raw_sendmsg: syz-executor.6 forgot to set AF_INET. Fix it!
syz-executor.1 (4757) used greatest stack depth: 24032 bytes left
------------[ cut here ]------------
kernfs_put: syz5/memory.events.local: released with incorrect active_ref 0
WARNING: CPU: 0 PID: 6 at fs/kernfs/dir.c:531 kernfs_put.part.0+0x433/0x540
Modules linked in:
CPU: 0 PID: 6 Comm: kworker/0:0 Not tainted 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events kernfs_notify_workfn
RIP: 0010:kernfs_put.part.0+0x433/0x540
Code: 03 80 3c 18 00 0f 85 ea 00 00 00 4d 8b 7d 38 e8 53 fc a6 ff 48 8b 14 24 44 89 f1 4c 89 fe 48 c7 c7 e0 5b 72 84 e8 13 aa 6c 02 <0f> 0b e9 b9 fc ff ff 48 89 ef e8 0e b3 d9 ff e9 c1 fd ff ff e8 04
RSP: 0018:ffff888008217bd8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: ffff888008201ac0 RSI: ffffffff812bd348 RDI: ffffed1001042f6d
RBP: ffff8880182eda30 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880182ed9f8
R13: ffff8880191410e8 R14: 0000000000000000 R15: ffff8880083343c0
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb4280ddb58 CR3: 000000000cc8e000 CR4: 0000000000350ef0
Call Trace:
kernfs_put+0x42/0x50
kernfs_notify_workfn+0x417/0x560
process_one_work+0xa0f/0x1690
worker_thread+0x637/0x1250
kthread+0x2ed/0x3a0
ret_from_fork+0x22/0x30
irq event stamp: 52403
hardirqs last enabled at (52413): [] __up_console_sem+0x78/0x80
hardirqs last disabled at (52424): [] __up_console_sem+0x5d/0x80
softirqs last enabled at (51986): [] srcu_invoke_callbacks+0x1e5/0x3a0
softirqs last disabled at (51982): [] srcu_invoke_callbacks+0x1b5/0x3a0
---[ end trace 0000000000000000 ]---
==================================================================
BUG: KASAN: use-after-free in llist_del_first+0x89/0xa0
Read of size 8 at addr ffff8880182eda78 by task kworker/0:0/6
CPU: 0 PID: 6 Comm: kworker/0:0 Tainted: G W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Workqueue: events kernfs_notify_workfn
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e1
kasan_report+0xb1/0x1b0
llist_del_first+0x89/0xa0
kernfs_notify_workfn+0x78/0x560
process_one_work+0xa0f/0x1690
worker_thread+0x637/0x1250
kthread+0x2ed/0x3a0
ret_from_fork+0x22/0x30
Allocated by task 300:
kasan_save_stack+0x1e/0x40
__kasan_slab_alloc+0x66/0x80
kmem_cache_alloc+0x1b1/0x490
__kernfs_new_node+0xd4/0x8b0
kernfs_new_node+0x93/0x120
__kernfs_create_file+0x51/0x350
cgroup_addrm_files+0x3e2/0x9d0
css_populate_dir+0x19b/0x450
cgroup_apply_control_enable+0x3ae/0xa40
cgroup_mkdir+0x824/0x11f0
kernfs_iop_mkdir+0x149/0x1d0
vfs_mkdir+0x417/0x6a0
do_mkdirat+0x17b/0x2e0
__x64_sys_mkdir+0xf2/0x140
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 6:
kasan_save_stack+0x1e/0x40
------------[ cut here ]------------
kasan_set_track+0x21/0x30
kasan_set_free_info+0x20/0x30
__kasan_slab_free+0x108/0x190
WARNING: CPU: 1 PID: 4768 at fs/kernfs/dir.c:504 kernfs_get.part.0+0x69/0x80
kmem_cache_free+0xfb/0x600
Modules linked in:
kernfs_put.part.0+0x2c7/0x540
kernfs_put+0x42/0x50
CPU: 1 PID: 4768 Comm: syz-executor.5 Tainted: G W 5.19.0-rc5-next-20220706 #1
kernfs_notify_workfn+0x417/0x560
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
process_one_work+0xa0f/0x1690
RIP: 0010:kernfs_get.part.0+0x69/0x80
worker_thread+0x637/0x1250
Code: 31 ff 89 ee e8 a8 fd a6 ff 85 ed 74 18 e8 cf 00 a7 ff be 04 00 00 00 48 89 df e8 d2 ba d9 ff f0 ff 03 5b 5d c3 e8 b7 00 a7 ff <0f> 0b eb df 48 89 df e8 7b b7 d9 ff eb c6 66 0f 1f 84 00 00 00 00
kthread+0x2ed/0x3a0
RSP: 0018:ffff8880453c7a58 EFLAGS: 00010012
ret_from_fork+0x22/0x30
The buggy address belongs to the object at ffff8880182ed9f8
which belongs to the cache kernfs_node_cache of size 168
RAX: 0000000000005421 RBX: ffff8880182ed9f8 RCX: ffffc90003bed000
The buggy address is located 128 bytes inside of
168-byte region [ffff8880182ed9f8, ffff8880182edaa0)
RDX: 0000000000040000 RSI: ffffffff819df849 RDI: 0000000000000005
