RBP: 00007f69055281d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fffd8abb5cf R14: 00007f6905528300 R15: 0000000000022000
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 UID: 0 PID: 10948 Comm: syz-executor.7 Not tainted 6.18.0-rc5-next-20251114 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:put_mnt_ns+0x2f/0x180
Code: 54 55 53 48 89 fb e8 10 2c b1 ff 48 85 db 74 3b e8 06 2c b1 ff 48 8d 7b 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 27 01 00 00 48 8b 6b 20 bf 08 00 00 00 48 89 ee
RSP: 0018:ffff88803ff179d8 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90011d18000
RDX: 0000000000000002 RSI: ffffffff81c407da RDI: 0000000000000014
RBP: ffff88800c872ea0 R08: 0000000000000001 R09: ffffed10084fe006
R10: fffffffffffffff4 R11: 0000000000000001 R12: fffffffffffffff4
R13: 00000003720e0180 R14: ffff88801e449040 R15: ffff88801c2c5bb8
FS: 00007f6905528700(0000) GS:ffff8880e538f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6905527f78 CR3: 00000000162ad000 CR4: 0000000000350ef0
Call Trace:
nsproxy_free+0x36/0x5a0
create_new_namespaces+0x585/0x750
copy_namespaces+0x45c/0x580
copy_process+0x26e4/0x72a0
kernel_clone+0xea/0x7f0
__do_sys_clone3+0x1f5/0x280
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6907fb2b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6905528188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f69080c5f60 RCX: 00007f6907fb2b19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 00000000200001c0
RBP: 00007f69055281d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fffd8abb5cf R14: 00007f6905528300 R15: 0000000000022000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:put_mnt_ns+0x2f/0x180
Code: 54 55 53 48 89 fb e8 10 2c b1 ff 48 85 db 74 3b e8 06 2c b1 ff 48 8d 7b 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 27 01 00 00 48 8b 6b 20 bf 08 00 00 00 48 89 ee
RSP: 0018:ffff88803ff179d8 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc90011d18000
RDX: 0000000000000002 RSI: ffffffff81c407da RDI: 0000000000000014
RBP: ffff88800c872ea0 R08: 0000000000000001 R09: ffffed10084fe006
R10: fffffffffffffff4 R11: 0000000000000001 R12: fffffffffffffff4
R13: 00000003720e0180 R14: ffff88801e449040 R15: ffff88801c2c5bb8
FS: 00007f6905528700(0000) GS:ffff8880e538f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6905527f78 CR3: 00000000162ad000 CR4: 0000000000350ef0
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
FAULT_INJECTION: forcing a failure.
name fail_page_alloc, interval 1, probability 0, space 0, times 0
CPU: 0 UID: 0 PID: 10962 Comm: syz-executor.5 Tainted: G D 6.18.0-rc5-next-20251114 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
should_fail_ex+0x4d7/0x5e0
should_fail_alloc_page+0xe0/0x110
prepare_alloc_pages+0x1eb/0x550
__alloc_frozen_pages_noprof+0x17f/0x1f10
__alloc_pages_noprof+0xb/0x30
copy_process+0x4e9/0x72a0
kernel_clone+0xea/0x7f0
__do_sys_clone3+0x1f5/0x280
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2687ff9b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f268556f188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f268810cf60 RCX: 00007f2687ff9b19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 00000000200001c0
RBP: 00007f268556f1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc6d11a69f R14: 00007f268556f300 R15: 0000000000022000
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 UID: 0 PID: 10976 Comm: syz-executor.5 Tainted: G D 6.18.0-rc5-next-20251114 #1 PREEMPT(voluntary)
Tainted: [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
should_fail_ex+0x4d7/0x5e0
should_failslab+0xc2/0x120
kmem_cache_alloc_noprof+0x80/0x690
prepare_creds+0x2c/0x830
copy_creds+0x7c/0xa30
copy_process+0xf59/0x72a0
kernel_clone+0xea/0x7f0
__do_sys_clone3+0x1f5/0x280
do_syscall_64+0xbf/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2687ff9b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f268556f188 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
RAX: ffffffffffffffda RBX: 00007f268810cf60 RCX: 00007f2687ff9b19
RDX: 0000000000000000 RSI: 0000000000000058 RDI: 00000000200001c0
RBP: 00007f268556f1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc6d11a69f R14: 00007f268556f300 R15: 0000000000022000
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.6'.
----------------
Code disassembly (best guess):
0: 54 push %rsp
1: 55 push %rbp
2: 53 push %rbx
3: 48 89 fb mov %rdi,%rbx
6: e8 10 2c b1 ff callq 0xffb12c1b
b: 48 85 db test %rbx,%rbx
e: 74 3b je 0x4b
10: e8 06 2c b1 ff callq 0xffb12c1b
15: 48 8d 7b 20 lea 0x20(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 27 01 00 00 jne 0x15b
34: 48 8b 6b 20 mov 0x20(%rbx),%rbp
38: bf 08 00 00 00 mov $0x8,%edi
3d: 48 89 ee mov %rbp,%rsi