./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2335504305 <...> Warning: Permanently added '10.128.0.230' (ED25519) to the list of known hosts. execve("./syz-executor2335504305", ["./syz-executor2335504305"], 0x7ffe0bf70f00 /* 10 vars */) = 0 brk(NULL) = 0x555560505000 brk(0x555560505d00) = 0x555560505d00 arch_prctl(ARCH_SET_FS, 0x555560505380) = 0 set_tid_address(0x555560505650) = 5789 set_robust_list(0x555560505660, 24) = 0 rseq(0x555560505ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2335504305", 4096) = 28 getrandom("\x07\x45\x4a\x9c\x61\x4a\x7c\x64", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555560505d00 brk(0x555560526d00) = 0x555560526d00 brk(0x555560527000) = 0x555560527000 mprotect(0x7fda14452000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555560505650) = 5790 ./strace-static-x86_64: Process 5790 attached [pid 5790] set_robust_list(0x555560505660, 24) = 0 [pid 5790] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5790] getppid() = 0 [pid 5790] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5790] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5790] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5790] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5790] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5790] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5790] unshare(CLONE_NEWNS) = 0 [pid 5790] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5790] unshare(CLONE_NEWIPC) = 0 [pid 5790] unshare(CLONE_NEWCGROUP) = 0 [pid 5790] unshare(CLONE_NEWUTS) = 0 [pid 5790] unshare(CLONE_SYSVSEM) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "16777216", 8) = 8 [pid 5790] close(3) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "536870912", 9) = 9 [pid 5790] close(3) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "1024", 4) = 4 [pid 5790] close(3) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "8192", 4) = 4 [pid 5790] close(3) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "1024", 4) = 4 [pid 5790] close(3) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "1024", 4) = 4 [pid 5790] close(3) = 0 [pid 5790] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5790] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5790] close(3) = 0 [pid 5790] getpid() = 1 [pid 5790] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 5790] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5817 attached , child_tidptr=0x555560505650) = 3 [pid 5817] set_robust_list(0x555560505660, 24) = 0 [pid 5817] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5817] setpgid(0, 0) = 0 [pid 5817] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5817] write(3, "1000", 4) = 4 executing program [pid 5817] close(3) = 0 [pid 5817] write(1, "executing program\n", 18) = 18 [pid 5817] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5817] socket(AF_PACKET, SOCK_RAW, htons(0 /* ETH_P_??? */)) = 3 [pid 5817] ioctl(3, SIOCGIFINDEX, {ifr_name="ip6gretap0", ifr_ifindex=11}) = 0 [pid 5817] bind(3, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("wpan0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xbb]}, 20) = 0 [pid 5817] setsockopt(3, SOL_PACKET, PACKET_VNET_HDR, [233], 4) = 0 [pid 5817] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x3f\x01\x14\x00\xdc\xdc\x18\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=56594}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=16}], msg_iovlen=2, msg_controllen=0, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_BATCH|MSG_FASTOPEN) = 56610 [pid 5817] close(3) = 0 [pid 5817] close(4) = -1 EBADF (Bad file descriptor) [pid 5817] close(5) = -1 EBADF (Bad file descriptor) [pid 5817] close(6) = -1 EBADF (Bad file descriptor) [pid 5817] close(7) = -1 EBADF (Bad file descriptor) [pid 5817] close(8) = -1 EBADF (Bad file descriptor) [pid 5817] close(9) = -1 