The buggy address belongs to the physical page:
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
page:00000000071539a8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x182ed
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
flags: 0x100000000000200(slab|node=0|zone=1)
R13: 1ffffffff0a01e40 R14: ffff8880182ed9f8 R15: ffff888043f644f0
raw: 0100000000000200 0000000000000000 dead000000000122 ffff8880080358c0
FS: 00007faa27cce700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
page dumped because: kasan: bad access detected
CR2: 00007faa27cad718 CR3: 000000000cc8e000 CR4: 0000000000350ee0
Memory state around the buggy address:
Call Trace:
ffff8880182ed900: fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880182ed980: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fa
kernfs_get+0x1b/0x30
>ffff8880182eda00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
kernfs_notify+0x180/0x350
^
cgroup_file_notify+0xf5/0x1a0
ffff8880182eda80: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00
try_charge_memcg+0x440/0x1440
ffff8880182edb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
mem_cgroup_charge_skmem+0x7c/0x1b0
sock_setsockopt+0x2080/0x34a0
__sys_setsockopt+0x258/0x2a0
__x64_sys_setsockopt+0xba/0x150
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7faa2a779b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa27cce188 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007faa2a88d020 RCX: 00007faa2a779b19
RDX: 0000000000000049 RSI: 0000000000000001 RDI: 0000000000000006
RBP: 00007faa2a7d3f6d R08: 0000000000000010 R09: 0000000000000000
R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd165cccaf R14: 00007faa27cce300 R15: 0000000000022000
irq event stamp: 30594
hardirqs last enabled at (30593): [] drain_local_stock+0x236/0x3e0
hardirqs last disabled at (30594): [] _raw_spin_lock_irqsave+0x4e/0x50
softirqs last enabled at (30042): [] __irq_exit_rcu+0x113/0x170
softirqs last disabled at (30021): [] __irq_exit_rcu+0x113/0x170
---[ end trace 0000000000000000 ]---
program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO
syz-executor.1 (4776) used greatest stack depth: 24024 bytes left
program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO
program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO
general protection fault, probably for non-canonical address 0x3676c5dffc44008: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 281 Comm: syz-fuzzer Tainted: G B W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xaf/0x190
Code: 80 4c 01 c2 0f 82 f0 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 c3 76 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 a1 76 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888016e3f8a0 EFLAGS: 00010207
RAX: 03676c5dffc44000 RBX: d9e01ffff1100889 RCX: 0000000000000000
RDX: d9e0200071100889 RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: d9e01ffff1100889 R09: 0000000000000000
R10: ffffed1001006950 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888016e3f8e0 R14: 0000000000000000 R15: ffff88804448738a
FS: 000000c000031910(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c011b0a000 CR3: 000000000d1d0000 CR4: 0000000000350ee0
Call Trace:
kasan_quarantine_reduce+0x180/0x200
__kasan_slab_alloc+0x78/0x80
kmem_cache_alloc_node+0x1bf/0x4a0
__alloc_skb+0x20c/0x340
tcp_stream_alloc_skb+0x38/0x580
tcp_sendmsg_locked+0xab0/0x2e60
tcp_sendmsg+0x2b/0x40
inet_sendmsg+0xb5/0x140
sock_sendmsg+0x138/0x190
sock_write_iter+0x28c/0x3d0
new_sync_write+0x31b/0x4e0
vfs_write+0x7b9/0xac0
ksys_write+0x1e8/0x250
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x4b0f4b
Code: ff e9 69 ff ff ff cc cc cc cc cc cc cc cc cc e8 5b c3 f8 ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30
RSP: 002b:000000c0007431e0 EFLAGS: 00000206 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000c00001e000 RCX: 00000000004b0f4b
