./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3836186752 <...> Warning: Permanently added '10.128.0.249' (ED25519) to the list of known hosts. execve("./syz-executor3836186752", ["./syz-executor3836186752"], 0x7ffc25942440 /* 10 vars */) = 0 brk(NULL) = 0x55558033d000 brk(0x55558033dd00) = 0x55558033dd00 arch_prctl(ARCH_SET_FS, 0x55558033d380) = 0 set_tid_address(0x55558033d650) = 288 set_robust_list(0x55558033d660, 24) = 0 rseq(0x55558033dca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3836186752", 4096) = 28 getrandom("\x5e\xb3\x38\xd3\xa6\x2f\x12\x09", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558033dd00 brk(0x55558035ed00) = 0x55558035ed00 brk(0x55558035f000) = 0x55558035f000 mprotect(0x7fb3335fa000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18executing program ) = 18 socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 3 openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 4 ioctl(4, TUNSETIFF, 0x200000000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 5 socket(AF_UNIX, SOCK_STREAM, 0) = 6 ioctl(6, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x38\x00\x00\x00\x24\x00\x41\x65\x2a\xbd\x70\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00", iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 21.905751][ T30] audit: type=1400 audit(1753191762.881:64): avc: denied { execmem } for pid=288 comm="syz-executor383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.918228][ T288] ================================================================== [ 21.919444][ T288] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x870/0x3240 [ 21.920912][ T288] Read of size 8 at addr ffff8881077a5dc0 by task syz-executor383/288 [ 21.922388][ T288] [ 21.922797][ T288] CPU: 1 PID: 288 Comm: syz-executor383 Not tainted 5.15.189-syzkaller-00079-ga71626bd56a5 #0 [ 21.924259][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 21.925933][ T288] Call Trace: [ 21.929201][ T288] [ 21.932116][ T288] __dump_stack+0x21/0x30 [ 21.936430][ T288] dump_stack_lvl+0xee/0x150 [ 21.941016][ T288] ? show_regs_print_info+0x20/0x20 [ 21.944838][ T30] audit: type=1400 audit(1753191762.911:65): avc: denied { read } for pid=140 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 21.946206][ T288] ? load_image+0x3a0/0x3a0 [ 21.971413][ T288] print_address_description+0x7f/0x2c0 [ 21.976949][ T288] ? tc_setup_flow_action+0x870/0x3240 [ 21.982389][ T288] kasan_report+0xf1/0x140 [ 21.986783][ T288] ? tc_setup_flow_action+0x870/0x3240 [ 21.992308][ T288] __asan_report_load8_noabort+0x14/0x20 [ 21.997918][ T288] tc_setup_flow_action+0x870/0x3240 [ 22.003185][ T288] mall_replace_hw_filter+0x293/0x820 [ 22.008545][ T288] ? pcpu_block_update_hint_alloc+0x8c1/0xc50 [ 22.014606][ T288] ? mall_set_parms+0x520/0x520 [ 22.019440][ T288] ? tcf_exts_destroy+0xb0/0xb0 [ 22.024274][ T288] ? mall_set_parms+0x1e8/0x520 [ 22.029106][ T288] mall_change+0x526/0x740 [ 22.033505][ T288] ? __kasan_check_write+0x14/0x20 [ 22.038619][ T288] ? mall_get+0xa0/0xa0 [ 22.042746][ T288] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 22.048637][ T288] tc_new_tfilter+0x12a2/0x1870 [ 22.053472][ T288] ? tcf_gate_entry_destructor+0x20/0x20 [ 22.059085][ T288] ? security_capable+0x87/0xb0 [ 22.063911][ T288] ? ns_capable+0x8c/0xf0 [ 22.068215][ T288] ? netlink_net_capable+0x125/0x160 [ 22.073480][ T288] ? tcf_gate_entry_destructor+0x20/0x20 [ 22.079095][ T288] rtnetlink_rcv_msg+0x81b/0xb90 [ 22.084105][ T288] ? rtnetlink_bind+0x80/0x80 [ 22.088759][ T288] ? memcpy+0x56/0x70 [ 22.092720][ T288] ? avc_has_perm_noaudit+0x2f4/0x460 [ 22.098079][ T288] ? arch_stack_walk+0xee/0x140 [ 22.102906][ T288] ? avc_denied+0x1b0/0x1b0 [ 22.107472][ T288] ? stack_trace_save+0x98/0xe0 [ 22.112304][ T288] ? avc_has_perm+0x158/0x240 [ 22.116995][ T288] ? avc_has_perm_noaudit+0x460/0x460 [ 22.122345][ T288] ? x64_sys_call+0x4b/0x9a0 [ 22.126997][ T288] ? selinux_nlmsg_lookup+0x416/0x4c0 [ 22.132350][ T288] netlink_rcv_skb+0x1e0/0x430 [ 22.137299][ T288] ? rtnetlink_bind+0x80/0x80 [ 22.141965][ T288] ? netlink_ack+0xb60/0xb60 [ 22.146625][ T288] ? __netlink_lookup+0x387/0x3b0 [ 22.151655][ T288] rtnetlink_rcv+0x1c/0x20 [ 22.156052][ T288] netlink_unicast+0x876/0xa40 [ 22.160794][ T288] netlink_sendmsg+0x86a/0xb70 [ 22.165537][ T288] ? netlink_getsockopt+0x530/0x530 [ 22.170723][ T288] ? __update_load_avg_cfs_rq+0xaf/0x2f0 [ 22.176347][ T288] ? security_socket_sendmsg+0x82/0xa0 [ 22.181796][ T288] ? netlink_getsockopt+0x530/0x530 [ 22.186976][ T288] ____sys_sendmsg+0x5a2/0x8c0 [ 22.191754][ T288] ? __sys_sendmsg_sock+0x40/0x40 [ 22.196754][ T288] ? import_iovec+0x7c/0xb0 [ 22.201232][ T288] ___sys_sendmsg+0x1f0/0x260 [ 22.205893][ T288] ? _raw_spin_unlock+0x4d/0x70 [ 22.210741][ T288] ? __sys_sendmsg+0x250/0x250 [ 22.215478][ T288] ? __schedule+0xb76/0x14c0 [ 22.220044][ T288] ? _raw_spin_lock_irqsave+0x110/0x110 [ 22.225594][ T288] ? cgroup_update_frozen+0x15c/0x970 [ 22.230958][ T288] ? ptrace_stop+0x6f4/0xa80 [ 22.235531][ T288] ? __kasan_check_read+0x11/0x20 [ 22.240538][ T288] ? __fdget+0x15b/0x230 [ 22.244768][ T288] __x64_sys_sendmsg+0x1e2/0x2a0 [ 22.249824][ T288] ? ___sys_sendmsg+0x260/0x260 [ 22.254666][ T288] ? __kasan_check_write+0x14/0x20 [ 22.259755][ T288] ? switch_fpu_return+0x15d/0x2c0 [ 22.264853][ T288] x64_sys_call+0x4b/0x9a0 [ 22.269257][ T288] do_syscall_64+0x4c/0xa0 [ 22.273662][ T288] ? clear_bhb_loop+0x50/0xa0 [ 22.278325][ T288] ? clear_bhb_loop+0x50/0xa0 [ 22.283076][ T288] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.288956][ T288] RIP: 0033:0x7fb3335877a9 [ 22.293356][ T288] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 22.313026][ T288] RSP: 002b:00007ffdb6cd2618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 22.321422][ T288] RAX: ffffffffffffffda RBX: 00007ffdb6cd27e8 RCX: 00007fb3335877a9 [ 22.329374][ T288] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 22.337329][ T288] RBP: 00007fb3335fa610 R08: 0000000000000004 R09: 00007ffdb6cd27e8 [ 22.345298][ T288] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 22.353337][ T288] R13: 00007ffdb6cd27d8 R14: 0000000000000001 R15: 0000000000000001 [ 22.361287][ T288] [ 22.364283][ T288] [ 22.366581][ T288] Allocated by task 288: [ 22.370797][ T288] __kasan_kmalloc+0xda/0x110 [ 22.375453][ T288] __kmalloc+0x13d/0x2c0 [ 22.379685][ T288] tcf_idr_create+0x5f/0x790 [ 22.384248][ T288] tcf_idr_create_from_flags+0x61/0x70 [ 22.389682][ T288] tcf_gact_init+0x346/0x580 [ 22.394247][ T288] tcf_action_init_1+0x3f7/0x6a0 [ 22.399176][ T288] tcf_action_init+0x1e9/0x710 [ 22.403913][ T288] tcf_exts_validate+0x217/0x520 [ 22.408821][ T288] mall_set_parms+0x48/0x520 [ 22.413386][ T288] mall_change+0x45a/0x740 [ 22.417793][ T288] tc_new_tfilter+0x12a2/0x1870 [ 22.422643][ T288] rtnetlink_rcv_msg+0x81b/0xb90 [ 22.427577][ T288] netlink_rcv_skb+0x1e0/0x430 [ 22.432321][ T288] rtnetlink_rcv+0x1c/0x20 [ 22.436796][ T288] netlink_unicast+0x876/0xa40 [ 22.441582][ T288] netlink_sendmsg+0x86a/0xb70 [ 22.446342][ T288] ____sys_sendmsg+0x5a2/0x8c0 [ 22.451082][ T288] ___sys_sendmsg+0x1f0/0x260 [ 22.455747][ T288] __x64_sys_sendmsg+0x1e2/0x2a0 [ 22.460661][ T288] x64_sys_call+0x4b/0x9a0 [ 22.465049][ T288] do_syscall_64+0x4c/0xa0 [ 22.469440][ T288] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.475307][ T288] [ 22.477607][ T288] The buggy address belongs to the object at ffff8881077a5d00 [ 22.477607][ T288] which belongs to the cache kmalloc-192 of size 192 [ 22.491635][ T288] The buggy address is located 0 bytes to the right of [ 22.491635][ T288] 192-byte region [ffff8881077a5d00, ffff8881077a5dc0) [ 22.505415][ T288] The buggy address belongs to the page: [ 22.511020][ T288] page:ffffea00041de940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1077a5 [ 22.521240][ T288] flags: 0x4000000000000200(slab|zone=1) [ 22.526858][ T288] raw: 4000000000000200 ffffea00041de280 0000000400000004 ffff888100042c00 [ 22.535419][ T288] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 22.543975][ T288] page dumped because: kasan: bad access detected [ 22.550368][ T288] page_owner tracks the page as allocated [ 22.556097][ T288] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1214215473, free_ts 0 [ 22.570918][ T288] post_alloc_hook+0x192/0x1b0 [ 22.575669][ T288] prep_new_page+0x1c/0x110 [ 22.580174][ T288] get_page_from_freelist+0x2cc5/0x2d50 [ 22.585700][ T288] __alloc_pages+0x18f/0x440 [ 22.590269][ T288] new_slab+0xa1/0x4d0 [ 22.594412][ T288] ___slab_alloc+0x381/0x810 [ 22.599001][ T288] __slab_alloc+0x49/0x90 [ 22.603315][ T288] __kmalloc_track_caller+0x169/0x2c0 [ 22.608666][ T288] krealloc+0x6a/0x100 [ 22.612712][ T288] add_sysfs_param+0xce/0x830 [ 22.617362][ T288] kernel_add_sysfs_param+0xb3/0x130 [ 22.622617][ T288] param_sysfs_builtin+0x164/0x1e0 [ 22.627701][ T288] param_sysfs_init+0x6a/0x70 [ 22.632353][ T288] do_one_initcall+0x17f/0x500 [ 22.637095][ T288] do_initcall_level+0x16f/0x2d0 [ 22.642031][ T288] do_initcalls+0x50/0xa0 [ 22.646334][ T288] page_owner free stack trace missing [ 22.651783][ T288] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x84\x00\x00\x00\x2c\x00\x27\x0d\x29\xbd\x30\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x07\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x50\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x02\x00\x00\x00\x40\x00\x00\x00\xff\xff\xff\xff\x70\xe6\x00\x00"..., iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 132 exit_group(0) = ? [ 22.654084][ T288] Memory state around the buggy address: [ 22.659780][ T288] ffff8881077a5c80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 22.667814][ T288] ffff8881077a5d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.675846][ T288] >ffff8881077a5d80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 22.683875][ T288] ^ [ 22.689999][ T288] ffff8881077a5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 22.698033][ T288] ffff8881077a5e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 22.706434][ T288] ================================================================== [ 22.714508][ T288] Disabling lock debugging due to kernel taint [ 22.727765][ T30] audit: type=1400 audit(1753191763.701:66): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 22.749547][ T30] audit: type=1400 audit(1753191763.701:67): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 22.771070][ T30] audit: type=1400 audit(1753191763.701:68): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 +++ exited with 0 +++ [ 22.792304][ T30] audit: type=1400 audit(1753191763.701:69): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r