kernel warning in statcheck

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: c5f7000db927 Print backtraces when we do a warn()
git tree: https://github.com/akaros/akaros.git/master
console output: https://syzkaller.appspot.com/x/log.txt?x=1023b368400000
kernel config: https://syzkaller.appspot.com/x/.config?x=efef8cf2939304d3
dashboard link: https://syzkaller.appspot.com/bug?extid=0068960e94fbc67ffab4
compiler:

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+006896...@syzkaller.appspotmail.com

kernel warning at kern/src/ns/convM2D.c:52, from core 3: nbuf 158,
STAT_FIX_LEN_9P 49 BIT16SZ 2, GBIT16(buf) 0
Stack Backtrace on Core 3:
#01 [<0xffffffffc200a2dc>] in backtrace at src/kdebug.c:220
#02 [<0xffffffffc2009b94>] in _warn at src/init.c:323
#03 [<0xffffffffc2034c5d>] in statcheck at src/ns/convM2D.c:51
#04 [<0xffffffffc203df08>] in validstat at src/ns/sysfile.c:961
#05 [<0xffffffffc203ef6e>] in sysfwstat at src/ns/sysfile.c:421
#06 [<0xffffffffc2055cc0>] in sys_fwstat at src/syscall.c:2337
#07 [<0xffffffffc2059459>] in syscall at src/syscall.c:2528
#08 [<0xffffffffc2059624>] in run_local_syscall at src/syscall.c:2563
#09 [<0xffffffffc2059b59>] in prep_syscalls at src/syscall.c:2583
#10 [<0xffffffffc20ab41a>] in sysenter_callwrapper at arch/x86/trap.c:854
10:07:50 executing program 7:
r0 = openat$dev_urandom(0xffffffffffffff9c,
&(0x7f0000000080)='/dev/urandom\x00', 0xd, 0x1, 0x0)
tcgetattr(r0, &(0x7f0000000040))
10:07:50 executing program 0:
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0)
openat$net_ndb(0xffffffffffffff9c, &(0x7f0000000140)='/net/ndb\x00', 0x9,
0x3, 0x0)
10:07:50 executing program 5:
r0 = openat$net_tcp_1_local(0xffffffffffffff9c,
&(0x7f0000000080)='/net/tcp/1/local\x00', 0x11, 0x1, 0x0)
fd2path(r0, &(0x7f0000000040)=""/8, 0x8)
kernel warning at kern/src/ns/convM2D.c:52, from core 1: nbuf 158,
STAT_FIX_LEN_9P 49 BIT16SZ 2, GBIT16(buf) 0
Stack Backtrace on Core 1:
#01 [<0xffffffffc200a2dc>] in backtrace at src/kdebug.c:220
#02 [<0xffffffffc2009b94>] in _warn at src/init.c:323
#03 [<0xffffffffc2034c5d>] in statcheck at src/ns/convM2D.c:51
#04 [<0xffffffffc203df08>] in validstat at src/ns/sysfile.c:961
#05 [<0xffffffffc203ef6e>] in sysfwstat at src/ns/sysfile.c:421
#06 [<0xffffffffc2055cc0>] in sys_fwstat at src/syscall.c:2337
#07 [<0xffffffffc2059459>] in syscall at src/syscall.c:2528
#08 [<0xffffffffc2059624>] in run_local_syscall at src/syscall.c:2563
#09 [<0xffffffffc2059b59>] in prep_syscalls at src/syscall.c:2583
#10 [<0xffffffffc20ab41a>] in sysenter_callwrapper at arch/x86/trap.c:854
10:07:51 executing program 1:
fwstat(0xffffffffffffffff, &(0x7f00000000c0)=""/158, 0x9e, 0x0)
10:07:51 executing program 3:
r0 = openat$net_tcp_1_err(0xffffffffffffff9c,
&(0x7f0000000180)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
fd2path(r0, &(0x7f0000000540)=""/184, 0xb8)
10:07:51 executing program 2:
r0 = openat$proc_self_vmstatus(0xffffffffffffff9c,
&(0x7f0000000080)='/proc/self/vmstatus\x00', 0x14, 0x1, 0x0)
openat(r0, &(0x7f0000000a40)='./file0\x00', 0x8, 0x81042, 0x0)
10:07:51 executing program 6:
r0 = openat$proc_self_notepg(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/notepg\x00', 0x5, 0x1, 0x0)
read(r0, &(0x7f0000000080)=""/4096, 0x1000)
10:07:51 executing program 4:
r0 = openat$prof_kpdata(0xffffffffffffff9c,
&(0x7f0000000000)='/prof/kpdata\x00', 0xd, 0x3, 0x0)
