./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1131637003 <...> Warning: Permanently added '10.128.0.107' (ED25519) to the list of known hosts. execve("./syz-executor1131637003", ["./syz-executor1131637003"], 0x7fff450b9d30 /* 10 vars */) = 0 brk(NULL) = 0x55556f20c000 brk(0x55556f20ce00) = 0x55556f20ce00 arch_prctl(ARCH_SET_FS, 0x55556f20c480) = 0 set_tid_address(0x55556f20c750) = 282 set_robust_list(0x55556f20c760, 24) = 0 rseq(0x55556f20cda0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1131637003", 4096) = 28 getrandom("\x5c\x5b\xca\x2b\x83\xbb\x80\xa4", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556f20ce00 brk(0x55556f22de00) = 0x55556f22de00 brk(0x55556f22e000) = 0x55556f22e000 mprotect(0x7f090203d000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 283 attached , child_tidptr=0x55556f20c750) = 283 [pid 282] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC [pid 283] set_robust_list(0x55556f20c760, 24 [pid 282] <... openat resumed>) = 3 [pid 283] <... set_robust_list resumed>) = 0 [pid 282] write(3, "10000000000", 11) = 11 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "20", 2) = 2 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "1", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "0", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "0", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "1", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "100", 3) = 3 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "0", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "0", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "7 4 1 3", 7) = 7 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "1", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "1", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "0", 1) = 1 [pid 282] close(3) = 0 [pid 282] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 282] write(3, "283", 3) = 3 [pid 282] close(3) = 0 [pid 282] kill(283, SIGKILL) = 0 [pid 283] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=283, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f0901f924b0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0901f9a470}, NULL, 8) = 0 executing program rt_sigaction(SIGBUS, {sa_handler=0x7f0901f924b0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f0901f9a470}, NULL, 8) = 0 write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f08f9b88000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f08f9b88000, 138412032) = 0 [ 27.437033][ T24] audit: type=1400 audit(1748310751.830:64): avc: denied { execmem } for pid=282 comm="syz-executor113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 27.477136][ T24] audit: type=1400 audit(1748310751.870:65): avc: denied { read write } for pid=282 comm="syz-executor113" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 27.501393][ T24] audit: type=1400 audit(1748310751.870:66): avc: denied { open } for pid=282 comm="syz-executor113" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 27.525528][ T24] audit: type=1400 audit(1748310751.890:67): avc: denied { ioctl } for pid=282 comm="syz-executor113" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 close(4) = 0 mkdir("./file2", 0777) = 0 [ 27.622728][ T24] audit: type=1400 audit(1748310752.020:68): avc: denied { mounton } for pid=282 comm="syz-executor113" path="/root/file2" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 27.685026][ T282] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 27.698092][ T282] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 27.708649][ T282] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a00ec01c, mo2=0002] [ 27.716826][ T282] System zones: 1-12 [ 27.721907][ T282] EXT4-fs (loop0): 1 truncate cleaned up mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "auto_da_alloc=0x0000000000000006,jqfmt=vfsv0,debug_want_extra_isize=0x0000000000000064,debug,i_versi"...) = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 open("./file2", O_WRONLY|O_TRUNC|O_APPEND|O_NONBLOCK|O_DIRECT|O_LARGEFILE|O_CLOEXEC) = 4 [ 27.727552][ T282] EXT4-fs (loop0): mounted filesystem without journal. Opts: auto_da_alloc=0x0000000000000006,jqfmt=vfsv0,debug_want_extra_isize=0x0000000000000064,debug,i_version,quota,grpid,,errors=continue [ 27.746718][ T24] audit: type=1400 audit(1748310752.140:69): avc: denied { mount } for pid=282 comm="syz-executor113" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 27.774144][ T282] ================================================================== [ 27.775595][ T24] audit: type=1400 audit(1748310752.170:70): avc: denied { append } for pid=282 comm="syz-executor113" name="file2" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.782264][ T282] BUG: KASAN: use-after-free in ext4_xattr_set_entry+0xde3/0x36c0 [ 27.782283][ T282] Read of size 4 at addr ffff888108790048 by task syz-executor113/282 [ 27.804712][ T24] audit: type=1400 audit(1748310752.170:71): avc: denied { open } for pid=282 comm="syz-executor113" path="/root/file2/file2" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.812453][ T282] [ 27.812475][ T282] CPU: 0 PID: 282 Comm: syz-executor113 Not tainted 5.10.237-syzkaller #0 [ 27.812481][ T282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 27.812495][ T282] Call Trace: [ 27.820883][ T24] audit: type=1400 audit(1748310752.170:72): avc: denied { write } for pid=282 comm="syz-executor113" name="file2" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.843996][ T282] __dump_stack+0x21/0x24 [ 27.844017][ T282] dump_stack_lvl+0x169/0x1d8 [ 27.846894][ T24] audit: type=1400 audit(1748310752.170:73): avc: denied { setattr } for pid=282 comm="syz-executor113" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.854806][ T282] ? show_regs_print_info+0x18/0x18 [ 27.854818][ T282] ? thaw_kernel_threads+0x220/0x220 [ 27.854837][ T282] print_address_description+0x7f/0x2c0 [ 27.938229][ T282] ? ext4_xattr_set_entry+0xde3/0x36c0 [ 27.943705][ T282] kasan_report+0xe2/0x130 [ 27.948131][ T282] ? ext4_xattr_set_entry+0xde3/0x36c0 [ 27.953600][ T282] __asan_report_load4_noabort+0x14/0x20 [ 27.959309][ T282] ext4_xattr_set_entry+0xde3/0x36c0 [ 27.964891][ T282] ? ext4_xattr_ibody_set+0x360/0x360 [ 27.970298][ T282] ? kmem_cache_free+0x100/0x2d0 [ 27.975242][ T282] ? _raw_spin_lock+0x8e/0xe0 [ 27.980027][ T282] ? __mb_cache_entry_free+0x225/0x340 [ 27.985748][ T282] ? mb_cache_entry_delete_or_get+0x203/0x220 [ 27.991948][ T282] ext4_xattr_block_set+0x4d6/0x2a50 [ 27.997232][ T282] ? __kasan_check_read+0x11/0x20 [ 28.002255][ T282] ? __ext4_xattr_check_block+0x265/0x8e0 [ 28.007965][ T282] ? ext4_xattr_block_find+0x4f0/0x4f0 [ 28.013432][ T282] ext4_xattr_set_handle+0xbd5/0x12a0 [ 28.018787][ T282] ? ext4_xattr_set_entry+0x36c0/0x36c0 [ 28.024319][ T282] ? __kasan_check_read+0x11/0x20 [ 28.029388][ T282] ? __ext4_journal_start_sb+0x2e2/0x490 [ 28.035040][ T282] ext4_xattr_set+0x1ec/0x320 [ 28.039709][ T282] ? ext4_xattr_set_credits+0x290/0x290 [ 28.045265][ T282] ext4_xattr_trusted_set+0x3b/0x50 [ 28.050444][ T282] ? ext4_xattr_trusted_get+0x40/0x40 [ 28.055811][ T282] __vfs_setxattr+0x42a/0x480 [ 28.060474][ T282] __vfs_setxattr_noperm+0x11e/0x4e0 [ 28.065759][ T282] __vfs_setxattr_locked+0x203/0x220 [ 28.071029][ T282] vfs_setxattr+0x8d/0x1c0 [ 28.075434][ T282] setxattr+0x1a9/0x370 [ 28.079595][ T282] ? path_setxattr+0x210/0x210 [ 28.084346][ T282] ? __mnt_want_write+0x1e6/0x260 [ 28.090426][ T282] ? mnt_want_write+0x19d/0x270 [ 28.095273][ T282] path_setxattr+0x110/0x210 [ 28.099850][ T282] ? simple_xattr_list_add+0x120/0x120 [ 28.105295][ T282] ? debug_smp_processor_id+0x17/0x20 [ 28.110660][ T282] __x64_sys_lsetxattr+0xc2/0xe0 [ 28.115625][ T282] do_syscall_64+0x31/0x40 [ 28.120031][ T282] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.125912][ T282] RIP: 0033:0x7f0901fc7499 [ 28.130308][ T282] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 28.150002][ T282] RSP: 002b:00007ffd56945d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 28.158458][ T282] RAX: ffffffffffffffda RBX: 0072657070752e79 RCX: 00007f0901fc7499 [ 28.166521][ T282] RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 0000200000000100 [ 28.174500][ T282] RBP: 00007ffd56945e68 R08: 0000000000000000 R09: 00007f0902010160 [ 28.182473][ T282] R10: 000000000000fe37 R11: 