Syzkaller hit 'WARNING in corrupted' bug.

cgroup: Unknown subsys name 'perf_event'
cgroup: Unknown subsys name 'net_cls'
------------[ cut here ]------------
WARNING: CPU: 0 PID: 851 at mm/page_alloc.c:4935 __alloc_pages_nodemask+0x560/0x680
Modules linked in:
CPU: 0 PID: 851 Comm: syz-executor.0 Not tainted 5.10.45 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:__alloc_pages_nodemask+0x560/0x680
Code: 00 00 0c 00 0f 85 86 00 00 00 4c 89 c2 44 89 e6 44 89 f7 c6 44 24 70 00 4c 89 6c 24 58 e8 98 d8 ff ff 49 89 c7 e9 41 fd ff ff <0f> 0b e9 00 fe ff ff 4c 89 44 24 18 4c 89 44 24 10 89 74 24 0c 4c
RSP: 0018:ffff888022c9f3d0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff11004593e7e RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000040dc0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000015
R13: 0000000000000015 R14: 0000000000000000 R15: ffff88801602a580
FS:  0000000002422400(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004cb7f0 CR3: 0000000018844005 CR4: 0000000000060ef0
Call Trace:
 alloc_pages_current+0x187/0x280
 kmalloc_order+0x35/0x160
 kmalloc_order_trace+0x14/0xf0
 netlbl_cipsov4_add+0x5a9/0x23e0
 genl_family_rcv_msg_doit+0x22d/0x330
 genl_rcv_msg+0x33c/0x5a0
 netlink_rcv_skb+0x14b/0x430
 genl_rcv+0x24/0x40
 netlink_unicast+0x53a/0x7e0
 netlink_sendmsg+0x860/0xda0
 sock_sendmsg+0x150/0x190
 ____sys_sendmsg+0x709/0x870
 ___sys_sendmsg+0xf3/0x170
 __sys_sendmsg+0xe5/0x1b0
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466609
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffda4bbd48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007fffda4bbee0 R14: 000000000056bf80 R15: 000000000005cce7
irq event stamp: 2601
hardirqs last  enabled at (2613): [<ffffffff81290989>] console_unlock+0x929/0xb30
hardirqs last disabled at (2622): [<ffffffff81290895>] console_unlock+0x835/0xb30
softirqs last  enabled at (1822): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20
softirqs last disabled at (1765): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20
---[ end trace 7084697bd8012ae7 ]---


Syzkaller reproducer:
# {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:true USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true UseTmpDir:true HandleSegv:true Repro:false Trace:false}
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), r0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x98, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x10}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x60, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x51}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x443fdd5a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf6}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x37}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x54d96860}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6f7e82fb}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x60}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf8}]}]}]}, 0x98}}, 0x0)


C reproducer:
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_link.h>
#include <linux/in6.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/veth.h>

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;
	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	exit(1);
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

static bool write_file(const char* file, const char* what, ...)
{
	char buf[1024];
	va_list args;
	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);
	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;
		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

struct nlmsg {
	char* pos;
	int nesting;
	struct nlattr* nested[8];
	char buf[4096];
};

static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
			 const void* data, int size)
{
	memset(nlmsg, 0, sizeof(*nlmsg));
	struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
	hdr->nlmsg_type = typ;
	hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
	memcpy(hdr + 1, data, size);
	nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}

static void netlink_attr(struct nlmsg* nlmsg, int typ,
			 const void* data, int size)
{
	struct nlattr* attr = (struct nlattr*)nlmsg->pos;
	attr->nla_len = sizeof(*attr) + size;
	attr->nla_type = typ;
	if (size > 0)
		memcpy(attr + 1, data, size);
	nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}

static int netlink_send_ext(struct nlmsg* nlmsg, int sock,
			    uint16_t reply_type, int* reply_len, bool dofail)
{
	if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
	exit(1);
	struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
	hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
	struct sockaddr_nl addr;
	memset(&addr, 0, sizeof(addr));
	addr.nl_family = AF_NETLINK;
	ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr));
	if (n != (ssize_t)hdr->nlmsg_len) {
		if (dofail)
	exit(1);
		return -1;
	}
	n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
	if (reply_len)
		*reply_len = 0;
	if (n < 0) {
		if (dofail)
	exit(1);
		return -1;
	}
	if (n < (ssize_t)sizeof(struct nlmsghdr)) {
		errno = EINVAL;
		if (dofail)
	exit(1);
		return -1;
	}
	if (hdr->nlmsg_type == NLMSG_DONE)
		return 0;
	if (reply_len && hdr->nlmsg_type == reply_type) {
		*reply_len = n;
		return 0;
	}
	if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
		errno = EINVAL;
		if (dofail)
	exit(1);
		return -1;
	}
	if (hdr->nlmsg_type != NLMSG_ERROR) {
		errno = EINVAL;
		if (dofail)
	exit(1);
		return -1;
	}
	errno = -((struct nlmsgerr*)(hdr + 1))->error;
	return -errno;
}

static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail)
{
	struct genlmsghdr genlhdr;
	memset(&genlhdr, 0, sizeof(genlhdr));
	genlhdr.cmd = CTRL_CMD_GETFAMILY;
	netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
	netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1);
	int n = 0;
	int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
	if (err < 0) {
		return -1;
	}
	uint16_t id = 0;
	struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr)));
	for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
		if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
			id = *(uint16_t*)(attr + 1);
			break;
		}
	}
	if (!id) {
		errno = EINVAL;
		return -1;
	}
	recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
	return id;
}

const int kInitNetNsFd = 239;

static long syz_init_net_socket(volatile long domain, volatile long type, volatile long proto)
{
	return syscall(__NR_socket, domain, type, proto);
}