fstat(r0, &(0x7f0000000080))
10:07:51 executing program 0:
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0)
openat$net_ndb(0xffffffffffffff9c, &(0x7f0000000140)='/net/ndb\x00', 0x9,
0x3, 0x0)
10:07:51 executing program 7:
r0 = openat$dev_urandom(0xffffffffffffff9c,
&(0x7f0000000080)='/dev/urandom\x00', 0xd, 0x1, 0x0)
tcgetattr(r0, &(0x7f0000000040))
10:07:51 executing program 5:
r0 = openat$net_tcp_1_local(0xffffffffffffff9c,
&(0x7f0000000080)='/net/tcp/1/local\x00', 0x11, 0x1, 0x0)
fd2path(r0, &(0x7f0000000040)=""/8, 0x8)
10:07:51 executing program 3:
r0 = openat$net_tcp_1_err(0xffffffffffffff9c,
&(0x7f0000000180)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
fd2path(r0, &(0x7f0000000540)=""/184, 0xb8)
kernel warning at kern/src/ns/convM2D.c:52, from core 3: nbuf 158,
STAT_FIX_LEN_9P 49 BIT16SZ 2, GBIT16(buf) 0
Stack Backtrace on Core 3:
#01 [<0xffffffffc200a2dc>] in backtrace at src/kdebug.c:220
#02 [<0xffffffffc2009b94>] in _warn at src/init.c:323
#03 [<0xffffffffc2034c5d>] in statcheck at src/ns/convM2D.c:51
#04 [<0xffffffffc203df08>] in validstat at src/ns/sysfile.c:961
#05 [<0xffffffffc203ef6e>] in sysfwstat at src/ns/sysfile.c:421
#06 [<0xffffffffc2055cc0>] in sys_fwstat at src/syscall.c:2337
#07 [<0xffffffffc2059459>] in syscall at src/syscall.c:2528
#08 [<0xffffffffc2059624>] in run_local_syscall at src/syscall.c:2563
#09 [<0xffffffffc2059b59>] in prep_syscalls at src/syscall.c:2583
#10 [<0xffffffffc20ab41a>] in sysenter_callwrapper at arch/x86/trap.c:854
10:07:53 executing program 1:
fwstat(0xffffffffffffffff, &(0x7f00000000c0)=""/158, 0x9e, 0x0)
10:07:53 executing program 2:
r0 = openat$proc_self_vmstatus(0xffffffffffffff9c,
&(0x7f0000000080)='/proc/self/vmstatus\x00', 0x14, 0x1, 0x0)
openat(r0, &(0x7f0000000a40)='./file0\x00', 0x8, 0x81042, 0x0)
10:07:53 executing program 0:
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0)
openat$net_ndb(0xffffffffffffff9c, &(0x7f0000000140)='/net/ndb\x00', 0x9,
0x3, 0x0)
10:07:53 executing program 7:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000380)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:53 executing program 5:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:53 executing program 6:
r0 = openat$proc_self_notepg(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/notepg\x00', 0x5, 0x1, 0x0)
read(r0, &(0x7f0000000080)=""/4096, 0x1000)
10:07:53 executing program 4:
r0 = openat$proc_self_wait(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/wait\x00', 0x10, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0)
10:07:53 executing program 3:
r0 = openat$net_tcp_1_err(0xffffffffffffff9c,
&(0x7f0000000180)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
fd2path(r0, &(0x7f0000000540)=""/184, 0xb8)
10:07:54 executing program 4:
r0 = openat$proc_self_wait(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/wait\x00', 0x10, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0)
kernel warning at kern/src/ns/convM2D.c:52, from core 2: nbuf 158,
STAT_FIX_LEN_9P 49 BIT16SZ 2, GBIT16(buf) 0
10:07:54 executing program 0:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c,
&(0x7f0000000240)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:54 executing program 7:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000380)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:54 executing program 5:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:54 executing program 6:
