SETMASK, [] [pid 5874] set_robust_list(0x55559476b6e0, 24 [pid 5630] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5874] <... set_robust_list resumed>) = 0 [pid 5874] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5874] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5874] setpgid(0, 0) = 0 [pid 5874] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5874] write(3, "1000", 4) = 4 [pid 5874] close(3) = 0 executing program [pid 5874] write(1, "executing program\n", 18) = 18 [pid 5874] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5874] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0b\x00\x02\x00\x4e\x45\x54\x5f\x44\x4d\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5874] recvfrom(3, [{nlmsg_len=196, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5874}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=11, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x4e\x45\x54\x5f\x44\x4d\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x32], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 2], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 23], [{nla_len=104, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=28, nla_type=CTRL_ATTR_MCAST_GROUPS}, [{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0x1], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x65\x76\x65\x6e\x74\x73\x00"...]]]]]], 4096, 0, NULL, NULL) = 196 [pid 5874] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5874}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5874] write(-1, "\x05\x00\x01\x00\x01\x00\x00\x00", 8) = -1 EBADF (Bad file descriptor) [pid 5874] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=28, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x2, version=0}, [{nla_len=5, nla_type=0x1}, "\x01"]], iov_len=28}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 28 [pid 5874] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NET_DM, nlmsg_flags=NLM_F_REQUEST, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0x3, version=0}], iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 [pid 5874] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 4 [pid 5874] ioctl(4, TUNSETIFF, 0x200000000040) = 0 [pid 5874] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5874] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5874] exit_group(0) = ? [ 97.096941][ T5874] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5874 [ 97.096973][ T5874] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 97.097016][ T5874] CPU: 1 UID: 0 PID: 5874 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [ 97.097039][ T5874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.097050][ T5874] Call Trace: [ 97.097059][ T5874] [ 97.097068][ T5874] dump_stack_lvl+0xe8/0x150 [ 97.097102][ T5874] check_preemption_disabled+0xcd/0xd0 [ 97.097130][ T5874] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 97.097162][ T5874] ? tun_queue_purge+0x4f/0xb0 [ 97.097203][ T5874] trace_kfree_skb+0x1d1/0x210 [ 97.097234][ T5874] sk_skb_reason_drop+0xdd/0x110 [ 97.097263][ T5874] tun_queue_purge+0x4f/0xb0 [ 97.097288][ T5874] __tun_detach+0xcd5/0x1900 [ 97.097330][ T5874] tun_chr_close+0x10a/0x1c0 [ 97.097351][ T5874] ? __pfx_tun_chr_close+0x10/0x10 [ 97.097372][ T5874] __fput+0x418/0xa50 [ 97.097408][ T5874] task_work_run+0x1d9/0x270 [ 97.097435][ T5874] ? __pfx_task_work_run+0x10/0x10 [ 97.097456][ T5874] ? do_raw_spin_unlock+0xf5/0x200 [ 97.097493][ T5874] do_exit+0x73a/0x2360 [ 97.097524][ T5874] ? __pfx_do_exit+0x10/0x10 [ 97.097541][ T5874] ? do_raw_spin_lock+0x12b/0x2f0 [ 97.097590][ T5874] ? _raw_spin_unlock_irq+0x23/0x50 [ 97.097624][ T5874] do_group_exit+0x22d/0x2f0 [ 97.097651][ T5874] __x64_sys_exit_group+0x3f/0x40 [ 97.097672][ T5874] x64_sys_call+0x18c6/0x18d0 [ 97.097690][ T5874] do_syscall_64+0x166/0x520 [ 97.097711][ T5874] ? trace_irq_disable+0x3b/0x140 [ 97.097732][ T5874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.097754][ T5874] ? clear_bhb_loop+0x70/0xc0 [ 97.097780][ T5874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.097800][ T5874] RIP: 0033:0x7f01a74bbbe5 [ 97.097820][ T5874] Code: Unable to access opcode bytes at 0x7f01a74bbbbb. [ 97.097830][ T5874] RSP: 002b:00007fff9e9eae78 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 97.097859][ T5874] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f01a74bbbe5 [ 97.097874][ T5874] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 97.097887][ T5874] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 97.097899][ T5874] R10: 0000000000000006 R11: 0000000000000206 R12: 0000000000000000 [ 97.097912][ T5874] R13: 00007f01a7554130 R14: 00007f01a75563c8 R15: 00007f01a75563e0 [ 97.097944][ T5874] [ 97.098027][ T5874] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor924/5874 [ 97.098045][ T5874] caller is net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 97.098075][ T5874] CPU: 1 UID: 0 PID: 5874 Comm: syz-executor924 Not tainted syzkaller #0 PREEMPT(full) [pid 5874] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5874, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-net-this-kasan-gce/strace-static-x86_64: Process 5884 attached , child_tidptr=0x55559476b6d0) = 5884 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5884] set_robust_list(0x55559476b6e0, 24) = 0 [pid 5884] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5884] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 97.098097][ T5874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.098109][ T5874] Call Trace: [ 97.098117][ T5874] [ 97.098126][ T5874] dump_stack_lvl+0xe8/0x150 [ 97.098154][ T5874] check_preemption_disabled+0xcd/0xd0 [ 97.098181][ T5874] net_dm_packet_trace_kfree_skb_hit+0xdf/0x360 [ 97.098213][ T5874] ? tun_queue_purge+0x4f/0xb0 [ 97.098237][ T5874] trace_kfree_skb+0x1d1/0x210 [ 97.098266][ T5874] sk_skb_reason_drop+0xdd/0x110 [ 97.098294][ T5874] tun_queue_purge+0x4f/0xb0