ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor2457179047 <...> Warning: Permanently added '10.128.0.174' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor2457179047", ["ci2-android-6-1/syz-executor2457179047"], 0x7ffe35ae8770 /* 10 vars */) = 0 brk(NULL) = 0x55557a81d000 brk(0x55557a81dd40) = 0x55557a81dd40 arch_prctl(ARCH_SET_FS, 0x55557a81d3c0) = 0 set_tid_address(0x55557a81d690) = 305 set_robust_list(0x55557a81d6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor2457179047", 4096) = 44 getrandom("\xfa\xde\x8a\x71\x27\x28\xe7\x28", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557a81dd40 brk(0x55557a83ed40) = 0x55557a83ed40 brk(0x55557a83f000) = 0x55557a83f000 mprotect(0x7f529a530000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 mkdirat(AT_FDCWD, "./sys", 063) = 0 mount(NULL, "./sys", "sysfs", 0, NULL) = 0 openat(AT_FDCWD, "./sys/bus/pnp/drivers/serial", O_RDONLY) = 3 openat(3, "unbind", O_WRONLY) = 4 write(4, "00:03\n", 6) = 6 openat(AT_FDCWD, "./sys/class/tty/ttyS0/console", O_RDWR) = 5 [ 24.773579][ T28] audit: type=1400 audit(1790284589.104:64): avc: denied { execmem } for pid=305 comm="syz-executor245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.793178][ T28] audit: type=1400 audit(1790284589.104:65): avc: denied { mounton } for pid=305 comm="syz-executor245" path="/root/sys" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 24.815905][ T305] printk: console [ttyS0] disabled write(5, "\x31\x00", 2) = 2 mkdirat(AT_FDCWD, "./myproc", 0777) = 0 mount(NULL, "./myproc", "proc", 0, NULL) = 0 openat(AT_FDCWD, "./myproc/interrupts", O_RDONLY) = 6 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 7 [ 24.825699][ T305] printk: console [ttyS0] enabled [ 24.832101][ T28] audit: type=1400 audit(1790284589.174:67): avc: denied { mount } for pid=305 comm="syz-executor245" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 24.855219][ T305] ================================================================== [ 24.863333][ T305] BUG: KASAN: use-after-free in string+0x20f/0x2a0 [ 24.870009][ T305] Read of size 1 at addr ffff88810b4b2ac8 by task syz-executor245/305 [ 24.878471][ T305] [ 24.880831][ T305] CPU: 0 PID: 305 Comm: syz-executor245 Not tainted syzkaller #0 [ 24.888668][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.898856][ T305] Call Trace: [ 24.902144][ T305] [ 24.905082][ T305] __dump_stack+0x21/0x24 [ 24.909524][ T305] dump_stack_lvl+0x110/0x170 [ 24.914254][ T305] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.919398][ T305] ? string+0x20f/0x2a0 [ 24.923582][ T305] print_address_description+0x71/0x200 [ 24.929138][ T305] print_report+0x4a/0x60 [ 24.933476][ T305] kasan_report+0x122/0x150 [ 24.937997][ T305] ? string+0x20f/0x2a0 [ 24.942168][ T305] __asan_report_load1_noabort+0x14/0x20 [ 24.947896][ T305] string+0x20f/0x2a0 [ 24.951917][ T305] vsnprintf+0xec5/0x1990 [ 24.956355][ T305] seq_printf+0x185/0x280 [ 24.960782][ T305] ? __cfi_seq_printf+0x10/0x10 [ 24.965653][ T305] ? radix_tree_lookup+0x248/0x290 [ 24.970769][ T305] ? _find_next_bit+0x129/0x130 [ 24.975635][ T305] show_interrupts+0x8f9/0xa00 [ 24.980577][ T305] seq_read_iter+0x992/0xd80 [ 24.985210][ T305] proc_reg_read_iter+0x1e0/0x2b0 [ 24.990277][ T305] generic_file_splice_read+0x1d9/0x530 [ 24.995840][ T305] ? __cfi_generic_file_splice_read+0x10/0x10 [ 25.002009][ T305] ? __kasan_check_read+0x11/0x20 [ 25.007040][ T305] ? fsnotify_perm+0x269/0x5b0 [ 25.011827][ T305] ? security_file_permission+0x94/0xb0 [ 25.017391][ T305] ? rw_verify_area+0xa7/0x1c0 [ 25.022168][ T305] splice_direct_to_actor+0x3d0/0xb30 [ 25.027954][ T305] ? __cfi_direct_splice_actor+0x10/0x10 [ 25.033644][ T305] ? __cfi_splice_direct_to_actor+0x10/0x10 [ 25.039608][ T305] ? security_file_permission+0x94/0xb0 [ 25.045202][ T305] ? rw_verify_area+0xa7/0x1c0 [ 25.049972][ T305] do_splice_direct+0x1c2/0x2d0 [ 25.054838][ T305] ? __cfi_do_splice_direct+0x10/0x10 [ 25.060401][ T305] ? security_file_permission+0x94/0xb0 [ 25.065960][ T305] do_sendfile+0x515/0xe20 [ 25.070387][ T305] ? do_preadv+0x390/0x390 [ 25.074896][ T305] ? ptrace_notify+0x1f7/0x270 [ 25.079689][ T305] __x64_sys_sendfile64+0x199/0x1f0 [ 25.084911][ T305] ? __cfi___x64_sys_sendfile64+0x10/0x10 [ 25.090675][ T305] ? fpregs_restore_userregs+0x128/0x260 [ 25.096324][ T305] x64_sys_call+0x62c/0x9a0 [ 25.100837][ T305] do_syscall_64+0x4c/0xa0 [ 25.105267][ T305] ? clear_bhb_loop+0x30/0x80 [ 25.109960][ T305] ? clear_bhb_loop+0x30/0x80 [ 25.114658][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.120573][ T305] RIP: 0033:0x7f529a49fdf9 [ 25.125022][ T305] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.145696][ T305] RSP: 002b:00007ffea0a88058 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 25.154150][ T305] RAX: ffffffffffffffda RBX: 636f7270796d2f2e RCX: 00007f529a49fdf9 [ 25.162151][ T305] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000007 [ 25.170367][ T305] RBP: 0000000000000001 R08: 00007ffea0a88198 R09: 00007ffea0a88198 [ 25.178362][ T305] R10: 00000000000007ff R11: 0000000000000246 R12: 00007ffea0a88188 [ 25.186356][ T305] R13: 0000000000000002 R14: 00007f529a530ca0 R15: 0000200000000004 [ 25.194352][ T305] [ 25.197430][ T305] [ 25.199768][ T305] Allocated by task 1: [ 25.203854][ T305] kasan_set_track+0x4b/0x70 [ 25.208490][ T305] kasan_save_alloc_info+0x1f/0x30 [ 25.213640][ T305] __kasan_kmalloc+0x95/0xb0 [ 25.218260][ T305] __kmalloc_node_track_caller+0xb1/0x1e0 [ 25.223997][ T305] kvasprintf+0xe8/0x1a0 [ 25.228257][ T305] kasprintf+0xdf/0x130 [ 25.232428][ T305] uart_add_one_port+0x38b/0x1cf0 [ 25.237498][ T305] serial8250_register_8250_port+0x1368/0x1b70 [ 25.243716][ T305] serial_pnp_probe+0x51e/0x710 [ 25.248641][ T305] pnp_device_probe+0x312/0x4d0 [ 25.253510][ T305] really_probe+0x2d7/0x9a0 [ 25.258044][ T305] __driver_probe_device+0x193/0x270 [ 25.263348][ T305] driver_probe_device+0x54/0x3e0 [ 25.268395][ T305] __driver_attach+0x41a/0x5d0 [ 25.273181][ T305] bus_for_each_dev+0x18c/0x200 [ 25.278044][ T305] driver_attach+0x42/0x50 [ 25.282507][ T305] bus_add_driver+0x322/0x560 [ 25.287196][ T305] driver_register+0x335/0x440 [ 25.291984][ T305] pnp_register_driver+0x7d/0x90 [ 25.296940][ T305] serial8250_pnp_init+0x15/0x20 [ 25.301904][ T305] serial8250_init+0xa0/0x16e [ 25.306705][ T305] do_one_initcall+0x1d6/0x580 [ 25.311610][ T305] do_initcall_level+0x174/0x2df [ 25.316562][ T305] do_initcalls+0x50/0x92 [ 25.320909][ T305] do_basic_setup+0x92/0x99 [ 25.325427][ T305] kernel_init_freeable+0x2d1/0x42d [ 25.330733][ T305] kernel_init+0x1d/0x1c0 [ 25.335082][ T305] ret_from_fork+0x1f/0x30 [ 25.339516][ T305] [ 25.341848][ T305] Freed by task 305: [ 25.345748][ T305] kasan_set_track+0x4b/0x70 [ 25.350359][ T305] kasan_save_free_info+0x2b/0x40 [ 25.355395][ T305] ____kasan_slab_free+0x132/0x180 [ 25.360524][ T305] __kasan_slab_free+0x11/0x20 [ 25.365317][ T305] slab_free_freelist_hook+0xc2/0x190 [ 25.370712][ T305] __kmem_cache_free+0xb7/0x1b0 [ 25.375586][ T305] kfree+0x6f/0xf0 [ 25.379319][ T305] uart_remove_one_port+0x36a/0x720 [ 25.384538][ T305] serial8250_unregister_port+0xad/0x250 [ 25.390190][ T305] serial_pnp_remove+0x6b/0x90 [ 25.394961][ T305] pnp_device_remove+0x84/0x260 [ 25.399848][ T305] device_release_driver_internal+0x486/0x7e0 [ 25.405963][ T305] device_driver_detach+0x3b/0x40 [ 25.411003][ T305] unbind_store+0x2e5/0x300 [ 25.415525][ T305] drv_attr_store+0x88/0xb0 [ 25.420042][ T305] sysfs_kf_write+0x137/0x150 [ 25.424823][ T305] kernfs_fop_write_iter+0x307/0x470 [ 25.430129][ T305] vfs_write+0x5ef/0xd00 [ 25.434391][ T305] ksys_write+0x14a/0x260 [ 25.438733][ T305] __x64_sys_write+0x7b/0x90 [ 25.443343][ T305] x64_sys_call+0x27b/0x9a0 [ 25.447889][ T305] do_syscall_64+0x4c/0xa0 [ 25.452332][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.458241][ T305] [ 25.460586][ T305] The buggy address belongs to the object at ffff88810b4b2ac8 [ 25.460586][ T305] which belongs to the cache kmalloc-8 of size 8 [ 25.474343][ T305] The buggy address is located 0 bytes inside of [ 25.474343][ T305] 8-byte region [ffff88810b4b2ac8, ffff88810b4b2ad0) [ 25.487337][ T305] [ 25.489673][ T305] The buggy address belongs to the physical page: [ 25.496095][ T305] page:ffffea00042d2c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810b4b26e0 pfn:0x10b4b2 [ 25.507662][ T305] flags: 0x4000000000000200(slab|zone=1) [ 25.513331][ T305] raw: 4000000000000200 ffffea0004371dc8 ffffea00042d7008 ffff888100042300 [ 25.521942][ T305] raw: ffff88810b4b26e0 0000000000660021 00000001ffffffff 0000000000000000 [ 25.530538][ T305] page dumped because: kasan: bad access detected [ 25.536989][ T305] page_owner tracks the page as allocated [ 25.542730][ T305] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2374775325, free_ts 0 [ 25.559344][ T305] post_alloc_hook+0x1f5/0x210 [ 25.564174][ T305] prep_new_page+0x1c/0x110 [ 25.568706][ T305] get_page_from_freelist+0x2ca9/0x2d20 [ 25.574797][ T305] __alloc_pages+0x1fa/0x610 [ 25.579441][ T305] alloc_slab_page+0x6e/0xf0 [ 25.584080][ T305] new_slab+0x98/0x3e0 [ 25.588165][ T305] ___slab_alloc+0x70f/0xb70 [ 25.592782][ T305] __slab_alloc+0x5e/0xa0 [ 25.597147][ T305] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.602691][ T305] __kmalloc_node_track_caller+0xa1/0x1e0 [ 25.608461][ T305] kstrdup_const+0x5a/0xa0 [ 25.612906][ T305] __kernfs_new_node+0xa6/0x670 [ 25.617903][ T305] kernfs_new_node+0x150/0x260 [ 25.622802][ T305] kernfs_create_dir_ns+0x47/0x130 [ 25.627941][ T305] sysfs_create_dir_ns+0x128/0x290 [ 25.633095][ T305] kobject_add_internal+0x718/0xc20 [ 25.638322][ T305] page_owner free stack trace missing [ 25.643704][ T305] [ 25.646148][ T305] Memory state around the buggy address: [ 25.651804][ T305] ffff88810b4b2980: fc fb fc fc fc fc 04 fc fc fc fc fb fc fc fc fc [ 25.659886][ T305] ffff88810b4b2a00: 00 fc fc fc fc fb fc fc fc fc fb fc fc fc fc 00 [ 25.667974][ T305] >ffff88810b4b2a80: fc fc fc fc 06 fc fc fc fc fa fc fc fc fc fb fc sendfile(7, 6, NULL, 2047) = 1867 exit_group(0) = ? +++ exited with 0 +++ [ 25.676053][ T305]