RDX: 00000000000000f0 RSI: 000000c00000a200 RDI: 0000000000000006
RBP: 000000c000743230 R08: 000000c00000a201 R09: 00000000000000f0
R10: 000000c0002ca000 R11: 0000000000000206 R12: 000000000000011e
R13: 000000c000462000 R14: 000000000000007f R15: 0000000000002c82
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x190
Code: 80 4c 01 c2 0f 82 f0 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 c3 76 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 a1 76 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888016e3f8a0 EFLAGS: 00010207
RAX: 03676c5dffc44000 RBX: d9e01ffff1100889 RCX: 0000000000000000
RDX: d9e0200071100889 RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: d9e01ffff1100889 R09: 0000000000000000
R10: ffffed1001006950 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888016e3f8e0 R14: 0000000000000000 R15: ffff88804448738a
FS: 000000c000031910(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c011b0a000 CR3: 000000000d1d0000 CR4: 0000000000350ee0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 140 at mm/kasan/shadow.c:134 kasan_unpoison+0x42/0x50
Modules linked in:
CPU: 1 PID: 140 Comm: systemd-timesyn Tainted: G B D W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kasan_unpoison+0x42/0x50
Code: 89 fb 48 83 c6 01 e8 7d fe ff ff 48 89 e8 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 eb 48 c1 eb 03 88 04 13 5b 5d c3 <0f> 0b c3 66 66 2e 0f 1f 84 00 00 00 00 00 41 57 48 89 f8 41 56 48
RSP: 0018:ffff88801907f850 EFLAGS: 00010202
RAX: 0000000003113680 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff88804448738a
RBP: ffff888008035280 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88804448738a
R13: 0000000000000cc0 R14: 0000000000000cc0 R15: 0000000000000cc0
FS: 00007fd7f8e20900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005583dd6b9648 CR3: 0000000019012000 CR4: 0000000000350ee0
Call Trace:
__kasan_slab_alloc+0x2c/0x80
kmem_cache_alloc+0x1b1/0x490
getname_kernel+0x4e/0x370
kern_path+0x1b/0x50
unix_find_other+0xf2/0x810
unix_dgram_sendmsg+0xc4a/0x1ab0
sock_sendmsg+0x150/0x190
____sys_sendmsg+0x70c/0x870
___sys_sendmsg+0xf3/0x170
__x64_sys_sendmsg+0x132/0x220
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fd7f97162fd
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 9a 5a f8 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ce 5a f8 ff 48
RSP: 002b:00007ffed55811f0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007fd7f97162fd
RDX: 0000000000004000 RSI: 00007ffed5581240 RDI: 000000000000000f
RBP: 00007ffed5581340 R08: 0000000000000000 R09: 000000000000000f
R10: 00007ffed55811d4 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
irq event stamp: 296374
hardirqs last enabled at (296373): [] _raw_write_unlock_irq+0x1f/0x40
hardirqs last disabled at (296374): [] __schedule+0x11d9/0x24a0
softirqs last enabled at (296298): [] unix_release_sock+0x4ef/0x1120
softirqs last disabled at (296296): [] unix_release_sock+0x473/0x1120
---[ end trace 0000000000000000 ]---
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#2] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 112 Comm: systemd-journal Tainted: G B D W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xd3/0x190
Code: 03 05 a1 76 7b 03 48 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48 8b 02 f6 c4 02 b8 00 00 00 00 48 0f 44 d0 <4c> 8b 72 18 e9 50 ff ff ff 49 83 7e 48 00 0f 85 68 ff ff ff 41 f7
RSP: 0018:ffff888018217c70 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880168d1d72 RCX: ffffea00005a3108
RDX: 0000000000000000 RSI: ffffea000060bb40 RDI: 0000000040000000
RBP: 0000000000000000 R08: ffff8880168d1d72 R09: 000000008011000f
R10: ffffea000060bb40 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888018217cb0 R14: 0000000000000000 R15: ffff8880182ed910
