ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor4037483023 <...> Warning: Permanently added '10.128.0.16' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor4037483023", ["ci2-android-5-15/syz-executor4037483023"], 0x7fff26e53310 /* 10 vars */) = 0 brk(NULL) = 0x555564cbf000 brk(0x555564cbfe00) = 0x555564cbfe00 arch_prctl(ARCH_SET_FS, 0x555564cbf480) = 0 set_tid_address(0x555564cbf750) = 303 set_robust_list(0x555564cbf760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor4037483023", 4096) = 45 getrandom("\x1a\xc6\x3e\x5f\x68\xad\xa8\xe3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555564cbfe00 brk(0x555564ce0e00) = 0x555564ce0e00 brk(0x555564ce1000) = 0x555564ce1000 mprotect(0x7f91d6c24000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f91d6b76020, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f91d6b7d290}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f91d6b76020, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f91d6b7d290}, NULL, 8) = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555564cbf750) = 304 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x555564cbf760, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] getppid() = 0 [pid 304] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 304] unshare(CLONE_NEWNS) = 0 [pid 304] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 304] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 304] unshare(CLONE_NEWCGROUP) = 0 [pid 304] unshare(CLONE_NEWUTS) = 0 [pid 304] unshare(CLONE_SYSVSEM) = 0 [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] getpid() = 1 [pid 304] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 28.471922][ T304] __dump_stack+0x21/0x30 [ 28.476271][ T304] dump_stack_lvl+0x110/0x170 [ 28.480980][ T304] ? show_regs_print_info+0x20/0x20 [ 28.486230][ T304] ? load_image+0x3f0/0x3f0 [ 28.490762][ T304] ? __xfrm_route_forward+0x37e/0x540 [ 28.496328][ T304] print_address_description+0x7f/0x2c0 [ 28.501893][ T304] ? __ipv6_addr_type+0x272/0x2f0 [ 28.506938][ T304] kasan_report+0x10f/0x150 [ 28.511645][ T304] ? __ipv6_addr_type+0x272/0x2f0 [ 28.516767][ T304] __asan_report_load4_noabort+0x14/0x20 [ 28.522420][ T304] __ipv6_addr_type+0x272/0x2f0 [ 28.527326][ T304] ip6_forward+0xdb2/0x1ba0 [ 28.531954][ T304] ? dst_output+0x80/0x80 [ 28.536311][ T304] ? sk_setup_caps+0x400/0x400 [ 28.541199][ T304] ip6_rcv_finish+0x18f/0x360 [ 28.545887][ T304] ipv6_rcv+0xed/0x230 [ 28.549969][ T304] ? ip6_rcv_finish+0x360/0x360 [ 28.554848][ T304] ? __alloc_skb+0x459/0x730 [ 28.559480][ T304] ? ip6_rcv_finish+0x360/0x360 [ 28.564351][ T304] __netif_receive_skb+0xc8/0x280 [ 28.569383][ T304] netif_receive_skb+0x98/0x3e0 [ 28.574250][ T304] ? netif_receive_skb_core+0x100/0x100 [ 28.580011][ T304] ? copy_page_from_iter+0x2e1/0x680 [ 28.585437][ T304] tun_rx_batched+0x600/0x750 [ 28.590128][ T304] ? local_bh_enable+0x30/0x30 [ 28.595277][ T304] tun_get_user+0x284f/0x34c0 [ 28.599973][ T304] ? tun_do_read+0x1d70/0x1d70 [ 28.604749][ T304] ? __switch_to+0x56c/0x1070 [ 28.609444][ T304] ? avc_policy_seqno+0x1b/0x70 [ 28.614422][ T304] ? selinux_file_permission+0x2aa/0x510 [ 28.620270][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 