r0 = openat$proc_self_notepg(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/notepg\x00', 0x5, 0x1, 0x0)
read(r0, &(0x7f0000000080)=""/4096, 0x1000)
Stack Backtrace on Core 2:
10:07:54 executing program 2:
r0 = openat$proc_self_vmstatus(0xffffffffffffff9c,
&(0x7f0000000080)='/proc/self/vmstatus\x00', 0x14, 0x1, 0x0)
openat(r0, &(0x7f0000000a40)='./file0\x00', 0x8, 0x81042, 0x0)
#01 [<0xffffffffc200a2dc>] in backtrace at src/kdebug.c:220
#02 [<0xffffffffc2009b94>] in _warn at src/init.c:323
#03 [<0xffffffffc2034c5d>] in statcheck at src/ns/convM2D.c:51
#04 [<0xffffffffc203df08>] in validstat at src/ns/sysfile.c:961
#05 [<0xffffffffc203ef6e>] in sysfwstat at src/ns/sysfile.c:421
#06 [<0xffffffffc2055cc0>] in sys_fwstat at src/syscall.c:2337
#07 [<0xffffffffc2059459>] in syscall at src/syscall.c:2528
#08 [<0xffffffffc2059624>] in run_local_syscall at src/syscall.c:2563
#09 [<0xffffffffc2059b59>] in prep_syscalls at src/syscall.c:2583
#10 [<0xffffffffc20ab41a>] in sysenter_callwrapper at arch/x86/trap.c:854
10:07:55 executing program 1:
fwstat(0xffffffffffffffff, &(0x7f00000000c0)=""/158, 0x9e, 0x0)
10:07:55 executing program 3:
r0 = openat$net_tcp_1_err(0xffffffffffffff9c,
&(0x7f0000000180)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
fd2path(r0, &(0x7f0000000540)=""/184, 0xb8)
10:07:55 executing program 7:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000380)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:55 executing program 5:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:55 executing program 6:
r0 = openat$proc_self_notepg(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/notepg\x00', 0x5, 0x1, 0x0)
read(r0, &(0x7f0000000080)=""/4096, 0x1000)
10:07:55 executing program 4:
r0 = openat$proc_self_wait(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/wait\x00', 0x10, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0)
10:07:55 executing program 2:
r0 = openat$proc_self_vmstatus(0xffffffffffffff9c,
&(0x7f0000000080)='/proc/self/vmstatus\x00', 0x14, 0x1, 0x0)
openat(r0, &(0x7f0000000a40)='./file0\x00', 0x8, 0x81042, 0x0)
10:07:55 executing program 0:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c,
&(0x7f0000000240)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:55 executing program 3:
r0 = openat$net_ether0_stats(0xffffffffffffff9c,
&(0x7f00000001c0)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
abort_sysc_fd(r0)
10:07:55 executing program 7:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000380)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:56 executing program 4:
r0 = openat$proc_self_wait(0xffffffffffffff9c,
&(0x7f0000000040)='/proc/self/wait\x00', 0x10, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f00000000c0), 0x0)
10:07:56 executing program 0:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c,
&(0x7f0000000240)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:56 executing program 2:
openat$proc_self_text(0xffffffffffffff9c,
&(0x7f0000000140)='/proc/self/text\x00', 0xfffffffffffffe78, 0x1, 0x0)
10:07:56 executing program 5:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:56 executing program 6:
openat$dev_caphash(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/caphash\x00', 0x4, 0x3, 0x0)
