./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1367879227

<...>
Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts.
execve("./syz-executor1367879227", ["./syz-executor1367879227"], 0x7ffe69242cb0 /* 10 vars */) = 0
brk(NULL)                               = 0x55555b9f3000
brk(0x55555b9f3e00)                     = 0x55555b9f3e00
arch_prctl(ARCH_SET_FS, 0x55555b9f3480) = 0
set_tid_address(0x55555b9f3750)         = 5831
set_robust_list(0x55555b9f3760, 24)     = 0
rseq(0x55555b9f3da0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1367879227", 4096) = 28
getrandom("\xb2\x61\x50\xa4\x39\x20\x9f\xee", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55555b9f3e00
brk(0x55555ba14e00)                     = 0x55555ba14e00
brk(0x55555ba15000)                     = 0x55555ba15000
mprotect(0x7fd91e021000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3
close(3)                                = 0
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7fd91df7daa0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fd91df84c80}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7fd91df7daa0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fd91df84c80}, NULL, 8) = 0
mkdir("./syzkaller.SM23aL", 0700)       = 0
chmod("./syzkaller.SM23aL", 0777)       = 0
chdir("./syzkaller.SM23aL")             = 0
executing program
write(1, "executing program\n", 18)     = 18
openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 3
write(3, "4", 1)                        = 1
[   65.166039][ T5831] FAULT_INJECTION: forcing a failure.
[   65.166039][ T5831] name failslab, interval 1, probability 0, space 0, times 1
[   65.178803][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor136 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
[   65.178823][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   65.178832][ T5831] Call Trace:
[   65.178837][ T5831]  <TASK>
[   65.178841][ T5831]  dump_stack_lvl+0x241/0x360
[   65.178873][ T5831]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.178884][ T5831]  ? __pfx__printk+0x10/0x10
[   65.178901][ T5831]  ? kmem_cache_alloc_lru_noprof+0x4d/0x390
[   65.178913][ T5831]  ? __pfx___might_resched+0x10/0x10
[   65.178927][ T5831]  should_fail_ex+0x40a/0x550
[   65.178949][ T5831]  should_failslab+0xac/0x100
[   65.178965][ T5831]  ? __d_alloc+0x31/0x700
[   65.178976][ T5831]  kmem_cache_alloc_lru_noprof+0x75/0x390
[   65.178989][ T5831]  __d_alloc+0x31/0x700
[   65.179002][ T5831]  d_alloc_pseudo+0x1f/0xb0
[   65.179014][ T5831]  alloc_file_pseudo+0x123/0x290
[   65.179027][ T5831]  ? __pfx_alloc_file_pseudo+0x10/0x10
[   65.179039][ T5831]  ? _raw_spin_unlock+0x28/0x50
[   65.179055][ T5831]  ? alloc_fd+0x61a/0x690
[   65.179068][ T5831]  anon_inode_getfile_fmode+0xe4/0x1e0
[   65.179087][ T5831]  __se_sys_fanotify_init+0x7e9/0x970
[   65.179101][ T5831]  do_syscall_64+0xf3/0x230
[   65.179111][ T5831]  ? clear_bhb_loop+0x35/0x90
[   65.179127][ T5831]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.179140][ T5831] RIP: 0033:0x7fd91dfb5979
[   65.179154][ T5831] Code: d8 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   65.179166][ T5831] RSP: 002b:00007ffe042a9608 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
[   65.179178][ T5831] RAX: ffffffffffffffda RBX: 00007ffe042a9610 RCX: 00007fd91dfb5979
[   65.179186][ T5831] RDX: 00007fd91dfb4c50 RSI: 0000000000000000 RDI: 0000000000000008
[   65.179192][ T5831] RBP: 0000000000000001 R08: 00007ffe042a93a7 R09: 0000000000000034
[   65.179198][ T5831] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[   65.179205][ T5831] R13: 00007ffe042a9888 R14: 0000000000000001 R15: 0000000000000001
[   65.179218][ T5831]  </TASK>
[   65.179230][ T5831] ==================================================================