EBADF (Bad file descriptor) [pid 5817] close(10) = -1 EBADF (Bad file descriptor) [pid 5817] close(11) = -1 EBADF (Bad file descriptor) [pid 5817] close(12) = -1 EBADF (Bad file descriptor) [pid 5817] close(13) = -1 EBADF (Bad file descriptor) [pid 5817] close(14) = -1 EBADF (Bad file descriptor) [pid 5817] close(15) = -1 EBADF (Bad file descriptor) [pid 5817] close(16) = -1 EBADF (Bad file descriptor) [pid 5817] close(17) = -1 EBADF (Bad file descriptor) [pid 5817] close(18) = -1 EBADF (Bad file descriptor) [pid 5817] close(19) = -1 EBADF (Bad file descriptor) [pid 5817] close(20) = -1 EBADF (Bad file descriptor) [pid 5817] close(21) = -1 EBADF (Bad file descriptor) [pid 5817] close(22) = -1 EBADF (Bad file descriptor) [pid 5817] close(23) = -1 EBADF (Bad file descriptor) [pid 5817] close(24) = -1 EBADF (Bad file descriptor) [pid 5817] close(25) = -1 EBADF (Bad file descriptor) [pid 5817] close(26) = -1 EBADF (Bad file descriptor) [pid 5817] close(27) = -1 EBADF (Bad file descriptor) [pid 5817] close(28) = -1 EBADF (Bad file descriptor) [pid 5817] close(29) = -1 EBADF (Bad file descriptor) [pid 5817] exit_group(0) = ? [pid 5817] +++ exited with 0 +++ [pid 5790] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 5790] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5790] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555560505650) = 4 ./strace-static-x86_64: Process 5818 attached [pid 5818] set_robust_list(0x555560505660, 24) = 0 [pid 5818] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5818] setpgid(0, 0) = 0 [pid 5818] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5818] write(3, "1000", 4) = 4 [pid 5818] close(3executing program ) = 0 [pid 5818] write(1, "executing program\n", 18) = 18 [pid 5818] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5818] socket(AF_PACKET, SOCK_RAW, htons(0 /* ETH_P_??? */)) = 3 [pid 5818] ioctl(3, SIOCGIFINDEX, {ifr_name="ip6gretap0", ifr_ifindex=11}) = 0 [pid 5818] bind(3, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("wpan0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xbb]}, 20) = 0 [pid 5818] setsockopt(3, SOL_PACKET, PACKET_VNET_HDR, [233], 4) = 0 [pid 5818] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x3f\x01\x14\x00\xdc\xdc\x18\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=56594}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=16}], msg_iovlen=2, msg_controllen=0, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_BATCH|MSG_FASTOPEN) = 56610 [pid 5818] close(3) = 0 [pid 5818] close(4) = -1 EBADF (Bad file descriptor) [pid 5818] close(5) = -1 EBADF (Bad file descriptor) [pid 5818] close(6) = -1 EBADF (Bad file descriptor) [pid 5818] close(7) = -1 EBADF (Bad file descriptor) [pid 5818] close(8) = -1 EBADF (Bad file descriptor) [pid 5818] close(9) = -1 EBADF (Bad file descriptor) [pid 5818] close(10) = -1 EBADF (Bad file descriptor) [pid 5818] close(11) = -1 EBADF (Bad file descriptor) [pid 5818] close(12) = -1 EBADF (Bad file descriptor) [pid 5818] close(13) = -1 EBADF (Bad file descriptor) [pid 5818] close(14) = -1 EBADF (Bad file descriptor) [pid 5818] close(15) = -1 EBADF (Bad file descriptor) [pid 5818] close(16) = -1 EBADF (Bad file descriptor) [pid 5818] close(17) = -1 EBADF (Bad file descriptor) [pid 5818] close(18) = -1 EBADF (Bad file descriptor) [pid 5818] close(19) = -1 EBADF (Bad file descriptor) [pid 5818] close(20) = -1 EBADF (Bad file descriptor) [pid 5818] close(21) = -1 EBADF (Bad file descriptor) [pid 5818] close(22) = -1 EBADF (Bad file descriptor) [pid 5818] close(23) = -1 EBADF (Bad file descriptor) [pid 5818] close(24) = -1 EBADF (Bad file descriptor) [pid 5818] close(25) = -1 EBADF (Bad file descriptor) [pid 5818] close(26) = -1 EBADF (Bad file descriptor) [pid 5818] close(27) = -1 EBADF (Bad file descriptor) [pid 5818] close(28) = -1 EBADF (Bad