./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2262013097
<...>
Warning: Permanently added '10.128.1.186' (ECDSA) to the list of known hosts.
execve("./syz-executor2262013097", ["./syz-executor2262013097"], 0x7fffd231f910 /* 10 vars */) = 0
brk(NULL) = 0x555555fa9000
brk(0x555555fa9c40) = 0x555555fa9c40
arch_prctl(ARCH_SET_FS, 0x555555fa9300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2262013097", 4096) = 28
brk(0x555555fcac40) = 0x555555fcac40
brk(0x555555fcb000) = 0x555555fcb000
mprotect(0x7f6a1d608000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/iommu", O_RDONLY) = 3
ioctl(3, _IOC(_IOC_NONE, 0x3b, 0x81, 0), 0x20000080) = 0
ioctl(3, _IOC(_IOC_NONE, 0x3b, 0x85, 0), 0x20000100) = 0
openat(AT_FDCWD, "/dev/iommu", O_RDONLY) = 4
ioctl(4, _IOC(_IOC_NONE, 0x3b, 0x81, 0), 0x20000000) = 0
syzkaller login: [ 54.533513][ T5081] iommufd_mock iommufd_mock0: Adding to iommu group 0
[ 54.541721][ T5081] ------------[ cut here ]------------
[ 54.547371][ T5081] WARNING: CPU: 0 PID: 5081 at drivers/iommu/iommufd/device.c:344 iommufd_hw_pagetable_detach+0x2cb/0x480
[ 54.558776][ T5081] Modules linked in:
[ 54.562726][ T5081] CPU: 0 PID: 5081 Comm: syz-executor226 Not tainted 6.3.0-rc4-next-20230331-syzkaller #0
[ 54.572663][ T5081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[ 54.582768][ T5081] RIP: 0010:iommufd_hw_pagetable_detach+0x2cb/0x480
[ 54.589498][ T5081] Code: f2 fc 49 8d 7d 70 be ff ff ff ff e8 cf 2f 76 05 31 ff 41 89 c5 89 c6 e8 63 6d f2 fc 45 85 ed 0f 85 ee fd ff ff e8 35 71 f2 fc <0f> 0b e9 e2 fd ff ff e8 29 71 f2 fc 49 8d bd a0 00 00 00 48 b8 00
[ 54.609184][ T5081] RSP: 0018:ffffc90003b0fb30 EFLAGS: 00010293
[ 54.615247][ T5081] RAX: 0000000000000000 RBX: ffff88801676da00 RCX: 0000000000000000
[ 54.624681][ T5081] RDX: ffff8880279c8000 RSI: ffffffff8490a01b RDI: 0000000000000005
[ 54.632724][ T5081] RBP: ffff88801676dab0 R08: 0000000000000005 R09: 0000000000000000
[ 54.640868][ T5081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801676dc00
[ 54.648887][ T5081] R13: 0000000000000000 R14: 0000000000000001 R15: ffff88801676dcc0
[ 54.656869][ T5081] FS: 0000555555fa9300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 54.665875][ T5081] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 54.672614][ T5081] CR2: 0000000020000188 CR3: 000000002ba93000 CR4: 00000000003506f0
[ 54.680630][ T5081] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 54.688695][ T5081] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 54.696679][ T5081] Call Trace:
[ 54.700020][ T5081]
[ 54.702970][ T5081] iommufd_hw_pagetable_alloc+0x646/0x800
[ 54.708786][ T5081] iommufd_device_change_pt+0x570/0xb30
[ 54.714357][ T5081] ? iommufd_hw_pagetable_attach+0x910/0x910
[ 54.720417][ T5081] ? iommufd_object_finalize+0x50/0x80
[ 54.725906][ T5081] ? iommufd_device_bind+0xa6/0xc70
[ 54.731180][ T5081] ? iommufd_access_create+0x2b0/0x2b0
[ 54.736682][ T5081] ? iommufd_device_attach+0xd0/0xd0
[ 54.742025][ T5081] iommufd_device_attach+0x27/0xd0
[ 54.747187][ T5081] iommufd_test+0x81c/0x2ef0
[ 54.752073][ T5081] ? lock_downgrade+0x690/0x690
[ 54.756968][ T5081] ? trace_lock_acquire+0x12d/0x180
[ 54.762260][ T5081] ? iommufd_selftest_destroy+0x190/0x190
[ 54.768004][ T5081] ? lock_acquire+0x32/0xc0
[ 54.772585][ T5081] iommufd_fops_ioctl+0x317/0x4b0
[ 54.777640][ T5081] ? iommufd_get_object.part.0+0x2b0/0x2b0
[ 54.783522][ T5081] ? lock_downgrade+0x690/0x690
[ 54.788404][ T5081] ? bpf_lsm_file_ioctl+0x9/0x10
[ 54.793407][ T5081] ? iommufd_get_object.part.0+0x2b0/0x2b0
[ 54.799263][ T5081] __x64_sys_ioctl+0x197/0x210
[ 54.804030][ T5081] do_syscall_64+0x39/0xb0
[ 54.808448][ T5081] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.814429][ T5081] RIP: 0033:0x7f6a1d59bc89
[ 54.818888][ T5081] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.838572][ T5081] RSP: 002b:00007ffe55301508 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 54.847045][ T5081] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6a1d59bc89
