./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1910422796 <...> syzkaller syzkaller login: [ 11.255501][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 12.328592][ T24] kauditd_printk_skb: 60 callbacks suppressed [ 12.328599][ T24] audit: type=1400 audit(1660738808.549:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.335252][ T24] audit: type=1400 audit(1660738808.549:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[11292]" dev="pipefs" ino=11292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 12.565065][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 12.567670][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.904867][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! Warning: Permanently added '10.128.0.243' (ECDSA) to the list of known hosts. execve("./syz-executor1910422796", ["./syz-executor1910422796"], 0x7ffe88039ee0 /* 10 vars */) = 0 brk(NULL) = 0x55555594d000 brk(0x55555594dc40) = 0x55555594dc40 arch_prctl(ARCH_SET_FS, 0x55555594d300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1910422796", 4096) = 28 brk(0x55555596ec40) = 0x55555596ec40 brk(0x55555596f000) = 0x55555596f000 mprotect(0x7f8e02fca000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 ftruncate(3, 2097152) = 0 pwrite64(3, "\x20\x00\x00\x00\x00\x02\x00\x00\x19\x00\x00\x00\x90\x01\x00\x00\x0f\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\x00\x00\x00\x08\x00\x00\x80\x00\x00\x20\x00\x00\x00\xdb\xf4\x65\x5f\xdb\xf4\x65\x5f\x01\x00\xff\xff\x53\xef\x01\x00\x01\x00\x00\x00\xda\xf4\x65\x5f\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x04\x00\x00\x08\x00\x00\x00\xd2\xc2\x00\x00"..., 102, 1024) = 102 pwrite64(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x82\xe3\x67\x24\xc6\xf3\x4c\xaa\x84\x6e\xd2\xe5\x27\x70\x33\x78\x01\x00\x40", 31, 1248) = 31 pwrite64(3, "\x02\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x19\x00\x0f\x00\x03\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x2e\x69", 32, 4096) = 32 pwrite64(3, "\x7f\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"..., 4098, 8192) = 4098 pwrite64(3, "\xed\x41\x00\x00\x10\x00\x00\x00\xda\xf4\x65\x5f\xdb\xf4\x65\x5f\xdb\xf4\x65\x5f\x00\x00\x00\x00\x00\x00\x04\x00\x80\x00\x00\x00\x00\x00\x08\x00\x05\x00\x00\x00\x0a\xf3\x01\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x10", 61, 17408) = 61 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 mkdir("./file0", 0777) = 0 mount("/dev/loop0", "./file0", "ext4", 0, ",errors=continue") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 5 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 close(3) = 0 chdir("./file0") = 0 open("./file0", O_RDWR|O_CREAT|O_EXCL|O_DIRECT|FASYNC, 000) = 3 write(3, "\x34\xfd\x98\xaa\x1d\x0e\x7a\xde\xc9\x37\xa5\xf3\x31\xa7\x5f\x48\x79\x34\xf5\x02\x42\xa0\x75\x19\x44\x93\x69\x72\x89\x6c\x29\xa5\x06\x8c\x8e\xcb\xa1\xaa\x0a\x4e\x2a\x63\x1b\x51\x80\xe1\xfb\xde\x79\xf4\x50\x2d\xc4\xc4\xa1\xfb\xa9\xdc\xd9\xed\x83\xe6\x39\xae\xfa\x1b\x87\x63\x1c\x33\xd1\xa8\x2c\xb0\xc0\x03\x56\x76\xdd\xfe\xb0\xfe\x79\x84\xd7\x51\x9b\x0f\x83\x9d\x49\x7f\xc9\xd6\x4e\xf1\x4d\x1d\xe2\x22"..., 512) = 512 open("./file0", O_RDWR|O_CREAT|O_SYNC|O_NOATIME, 000) = 4 write(3, "\x28\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 40) = -1 EINVAL (Invalid argument) [ 20.406869][ T24] audit: type=1400 audit(1660738816.629:73): avc: denied { execmem } for pid=371 comm="syz-executor191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.410242][ T24] audit: type=1400 audit(1660738816.629:74): avc: denied { read write } for pid=371 comm="syz-executor191" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 20.413705][ T24] audit: type=1400 audit(1660738816.629:75): avc: denied { open } for pid=371 