file descriptor) [pid 5818] close(29) = -1 EBADF (Bad file descriptor) [pid 5818] exit_group(0) = ? [pid 5818] +++ exited with 0 +++ [pid 5790] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5790] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555560505650) = 5 ./strace-static-x86_64: Process 5819 attached [pid 5819] set_robust_list(0x555560505660, 24) = 0 [pid 5819] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5819] setpgid(0, 0) = 0 [pid 5819] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5819] write(3, "1000", 4) = 4 [pid 5819] close(3) = 0 [pid 5819] write(1, "executing program\n", 18) = 18 executing program [pid 5819] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5819] socket(AF_PACKET, SOCK_RAW, htons(0 /* ETH_P_??? */)) = 3 [pid 5819] ioctl(3, SIOCGIFINDEX, {ifr_name="ip6gretap0", ifr_ifindex=11}) = 0 [pid 5819] bind(3, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("wpan0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xbb]}, 20) = 0 [pid 5819] setsockopt(3, SOL_PACKET, PACKET_VNET_HDR, [233], 4) = 0 [pid 5819] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x3f\x01\x14\x00\xdc\xdc\x18\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=56594}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=16}], msg_iovlen=2, msg_controllen=0, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_BATCH|MSG_FASTOPEN) = 56610 [pid 5819] close(3) = 0 [pid 5819] close(4) = -1 EBADF (Bad file descriptor) [pid 5819] close(5) = -1 EBADF (Bad file descriptor) [pid 5819] close(6) = -1 EBADF (Bad file descriptor) [pid 5819] close(7) = -1 EBADF (Bad file descriptor) [pid 5819] close(8) = -1 EBADF (Bad file descriptor) [pid 5819] close(9) = -1 EBADF (Bad file descriptor) [pid 5819] close(10) = -1 EBADF (Bad file descriptor) [pid 5819] close(11) = -1 EBADF (Bad file descriptor) [pid 5819] close(12) = -1 EBADF (Bad file descriptor) [pid 5819] close(13) = -1 EBADF (Bad file descriptor) [pid 5819] close(14) = -1 EBADF (Bad file descriptor) [pid 5819] close(15) = -1 EBADF (Bad file descriptor) [pid 5819] close(16) = -1 EBADF (Bad file descriptor) [pid 5819] close(17) = -1 EBADF (Bad file descriptor) [pid 5819] close(18) = -1 EBADF (Bad file descriptor) [pid 5819] close(19) = -1 EBADF (Bad file descriptor) [pid 5819] close(20) = -1 EBADF (Bad file descriptor) [pid 5819] close(21) = -1 EBADF (Bad file descriptor) [pid 5819] close(22) = -1 EBADF (Bad file descriptor) [pid 5819] close(23) = -1 EBADF (Bad file descriptor) [pid 5819] close(24) = -1 EBADF (Bad file descriptor) [pid 5819] close(25) = -1 EBADF (Bad file descriptor) [pid 5819] close(26) = -1 EBADF (Bad file descriptor) [pid 5819] close(27) = -1 EBADF (Bad file descriptor) [pid 5819] close(28) = -1 EBADF (Bad file descriptor) [pid 5819] close(29) = -1 EBADF (Bad file descriptor) [pid 5819] exit_group(0) = ? [pid 5819] +++ exited with 0 +++ [pid 5790] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5790] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5790] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555560505650) = 6 ./strace-static-x86_64: Process 5820 attached [pid 5820] set_robust_list(0x555560505660, 24) = 0 [pid 5820] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5820] setpgid(0, 0) = 0 [pid 5820] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5820] write(3, "1000", 4) = 4 executing program [pid 5820] close(3) = 0 [pid 5820] write(1, "executing program\n", 18) = 18 [pid 5820] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_LWT_XMIT, insn_cnt=14, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=NULL, ...