./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1662879800 <...> Warning: Permanently added '10.128.0.160' (ECDSA) to the list of known hosts. execve("./syz-executor1662879800", ["./syz-executor1662879800"], 0x7ffd0aa88b90 /* 10 vars */) = 0 brk(NULL) = 0x555555ce6000 brk(0x555555ce6c40) = 0x555555ce6c40 arch_prctl(ARCH_SET_FS, 0x555555ce6300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1662879800", 4096) = 28 brk(0x555555d07c40) = 0x555555d07c40 brk(0x555555d08000) = 0x555555d08000 mprotect(0x7f23ac627000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f23a416e000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 munmap(0x7f23a416e000, 32768) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 59.091783][ T26] audit: type=1400 audit(1686770080.508:83): avc: denied { write } for pid=4987 comm="strace-static-x" path="pipe:[29874]" dev="pipefs" ino=29874 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 59.115635][ T4990] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4990 'syz-executor166' ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 59.116407][ T26] audit: type=1400 audit(1686770080.528:84): avc: denied { execmem } for pid=4990 comm="syz-executor166" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 59.134362][ T4990] loop0: detected capacity change from 0 to 64 [ 59.145661][ T26] audit: type=1400 audit(1686770080.548:85): avc: denied { read write } for pid=4990 comm="syz-executor166" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.156841][ T4990] ======================================================= [ 59.156841][ T4990] WARNING: The mand mount option has been deprecated and [ 59.156841][ T4990] and is ignored by this kernel. Remove the mand [ 59.156841][ T4990] option from the mount to silence this warning. [ 59.156841][ T4990] ======================================================= [ 59.175754][ T26] audit: type=1400 audit(1686770080.548:86): avc: denied { open } for pid=4990 comm="syz-executor166" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.234800][ T26] audit: type=1400 audit(1686770080.548:87): avc: denied { ioctl } for pid=4990 comm="syz-executor166" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 59.237519][ T4990] general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN [ 59.272581][ T4990] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 59.280998][ T4990] CPU: 0 PID: 4990 Comm: syz-executor166 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 [ 59.291421][ T4990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 59.301473][ T4990] RIP: 0010:hfs_find_init+0x74/0x240 [ 59.306865][ T4990] Code: c1 ea 03 80 3c 02 00 0f 85 bc 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 6b 01 00 00 8b 43 40 be c0 0c [ 59.326473][ T4990] RSP: 0018:ffffc900032f7530 EFLAGS: 00010202 [ 59.332539][ T4990] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 59.340513][ T4990] RDX: 0000000000000008 RSI: ffffffff824fda75 RDI: ffffc900032f75b0 [ 59.348487][ T4990] RBP: ffffc900032f7598 R08: 0000000000000004 R09: 0000000000000004 [ 59.356460][ T4990] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000004 [ 59.364518][ T4990] R13: 0000000000000040 R14: ffff88801e23b50a R15: ffffc900032f7598 [ 59.372490][ T4990] FS: 0000555555ce6300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 59.381427][ T4990] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.388011][ T4990] CR2: 00000000005fdeb8 CR3: 00000000790f8000 CR4: 00000000003506f0 [ 59.395985][ T4990] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.403969][ T4990] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.411943][ T4990] Call Trace: [ 59.415219][ T4990] [ 59.418148][ T4990] ? die_addr+0x3c/0xa0 [ 59.422320][ T4990] ? exc_general_protection+0x129/0x230 [ 59.427883][ T4990] ? asm_exc_general_protection+0x26/0x30 [ 59.433617][ T4990] ? hfs_find_init+0x15/0x240 [ 59.438301][ T4990] ? hfs_find_init+0x74/0x240 [ 59.442981][ T4990] hfs_ext_read_extent+0x18d/0xa20 [ 59.448103][ T4990] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 59.453664][ T4990] ? find_held_lock+0x2d/0x110 [ 59.458433][ T4990] ? hfs_free_extents+0x2e0/0x2e0 [ 59.463555][ T4990] ? folio_create_buffers+0x10b/0x160 [ 59.468934][ T4990] ? lock_downgrade+0x690/0x690 [ 59.473797][ T4990] hfs_get_block+0x48d/0x820 [ 59.478395][ T4990] block_read_full_folio+0x41d/0xab0 [ 59.483690][ T4990] ? hfs_extend_file+0xae0/0xae0 [ 59.488651][ T4990] ? decrypt_bh+0x390/0x390 [ 59.493159][ T4990] ? folio_flags.constprop.0+0x53/0x150 [ 59.498712][ T4990] ? folio_add_lru+0x47f/0x7c0 [ 59.503483][ T4990] ? hfs_bmap+0x30/0x30 [ 59.507652][ T4990] filemap_read_folio+0xdb/0x2c0 [ 59.512594][ T4990] ? __folio_lock_killable+0x20/0x20 [ 59.517893][ T4990] ? __filemap_get_folio+0x1f8/0x990 [ 59.523183][ T4990] do_read_cache_folio+0x1f2/0x510 [ 59.528301][ T4990] ? hfs_bmap+0x30/0x30 [ 59.532483][ T4990] read_cache_page+0x5d/0x160 [ 59.537188][ T4990] hfs_btree_open+0x66f/0x1090 [ 59.541971][ T4990] hfs_mdb_get+0x15fe/0x20c0 [ 59.546599][ T4990] ? hfs_mdb_put+0x380/0x380 [ 59.551226][ T4990] ? do_raw_spin_lock+0x124/0x2b0 [ 59.556270][ T4990] ? spin_bug+0x1c0/0x1c0 [ 59.560625][ T4990] ? lockdep_init_map_type+0x21e/0x810 [ 59.566124][ T4990] ? lockdep_init_map_type+0x21e/0x810 [ 59.571599][ T4990] ? __raw_spin_lock_init+0x3a/0x110 [ 59.576893][ T4990] hfs_fill_super+0xe7f/0x1480 [ 59.581671][ T4990] ? hfs_remount+0x2c0/0x2c0 [ 59.586270][ T4990] ? vsnprintf+0x4df/0x1710 [ 59.590795][ T4990] ? pointer+0xc50/0xc50 [ 59.595043][ T4990] ? snprintf+0xbf/0x100 [ 59.599288][ T4990] ? vsprintf+0x30/0x30 [ 59.603450][ T4990] ? wait_for_completion_io_timeout+0x20/0x20 [ 59.609529][ T4990] ? set_blocksize+0x2d8/0x370 [ 59.614310][ T4990] mount_bdev+0x358/0x420 [ 59.618650][ T4990] ? hfs_remount+0x2c0/0x2c0 [ 59.623246][ T4990] ? hfs_statfs+0x4b0/0x4b0 [ 59.627760][ T4990] legacy_get_tree+0x109/0x220 [ 59.632537][ T4990] vfs_get_tree+0x8d/0x350 [ 59.636961][ T4990] path_mount+0x134b/0x1e40 [ 59.641472][ T4990] ? putname+0x102/0x140 [ 59.645719][ T4990] ? lockdep_hardirqs_on+0x7d/0x100 [ 59.650924][ T4990] ? finish_automount+0x9b0/0x9b0 [ 59.655961][ T4990] ? putname+0x102/0x140 [ 59.660209][ T4990] __x64_sys_mount+0x283/0x300 [ 59.665000][ T4990] ? copy_mnt_ns+0xb30/0xb30 [ 59.669597][ T4990] ? lockdep_hardirqs_on+0x7d/0x100 [ 59.674803][ T4990] ? _raw_spin_unlock_irq+0x2e/0x50 [ 59.680097][ T4990] ? ptrace_notify+0xfe/0x140 [ 59.684777][ T4990] do_syscall_64+0x39/0xb0 [ 59.689198][ T4990] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.695108][ T4990] RIP: 0033:0x7f23ac5bbb2a [ 59.699521][ T4990] Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 59.719133][ T4990] RSP: 002b:00007ffe3749d2f8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 59.727552][ T4990] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f23ac5bbb2a [ 59.735522][ T4990] RDX: 0000000020000080 RSI: 0000000020000280 RDI: 00007ffe3749d300 [ 59.743505][ T4990] RBP: 00007ffe3749d300 R08: 00007ffe3749d340 R09: 0000000000000255 [ 59.751493][ T4990] R10: 00000000010184c9 R11: 0000000000000286 R12: 0000000000000004 [ 59.759466][ T4990] R13: 0000555555ce62c0 R14: 00007ffe3749d340 R15: 0000000000000000 [ 59.767530][ T4990] [ 59.770544][ T4990] Modules linked in: [ 59.774694][ T4990] ---[ end trace 0000000000000000 ]--- [ 59.780288][ T4990] RIP: 0010:hfs_find_init+0x74/0x240 [ 59.781062][ T26] audit: type=1400 audit(1686770080.578:88): avc: denied { mounton } for pid=4990 comm="syz-executor166" path="/root/file1" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 59.785602][ T4990] Code: c1 ea 03 80 3c 02 00 0f 85 bc 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 6b 01 00 00 8b 43 40 be c0 0c [ 59.808702][ T26] audit: type=1400 audit(1686770081.198:89): avc: denied { append } for pid=4428 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 59.828061][ T4990] RSP: 0018:ffffc900032f7530 EFLAGS: 00010202 [ 59.850524][ T26] audit: type=1400 audit(1686770081.198:90): avc: denied { open } for pid=4428 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 59.856251][ T4990] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 59.856297][ T4990] RDX: 0000000000000008 RSI: ffffffff824fda75 RDI: ffffc900032f75b0 [ 59.856312][ T4990] RBP: ffffc900032f7598 R08: 0000000000000004 R09: 0000000000000004 [ 59.879125][ T26] audit: type=1400 audit(1686770081.198:91): avc: denied { getattr } for pid=4428 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 59.886627][ T4990] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000004 [ 59.886648][ T4990] R13: 0000000000000040 R14: ffff88801e23b50a R15: ffffc900032f7598 [ 59.941363][ T4990] FS: 0000555555ce6300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 59.950321][ T4990] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.956948][ T4990] CR2: 00000000005fdeb8 CR3: 00000000790f8000 CR4: 00000000003506f0 [ 59.964910][ T4990] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 59.972910][ T4990] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 59.980954][ T4990] Kernel panic - not syncing: Fatal exception [ 59.987249][ T4990] Kernel Offset: disabled [ 59.991588][ T4990] Rebooting in 86400 seconds..