FS: 00007f53f7872900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 00000000086b0000 CR4: 0000000000350ee0
Call Trace:
kasan_quarantine_reduce+0x180/0x200
__kasan_slab_alloc+0x78/0x80
kmem_cache_alloc+0x1b1/0x490
getname_flags.part.0+0x50/0x4f0
getname+0x8e/0xd0
do_sys_openat2+0xf5/0x4c0
__x64_sys_openat+0x13f/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f53f812bc64
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 36 61 f9 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 68 61 f9 ff 8b 44
RSP: 002b:00007ffd4193dac0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055e9fd5c7d60 RCX: 00007f53f812bc64
RDX: 0000000000080802 RSI: 000055e9fd5eb080 RDI: 00000000ffffff9c
RBP: 000055e9fd5eb080 R08: 0000000000000000 R09: ffffffffffffff01
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080802
R13: 00000000fffffffa R14: 000055e9fd5ceab0 R15: 0000000000000002
Modules linked in:
CR2: 0000000000000018
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x190
Code: 80 4c 01 c2 0f 82 f0 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 c3 76 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 a1 76 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888016e3f8a0 EFLAGS: 00010207
RAX: 03676c5dffc44000 RBX: d9e01ffff1100889 RCX: 0000000000000000
RDX: d9e0200071100889 RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: d9e01ffff1100889 R09: 0000000000000000
R10: ffffed1001006950 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888016e3f8e0 R14: 0000000000000000 R15: ffff88804448738a
FS: 00007f53f7872900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 00000000086b0000 CR4: 0000000000350ee0
kmemleak: Cannot insert 0xffff88804448738a into the object search tree (overlaps existing)
CPU: 1 PID: 140 Comm: systemd-timesyn Tainted: G B D W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
__create_object.isra.0.cold+0x44/0x6a
kmem_cache_alloc+0x247/0x490
getname_kernel+0x4e/0x370
kern_path+0x1b/0x50
unix_find_other+0xf2/0x810
unix_dgram_sendmsg+0xc4a/0x1ab0
sock_sendmsg+0x150/0x190
____sys_sendmsg+0x70c/0x870
___sys_sendmsg+0xf3/0x170
__x64_sys_sendmsg+0x132/0x220
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fd7f97162fd
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 9a 5a f8 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ce 5a f8 ff 48
RSP: 002b:00007ffed55811f0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007fd7f97162fd
RDX: 0000000000004000 RSI: 00007ffed5581240 RDI: 000000000000000f
RBP: 00007ffed5581340 R08: 0000000000000000 R09: 000000000000000f
R10: 00007ffed55811d4 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
kmemleak: Kernel memory leak detector disabled
kmemleak: Object 0xffff888044488000 (size 4096):
kmemleak: comm "syz-executor.4", pid 298, jiffies 4294807033
kmemleak: min_count = 1
kmemleak: count = 0
kmemleak: flags = 0x1
kmemleak: checksum = 0
kmemleak: backtrace:
kmemdup+0x23/0x50
__addrconf_sysctl_register+0x9d/0x3d0
addrconf_sysctl_register+0x139/0x1d0
ipv6_add_dev+0xa49/0x1300
addrconf_notify+0xb1e/0x2360
raw_notifier_call_chain+0xb3/0x110
call_netdevice_notifiers_info+0xb5/0x130
register_netdevice+0x107f/0x1510
cfg80211_register_netdevice+0x153/0x320
ieee80211_if_add+0xfbc/0x1800
ieee80211_register_hw+0x32b7/0x3930
mac80211_hwsim_new_radio+0x2525/0x4bf0
hwsim_new_radio_nl+0x9a9/0x1070
genl_family_rcv_msg_doit+0x22d/0x330
genl_rcv_msg+0x33c/0x5a0
netlink_rcv_skb+0x14b/0x430
kmemleak: Automatic memory scanning thread ended
systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1.
systemd[1]: Stopping Flush Journal to Persistent Storage...
systemd[1]: systemd-journal-flush.service: Succeeded.
systemd[1]: Stopped Flush Journal to Persistent Storage.
systemd[1]: Stopped Journal Service.
systemd[1]: systemd-journald.service: Consumed 1.342s CPU time.
systemd[1]: Starting Journal Service...
