./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1205199156 <...> Warning: Permanently added '10.128.1.56' (ED25519) to the list of known hosts. execve("./syz-executor1205199156", ["./syz-executor1205199156"], 0x7ffc58152ca0 /* 10 vars */) = 0 brk(NULL) = 0x55557265e000 brk(0x55557265ed00) = 0x55557265ed00 arch_prctl(ARCH_SET_FS, 0x55557265e380) = 0 set_tid_address(0x55557265e650) = 289 set_robust_list(0x55557265e660, 24) = 0 rseq(0x55557265eca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1205199156", 4096) = 28 getrandom("\xd0\xfc\x07\x64\xe4\x8e\xce\x7e", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557265ed00 brk(0x55557267fd00) = 0x55557267fd00 brk(0x555572680000) = 0x555572680000 mprotect(0x7f140aabe000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 executing program write(1, "executing program\n", 18) = 18 socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 3 openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 4 ioctl(4, TUNSETIFF, 0x20000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 5 socket(AF_UNIX, SOCK_STREAM, 0) = 6 ioctl(6, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x38\x00\x00\x00\x24\x00\x41\x65\x2a\xbd\x70\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00", iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 21.988872][ T24] audit: type=1400 audit(1736031340.920:66): avc: denied { execmem } for pid=289 comm="syz-executor120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.992044][ T289] ================================================================== [ 21.993819][ T289] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xbb8/0x3630 [ 21.995275][ T289] Read of size 8 at addr ffff88810c890ec0 by task syz-executor120/289 [ 21.996474][ T289] [ 21.996848][ T289] CPU: 0 PID: 289 Comm: syz-executor120 Not tainted 5.10.232-syzkaller-00746-g49e8ba0a684f #0 [ 21.997198][ T24] audit: type=1400 audit(1736031340.920:67): avc: denied { read } for pid=133 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 21.998553][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 21.998563][ T289] Call Trace: [ 21.998580][ T289] dump_stack_lvl+0x1e2/0x24b [ 21.998589][ T289] ? bfq_pos_tree_add_move+0x43b/0x43b [ 21.998597][ T289] ? panic+0x812/0x812 [ 21.998608][ T289] print_address_description+0x81/0x3b0 [ 21.998617][ T289] kasan_report+0x179/0x1c0 [ 21.998632][ T289] ? tc_setup_flow_action+0xbb8/0x3630 [ 22.009225][ T289] ? tc_setup_flow_action+0xbb8/0x3630 [ 22.014488][ T289] __asan_report_load8_noabort+0x14/0x20 [ 22.019949][ T289] tc_setup_flow_action+0xbb8/0x3630 [ 22.025067][ T289] ? __kmalloc+0x1aa/0x330 [ 22.029321][ T289] ? flow_rule_alloc+0x30/0x2b0 [ 22.034016][ T289] mall_replace_hw_filter+0x394/0xc10 [ 22.039218][ T289] ? mall_set_parms+0x440/0x440 [ 22.043899][ T289] ? tcf_exts_destroy+0xb0/0xb0 [ 22.048593][ T289] ? pcpu_memcg_post_alloc_hook+0x1c8/0x360 [ 22.054315][ T289] ? pcpu_alloc+0xfa0/0x1420 [ 22.058740][ T289] ? mall_set_parms+0x4b/0x440 [ 22.063344][ T289] ? mall_set_parms+0x1a2/0x440 [ 22.068029][ T289] mall_change+0x573/0x7a0 [ 22.072283][ T289] ? __kasan_check_write+0x14/0x20 [ 22.077226][ T289] ? mall_get+0xb0/0xb0 [ 22.081310][ T289] ? tcf_chain_tp_insert_unique+0xa90/0xbb0 [ 22.087037][ T289] tc_new_tfilter+0x168e/0x1dc0 [ 22.091720][ T289] ? mall_get+0xb0/0xb0 [ 22.095713][ T289] ? tcf_gate_entry_destructor+0x20/0x20 [ 22.101185][ T289] ? security_capable+0x87/0xb0 [ 22.105876][ T289] ? ns_capable+0x89/0xe0 [ 22.110032][ T289] ? netlink_net_capable+0x125/0x160 [ 22.115155][ T289] ? tcf_gate_entry_destructor+0x20/0x20 [ 22.120627][ T289] rtnetlink_rcv_msg+0x77a/0xc50 [ 22.125399][ T289] ? is_bpf_text_address+0x172/0x190 [ 22.130517][ T289] ? rtnetlink_bind+0x80/0x80 [ 22.135032][ T289] ? arch_stack_walk+0xf3/0x140 [ 22.139720][ T289] ? stack_trace_save+0x113/0x1c0 [ 22.144578][ T289] ? stack_trace_snprint+0xf0/0xf0 [ 22.149524][ T289] ? avc_has_perm+0x14d/0x400 [ 22.154048][ T289] ? memcpy+0x56/0x70 [ 22.157856][ T289] ? avc_has_perm+0x275/0x400 [ 22.162372][ T289] ? __kasan_slab_alloc+0xb1/0xe0 [ 22.167230][ T289] ? slab_post_alloc_hook+0x61/0x2f0 [ 22.172349][ T289] ? kmem_cache_alloc+0x168/0x2e0 [ 22.177212][ T289] ? avc_has_perm_noaudit+0x240/0x240 [ 22.182430][ T289] ? iov_iter_advance+0x258/0xb20 [ 22.187284][ T289] netlink_rcv_skb+0x1cf/0x410 [ 22.191881][ T289] ? rtnetlink_bind+0x80/0x80 [ 22.196401][ T289] ? netlink_ack+0xb30/0xb30 [ 22.200821][ T289] ? __netlink_lookup+0x37b/0x3a0 [ 22.205683][ T289] rtnetlink_rcv+0x1c/0x20 [ 22.209932][ T289] netlink_unicast+0x8df/0xac0 [ 22.214534][ T289] ? netlink_detachskb+0x90/0x90 [ 22.219308][ T289] ? security_netlink_send+0x7b/0xa0 [ 22.224428][ T289] netlink_sendmsg+0xa46/0xd00 [ 22.229028][ T289] ? netlink_getsockopt+0x5c0/0x5c0 [ 22.234060][ T289] ? security_socket_sendmsg+0x82/0xb0 [ 22.239355][ T289] ? netlink_getsockopt+0x5c0/0x5c0 [ 22.244389][ T289] ____sys_sendmsg+0x59e/0x8f0 [ 22.248990][ T289] ? __sys_sendmsg_sock+0x40/0x40 [ 22.253852][ T289] ? import_iovec+0xe5/0x120 [ 22.258276][ T289] ___sys_sendmsg+0x252/0x2e0 [ 22.262790][ T289] ? __sys_sendmsg+0x280/0x280 [ 22.267392][ T289] ? finish_task_switch+0x130/0x5a0 [ 22.272424][ T289] ? __schedule+0xbee/0x1330 [ 22.276854][ T289] ? __kasan_check_write+0x14/0x20 [ 22.281806][ T289] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 22.286744][ T289] ? __kasan_check_read+0x11/0x20 [ 22.291605][ T289] ? __fdget+0x179/0x240 [ 22.295684][ T289] __se_sys_sendmsg+0x1b1/0x280 [ 22.300372][ T289] ? _raw_spin_unlock_irq+0x4e/0x70 [ 22.305404][ T289] ? __x64_sys_sendmsg+0x90/0x90 [ 22.310178][ T289] ? fpu__clear_all+0x20/0x20 [ 22.314690][ T289] __x64_sys_sendmsg+0x7b/0x90 [ 22.319293][ T289] do_syscall_64+0x34/0x70 [ 22.323545][ T289] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.329269][ T289] RIP: 0033:0x7f140aa4b829 [ 22.333525][ T289] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 22.352982][ T289] RSP: 002b:00007ffde91f0818 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 22.361210][ T289] RAX: ffffffffffffffda RBX: 00007ffde91f09e8 RCX: 00007f140aa4b829 [ 22.369030][ T289] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 [ 22.376836][ T289] RBP: 00007f140aabe610 R08: 0000000000000001 R09: 00007ffde91f09e8 [ 22.384657][ T289] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 22.392575][ T289] R13: 00007ffde91f09d8 R14: 0000000000000001 R15: 0000000000000001 [ 22.400371][ T289] [ 22.402548][ T289] Allocated by task 289: [ 22.406635][ T289] ____kasan_kmalloc+0xdb/0x110 [ 22.411307][ T289] __kasan_kmalloc+0x9/0x10 [ 22.415645][ T289] __kmalloc+0x1aa/0x330 [ 22.419725][ T289] tcf_idr_create+0x5f/0x770 [ 22.424150][ T289] tcf_idr_create_from_flags+0x5f/0x70 [ 22.429462][ T289] tcf_gact_init+0x373/0x6e0 [ 22.433874][ T289] tcf_action_init_1+0x584/0x830 [ 22.438654][ T289] tcf_action_init+0x2b5/0x800 [ 22.443244][ T289] tcf_exts_validate+0x232/0x540 [ 22.448028][ T289] mall_set_parms+0x4b/0x440 [ 22.452446][ T289] mall_change+0x49e/0x7a0 [ 22.456720][ T289] tc_new_tfilter+0x168e/0x1dc0 [ 22.461388][ T289] rtnetlink_rcv_msg+0x77a/0xc50 [ 22.466173][ T289] netlink_rcv_skb+0x1cf/0x410 [ 22.470758][ T289] rtnetlink_rcv+0x1c/0x20 [ 22.475014][ T289] netlink_unicast+0x8df/0xac0 [ 22.479614][ T289] netlink_sendmsg+0xa46/0xd00 [ 22.484210][ T289] ____sys_sendmsg+0x59e/0x8f0 [ 22.489018][ T289] ___sys_sendmsg+0x252/0x2e0 [ 22.493521][ T289] __se_sys_sendmsg+0x1b1/0x280 [ 22.498293][ T289] __x64_sys_sendmsg+0x7b/0x90 [ 22.502932][ T289] do_syscall_64+0x34/0x70 [ 22.507154][ T289] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.512877][ T289] [ 22.515038][ T289] The buggy address belongs to the object at ffff88810c890e00 [ 22.515038][ T289] which belongs to the cache kmalloc-192 of size 192 [ 22.528934][ T289] The buggy address is located 0 bytes to the right of [ 22.528934][ T289] 192-byte region [ffff88810c890e00, ffff88810c890ec0) [ 22.542375][ T289] The buggy address belongs to the page: [ 22.547863][ T289] page:ffffea0004322400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c890 [ 22.557918][ T289] flags: 0x4000000000000200(slab) [ 22.562776][ T289] raw: 4000000000000200 ffffea0004321e00 0000000400000004 ffff888100043380 [ 22.571194][ T289] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 22.579608][ T289] page dumped because: kasan: bad access detected [ 22.585860][ T289] page_owner tracks the page as allocated [ 22.591418][ T289] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 3123548648, free_ts 0 [ 22.606089][ T289] prep_new_page+0x166/0x180 [ 22.610507][ T289] get_page_from_freelist+0x2d8c/0x2f30 [ 22.615890][ T289] __alloc_pages_nodemask+0x435/0xaf0 [ 22.621098][ T289] new_slab+0x80/0x400 [ 22.625001][ T289] ___slab_alloc+0x302/0x4b0 [ 22.629428][ T289] __slab_alloc+0x63/0xa0 [ 22.633595][ T289] __kmalloc+0x204/0x330 [ 22.637675][ T289] security_get_permissions+0x9f/0x370 [ 22.642971][ T289] sel_make_policy_nodes+0xfac/0x1b20 [ 22.648177][ T289] sel_write_load+0x3a2/0x550 [ 22.652690][ T289] vfs_write+0x36a/0xe70 [ 22.656924][ T289] ksys_write+0x199/0x2c0 [ 22.661021][ T289] __x64_sys_write+0x7b/0x90 [ 22.665450][ T289] do_syscall_64+0x34/0x70 [ 22.669701][ T289] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.675426][ T289] page_owner free stack trace missing [ 22.680629][ T289] [ 22.682799][ T289] Memory state around the buggy address: [ 22.688272][ T289] ffff88810c890d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.696169][ T289] ffff88810c890e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.704068][ T289] >ffff88810c890e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 22.711963][ T289] ^ [ 22.717957][ T289] ffff88810c890f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.725853][ T289] ffff88810c890f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.733749][ T289] ================================================================== sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x84\x00\x00\x00\x2c\x00\x27\x0d\x29\xbd\x30\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x07\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x50\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x02\x00\x00\x00\x40\x00\x00\x00\xff\xff\xff\xff\x70\xe6\x00\x00"..., iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 132 exit_group(0) = ? +++ exited with 0 +++ [ 22.74