./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3849559825 <...> Warning: Permanently added '10.128.0.53' (ED25519) to the list of known hosts. execve("./syz-executor3849559825", ["./syz-executor3849559825"], 0x7fffbe63ecb0 /* 10 vars */) = 0 brk(NULL) = 0x555557541000 brk(0x555557541d40) = 0x555557541d40 arch_prctl(ARCH_SET_FS, 0x5555575413c0) = 0 set_tid_address(0x555557541690) = 297 set_robust_list(0x5555575416a0, 24) = 0 rseq(0x555557541ce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3849559825", 4096) = 28 getrandom("\x88\xe9\x27\x68\xb1\xda\x66\x58", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555557541d40 brk(0x555557562d40) = 0x555557562d40 brk(0x555557563000) = 0x555557563000 mprotect(0x7fb56822b000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557541690) = 298 ./strace-static-x86_64: Process 298 attached [pid 298] set_robust_list(0x5555575416a0, 24) = 0 [pid 298] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 298] setpgid(0, 0) = 0 [pid 298] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 298] write(3, "1000", 4) = 4 [pid 298] close(3) = 0 [pid 298] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] rt_sigaction(SIGRT_1, {sa_handler=0x7fb5681c6fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fb5681b8620}, NULL, 8) = 0 [pid 298] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb568141000 [pid 298] mprotect(0x7fb568142000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb568161990, parent_tid=0x7fb568161990, exit_signal=0, stack=0x7fb568141000, stack_size=0x20300, tls=0x7fb5681616c0} => {parent_tid=[299]}, 88) = 299 [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 299 attached [pid 299] set_robust_list(0x7fb5681619a0, 24) = 0 [pid 299] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] mkdir("./file0", 000) = 0 [pid 299] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [pid 299] openat(AT_FDCWD, "/dev/fuse", O_RDWR|O_CREAT, 000) = 3 [pid 299] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 299] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 0 [pid 299] mount(NULL, "./file0", "fuse", 0, "fd=0x0000000000000003,rootmode=0000000000000000040000,user_id=00000000000000000000,group_id=00000000"...) = 0 [pid 299] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [pid 299] read(3, "\x38\x00\x00\x00\x1a\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x20\x00\x00\x00\x00\x00\x02\x00\xfb\xff\xff\x83", 8224) = 56 [pid 299] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [pid 299] write(3, "\x50\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x27\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 80) = 80 [pid 299] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... futex resumed>) = 1 [pid 299] rename("./file0/../file0/file0", "./file0/../file0/file0" [pid 298] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7fb56823141c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb568120000 [pid 298] mprotect(0x7fb568121000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb568140990, parent_tid=0x7fb568140990, exit_signal=0, stack=0x7fb568120000, stack_size=0x20300, tls=0x7fb5681406c0}./strace-static-x86_64: Process 301 attached [pid 301] set_robust_list(0x7fb5681409a0, 24 [pid 298] <... clone3 resumed> => {parent_tid=[301]}, 88) = 301 [pid 301] <... set_robust_list resumed>) = 0 [pid 301] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 301] futex(0x7fb568231418, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] futex(0x7fb568231418, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 298] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... futex resumed>) = 0 [pid 301] read(3, "\x2e\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2b\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 46 [pid 301] write(3, "\x90\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 144) = 144 [pid 301] futex(0x7fb56823141c, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231418, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... futex resumed>) = 1 [ 18.486081][ T24] audit: type=1400 audit(1697386503.839:66): avc: denied { execmem } for pid=297 comm="syz-executor384" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.493072][ T24] audit: type=1400 audit(1697386503.849:67): avc: denied { read write } for pid=298 comm="syz-executor384" name="fuse" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 18.497903][ T24] audit: type=1400 audit(1697386503.849:68): avc: denied { open } for pid=298 comm="syz-executor384" path="/dev/fuse" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 18.502366][ T24] audit: type=1400 audit(1697386503.849:69): avc: denied { mounton } for pid=298 comm="syz-executor384" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 18.511540][ T24] audit: type=1400 audit(1697386503.849:70): avc: denied { mount } for pid=298 comm="syz-executor384" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [pid 