BUG: unable to handle page fault for address: ffffebde000003c8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#3] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 4853 Comm: systemd-journal Tainted: G B D W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xaf/0x190
Code: 80 4c 01 c2 0f 82 f0 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 c3 76 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 a1 76 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff8880443bf8b8 EFLAGS: 00010286
RAX: ffffebde000003c0 RBX: 000000000000f7a0 RCX: 1ffffffff0b1d66d
RDX: 000000008000f7a0 RSI: 0000000000000008 RDI: ffffffff81771eb1
RBP: 0000000000000000 R08: 000000000000f7a0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff8880443bf8f8 R14: 0000000000000000 R15: ffff88800cae3a26
FS: 00007fda65b49900(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffebde000003c8 CR3: 000000000d6d6000 CR4: 0000000000350ef0
Call Trace:
kasan_quarantine_reduce+0x180/0x200
__kasan_slab_alloc+0x78/0x80
kmem_cache_alloc+0x1b1/0x490
vm_area_dup+0x7f/0x220
__split_vma+0xa2/0x540
split_vma+0x9f/0xe0
mprotect_fixup+0x70c/0x8c0
do_mprotect_pkey+0x709/0xa80
__x64_sys_mprotect+0x74/0xb0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fda667b9e27
Code: 44 00 00 b8 0b 00 00 00 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 8d 0d 31 03 01 00 f7 d8 89 01 48 83 c8 ff c3 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 11 03 01 00 f7 d8 89 01 48 83
RSP: 002b:00007ffd61295a18 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00007fda667c99e8 RCX: 00007fda667b9e27
RDX: 0000000000000001 RSI: 0000000000001000 RDI: 00007fda667c8000
RBP: 00007ffd61295b30 R08: 000000000000ffff R09: 00007fda6631c738
R10: 00007fda667c8f78 R11: 0000000000000206 R12: 0000000000000007
R13: 0000000800000007 R14: 00007fda6679e4f0 R15: 00007fda667c99e8
Modules linked in:
CR2: ffffebde000003c8
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x190
Code: 80 4c 01 c2 0f 82 f0 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 c3 76 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 a1 76 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888016e3f8a0 EFLAGS: 00010207
RAX: 03676c5dffc44000 RBX: d9e01ffff1100889 RCX: 0000000000000000
RDX: d9e0200071100889 RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: d9e01ffff1100889 R09: 0000000000000000
R10: ffffed1001006950 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888016e3f8e0 R14: 0000000000000000 R15: ffff88804448738a
FS: 00007fda65b49900(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffebde000003c8 CR3: 000000000d6d6000 CR4: 0000000000350ef0
systemd[1]: systemd-rfkill.service: Succeeded.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 295 at mm/kasan/shadow.c:134 kasan_unpoison+0x42/0x50
Modules linked in:
CPU: 1 PID: 295 Comm: syz-executor.1 Tainted: G B D W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kasan_unpoison+0x42/0x50
Code: 89 fb 48 83 c6 01 e8 7d fe ff ff 48 89 e8 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 eb 48 c1 eb 03 88 04 13 5b 5d c3 <0f> 0b c3 66 66 2e 0f 1f 84 00 00 00 00 00 41 57 48 89 f8 41 56 48
RSP: 0018:ffff88800cb17e60 EFLAGS: 00010202
RAX: 0000000003113680 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff88801753ea44
RBP: ffff888008035280 R08: 0000000000000000 R09: ffffffff858ea357
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801753ea44
R13: 0000000000000cc0 R14: 0000000000000cc0 R15: 0000000000000cc0
FS: 000055555643a400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556443c58 CR3: 000000000917c000 CR4: 0000000000350ee0
Call Trace:
__kasan_slab_alloc+0x2c/0x80
kmem_cache_alloc+0x1b1/0x490
getname_flags.part.0+0x50/0x4f0
__x64_sys_unlink+0xb1/0x110
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fb427ff9457
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe78f02f08 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb427ff9457
RDX: 00007ffe78f02f40 RSI: 00007ffe78f02f40 RDI: 00007ffe78f02fd0
RBP: 00007ffe78f02fd0 R08: 0000000000000001 R09: 00007ffe78f02da0
R10: 000055555643bcbb R11: 0000000000000206 R12: 00007fb428053105
R13: 00007ffe78f04090 R14: 000055555643bc20 R15: 00007ffe78f040d0
irq event stamp: 370582
hardirqs last enabled at (370581): [] _raw_spin_unlock_irqrestore+0x28/0x50
hardirqs last disabled at (370582): [] __schedule+0x11d9/0x24a0
softirqs last enabled at (370508): [] tcp_close+0x38/0xc0
softirqs last disabled at (370506): [] release_sock+0x1b/0x1b0
---[ end trace 0000000000000000 ]---
usercopy: Kernel memory overwrite attempt detected to SLUB object 'names_cache' (offset 1124, size 4064)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:101!