kernel warning at kern/src/ns/convM2D.c:52, from core 3: nbuf 158,
STAT_FIX_LEN_9P 49 BIT16SZ 2, GBIT16(buf) 0
Stack Backtrace on Core 3:
#01 [<0xffffffffc200a2dc>] in backtrace at src/kdebug.c:220
#02 [<0xffffffffc2009b94>] in _warn at src/init.c:323
#03 [<0xffffffffc2034c5d>] in statcheck at src/ns/convM2D.c:51
#04 [<0xffffffffc203df08>] in validstat at src/ns/sysfile.c:961
#05 [<0xffffffffc203ef6e>] in sysfwstat at src/ns/sysfile.c:421
#06 [<0xffffffffc2055cc0>] in sys_fwstat at src/syscall.c:2337
#07 [<0xffffffffc2059459>] in syscall at src/syscall.c:2528
#08 [<0xffffffffc2059624>] in run_local_syscall at src/syscall.c:2563
#09 [<0xffffffffc2059b59>] in prep_syscalls at src/syscall.c:2583
#10 [<0xffffffffc20ab41a>] in sysenter_callwrapper at arch/x86/trap.c:854
10:07:57 executing program 1:
openat$prof_mpstat(0xffffffffffffff9c,
&(0x7f00000003c0)='/prof/mpstat\x00', 0x1, 0x3, 0x0)
10:07:57 executing program 3:
r0 = openat$net_ether0_stats(0xffffffffffffff9c,
&(0x7f00000001c0)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
abort_sysc_fd(r0)
10:07:57 executing program 0:
r0 = openat$net_ipifc_0_snoop(0xffffffffffffff9c,
&(0x7f0000000240)='/net/ipifc/0/snoop\x00', 0x13, 0x1, 0x0)
close(r0)
10:07:57 executing program 7:
r0 = openat$net_ether0_2_data(0xffffffffffffff9c,
&(0x7f0000000080)='/net/ether0/2/data\x00', 0x21e, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:57 executing program 2:
openat$proc_self_text(0xffffffffffffff9c,
&(0x7f0000000140)='/proc/self/text\x00', 0xfffffffffffffe78, 0x1, 0x0)
10:07:57 executing program 6:
openat$dev_caphash(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/caphash\x00', 0x4, 0x3, 0x0)
10:07:57 executing program 5:
r0 = openat$net_ipifc_1_data(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ipifc/1/data\x00', 0x12, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:57 executing program 4:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fd2path(r0, &(0x7f0000000200)=""/165, 0xa5)
10:07:57 executing program 1:
openat$prof_mpstat(0xffffffffffffff9c,
&(0x7f00000003c0)='/prof/mpstat\x00', 0x1, 0x3, 0x0)
10:07:57 executing program 2:
openat$proc_self_text(0xffffffffffffff9c,
&(0x7f0000000140)='/proc/self/text\x00', 0xfffffffffffffe78, 0x1, 0x0)
10:07:57 executing program 3:
r0 = openat$net_ether0_stats(0xffffffffffffff9c,
&(0x7f00000001c0)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
abort_sysc_fd(r0)
10:07:57 executing program 0:
r0 = openat$net_icmpv6_stats(0xffffffffffffff9c,
&(0x7f0000000080)='/net/icmpv6/stats\x00', 0x12, 0x1, 0x0)
fstat(r0, &(0x7f0000000400))
10:07:57 executing program 6:
openat$dev_caphash(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/caphash\x00', 0x4, 0x3, 0x0)
10:07:57 executing program 7:
r0 = openat$net_ether0_2_data(0xffffffffffffff9c,
&(0x7f0000000080)='/net/ether0/2/data\x00', 0x21e, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:57 executing program 5:
r0 = openat$net_ipifc_1_data(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ipifc/1/data\x00', 0x12, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:57 executing program 4:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fd2path(r0, &(0x7f0000000200)=""/165, 0xa5)
10:07:57 executing program 3:
r0 = openat$net_ether0_stats(0xffffffffffffff9c,
&(0x7f00000001c0)='/net/ether0/stats\x00', 0x12, 0x1, 0x0)