comm="syz-executor191" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 20.417988][ T24] audit: type=1400 audit(1660738816.629:76): avc: denied { ioctl } for pid=371 comm="syz-executor191" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 20.418622][ T371] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 20.421649][ T24] audit: type=1400 audit(1660738816.629:77): avc: denied { mounton } for pid=371 comm="syz-executor191" path="/root/file0" dev="sda1" ino=1138 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 20.426612][ T24] audit: type=1400 audit(1660738816.639:78): avc: denied { mount } for pid=371 comm="syz-executor191" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 20.428029][ T371] ------------[ cut here ]------------ [ 20.445776][ T24] audit: type=1400 audit(1660738816.649:79): avc: denied { write } for pid=371 comm="syz-executor191" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 20.467519][ T371] kernel BUG at fs/ext4/inode.c:2753! [ 20.472507][ T24] audit: type=1400 audit(1660738816.649:80): avc: denied { add_name } for pid=371 comm="syz-executor191" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 20.477640][ T371] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 20.498674][ T24] audit: type=1400 audit(1660738816.649:81): avc: denied { create } for pid=371 comm="syz-executor191" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 20.504494][ T371] CPU: 0 PID: 371 Comm: syz-executor191 Not tainted 5.10.136-syzkaller-01853-gee965fe12def #0 [ 20.525153][ T24] audit: type=1400 audit(1660738816.649:82): avc: denied { read write open } for pid=371 comm="syz-executor191" path="/root/file0/file0" dev="loop0" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 20.535158][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 [ 20.535175][ T371] RIP: 0010:ext4_writepages+0x36ca/0x36f0 [ 20.535191][ T371] Code: c6 31 ff e8 f8 1b 90 ff 84 db 75 2c e8 df 18 90 ff 49 bf 00 00 00 00 00 fc ff df 4c 8b 64 24 48 e9 3f f7 ff ff e8 c6 18 90 ff <0f> 0b e8 bf 18 90 ff e8 99 a6 23 ff eb 9d e8 b3 18 90 ff e8 8d a6 [ 20.594454][ T371] RSP: 0018:ffffc9000027f300 EFLAGS: 00010293 [ 20.600501][ T371] RAX: ffffffff81dcad7a RBX: 0000008000000000 RCX: ffff8881075fe2c0 [ 20.608457][ T371] RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 [ 20.616399][ T371] RBP: ffffc9000027f6f0 R08: ffffffff81dc7d47 R09: ffffed102352800b [ 20.624339][ T371] R10: ffffed102352800b R11: 1ffff1102352800a R12: ffffc9000027f5c0 [ 20.632282][ T371] R13: 0000000000000001 R14: 000000c410000000 R15: ffffc9000027f860 [ 20.640230][ T371] FS: 000055555594d300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 20.649126][ T371] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 20.655677][ T371] CR2: 0000564e2562d430 CR3: 000000011e255000 CR4: 00000000003506b0 [ 20.663624][ T371] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 20.671565][ T371] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 20.679515][ T371] Call Trace: [ 20.682779][ T371] ? __kasan_check_read+0x11/0x20 [ 20.687777][ T371] ? __getblk_gfp+0x3c/0x2a0 [ 20.692332][ T371] ? __kasan_check_read+0x11/0x20 [ 20.697345][ T371] ? __ext4_get_inode_loc+0x45c/0xd70 [ 20.702689][ T371] ? domain_dirty_limits+0x2aa/0x3c0 [ 20.707941][ T371] ? __kasan_check_read+0x11/0x20 [ 20.712930][ T371] ? balance_dirty_pages+0x23c5/0x2650 [ 20.718354][ T371] ? mark_buffer_dirty+0x1f8/0x310 [ 20.723433][ T371] ? ext4_readpage+0x220/0x220 [ 20.728179][ T371] ? ext4_blocks_for_truncate+0x240/0x240 [ 20.733865][ T371] ? balance_dirty_pages_ratelimited+0xf60/0xf60 [ 20.740176][ T371] ? __page_pinner_migration_failed+0xdd/0x250 [ 20.746395][ T371] ? ext4_readpage+0x220/0x220 [ 20.751135][ T371] do_writepages+0x13a/0x280 [ 20.755789][ T371] ? __writepage+0x130/0x130 [ 20.760358][ T371] ? __kasan_check_write+0x14/0x20 [ 20.765442][ T371] ? _raw_spin_unlock+0x4d/0x70 [ 20.770262][ T371] __filemap_fdatawrite_range+0x354/0x420 [ 20.776019][ T371] ? filemap_check_errors+0x120/0x120 [ 20.781358][ T371] ? generic_perform_write+0x51c/0x5b0 [ 20.786783][ T371] file_write_and_wait_range+0x89/0x120 [ 20.792300][ T371] ext4_sync_file+0x19e/0x9d0 [ 20.796947][ T371] vfs_fsync_range+0x17b/0x190 [ 20.801710][ T371] ext4_buffered_write_iter+0x565/0x610 [ 20.807222][ T371] ext4_file_write_iter+0x192/0x1cd0 [ 20.812485][ T371] ? native_set_ldt+0x360/0x360 [ 20.817305][ T371] ? compat_start_thread+0x80/0x80 [ 20.822400][ T371] ? avc_policy_seqno+0x1b/0x70 [ 20.827217][ T371] ? selinux_file_permission+0x2a9/0x520 [ 20.832818][ T371] ? fsnotify_perm+0x67/0x4e0 [ 20.837468][ T371] ? ext4_file_read_iter+0x4d0/0x4d0 [ 20.842719][ T371] ? security_file_permission+0xa8/0xc0 [ 20.848241][ T371] ? iov_iter_init+0x3f/0x120 [ 20.852888][ T371] vfs_write+0xc1c/0xf40 [ 20.857459][ T371] ? __kasan_check_write+0x14/0x20 [ 20.862543][ T371] ? kernel_write+0x3c0/0x3c0 [ 20.867205][ T371] ? _raw_spin_unlock_irq+0x4e/0x70 [ 20.872369][ T371] ? ptrace_stop+0x6ff/0x9f0 [ 20.876929][ T371] ? __kasan_check_read+0x11/0x20 [ 20.881919][ T371] ? __fdget_pos+0x27e/0x310 [ 20.886476][ T371] ksys_write+0x198/0x2c0 [ 20.890788][ T371] ? do_notify_parent+0xa40/0xa40 [ 20.895779][ T371] ? __ia32_sys_read+0x90/0x90 [ 20.900527][ T371] ? do_sys_openat2+0x470/0x470 [ 20.905347][ T371] __x64_sys_write+0x7b/0x90 [ 20.909906][ T371] do_syscall_64+0x34/0x70 [ 20.914293][ T371] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 20.920155][ T371] RIP: 0033:0x7f8e02f5d029 [ 20.924539][ T371] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 20.944214][ T371] RSP: 002b:00007ffe858be388 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 20.952593][ T371] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f8e02f5d029 [ 20.960532][ T371] RDX: 0000000000000016 RSI: 0000000020000380 RDI: 0000000000000004 [ 20.968475][ T371] RBP: 00007f8e02f1c820 R08: 0000000000000000 R09: 0000000000000000 [ 20.976427][ T371] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8e02f1c8b0 [ 20.984378][ T371] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 20.992319][ T371] Modules linked in: [ 20.996489][ T371] ---[ end trace 4c2a8eefee83e14f ]--- [ 21.001941][ T371] RIP: 0010:ext4_writepages+0x36ca/0x36f0 [ 21.007997][ T371] Code: c6 31 ff e8 f8 1b 90 ff 84 db 75 2c e8 df 18 90 ff 49 bf 00 00 00 00 00 fc ff df 4c 8b 64 24 48 e9 3f f7 ff ff e8 c6 18 90 ff <0f> 0b e8 bf 18 90 ff e8 99 a6 23 ff eb 9d e8 b3 18 90 ff e8 8d a6 [ 21.027611][ T371] RSP: 0018:ffffc9000027f300 EFLAGS: 00010293 [ 21.033668][ T371] RAX: ffffffff81dcad7a RBX: 0000008000000000 RCX: ffff8881075fe2c0 [ 21.041648][ T371] RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 [ 21.049722][ T371] RBP: ffffc9000027f6f0 R08: ffffffff81dc7d47 R09: ffffed102352800b [ 21.057720][ T371] R10: ffffed102352800b R11: 1ffff1102352800a R12: ffffc9000027f5c0 [ 21.065706][ T371] R13: 0000000000000001 R14: 000000c410000000 R15: ffffc9000027f860 [ 21.073675][ T371] FS: 000055555594d300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 21.082682][ T371] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.089305][ T371] CR2: 0000564e2562d430 CR3: 000000011e255000 CR4: 00000000003506b0 [ 21.097316][ T371] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.105290][ T371] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 21.113241][ T371] Kernel panic - not syncing: Fatal exception [ 21.119534][ T371] Kernel Offset: disabled [ 21.123836][ T371] Rebooting in 86400 seconds..