invalid opcode: 0000 [#4] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 295 Comm: syz-executor.1 Tainted: G B D W 5.19.0-rc5-next-20220706 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:usercopy_abort+0xb9/0xbb
Code: e8 49 a3 38 fd 49 89 d9 4d 89 e8 4c 89 e1 41 56 48 89 ee 48 c7 c7 20 86 6f 84 ff 74 24 08 41 57 48 8b 54 24 20 e8 2f 03 ff ff <0f> 0b e8 1d a3 38 fd 48 89 e5 e8 e5 4f 6b fd 48 89 e9 8b 54 24 0c
RSP: 0018:ffff88800cb17dd8 EFLAGS: 00010286
RAX: 0000000000000069 RBX: ffffffff846fd660 RCX: 0000000000000000
RDX: ffff88800f95b580 RSI: ffffffff812bd348 RDI: ffffed1001962fad
RBP: ffffffff846f8560 R08: 0000000000000069 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff84e88bda
R13: ffffffff846f84a0 R14: 0000000000000fe0 R15: ffffffff846f8460
FS: 000055555643a400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556443c58 CR3: 000000000917c000 CR4: 0000000000350ee0
Call Trace:
__check_heap_object+0x8e/0xd0
__check_object_size+0x234/0x800
strncpy_from_user+0xad/0x3d0
getname_flags.part.0+0x95/0x4f0
__x64_sys_unlink+0xb1/0x110
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fb427ff9457
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe78f02f08 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb427ff9457
RDX: 00007ffe78f02f40 RSI: 00007ffe78f02f40 RDI: 00007ffe78f02fd0
RBP: 00007ffe78f02fd0 R08: 0000000000000001 R09: 00007ffe78f02da0
R10: 000055555643bcbb R11: 0000000000000206 R12: 00007fb428053105
R13: 00007ffe78f04090 R14: 000055555643bc20 R15: 00007ffe78f040d0
program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x190
Code: 80 4c 01 c2 0f 82 f0 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 c3 76 7b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 a1 76 7b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 b6 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888016e3f8a0 EFLAGS: 00010207
RAX: 03676c5dffc44000 RBX: d9e01ffff1100889 RCX: 0000000000000000
RDX: d9e0200071100889 RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: d9e01ffff1100889 R09: 0000000000000000
R10: ffffed1001006950 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888016e3f8e0 R14: 0000000000000000 R15: ffff88804448738a
FS: 000055555643a400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
ieee80211 phy21: Selected rate control algorithm 'minstrel_ht'
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556443c58 CR3: 000000000917c000 CR4: 0000000000350ee0
program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 4c 01 c2 add %r8,%rdx
3: 0f 82 f0 00 00 00 jb 0xf9
9: 48 c7 c0 00 00 00 80 mov $0xffffffff80000000,%rax
10: 48 2b 05 c3 76 7b 03 sub 0x37b76c3(%rip),%rax # 0x37b76da
17: 48 01 d0 add %rdx,%rax
1a: 48 c1 e8 0c shr $0xc,%rax
1e: 48 c1 e0 06 shl $0x6,%rax
22: 48 03 05 a1 76 7b 03 add 0x37b76a1(%rip),%rax # 0x37b76ca
* 29: 48 8b 48 08 mov 0x8(%rax),%rcx <-- trapping instruction
2d: 48 89 c2 mov %rax,%rdx
30: f6 c1 01 test $0x1,%cl
33: 0f 85 b6 00 00 00 jne 0xef
39: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
3e: 48 rex.W