abort_sysc_fd(r0)
10:07:57 executing program 1:
openat$prof_mpstat(0xffffffffffffff9c,
&(0x7f00000003c0)='/prof/mpstat\x00', 0x1, 0x3, 0x0)
10:07:57 executing program 2:
openat$proc_self_text(0xffffffffffffff9c,
&(0x7f0000000140)='/proc/self/text\x00', 0xfffffffffffffe78, 0x1, 0x0)
10:07:57 executing program 6:
openat$dev_caphash(0xffffffffffffff9c,
&(0x7f0000000000)='/dev/caphash\x00', 0x4, 0x3, 0x0)
10:07:58 executing program 0:
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0)
openat$net_udp_0_listen(0xffffffffffffff9c,
&(0x7f0000001340)='/net/udp/0/listen\x00', 0x12, 0x3, 0x0)
10:07:58 executing program 5:
r0 = openat$net_ipifc_1_data(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ipifc/1/data\x00', 0x12, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 4:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fd2path(r0, &(0x7f0000000200)=""/165, 0xa5)
10:07:58 executing program 7:
r0 = openat$net_ether0_2_data(0xffffffffffffff9c,
&(0x7f0000000080)='/net/ether0/2/data\x00', 0x21e, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:58 executing program 6:
r0 = openat$dev_config(0xffffffffffffff9c,
&(0x7f0000000340)='/dev/config\x00', 0xc, 0x1, 0x0)
fstat(r0, &(0x7f0000000040))
10:07:58 executing program 1:
openat$prof_mpstat(0xffffffffffffff9c,
&(0x7f00000003c0)='/prof/mpstat\x00', 0x1, 0x3, 0x0)
10:07:58 executing program 2:
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000004, 0x8832,
0xffffffffffffff9c, 0x0)
openat$net_arp(0xffffffffffffff9c, &(0x7f0000000080)='/net/arp\x00', 0x9,
0x3, 0x0)
10:07:58 executing program 3:
openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000040)='/prof/kpctl\x00',
0x2, 0x3, 0x0)
10:07:58 executing program 5:
r0 = openat$net_ipifc_1_data(0xffffffffffffff9c,
&(0x7f0000000000)='/net/ipifc/1/data\x00', 0x12, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 4:
r0 = openat$net_ipifc_1_err(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ipifc/1/err\x00', 0x11, 0x3, 0x0)
fd2path(r0, &(0x7f0000000200)=""/165, 0xa5)
10:07:58 executing program 7:
r0 = openat$net_ether0_2_data(0xffffffffffffff9c,
&(0x7f0000000080)='/net/ether0/2/data\x00', 0x21e, 0x3, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:58 executing program 0:
openat$net_ether0_2_data(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ether0/2/data\x00', 0xe, 0x3, 0x0)
10:07:58 executing program 1:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
read(r0, &(0x7f0000000100)=""/178, 0xb2)
10:07:58 executing program 3:
openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000040)='/prof/kpctl\x00',
0x2, 0x3, 0x0)
10:07:58 executing program 2:
r0 = openat$net_udp_0_local(0xffffffffffffff9c,
&(0x7f0000000100)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
fd2path(r0, &(0x7f0000000140)=""/62, 0x3e)
10:07:58 executing program 6:
r0 = openat$net_udp_0_local(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/udp/0/local\x00', 0x11, 0x1, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 5:
r0 = openat$prof_kptrace(0xffffffffffffff9c,
&(0x7f0000000000)='/prof/kptrace\x00', 0xe, 0x3, 0x0)
abort_sysc_fd(r0)
10:07:58 executing program 4:
r0 = openat$net_tcp_0_local(0xffffffffffffff9c,
&(0x7f0000000000)='/net/tcp/0/local\x00', 0x11, 0x1, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 0:
waitpid(0xffffffffffffffff, &(0x7f0000000040), 0x2)
10:07:58 executing program 7:
proc_create(&(0x7f0000000000)='./file0\x00', 0x8, &(0x7f00000000c0), 0x0,
0x0)
10:07:58 executing program 3:
openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000040)='/prof/kpctl\x00',
0x2, 0x3, 0x0)
10:07:58 executing program 2:
r0 = openat$net_tcp_2_remote(0xffffffffffffff9c,
&(0x7f0000000000)='/net/tcp/2/remote\x00', 0x12, 0x1, 0x0)
close(r0)
10:07:58 executing program 1:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
read(r0, &(0x7f0000000100)=""/178, 0xb2)
10:07:58 executing program 5:
r0 = openat$dev_zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00',
0xa, 0x1, 0x0)
close(r0)
openat$net_udp_0_data(0xffffffffffffff9c,
&(0x7f0000000180)='/net/udp/0/data\x00', 0x9c, 0x3, 0x0)
write(r0, &(0x7f0000000080), 0x0)
10:07:58 executing program 6:
r0 = openat$dev_stdout(0xffffffffffffff9c,
&(0x7f00000000c0)='/dev/stdout\x00', 0xc, 0x3, 0x0)
tcgetattr(r0, &(0x7f0000000100))
10:07:58 executing program 4:
r0 = openat$net_tcp_2_data(0xffffffffffffff9c,
&(0x7f0000000080)='/net/tcp/2/data\x00', 0x10, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 0:
r0 = openat$net_tcp_1_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/tcp/1/ctl\x00', 0x18b, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 7:
r0 = openat$net_tcp_1_data(0xffffffffffffff9c,
&(0x7f0000000380)='/net/tcp/1/data\x00', 0x10, 0x3, 0x0)
openat$dev_urandom(0xffffffffffffff9c,
&(0x7f0000000040)='/dev/urandom\x00', 0xd, 0x1, 0x0)
write(r0, &(0x7f00000000c0), 0x0)
llseek(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x0)
fcntl$F_GETFD(0xffffffffffffffff, 0x1)
10:07:58 executing program 3:
openat$prof_kpctl(0xffffffffffffff9c, &(0x7f0000000040)='/prof/kpctl\x00',
0x2, 0x3, 0x0)
10:07:58 executing program 2:
r0 = openat$net_ether0_0_ifstats(0xffffffffffffff9c,
&(0x7f0000000300)='/net/ether0/0/ifstats\x00', 0x16, 0x1, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x2d132, r0, 0x0)
10:07:58 executing program 5:
r0 = openat$net_tcp_stats(0xffffffffffffff9c,
&(0x7f0000000300)='/net/tcp/stats\x00', 0xf, 0x1, 0x0)
fcntl$F_GETFL(r0, 0x3)
10:07:58 executing program 1:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
read(r0, &(0x7f0000000100)=""/178, 0xb2)
10:07:58 executing program 6:
r0 = proc_create(&(0x7f0000000000)='./file0\x00', 0x8,
&(0x7f0000000040)='!\x00', 0x2, 0x0)
waitpid(r0, &(0x7f0000000080), 0x2)
r1 = openat$net_ipifc_1_remote(0xffffffffffffff9c,
&(0x7f00000000c0)='/net/ipifc/1/remote\x00', 0x14, 0x1, 0x0)
r2 = openat$net_ipifc_0_listen(0xffffffffffffff9c,
&(0x7f0000000100)='/net/ipifc/0/listen\x00', 0x14, 0x3, 0x0)
r3 = proc_create(&(0x7f0000000140)='./file0\x00', 0x8,
&(0x7f0000000180)='\'\x00', 0x2, 0x1)
nbind(&(0x7f00000001c0)='./file0\x00', 0x8,
&(0x7f0000000200)='./file0\x00', 0x8, 0x7)
waitpid(r3, &(0x7f0000000240), 0x3)
close(r1)
tcgetattr(r1, &(0x7f0000000280))
nunmount(&(0x7f00000002c0)='./file0\x00', 0x8,
&(0x7f0000000300)='./file0\x00', 0x8)
openat$dev_empty(0xffffffffffffff9c, &(0x7f0000000340)='/dev/.empty\x00',
0xc, 0x3, 0x0)
proc_create(&(0x7f0000000380)='./file0\x00', 0x8,
&(0x7f00000003c0)='---\x00', 0x4, 0x0)
openat(r2, &(0x7f0000000400)='./file0\x00', 0x8, 0x403, 0x10)
fcntl$F_SYNC(r1, 0x65)
openat$prof_empty(0xffffffffffffff9c, &(0x7f0000000440)='/prof/.empty\x00',
0xd, 0x3, 0x0)
openat$net_tcp_1_local(0xffffffffffffff9c,
&(0x7f0000000480)='/net/tcp/1/local\x00', 0x11, 0x1, 0x0)