[ 54.855187][ T5081] RDX: 00000000200000c0 RSI: 0000000000003ba0 RDI: 0000000000000003
[ 54.863201][ T5081] RBP: 00007f6a1d55fe30 R08: 0000000000000000 R09: 0000000000000000
[ 54.871251][ T5081] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6a1d55fec0
[ 54.879376][ T5081] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 54.887379][ T5081]
[ 54.890467][ T5081] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 54.897765][ T5081] CPU: 0 PID: 5081 Comm: syz-executor226 Not tainted 6.3.0-rc4-next-20230331-syzkaller #0
[ 54.907662][ T5081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[ 54.917804][ T5081] Call Trace:
[ 54.921088][ T5081]
[ 54.924035][ T5081] dump_stack_lvl+0xd9/0x150
[ 54.928659][ T5081] panic+0x688/0x730
[ 54.932573][ T5081] ? panic_smp_self_stop+0x90/0x90
[ 54.937685][ T5081] ? show_trace_log_lvl+0x285/0x390
[ 54.942908][ T5081] ? iommufd_hw_pagetable_detach+0x2cb/0x480
[ 54.948886][ T5081] check_panic_on_warn+0xb1/0xc0
[ 54.953836][ T5081] __warn+0xf2/0x390
[ 54.957780][ T5081] ? iommufd_hw_pagetable_detach+0x2cb/0x480
[ 54.963783][ T5081] report_bug+0x2da/0x500
[ 54.968126][ T5081] handle_bug+0x3c/0x70
[ 54.972306][ T5081] exc_invalid_op+0x18/0x50
[ 54.976812][ T5081] asm_exc_invalid_op+0x1a/0x20
[ 54.981673][ T5081] RIP: 0010:iommufd_hw_pagetable_detach+0x2cb/0x480
[ 54.988271][ T5081] Code: f2 fc 49 8d 7d 70 be ff ff ff ff e8 cf 2f 76 05 31 ff 41 89 c5 89 c6 e8 63 6d f2 fc 45 85 ed 0f 85 ee fd ff ff e8 35 71 f2 fc <0f> 0b e9 e2 fd ff ff e8 29 71 f2 fc 49 8d bd a0 00 00 00 48 b8 00
[ 55.007882][ T5081] RSP: 0018:ffffc90003b0fb30 EFLAGS: 00010293
[ 55.013956][ T5081] RAX: 0000000000000000 RBX: ffff88801676da00 RCX: 0000000000000000
[ 55.021933][ T5081] RDX: ffff8880279c8000 RSI: ffffffff8490a01b RDI: 0000000000000005
[ 55.029908][ T5081] RBP: ffff88801676dab0 R08: 0000000000000005 R09: 0000000000000000
[ 55.037884][ T5081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801676dc00
[ 55.045859][ T5081] R13: 0000000000000000 R14: 0000000000000001 R15: ffff88801676dcc0
[ 55.055333][ T5081] ? iommufd_hw_pagetable_detach+0x2cb/0x480
[ 55.061362][ T5081] iommufd_hw_pagetable_alloc+0x646/0x800
[ 55.067104][ T5081] iommufd_device_change_pt+0x570/0xb30
[ 55.072675][ T5081] ? iommufd_hw_pagetable_attach+0x910/0x910
[ 55.078666][ T5081] ? iommufd_object_finalize+0x50/0x80
[ 55.084153][ T5081] ? iommufd_device_bind+0xa6/0xc70
[ 55.089359][ T5081] ? iommufd_access_create+0x2b0/0x2b0
[ 55.094830][ T5081] ? iommufd_device_attach+0xd0/0xd0
[ 55.100143][ T5081] iommufd_device_attach+0x27/0xd0
[ 55.105267][ T5081] iommufd_test+0x81c/0x2ef0
[ 55.109873][ T5081] ? lock_downgrade+0x690/0x690
[ 55.114741][ T5081] ? trace_lock_acquire+0x12d/0x180
[ 55.119949][ T5081] ? iommufd_selftest_destroy+0x190/0x190
[ 55.125735][ T5081] ? lock_acquire+0x32/0xc0
[ 55.130259][ T5081] iommufd_fops_ioctl+0x317/0x4b0
[ 55.135298][ T5081] ? iommufd_get_object.part.0+0x2b0/0x2b0
[ 55.141126][ T5081] ? lock_downgrade+0x690/0x690
[ 55.146011][ T5081] ? bpf_lsm_file_ioctl+0x9/0x10
[ 55.150960][ T5081] ? iommufd_get_object.part.0+0x2b0/0x2b0
[ 55.156781][ T5081] __x64_sys_ioctl+0x197/0x210
[ 55.161559][ T5081] do_syscall_64+0x39/0xb0
[ 55.166007][ T5081] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.171931][ T5081] RIP: 0033:0x7f6a1d59bc89
[ 55.176380][ T5081] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.196015][ T5081] RSP: 002b:00007ffe55301508 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 55.204442][ T5081] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6a1d59bc89
[ 55.212418][ T5081] RDX: 00000000200000c0 RSI: 0000000000003ba0 RDI: 0000000000000003
[ 55.220417][ T5081] RBP: 00007f6a1d55fe30 R08: 0000000000000000 R09: 0000000000000000
[ 55.228390][ T5081] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6a1d55fec0
[ 55.236365][ T5081] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 55.244387][ T5081]
[ 55.247846][ T5081] Kernel Offset: disabled
[ 55.252279][ T5081] Rebooting in 86400 seconds..