static long syz_genetlink_get_family_id(volatile long name, volatile long sock_arg)
{
	bool dofail = false;
	int fd = sock_arg;
	if (fd < 0) {
		dofail = true;
		fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
		if (fd == -1) {
			return -1;
		}
	}
	struct nlmsg nlmsg_tmp;
	int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, dofail);
	if ((int)sock_arg < 0)
		close(fd);
	if (ret < 0) {
		return -1;
	}
	return ret;
}

static void kill_and_wait(int pid, int* status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR* dir = opendir("/sys/fs/fuse/connections");
	if (dir) {
		for (;;) {
			struct dirent* ent = readdir(dir);
			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];
			snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
			int fd = open(abort, O_WRONLY);
			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;
	for (;; iter++) {
		int pid = fork();
		if (pid < 0)
	exit(1);
		if (pid == 0) {
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();
		for (;;) {
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			sleep_ms(1);
		if (current_time_ms() - start < 5000) {
			continue;
		}
			kill_and_wait(pid, &status);
			break;
		}
	}
}

uint64_t r[3] = {0xffffffffffffffff, 0x0, 0xffffffffffffffff};

void execute_one(void)
{
		intptr_t res = 0;
	res = -1;
res = syz_init_net_socket(0x10, 3, 0x10);
	if (res != -1)
		r[0] = res;
memcpy((void*)0x20000000, "NLBL_CIPSOv4\000", 13);
	res = -1;
res = syz_genetlink_get_family_id(0x20000000, r[0]);
	if (res != -1)
		r[1] = res;
	res = -1;
res = syz_init_net_socket(0x10, 3, 0x10);
	if (res != -1)
		r[2] = res;
*(uint64_t*)0x200000c0 = 0;
*(uint32_t*)0x200000c8 = 0;
*(uint64_t*)0x200000d0 = 0x20000080;
*(uint64_t*)0x20000080 = 0x20000480;
*(uint32_t*)0x20000480 = 0x98;
*(uint16_t*)0x20000484 = r[1];
*(uint16_t*)0x20000486 = 1;
*(uint32_t*)0x20000488 = 0;
*(uint32_t*)0x2000048c = 0;
*(uint8_t*)0x20000490 = 1;
*(uint8_t*)0x20000491 = 0;
*(uint16_t*)0x20000492 = 0;
*(uint16_t*)0x20000494 = 8;
*(uint16_t*)0x20000496 = 1;
*(uint32_t*)0x20000498 = 0;
*(uint16_t*)0x2000049c = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x2000049e, 4, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x2000049f, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x2000049f, 1, 7, 1);
*(uint16_t*)0x200004a0 = 5;
*(uint16_t*)0x200004a2 = 0x10;
*(uint8_t*)0x200004a4 = 0;
*(uint16_t*)0x200004a8 = 8;
*(uint16_t*)0x200004aa = 2;
*(uint32_t*)0x200004ac = 2;
*(uint16_t*)0x200004b0 = 8;
*(uint16_t*)0x200004b2 = 2;
*(uint32_t*)0x200004b4 = 1;
*(uint16_t*)0x200004b8 = 0x60;
STORE_BY_BITMASK(uint16_t, , 0x200004ba, 8, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200004bb, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200004bb, 1, 7, 1);
*(uint16_t*)0x200004bc = 0x24;
STORE_BY_BITMASK(uint16_t, , 0x200004be, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200004bf, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200004bf, 1, 7, 1);
*(uint16_t*)0x200004c0 = 8;
*(uint16_t*)0x200004c2 = 6;
*(uint32_t*)0x200004c4 = 0x51;
*(uint16_t*)0x200004c8 = 8;
*(uint16_t*)0x200004ca = 5;
*(uint32_t*)0x200004cc = 0x443fdd5a;
*(uint16_t*)0x200004d0 = 8;
*(uint16_t*)0x200004d2 = 6;
*(uint32_t*)0x200004d4 = 0xf6;
*(uint16_t*)0x200004d8 = 8;
*(uint16_t*)0x200004da = 6;
*(uint32_t*)0x200004dc = 0x37;
*(uint16_t*)0x200004e0 = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x200004e2, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200004e3, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200004e3, 1, 7, 1);
*(uint16_t*)0x200004e4 = 8;
*(uint16_t*)0x200004e6 = 5;
*(uint32_t*)0x200004e8 = 0x54d96860;
*(uint16_t*)0x200004ec = 8;
*(uint16_t*)0x200004ee = 6;
*(uint32_t*)0x200004f0 = 0;
*(uint16_t*)0x200004f4 = 8;
*(uint16_t*)0x200004f6 = 5;
*(uint32_t*)0x200004f8 = 0x6f7e82fb;
*(uint16_t*)0x200004fc = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x200004fe, 7, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x200004ff, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x200004ff, 1, 7, 1);
*(uint16_t*)0x20000500 = 8;
*(uint16_t*)0x20000502 = 6;
*(uint32_t*)0x20000504 = 7;
*(uint16_t*)0x20000508 = 8;
*(uint16_t*)0x2000050a = 6;
*(uint32_t*)0x2000050c = 0x60;
*(uint16_t*)0x20000510 = 8;
*(uint16_t*)0x20000512 = 6;
*(uint32_t*)0x20000514 = 0xf8;
*(uint64_t*)0x20000088 = 0x98;
*(uint64_t*)0x200000d8 = 1;
*(uint64_t*)0x200000e0 = 0;
*(uint64_t*)0x200000e8 = 0;
*(uint32_t*)0x200000f0 = 0;
	syscall(__NR_sendmsg, r[2], 0x200000c0ul, 0ul);

}
int main(void)
{
		syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
	syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
	syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
			loop();
	return 0;
}