openat$net_tcp_2_ctl(0xffffffffffffff9c,
&(0x7f00000004c0)='/net/tcp/2/ctl\x00', 0xf, 0x3, 0x0)
proc_create(&(0x7f0000000500)='./file0\x00', 0x8,
&(0x7f0000000540)='/dev/.empty\x00', 0xc, 0x1)
provision(r3, 0x0, 0x7ff)
rename(&(0x7f0000000580)='./file0\x00', 0x8,
&(0x7f00000005c0)='./file0\x00', 0x8)
openat$net_tcp_0_local(0xffffffffffffff9c,
&(0x7f0000000600)='/net/tcp/0/local\x00', 0x11, 0x1, 0x0)
openat$dev_consctl(0xffffffffffffff9c,
&(0x7f0000000640)='/dev/consctl\x00', 0xd, 0x3, 0x0)
openat$dev_kmesg(0xffffffffffffff9c, &(0x7f0000000680)='/dev/kmesg\x00',
0xb, 0x1, 0x0)
openat$dev_caphash(0xffffffffffffff9c,
&(0x7f00000006c0)='/dev/caphash\x00', 0xd, 0x3, 0x0)
openat$dev_pid(0xffffffffffffff9c, &(0x7f0000000700)='/dev/pid\x00', 0x9,
0x1, 0x0)
openat$prof_kpdata(0xffffffffffffff9c,
&(0x7f0000000740)='/prof/kpdata\x00', 0xd, 0x3, 0x0)
openat$dev_null(0xffffffffffffff9c, &(0x7f0000000780)='/dev/null\x00', 0xa,
0x1, 0x0)
proc_create(&(0x7f00000007c0)='./file1\x00', 0x8,
&(0x7f0000000800)='---\x00', 0x4, 0x0)
openat$net_ipifc_0_data(0xffffffffffffff9c,
&(0x7f0000000840)='/net/ipifc/0/data\x00', 0x12, 0x3, 0x0)
openat$dev_capuse(0xffffffffffffff9c, &(0x7f0000000880)='/dev/capuse\x00',
0xc, 0x3, 0x0)
10:07:58 executing program 4:
mmap(&(0x7f000054b000/0x2000)=nil, 0x2000, 0x3, 0x8000002035,
0xffffffffffffffff, 0x0)
10:07:58 executing program 0:
r0 = openat$net_tcp_1_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/tcp/1/ctl\x00', 0x18b, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 2:
r0 = openat$net_tcp_clone(0xffffffffffffff9c,
&(0x7f0000000000)='/net/tcp/clone\x00', 0xf, 0x3, 0x0)
fcntl$F_DUPFD(r0, 0x0, r0, 0x0)
10:07:58 executing program 3:
r0 = openat$proc_self_fd(0xffffffffffffff9c,
&(0x7f00000000c0)='/proc/self/fd\x00', 0xe, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000140), 0x0)
10:07:58 executing program 7:
r0 = openat$net_ipifc_0_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/0/ctl\x00', 0x11, 0x3, 0x0)
fstat(r0, &(0x7f00000000c0))
10:07:58 executing program 5:
r0 = openat$net_ether0_0_stats(0xffffffffffffff9c,
&(0x7f0000000080)='/net/ether0/0/stats\x00', 0x14, 0x1, 0x0)
llseek(r0, 0x0, 0x0, &(0x7f0000000100), 0x0)
10:07:58 executing program 4:
r0 = openat$net_tcp_1_err(0xffffffffffffff9c,
&(0x7f0000000000)='/net/tcp/1/err\x00', 0xf, 0x3, 0x0)
fcntl$F_SYNC(r0, 0x65)
openat$net_ipifc_1_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ipifc/1/ctl\x00', 0x11, 0x3, 0x0)
r1 = openat$prof_empty(0xffffffffffffff9c,
&(0x7f0000000080)='/prof/.empty\x00', 0xd, 0x3, 0x0)
openat$dev_hostdomain(0xffffffffffffff9c,
&(0x7f00000000c0)='/dev/hostdomain\x00', 0x10, 0x3, 0x0)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x9)
10:07:58 executing program 0:
r0 = openat$net_tcp_1_ctl(0xffffffffffffff9c,
&(0x7f0000000040)='/net/tcp/1/ctl\x00', 0x18b, 0x3, 0x0)
fcntl$F_GETFD(r0, 0x1)
10:07:58 executing program 1:
r0 = openat$net_ether0_1_type(0xffffffffffffff9c,
&(0x7f0000000040)='/net/ether0/1/type\x00', 0x13, 0x1, 0x0)
read(r0, &(0x7f0000000100)=""/178, 0xb2)
Which cores are provisioned to which procs:
------------------
10:07:58 executing program 2:
r0 = openat$net_tcp_stats(0xffffffffffffff9c,
&(0x7f0000000000)='/net/tcp/stats\x00', 0xf, 0x1, 0x0)
fstat(r0, &(0x7f0000000040))
Core 00, prov: 0(0x0000000000000000) alloc: 0(0x0000000000000000)