[   65.388190][ T5831] BUG: KASAN: use-after-free in __put_unused_fd+0xdb/0x2a0
[   65.395371][ T5831] Write of size 8 at addr ffff888048091f08 by task syz-executor136/5831
[   65.403669][ T5831] 
[   65.405973][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor136 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
[   65.405986][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   65.405992][ T5831] Call Trace:
[   65.405998][ T5831]  <TASK>
[   65.406003][ T5831]  dump_stack_lvl+0x241/0x360
[   65.406017][ T5831]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.406027][ T5831]  ? __pfx__printk+0x10/0x10
[   65.406043][ T5831]  ? _printk+0xd5/0x120
[   65.406057][ T5831]  ? __virt_addr_valid+0x183/0x530
[   65.406071][ T5831]  ? __virt_addr_valid+0x183/0x530
[   65.406085][ T5831]  print_report+0x169/0x550
[   65.406100][ T5831]  ? __virt_addr_valid+0x183/0x530
[   65.406114][ T5831]  ? __virt_addr_valid+0x183/0x530
[   65.406127][ T5831]  ? __virt_addr_valid+0x45f/0x530
[   65.406140][ T5831]  ? __phys_addr+0xba/0x170
[   65.406154][ T5831]  ? __put_unused_fd+0xdb/0x2a0
[   65.406162][ T5831]  kasan_report+0x143/0x180
[   65.406177][ T5831]  ? __put_unused_fd+0xdb/0x2a0
[   65.406187][ T5831]  kasan_check_range+0x282/0x290
[   65.406202][ T5831]  __put_unused_fd+0xdb/0x2a0
[   65.406212][ T5831]  put_unused_fd+0x5c/0x70
[   65.406221][ T5831]  __se_sys_fanotify_init+0x800/0x970
[   65.406235][ T5831]  do_syscall_64+0xf3/0x230
[   65.406246][ T5831]  ? clear_bhb_loop+0x35/0x90
[   65.406260][ T5831]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.406274][ T5831] RIP: 0033:0x7fd91dfb5979
[   65.406284][ T5831] Code: d8 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   65.406292][ T5831] RSP: 002b:00007ffe042a9608 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
[   65.406304][ T5831] RAX: ffffffffffffffda RBX: 00007ffe042a9610 RCX: 00007fd91dfb5979
[   65.406312][ T5831] RDX: 00007fd91dfb4c50 RSI: 0000000000000000 RDI: 0000000000000008
[   65.406318][ T5831] RBP: 0000000000000001 R08: 00007ffe042a93a7 R09: 0000000000000034
[   65.406325][ T5831] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[   65.406331][ T5831] R13: 00007ffe042a9888 R14: 0000000000000001 R15: 0000000000000001
[   65.406340][ T5831]  </TASK>
[   65.406344][ T5831] 
[   65.611648][ T5831] The buggy address belongs to the physical page:
[   65.618050][ T5831] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x48091
[   65.626793][ T5831] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   65.633901][ T5831] raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
[   65.642499][ T5831] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   65.651066][ T5831] page dumped because: kasan: bad access detected
[   65.657511][ T5831] page_owner tracks the page as freed
[   65.662874][ T5831] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xcc0(GFP_KERNEL), pid 1, tgid 1 (swapper/0), ts 15877461181, free_ts 16327124136
[   65.677876][ T5831]  post_alloc_hook+0x1f4/0x240
[   65.682633][ T5831]  split_free_pages+0xe1/0x2d0
[   65.687386][ T5831]  alloc_contig_range_noprof+0x10eb/0x1770
[   65.693179][ T5831]  alloc_contig_pages_noprof+0x4b3/0x5c0
[   65.698815][ T5831]  debug_vm_pgtable_alloc_huge_page+0xaf/0x100
[   65.704954][ T5831]  init_args+0x83b/0xb20
[   65.709177][ T5831]  debug_vm_pgtable+0xe0/0x550
[   65.713920][ T5831]  do_one_initcall+0x248/0x870
[   65.718661][ T5831]  do_initcall_level+0x157/0x210
[   65.723583][ T5831]  do_initcalls+0x3f/0x80
[   65.727893][ T5831]  kernel_init_freeable+0x435/0x5d0
[   65.733069][ T5831]  kernel_init+0x1d/0x2b0
[   65.737379][ T5831]  ret_from_fork+0x4b/0x80
[   65.741782][ T5831]  ret_from_fork_asm+0x1a/0x30