0000000000000246 R12: 0000000000000000 [ 28.190425][ T282] R13: 00007ffd56946108 R14: 0000000000000001 R15: 0000000000000001 [ 28.198377][ T282] [ 28.200685][ T282] Allocated by task 0: [ 28.204764][ T282] __kasan_slab_alloc+0xbd/0xf0 [ 28.209595][ T282] slab_post_alloc_hook+0x5d/0x2f0 [ 28.214698][ T282] kmem_cache_alloc+0x165/0x2e0 [ 28.219530][ T282] __alloc_skb+0x9e/0x520 [ 28.223853][ T282] __napi_alloc_skb+0x158/0x2e0 [ 28.228718][ T282] page_to_skb+0x40/0x8b0 [ 28.233031][ T282] receive_buf+0xba1/0x4590 [ 28.237517][ T282] virtnet_poll+0x4f2/0xef0 [ 28.242012][ T282] net_rx_action+0x432/0xdd0 [ 28.246584][ T282] __do_softirq+0x255/0x563 [ 28.251065][ T282] [ 28.253397][ T282] Freed by task 270: [ 28.257279][ T282] kasan_set_track+0x4a/0x70 [ 28.262632][ T282] kasan_set_free_info+0x23/0x40 [ 28.267551][ T282] ____kasan_slab_free+0x125/0x160 [ 28.272646][ T282] __kasan_slab_free+0x11/0x20 [ 28.277396][ T282] slab_free_freelist_hook+0xc5/0x190 [ 28.282756][ T282] kmem_cache_free+0x100/0x2d0 [ 28.287507][ T282] kfree_skbmem+0x10c/0x180 [ 28.291993][ T282] __kfree_skb+0x58/0x70 [ 28.296222][ T282] tcp_recvmsg+0x1515/0x2e10 [ 28.300797][ T282] inet_recvmsg+0x134/0x470 [ 28.305288][ T282] sock_read_iter+0x2a2/0x340 [ 28.309952][ T282] vfs_read+0x874/0xa10 [ 28.314092][ T282] ksys_read+0x140/0x240 [ 28.318318][ T282] __x64_sys_read+0x7b/0x90 [ 28.322806][ T282] do_syscall_64+0x31/0x40 [ 28.327230][ T282] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.333098][ T282] [ 28.335449][ T282] The buggy address belongs to the object at ffff888108790000 [ 28.335449][ T282] which belongs to the cache skbuff_head_cache of size 248 [ 28.350032][ T282] The buggy address is located 72 bytes inside of [ 28.350032][ T282] 248-byte region [ffff888108790000, ffff8881087900f8) [ 28.363198][ T282] The buggy address belongs to the page: [ 28.368847][ T282] page:ffffea000421e400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108790 [ 28.379063][ T282] flags: 0x4000000000000200(slab) [ 28.384076][ T282] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888107d94780 [ 28.392647][ T282] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 28.401226][ T282] page dumped because: kasan: bad access detected [ 28.407628][ T282] page_owner tracks the page as allocated [ 28.413336][ T282] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 0, ts 20824981649, free_ts 20823670797 [ 28.429117][ T282] prep_new_page+0x179/0x180 [ 28.433696][ T282] get_page_from_freelist+0x2235/0x23d0 [ 28.439226][ T282] __alloc_pages_nodemask+0x268/0x5f0 [ 28.444581][ T282] new_slab+0x84/0x3f0 [ 28.448634][ T282] ___slab_alloc+0x2a6/0x450 [ 28.453211][ T282] __slab_alloc+0x63/0xa0 [ 28.457528][ T282] kmem_cache_alloc+0x1af/0x2e0 [ 28.462395][ T282] __alloc_skb+0x9e/0x520 [ 28.466710][ T282] __napi_alloc_skb+0x158/0x2e0 [ 28.471648][ T282] page_to_skb+0x40/0x8b0 [ 28.475983][ T282] receive_buf+0xba1/0x4590 [ 28.480469][ T282] virtnet_poll+0x4f2/0xef0 [ 28.484957][ T282] net_rx_action+0x432/0xdd0 [ 28.489530][ T282] __do_softirq+0x255/0x563 [ 28.494011][ T282] page last free stack trace: [ 28.498674][ T282] free_unref_page_prepare+0x2b7/0x2d0 [ 28.504116][ T282] free_unref_page+0x7f/0x180 [ 28.508778][ T282] __put_page+0xae/0xe0 [ 28.512921][ T282] anon_pipe_buf_release+0x189/0x220 [ 28.518208][ T282] pipe_read+0x53d/0xfe0 [ 28.522446][ T282] vfs_read+0x874/0xa10 [ 28.526585][ T282] ksys_read+0x140/0x240 [ 28.530810][ T282] __x64_sys_read+0x7b/0x90 [ 28.535296][ T282] do_syscall_64+0x31/0x40 [ 28.539699][ T282] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.545571][ T282] [ 28.547884][ T282] Memory state around the buggy address: [ 28.553501][ T282] ffff88810878ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.561548][ T282] ffff88810878ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.569595][ T282] >ffff888108790000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.577639][ T282] ^ lsetxattr("./file1", "trusted.overlay.upper", "\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65079, 0) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 28.584037][ T282] ffff888108790080: fb fb fb fb fb f