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: c5f7000db927 Print backtraces when we do a warn()
git tree: https://github.com/akaros/akaros.git/master

console output: https://syzkaller.appspot.com/x/log.txt?x=1781932c400000

kernel config: https://syzkaller.appspot.com/x/.config?x=efef8cf2939304d3
dashboard link: https://syzkaller.appspot.com/bug?extid=0068960e94fbc67ffab4
compiler:

syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1157a9a4400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=151cf794400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+006896...@syzkaller.appspotmail.com

kernel warning at kern/src/ns/convM2D.c:52, from core 0: nbuf 158,

STAT_FIX_LEN_9P 49 BIT16SZ 2, GBIT16(buf) 0

Stack Backtrace on Core 0:

#01 [<0xffffffffc200a2dc>] in backtrace at src/kdebug.c:220
#02 [<0xffffffffc2009b94>] in _warn at src/init.c:323
#03 [<0xffffffffc2034c5d>] in statcheck at src/ns/convM2D.c:51
#04 [<0xffffffffc203df08>] in validstat at src/ns/sysfile.c:961
#05 [<0xffffffffc203ef6e>] in sysfwstat at src/ns/sysfile.c:421
#06 [<0xffffffffc2055cc0>] in sys_fwstat at src/syscall.c:2337
#07 [<0xffffffffc2059459>] in syscall at src/syscall.c:2528
#08 [<0xffffffffc2059624>] in run_local_syscall at src/syscall.c:2563
#09 [<0xffffffffc2059b59>] in prep_syscalls at src/syscall.c:2583
#10 [<0xffffffffc20ab41a>] in sysenter_callwrapper at arch/x86/trap.c:854

executing program

[Dmitry Vyukov]

Record-breaking 600000 machines crashes on this bug:
https://syzkaller.appspot.com/bug?id=7f866c2900115a0d6fdec39193d118c3b9312b95

> --
> You received this message because you are subscribed to the Google Groups
> "Akaros" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to akaros+un...@googlegroups.com.
> To post to this group, send email to aka...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/akaros/0000000000009091c30571bc0c01%40google.com.
>
> For more options, visit https://groups.google.com/d/optout.