[   65.746523][ T5831] page last free pid 1 tgid 1 stack trace:
[   65.752306][ T5831]  free_frozen_pages+0xe0d/0x10e0
[   65.757307][ T5831]  free_contig_range+0x14c/0x430
[   65.762226][ T5831]  destroy_args+0x92/0x910
[   65.766622][ T5831]  debug_vm_pgtable+0x4be/0x550
[   65.771451][ T5831]  do_one_initcall+0x248/0x870
[   65.776189][ T5831]  do_initcall_level+0x157/0x210
[   65.781105][ T5831]  do_initcalls+0x3f/0x80
[   65.785412][ T5831]  kernel_init_freeable+0x435/0x5d0
[   65.790589][ T5831]  kernel_init+0x1d/0x2b0
[   65.794895][ T5831]  ret_from_fork+0x4b/0x80
[   65.799292][ T5831]  ret_from_fork_asm+0x1a/0x30
[   65.804038][ T5831] 
[   65.806340][ T5831] Memory state around the buggy address:
[   65.811948][ T5831]  ffff888048091e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.819982][ T5831]  ffff888048091e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.828015][ T5831] >ffff888048091f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.836051][ T5831]                       ^
[   65.840354][ T5831]  ffff888048091f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.848386][ T5831]  ffff888048092000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   65.856768][ T5831] ==================================================================
[   65.864957][ T5831] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   65.872156][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor136 Not tainted 6.13.0-rc3-next-20241220-syzkaller #0
[   65.882755][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   65.892804][ T5831] Call Trace:
[   65.896076][ T5831]  <TASK>
[   65.899000][ T5831]  dump_stack_lvl+0x241/0x360
[   65.903685][ T5831]  ? __pfx_dump_stack_lvl+0x10/0x10
[   65.908883][ T5831]  ? __pfx__printk+0x10/0x10
[   65.913472][ T5831]  ? lock_release+0xbf/0xa30
[   65.918068][ T5831]  ? vscnprintf+0x5d/0x90
[   65.922397][ T5831]  panic+0x349/0x880
[   65.926302][ T5831]  ? check_panic_on_warn+0x21/0xb0
[   65.931415][ T5831]  ? __pfx_panic+0x10/0x10
[   65.935828][ T5831]  ? mark_lock+0x9a/0x360
[   65.940153][ T5831]  ? _raw_spin_unlock_irqrestore+0xd8/0x140
[   65.946044][ T5831]  ? _raw_spin_unlock_irqrestore+0xdd/0x140
[   65.951946][ T5831]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   65.958305][ T5831]  ? print_report+0x502/0x550
[   65.962992][ T5831]  check_panic_on_warn+0x86/0xb0
[   65.967930][ T5831]  ? __put_unused_fd+0xdb/0x2a0
[   65.972777][ T5831]  end_report+0x77/0x160
[   65.977016][ T5831]  kasan_report+0x154/0x180
[   65.981516][ T5831]  ? __put_unused_fd+0xdb/0x2a0
[   65.986359][ T5831]  kasan_check_range+0x282/0x290
[   65.991295][ T5831]  __put_unused_fd+0xdb/0x2a0
[   65.995962][ T5831]  put_unused_fd+0x5c/0x70
[   66.000365][ T5831]  __se_sys_fanotify_init+0x800/0x970
[   66.005731][ T5831]  do_syscall_64+0xf3/0x230
[   66.010225][ T5831]  ? clear_bhb_loop+0x35/0x90
[   66.014898][ T5831]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.020784][ T5831] RIP: 0033:0x7fd91dfb5979
[   66.025189][ T5831] Code: d8 5b c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   66.044785][ T5831] RSP: 002b:00007ffe042a9608 EFLAGS: 00000246 ORIG_RAX: 000000000000012c
[   66.053192][ T5831] RAX: ffffffffffffffda RBX: 00007ffe042a9610 RCX: 00007fd91dfb5979
[   66.061160][ T5831] RDX: 00007fd91dfb4c50 RSI: 0000000000000000 RDI: 0000000000000008
[   66.069121][ T5831] RBP: 0000000000000001 R08: 00007ffe042a93a7 R09: 0000000000000034
[   66.077083][ T5831] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
[   66.085048][ T5831] R13: 00007ffe042a9888 R14: 0000000000000001 R15: 0000000000000001
[   66.093014][ T5831]  </TASK>
[   66.096276][ T5831] Kernel Offset: disabled
[   66.100675][ T5831] Rebooting in 86400 seconds..