28.625324][ T304] vfs_write+0x831/0xfd0 [ 28.629589][ T304] ? file_end_write+0x1b0/0x1b0 [ 28.634455][ T304] ? _raw_spin_unlock_irq+0x4e/0x70 [ 28.639670][ T304] ? cgroup_leave_frozen+0x165/0x2a0 [ 28.644979][ T304] ? __kasan_check_read+0x11/0x20 [ 28.650103][ T304] ? __fdget_pos+0x1f7/0x380 [ 28.654712][ T304] ksys_write+0x14a/0x260 [ 28.659059][ T304] ? __ia32_sys_read+0x90/0x90 [ 28.664005][ T304] ? __kasan_check_write+0x14/0x20 [ 28.669275][ T304] ? switch_fpu_return+0x15d/0x2c0 [ 28.674403][ T304] __x64_sys_write+0x7b/0x90 [ 28.679001][ T304] x64_sys_call+0x8ef/0x9a0 [ 28.683547][ T304] do_syscall_64+0x4c/0xa0 [ 28.688235][ T304] ? clear_bhb_loop+0x50/0xa0 [ 28.692931][ T304] ? clear_bhb_loop+0x50/0xa0 [ 28.697758][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.704780][ T304] RIP: 0033:0x7f91d6b975c9 [ 28.709228][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 28.729015][ T304] RSP: 002b:00007ffea5eeaf48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 28.737454][ T304] RAX: ffffffffffffffda RBX: 00007f91d6bf8500 RCX: 00007f91d6b975c9 [ 28.745552][ T304] RDX: 000000000000ffdd RSI: 0000200000000000 RDI: 0000000000000005 [ 28.753533][ T304] RBP: 00007f91d6bf84d0 R08: 00007ffea5eeaf70 R09: 00007ffea5eeaf70 [ 28.761503][ T304] R10: 00007ffea5eeaf70 R11: 0000000000000246 R12: 00007f91d6bf8438 [ 28.769599][ T304] R13: 0000000000000001 R14: 00007ffea5eeafa0 R15: 0000000000000003 [ 28.777805][ T304] [ 28.780822][ T304] [ 28.783150][ T304] Allocated by task 304: [ 28.787428][ T304] __kasan_kmalloc+0xd4/0x100 [ 28.792108][ T304] __kmalloc_track_caller+0x13c/0x2c0 [ 28.797683][ T304] __alloc_skb+0x210/0x730 [ 28.802118][ T304] alloc_skb_with_frags+0xa8/0x620 [ 28.807326][ T304] sock_alloc_send_pskb+0x87f/0x9a0 [ 28.812937][ T304] tun_get_user+0xaa2/0x34c0 [ 28.817569][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 28.822800][ T304] vfs_write+0x831/0xfd0 [ 28.827057][ T304] ksys_write+0x14a/0x260 [ 28.831391][ T304] __x64_sys_write+0x7b/0x90 [ 28.836048][ T304] x64_sys_call+0x8ef/0x9a0 [ 28.840564][ T304] do_syscall_64+0x4c/0xa0 [ 28.844989][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.850907][ T304] [ 28.853380][ T304] Freed by task 304: [ 28.857315][ T304] kasan_set_track+0x4a/0x70 [ 28.861934][ T304] kasan_set_free_info+0x23/0x40 [ 28.866922][ T304] ____kasan_slab_free+0x125/0x160 [ 28.872038][ T304] __kasan_slab_free+0x11/0x20 [ 28.876814][ T304] slab_free_freelist_hook+0xc2/0x190 [ 28.882366][ T304] kfree+0xc4/0x270 [ 28.886211][ T304] pskb_expand_head+0x394/0x1280 [ 28.891193][ T304] __pskb_pull_tail+0xba/0x1570 [ 28.896058][ T304] __xfrm_decode_session+0x5b0/0x1de0 [ 28.901450][ T304] __xfrm_route_forward+0x115/0x540 [ 28.906658][ T304] ip6_forward+0xca5/0x1ba0 [ 28.911198][ T304] ip6_rcv_finish+0x18f/0x360 [ 28.915880][ T304] ipv6_rcv+0xed/0x230 [ 28.919978][ T304] __netif_receive_skb+0xc8/0x280 [ 28.925090][ T304] netif_receive_skb+0x98/0x3e0 [ 28.929966][ T304] tun_rx_batched+0x600/0x750 [ 28.934649][ T304] tun_get_user+0x284f/0x34c0 [ 28.939436][ T304] tun_chr_write_iter+0x1ed/0x2f0 [ 28.944463][ T304] vfs_write+0x831/0xfd0 [ 28.948716][ T304] ksys_write+0x14a/0x260 [ 28.953041][ T304] __x64_sys_write+0x7b/0x90 [ 28.957628][ T304] x64_sys_call+0x8ef/0x9a0 [ 28.962142][ T304] do_syscall_64+0x4c/0xa0 [ 28.966557][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.972711][ T304] [ 28.975046][ T304] The buggy address belongs to the object at ffff88810f2c4400 [ 28.975046][ T304] which belongs to the cache kmalloc-512 of size 512 [ 28.989216][ T304] The buggy address is located 72 bytes inside of [ 28.989216][ T304] 512-byte region [ffff88810f2c4400, ffff88810f2c4600) [ 29.002414][ T304] The buggy address belongs to the page: [ 29.008079][ T304] page:ffffea00043cb100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f2c4 [ 29.018594][ T304] head:ffffea00043cb100 order:2 compound_mapcount:0 compound_pincount:0 [ 29.026922][ T304] flags: 0x4000000000010200(slab|head|zone=1) [ 29.033123][ T304] raw: 4000000000010200 ffffea00043d3200 0000000400000004 ffff888100042f00 [ 29.041908][ T304] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.050820][ T304] page dumped because: kasan: bad access detected [ 29.057760][ T304] page_owner tracks the page as allocated [ 29.063489][ T304] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 102, ts 5630176405, free_ts 0 [ 29.081779][ T304] post_alloc_hook+0x192/0x1b0 [ 29.086559][ T304] prep_new_page+0x1c/0x110 [ 29.091083][ T304] get_page_from_freelist+0x2c3a/0x2cd0 [ 29.096771][ T304] __alloc_pages+0x1a2/0x460 [ 29.101382][ T304] new_slab+0xa0/0x4d0 [ 29.105451][ T304] ___slab_alloc+0x3ac/0x840 [ 29.110133][ T304] __slab_alloc+0x49/0x90 [ 29.114495][ T304] __kmalloc_track_caller+0x169/0x2c0 [ 29.120148][ T304] __alloc_skb+0x210/0x730 [ 29.124566][ T304] alloc_uevent_skb+0x85/0x240 [ 29.129347][ T304] kobject_uevent_net_broadcast+0x335/0x5a0 [ 29.135325][ T304] kobject_uevent_env+0x52b/0x700 [ 29.140374][ T304] kobject_synth_uevent+0x457/0x940 [ 29.145600][ T304] uevent_store+0x4b/0x70 [ 29.149935][ T304] drv_attr_store+0x79/0xa0 [ 29.154441][ T304] sysfs_kf_write+0x129/0x150 [ 29.159148][ T304] page_owner free stack trace missing [ 29.164514][ T304] [ 29.166837][ T304] Memory state around the buggy address: [ 29.172468][ T304] ffff88810f2c4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.180530][ T304] ffff88810f2c4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.188794][ T304] >ffff88810f2c4400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.196867][ T304] ^ [ 29.203430][ T304] ffff88810f2c4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [pid 304] write(5, "\x1e\x03\x08\x00\x4d\x6b\x71\xef\x28\x85\x63\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x79\x7a\x6b\x61\x6c\x6c\x65\x72\x30\x00\x00\x00\x00\x00\x00\x01\x71\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65501) = 65501 [pid 304] exit_group(1) = ? [ 29.213600][ T304] ffff88810f2c4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.228347][ T304] ================================================================== [ 29.240493][ T304] Disabling lock debugging due to kernel taint [pid 304] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=304, si_uid=0, si_status=1, si_utime=0, si_stime=38 /* 0.38 s */} --- exit_group(0) = ? +++ exited with 0 +++