}, 148) = -1 EINVAL (Invalid argument) [pid 5820] socket(AF_PACKET, SOCK_RAW, htons(0 /* ETH_P_??? */)) = 3 [pid 5820] ioctl(3, SIOCGIFINDEX, {ifr_name="ip6gretap0", ifr_ifindex=11}) = 0 [pid 5820] bind(3, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("wpan0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xbb]}, 20) = 0 [pid 5820] setsockopt(3, SOL_PACKET, PACKET_VNET_HDR, [233], 4) = 0 [ 210.419002][ T5820] ===================================================== [ 210.426472][ T5820] BUG: KMSAN: uninit-value in validate_xmit_skb+0xb10/0x18d0 [ 210.434335][ T5820] validate_xmit_skb+0xb10/0x18d0 [ 210.439771][ T5820] validate_xmit_skb_list+0xd4/0x320 [ 210.445230][ T5820] sch_direct_xmit+0xd4/0xcf0 [ 210.450312][ T5820] __dev_queue_xmit+0x35e6/0x5e20 [ 210.455702][ T5820] packet_xmit+0x8f/0x710 [ 210.460423][ T5820] packet_sendmsg+0x9614/0xa710 [ 210.465552][ T5820] __sock_sendmsg+0x333/0x3d0 [ 210.470560][ T5820] ____sys_sendmsg+0x7e0/0xd80 [ 210.475634][ T5820] ___sys_sendmsg+0x271/0x3b0 [ 210.480816][ T5820] __x64_sys_sendmsg+0x211/0x3e0 [ 210.486014][ T5820] x64_sys_call+0x32fb/0x3db0 [ 210.491036][ T5820] do_syscall_64+0xd9/0x1b0 [ 210.495810][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.502027][ T5820] [ 210.504470][ T5820] Uninit was stored to memory at: [ 210.510002][ T5820] validate_xmit_skb+0xb09/0x18d0 [ 210.515330][ T5820] validate_xmit_skb_list+0xd4/0x320 [ 210.520942][ T5820] sch_direct_xmit+0xd4/0xcf0 [ 210.525975][ T5820] __dev_queue_xmit+0x35e6/0x5e20 [ 210.531534][ T5820] packet_xmit+0x8f/0x710 [ 210.536122][ T5820] packet_sendmsg+0x9614/0xa710 [ 210.541368][ T5820] __sock_sendmsg+0x333/0x3d0 [ 210.546255][ T5820] ____sys_sendmsg+0x7e0/0xd80 [ 210.551363][ T5820] ___sys_sendmsg+0x271/0x3b0 [ 210.556472][ T5820] __x64_sys_sendmsg+0x211/0x3e0 [ 210.561871][ T5820] x64_sys_call+0x32fb/0x3db0 [ 210.566815][ T5820] do_syscall_64+0xd9/0x1b0 [ 210.571679][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.577798][ T5820] [ 210.580348][ T5820] Uninit was created at: [ 210.584810][ T5820] kmem_cache_alloc_node_noprof+0x818/0xf00 [ 210.591030][ T5820] kmalloc_reserve+0x13c/0x4b0 [ 210.596032][ T5820] __alloc_skb+0x347/0x7d0 [ 210.600740][ T5820] alloc_skb_with_frags+0xc5/0xa60 [ 210.606155][ T5820] sock_alloc_send_pskb+0xad8/0xc70 [ 210.611728][ T5820] packet_sendmsg+0x77e7/0xa710 [ 210.616803][ T5820] __sock_sendmsg+0x333/0x3d0 [ 210.621750][ T5820] ____sys_sendmsg+0x7e0/0xd80 [ 210.626745][ T5820] ___sys_sendmsg+0x271/0x3b0 [ 210.631749][ T5820] __x64_sys_sendmsg+0x211/0x3e0 [ 210.636952][ T5820] x64_sys_call+0x32fb/0x3db0 [ 210.642045][ T5820] do_syscall_64+0xd9/0x1b0 [ 210.646780][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.652962][ T5820] [ 210.655565][ T5820] CPU: 1 UID: 0 PID: 5820 Comm: syz-executor233 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(undef) [ 210.666834][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 210.677250][ T5820] ===================================================== [ 210.684613][ T5820] Disabling lock debugging due to kernel taint [ 210.691037][ T5820] Kernel panic - not syncing: kmsan.panic set ... [ 210.697687][ T5820] CPU: 1 UID: 0 PID: 5820 Comm: syz-executor233 Tainted: G B 6.15.0-rc7-syzkaller #0 PREEMPT(undef) [ 210.710314][ T5820] Tainted: [B]=BAD_PAGE [ 210.714654][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 210.724854][ T5820] Call Trace: [ 210.728220][ T5820] [ 210.731489][ T5820] __dump_stack+0x26/0x30 [ 210.735975][ T5820] dump_stack_lvl+0x53/0x270 [ 210.740708][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 210.746689][ T5820] dump_stack+0x1e/0x25 [ 210.751013][ T5820] panic+0x4bd/0xd50 [ 210.755148][ T5820] kmsan_report+0x29d/0x2a0 [ 210.759832][ T5820] ? kmsan_internal_chain_origin+0xb6/0xd0 [ 210.765812][ T5820] ? __msan_warning+0x96/0x120 [ 210.770774][ T5820] ? validate_xmit_skb+0xb10/0x18d0 [ 210.776205][ T5820] ? validate_xmit_skb_list+0xd4/0x320 [ 210.781812][ T5820] ? sch_direct_xmit+0xd4/0xcf0 [ 210.786788][ T5820] ? __dev_queue_xmit+0x35e6/0x5e20 [ 210.792165][ T5820] ? packet_xmit+0x8f/0x710 [ 210.796910][ T5820] ? packet_sendmsg+0x9614/0xa710 [ 210.802113][ T5820] ? __sock_sendmsg+0x333/0x3d0 [ 210.807141][ T5820] ? ____sys_sendmsg+0x7e0/0xd80 [ 210.812223][ T5820] ? ___sys_sendmsg+0x271/0x3b0 [ 210.817221][ T5820] ? __x64_sys_sendmsg+0x211/0x3e0 [ 210.822516][ T5820] ? x64_sys_call+0x32fb/0x3db0 [ 210.827561][ T5820] ? do_syscall_64+0xd9/0x1b0 [ 210.832486][ T5820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.838705][ T5820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.844976][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.850382][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 210.856454][ T5820] ? skb_network_protocol+0x898/0xaa0 [ 210.862028][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.867517][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 210.873593][ T5820] ? netif_skb_features+0x11c1/0x1450 [ 210.879188][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.884690][ T5820] __msan_warning+0x96/0x120 [ 210.889462][ T5820] validate_xmit_skb+0xb10/0x18d0 [ 210.894673][ T5820] ? filter_irq_stacks+0x49/0x190 [ 210.899992][ T5820] validate_xmit_skb_list+0xd4/0x320 [ 210.905646][ T5820] sch_direct_xmit+0xd4/0xcf0 [ 210.910511][ T5820] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 210.917097][ T5820] __dev_queue_xmit+0x35e6/0x5e20 [ 210.922306][ T5820] ? packet_parse_headers+0xb71/0xed0 [ 210.927907][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.933395][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 210.939447][ T5820] ? __dev_queue_xmit+0x30c/0x5e20 [ 210.944858][ T5820] packet_xmit+0x8f/0x710 [ 210.949401][ T5820] ? skb_put+0x1a3/0x250 [ 210.953951][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.959331][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 210.965387][ T5820] packet_sendmsg+0x9614/0xa710 [ 210.970399][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.975824][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 210.981912][ T5820] ? aa_label_sk_perm+0x6f0/0x7b0 [ 210.987151][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 210.992673][ T5820] ? __pfx_packet_sendmsg+0x10/0x10 [ 210.998043][ T5820] ? __pfx_packet_sendmsg+0x10/0x10 [ 211.003430][ T5820] __sock_sendmsg+0x333/0x3d0 [ 211.008280][ T5820] ____sys_sendmsg+0x7e0/0xd80 [ 211.013270][ T5820] ___sys_sendmsg+0x271/0x3b0 [ 211.018225][ T5820] ? stack_depot_save_flags+0x35/0x7c0 [ 211.023829][ T5820] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 211.030458][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 211.035828][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 211.041817][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 211.047191][ T5820] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 211.053204][ T5820] __x64_sys_sendmsg+0x211/0x3e0 [ 211.058304][ T5820] ? kmsan_get_metadata+0x105/0x1b0 [ 211.063723][ T5820] x64_sys_call+0x32fb/0x3db0 [ 211.068642][ T5820] do_syscall_64+0xd9/0x1b0 [ 211.073298][ T5820] ? irqentry_exit+0x16/0x60 [ 211.078031][ T5820] ? clear_bhb_loop+0x40/0x90 [ 211.082854][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.088905][ T5820] RIP: 0033:0x7fda143d9fa9 [ 211.093440][ T5820] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 211.113333][ T5820] RSP: 002b:00007fffff3c8f88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 211.122026][ T5820] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fda143d9fa9 [ 211.130236][ T5820] RDX: 0000000020040051 RSI: 0000200000002ac0 RDI: 0000000000000003 [ 211.138464][ T5820] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 211.146709][ T5820] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 211.154901][ T5820] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 211.163038][ T5820] [ 211.166517][ T5820] Kernel Offset: disabled [ 211.170950][ T5820] Rebooting in 86400 seconds..