./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2892159737 <...> [ 5.079672][ T23] audit: type=1400 audit(1684349291.370:9): avc: denied { append open } for pid=144 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=10146 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 5.089344][ T23] audit: type=1400 audit(1684349291.370:10): avc: denied { getattr } for pid=144 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=10146 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 5.232510][ T161] udevd[161]: starting version 3.2.11 [ 5.317593][ T162] udevd[162]: starting eudev-3.2.11 [ 14.232653][ T23] kauditd_printk_skb: 50 callbacks suppressed [ 14.232664][ T23] audit: type=1400 audit(1684349300.560:61): avc: denied { transition } for pid=287 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.242823][ T23] audit: type=1400 audit(1684349300.560:62): avc: denied { noatsecure } for pid=287 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.248911][ T23] audit: type=1400 audit(1684349300.560:63): avc: denied { write } for pid=287 comm="sh" path="pipe:[1702]" dev="pipefs" ino=1702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.263442][ T23] audit: type=1400 audit(1684349300.560:64): avc: denied { rlimitinh } for pid=287 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.282092][ T23] audit: type=1400 audit(1684349300.560:65): avc: denied { siginh } for pid=287 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.10.3' (ECDSA) to the list of known hosts. execve("./syz-executor2892159737", ["./syz-executor2892159737"], 0x7ffe08ea1bb0 /* 10 vars */) = 0 brk(NULL) = 0x555556d38000 brk(0x555556d38c40) = 0x555556d38c40 arch_prctl(ARCH_SET_FS, 0x555556d38300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2892159737", 4096) = 28 brk(0x555556d59c40) = 0x555556d59c40 brk(0x555556d5a000) = 0x555556d5a000 mprotect(0x7f17fe3a4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f17f5eeb000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f17f5eeb000, 262144) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 24.371972][ T23] audit: type=1400 audit(1684349310.700:66): avc: denied { execmem } for pid=357 comm="syz-executor289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.394429][ T23] audit: type=1400 audit(1684349310.720:67): avc: denied { read write } for pid=357 comm="syz-executor289" name="loop0" dev="devtmpfs" ino=1149 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.419468][ T23] audit: type=1400 audit(1684349310.720:68): avc: denied { open } for pid=357 comm="syz-executor289" path="/dev/loop0" dev="devtmpfs" ino=1149 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.443978][ T23] audit: type=1400 audit(1684349310.720:69): avc: denied { ioctl } for pid=357 comm="syz-executor289" path="/dev/loop0" dev="devtmpfs" ino=1149 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 ioctl(4, LOOP_CLR_FD) = 0 [ 24.453410][ T357] EXT4-fs (loop0): 1 orphan inode deleted [ 24.469548][ T23] audit: type=1400 audit(1684349310.720:70): avc: denied { mounton } for pid=357 comm="syz-executor289" path="/root/file1" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 24.475291][ T357] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue close(4) = 0 open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 open("./bus", O_RDWR|O_CREAT|O_NONBLOCK|O_SYNC|O_DIRECT|O_NOATIME|O_CLOEXEC|0x3c, 000) = 5 write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 262144 [ 24.506597][ T23] audit: type=1400 audit(1684349310.840:71): avc: denied { mount } for pid=357 comm="syz-executor289" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.506606][ T357] ext4 filesystem being mounted at /root/file1 supports timestamps until 2038 (0x7fffffff) [ 24.538472][ T23] audit: type=1400 audit(1684349310.860:72): avc: denied { write } for pid=357 comm="syz-executor289" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.541811][ T357] EXT4-fs error (device loop0): ext4_xattr_block_get:549: inode #16: comm syz-executor289: corrupted xattr block 37 [ 24.560740][ T23] audit: type=1400 audit(1684349310.860:73): avc: denied { add_name } for pid=357 comm="syz-executor289" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.572913][ T357] EXT4-fs error (device loop0) in ext4_reserve_inode_write:6082: Corrupt filesystem [ 24.593345][ T23] audit: type=1400 audit(1684349310.860:74): avc: denied { create } for pid=357 comm="syz-executor289" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 24.602741][ T357] ------------[ cut here ]------------ [ 24.622602][ T23] audit: type=1400 audit(1684349310.860:75): avc: denied { read write open } for pid=357 comm="syz-executor289" path="/root/file1/bus" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 24.627542][ T357] kernel BUG at fs/ext4/ext4.h:2981! [ 24.656333][ T357] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 24.662169][ T357] CPU: 1 PID: 357 Comm: syz-executor289 Not tainted 5.4.233-syzkaller-00003-gf423d52eea72 #0 [ 24.672247][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 [ 24.682224][ T357] RIP: 0010:ext4_mb_find_by_goal+0xc10/0xc50 [ 24.688028][ T357] Code: fc ff ff 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c 0d fc ff ff 48 89 d7 e8 7f 90 c8 ff 48 8b 54 24 30 e9 fb fb ff ff e8 40 d8 98 ff <0f> 0b e8 e9 a1 6f ff e8 34 d8 98 ff 0f 0b e8 2d d8 98 ff 0f 0b e8 [ 24.707561][ T357] RSP: 0018:ffff8881dc0366a0 EFLAGS: 00010293 [ 24.713549][ T357] RAX: ffffffff81cb4600 RBX: 0000000000000001 RCX: ffff8881e019bf00 [ 24.721380][ T357] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 24.729281][ T357] RBP: ffff8881dc0367b0 R08: ffffffff81cb3b29 R09: ffffed103d37ec8e [ 24.737161][ T357] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001 [ 24.744967][ T357] R13: ffff8881dc0793f0 R14: 1ffff1103b806ce4 R15: 1ffff1103b80f27e [ 24.752787][ T357] FS: 0000555556d38300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 24.761548][ T357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.768059][ T357] CR2: 00000000200400bf CR3: 00000001dd0da000 CR4: 00000000003406a0 [ 24.775952][ T357] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.783764][ T357] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.791570][ T357] Call Trace: [ 24.794711][ T357] ? ext4_mb_new_blocks+0x29f/0x2d10 [ 24.799830][ T357] ? ext4_map_blocks+0xa83/0x1c40 [ 24.804789][ T357] ? __blockdev_direct_IO+0x16b1/0x49b0 [ 24.810156][ T357] ? ext4_mb_use_inode_pa+0x4a0/0x4a0 [ 24.815596][ T357] ? ext4_file_write_iter+0x8f8/0x10e0 [ 24.820835][ T357] ? __vfs_write+0x5d3/0x750 [ 24.825261][ T357] ? vfs_write+0x206/0x4e0 [ 24.829516][ T357] ? ksys_write+0x199/0x2c0 [ 24.833854][ T357] ? do_syscall_64+0xca/0x1c0 [ 24.838376][ T357] ext4_mb_regular_allocator+0x229/0x10d0 [ 24.844022][ T357] ? memcpy+0x38/0x50 [ 24.847834][ T357] ? ext4_mb_normalize_request+0x1090/0x1090 [ 24.853649][ T357] ext4_mb_new_blocks+0x59a/0x2d10 [ 24.858597][ T357] ? memset+0x1f/0x40 [ 24.862411][ T357] ? ext4_ext_check_overlap+0x180/0x5b0 [ 24.867881][ T357] ? ext4_inode_to_goal_block+0x265/0x360 [ 24.873435][ T357] ext4_ext_map_blocks+0x1e70/0x7450 [ 24.878570][ T357] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 24.884458][ T357] ? get_page_from_freelist+0x2d13/0x2d90 [ 24.890100][ T357] ? check_preemption_disabled+0x9f/0x320 [ 24.895675][ T357] ? debug_smp_processor_id+0x20/0x20 [ 24.902091][ T357] ? ext4_ext_release+0x10/0x10 [ 24.906792][ T357] ? _raw_spin_trylock_bh+0x190/0x190 [ 24.911971][ T357] ? check_preemption_disabled+0x9f/0x320 [ 24.917613][ T357] ? debug_smp_processor_id+0x20/0x20 [ 24.922819][ T357] ? vm_normal_page+0x1c9/0x1d0 [ 24.927515][ T357] ? _raw_read_unlock+0x21/0x40 [ 24.932195][ T357] ? ext4_es_lookup_extent+0x54f/0x9c0 [ 24.937492][ T357] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 24.943393][ T357] ext4_map_blocks+0xa83/0x1c40 [ 24.948084][ T357] ? ext4_issue_zeroout+0x150/0x150 [ 24.953118][ T357] _ext4_get_block+0x21b/0x610 [ 24.957717][ T357] ? ext4_get_block+0x40/0x40 [ 24.962225][ T357] ? __ext4_journal_start_sb+0x295/0x460 [ 24.967695][ T357] ext4_get_block_trans+0x41a/0x5b0 [ 24.972733][ T357] ? gup_pgd_range+0x1640/0x1640 [ 24.977501][ T357] ? ext4_dio_get_block+0xb0/0xb0 [ 24.982366][ T357] ? iov_iter_get_pages+0x233/0x760 [ 24.987398][ T357] ? ext4_get_block_unwritten+0x30/0x30 [ 24.992781][ T357] __blockdev_direct_IO+0x16b1/0x49b0 [ 24.997998][ T357] ? sb_init_dio_done_wq+0x80/0x80 [ 25.002933][ T357] ? ext4_get_block_unwritten+0x30/0x30 [ 25.008318][ T357] ? __sync_dirty_buffer+0x2d7/0x320 [ 25.013442][ T357] ? down_write+0xd7/0x150 [ 25.017689][ T357] ? up_read+0x1b0/0x1b0 [ 25.021767][ T357] ? __ext4_journal_start_sb+0x295/0x460 [ 25.027232][ T357] ? ext4_get_block_unwritten+0x30/0x30 [ 25.032614][ T357] ext4_direct_IO+0xc36/0x19a0 [ 25.037218][ T357] ? ext4_releasepage+0x2b0/0x2b0 [ 25.042079][ T357] ? memset+0x1f/0x40 [ 25.046330][ T357] ? invalidate_inode_pages2_range+0xe6f/0xf30 [ 25.052318][ T357] ? mb_cache_entry_put+0x90/0x90 [ 25.057179][ T357] ? down_write_trylock+0x130/0x130 [ 25.062217][ T357] ? __ext4_xattr_check_block+0x24b/0x890 [ 25.067769][ T357] ? debug_smp_processor_id+0x20/0x20 [ 25.072981][ T357] ? invalidate_mapping_pages+0xa50/0xa50 [ 25.078534][ T357] ? ext4_xattr_get+0x53c/0x7f0 [ 25.083221][ T357] ? debug_smp_processor_id+0x20/0x20 [ 25.088424][ T357] ? ktime_get_coarse_real_ts64+0xcc/0xe0 [ 25.093979][ T357] ? filemap_check_errors+0xda/0x130 [ 25.099102][ T357] generic_file_direct_write+0x509/0x740 [ 25.104662][ T357] ? pagecache_write_end+0xa0/0xa0 [ 25.109602][ T357] ? file_update_time+0x34d/0x470 [ 25.114463][ T357] ? file_remove_privs+0x640/0x640 [ 25.119409][ T357] ? debug_smp_processor_id+0x20/0x20 [ 25.124620][ T357] ? down_write_trylock+0xd7/0x130 [ 25.129569][ T357] __generic_file_write_iter+0x27d/0x530 [ 25.135121][ T357] ext4_file_write_iter+0x8f8/0x10e0 [ 25.140245][ T357] ? ext4_file_read_iter+0x140/0x140 [ 25.145379][ T357] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 25.150317][ T357] ? cgroup_update_frozen+0x157/0xab0 [ 25.155521][ T357] ? cgroup_update_frozen+0x157/0xab0 [ 25.160738][ T357] ? cgroup_leave_frozen+0x13c/0x290 [ 25.165858][ T357] ? iov_iter_init+0x82/0x160 [ 25.170473][ T357] __vfs_write+0x5d3/0x750 [ 25.174752][ T357] ? __kernel_write+0x350/0x350 [ 25.179450][ T357] ? check_preemption_disabled+0x9f/0x320 [ 25.184956][ T357] ? debug_smp_processor_id+0x20/0x20 [ 25.190182][ T357] ? selinux_file_permission+0x2be/0x530 [ 25.195645][ T357] vfs_write+0x206/0x4e0 [ 25.199728][ T357] ksys_write+0x199/0x2c0 [ 25.203881][ T357] ? do_syscall_64+0x1c0/0x1c0 [ 25.208701][ T357] ? __ia32_sys_read+0x80/0x80 [ 25.213379][ T357] do_syscall_64+0xca/0x1c0 [ 25.217982][ T357] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 25.223797][ T357] Modules linked in: [ 25.227814][ T357] ---[ end trace 0ac9c20f36b64924 ]--- [ 25.233130][ T357] RIP: 0010:ext4_mb_find_by_goal+0xc10/0xc50 [ 25.238903][ T357] Code: fc ff ff 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c 0d fc ff ff 48 89 d7 e8 7f 90 c8 ff 48 8b 54 24 30 e9 fb fb ff ff e8 40 d8 98 ff <0f> 0b e8 e9 a1 6f ff e8 34 d8 98 ff 0f 0b e8 2d d8 98 ff 0f 0b e8 [ 25.258850][ T357] RSP: 0018:ffff8881dc0366a0 EFLAGS: 00010293 [ 25.264937][ T357] RAX: ffffffff81cb4600 RBX: 0000000000000001 RCX: ffff8881e019bf00 [ 25.272728][ T357] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 25.280526][ T357] RBP: ffff8881dc0367b0 R08: ffffffff81cb3b29 R09: ffffed103d37ec8e [ 25.288365][ T357] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001 [ 25.296167][ T357] R13: ffff8881dc0793f0 R14: 1ffff1103b806ce4 R15: 1ffff1103b80f27e [ 25.304098][ T357] FS: 0000555556d38300(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 25.312954][ T357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.319470][ T357] CR2: 00000000200400bf CR3: 00000001dd0da000 CR4: 00000000003406a0 [ 25.327326][ T357] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.335216][ T357] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.343023][ T357] Kernel panic - not syncing: Fatal exception [ 25.349360][ T357] Kernel Offset: disabled [ 25.353590][ T357] Rebooting in 86400 seconds..