301] newfstatat(AT_FDCWD, "./file0", [pid 298] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb5680ff000 [pid 298] mprotect(0x7fb568100000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb56811f990, parent_tid=0x7fb56811f990, exit_signal=0, stack=0x7fb5680ff000, stack_size=0x20300, tls=0x7fb56811f6c0} => {parent_tid=[302]}, 88) = 302 [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 302 attached [pid 302] set_robust_list(0x7fb56811f9a0, 24) = 0 [pid 302] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 302] read(3, "\x38\x00\x00\x00\x03\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2d\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 8192) = 56 [pid 302] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 302] read(3, "\x2e\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2b\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 46 [pid 302] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] read(3, [pid 298] <... futex resumed>) = 0 [pid 298] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 298] futex(0x7fb56823143c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb5680de000 [pid 298] mprotect(0x7fb5680df000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb5680fe990, parent_tid=0x7fb5680fe990, exit_signal=0, stack=0x7fb5680de000, stack_size=0x20300, tls=0x7fb5680fe6c0}./strace-static-x86_64: Process 303 attached => {parent_tid=[303]}, 88) = 303 [pid 303] set_robust_list(0x7fb5680fe9a0, 24 [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] futex(0x7fb568231438, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... set_robust_list resumed>) = 0 [pid 298] <... futex resumed>) = 0 [pid 303] rt_sigprocmask(SIG_SETMASK, [], [pid 298] futex(0x7fb56823143c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 303] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] write(3, "\xa0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x1f\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00"..., 160) = -1 EINVAL (Invalid argument) [pid 303] futex(0x7fb56823143c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 298] <... futex resumed>) = 0 [pid 303] futex(0x7fb568231438, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] exit_group(0 [pid 303] <... futex resumed>) = ? [pid 302] <... read resumed> ) = ? [pid 298] <... exit_group resumed>) = ? [pid 303] +++ exited with 0 +++ [pid 302] +++ exited with 0 +++ [pid 297] kill(-298, SIGKILL) = 0 [pid 297] kill(298, SIGKILL) = 0 [pid 297] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555557542730 /* 3 entries */, 32768) = 72 [pid 297] openat(AT_FDCWD, "/sys/fs/fuse/connections/27/abort", O_WRONLY) = 4 [pid 297] write(4, "/", 1) = 1 [pid 299] <... rename resumed>) = ? [pid 301] <... newfstatat resumed> ) = ? [pid 301] +++ exited with 0 +++ [pid 297] close(4) = 0 [pid 297] getdents64(3, 0x555557542730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 299] +++ exited with 0 +++ [pid 298] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=298, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 309 attached , child_tidptr=0x555557541690) = 309 [pid 309] set_robust_list(0x5555575416a0, 24) = 0 [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 309] setpgid(0, 0) = 0 [pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "1000", 4) = 4 [pid 309] close(3) = 0 [pid 309] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] rt_sigaction(SIGRT_1, {sa_handler=0x7fb5681c6fa0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fb5681b8620}, NULL, 8) = 0 [pid 309] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb568141000 [pid 309] mprotect(0x7fb568142000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb568161990, parent_tid=0x7fb568161990, exit_signal=0, stack=0x7fb568141000, stack_size=0x20300, tls=0x7fb5681616c0}./strace-static-x86_64: Process 310 attached => {parent_tid=[310]}, 88) = 310 [pid 310] set_robust_list(0x7fb5681619a0, 24) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [], [pid 310] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 309] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 310] <... futex resumed>) = 0 [pid 310] mkdir("./file0", 000) = -1 EEXIST (File exists) [pid 310] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 309] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 1 [pid 310] openat(AT_FDCWD, "/dev/fuse", O_RDWR|O_CREAT, 000) = 3 [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 310] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 309] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 310] <... futex resumed>) = 0 [pid 310] mount(NULL, "./file0", "fuse", 0, "fd=0x0000000000000003,rootmode=0000000000000000040000,user_id=00000000000000000000,group_id=00000000"... [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... mount resumed>) = 0 [pid 310] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 310] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 310] read(3, "\x38\x00\x00\x00\x1a\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x20\x00\x00\x00\x00\x00\x02\x00\xfb\xff\xff\x83", 8224) = 56 [pid 310] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 310] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... futex resumed>) = 1 [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 309] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 310] write(3, "\x50\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x27\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 80) = 80 [pid 310] futex(0x7fb56823140c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 310] futex(0x7fb568231408, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... futex resumed>) = 1 [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 309] futex(0x7fb568231408, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 310] rename("./file0/../file0/file0", "./file0/../file0/file0" [pid 309] <... futex resumed>) = 1 [ 23.618649][ T24] audit: type=1400 audit(1697386508.979:71): avc: denied { mounton } for pid=309 comm="syz-executor384" path="/root/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 309] futex(0x7fb56823140c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 309] futex(0x7fb56823141c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb568120000 [pid 309] mprotect(0x7fb568121000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb568140990, parent_tid=0x7fb568140990, exit_signal=0, stack=0x7fb568120000, stack_size=0x20300, tls=0x7fb5681406c0}./strace-static-x86_64: Process 312 attached => {parent_tid=[312]}, 88) = 312 [pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] futex(0x7fb568231418, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 312] set_robust_list(0x7fb5681409a0, 24) = 0 [pid 312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 312] read(3, "\x2e\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 46 [pid 312] write(3, "\x90\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 144) = 144 [pid 312] futex(0x7fb56823141c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7fb568231418, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 312] newfstatat(AT_FDCWD, "./file0", [pid 309] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 309] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 309] futex(0x7fb56823141c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 309] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb5680ff000 [pid 309] mprotect(0x7fb568100000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb56811f990, parent_tid=0x7fb56811f990, exit_signal=0, stack=0x7fb5680ff000, stack_size=0x20300, tls=0x7fb56811f6c0}./strace-static-x86_64: Process 313 attached => {parent_tid=[313]}, 88) = 313 [pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] set_robust_list(0x7fb56811f9a0, 24) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 313] read(3, "\x2e\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 46 [pid 313] write(3, "\x90\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 144) = 144 [pid 313] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] read(3, "\x38\x00\x00\x00\x03\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x38\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 8192) = 56 [pid 313] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] read(3, "\x2e\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8224) = 46 [pid 313] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7fb568231428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7fb56823142c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] write(3, "\xa0\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x1f\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00"..., 160) = 160 [pid 313] futex(0x7fb56823142c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 313] futex(0x7fb568231428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] <... futex resumed>) = 0 [ 23.742156][ T310] general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN [ 23.753676][ T310] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 23.761928][ T310] CPU: 1 PID: 310 Comm: syz-executor384 Not tainted 5.10.194-syzkaller-00508-ga27512601c2d #0 [ 23.772250][ T310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 23.782439][ T310] RIP: 0010:vfs_rename+0x103/0xda0 [ 23.787353][ T310] Code: c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 e5 09 f4 ff 48 8b 03 48 89 44 24 48 4c 89 74 24 20 4d 8d 7e 30 4d 89 fe 49 c1 ee 03 <43> 80 3c 26 00 74 08 4c 89 ff e8 be 09 f4 ff 49 8b 07 48 89 44 24 [ 23.806794][ T310] RSP: 0018:ffffc90000b57ba0 EFLAGS: 00010202 [ 23.812707][ T310] RAX: ffff88811c4dc000 RBX: ffff88811c49a360 RCX: ffff88811e70e2c0 [ 23.820501][ T310] RDX: ffff88811e70e2c0 RSI: 0000000000400000 RDI: 0000000000200000 [ 23.828312][ T310] RBP: ffffc90000b57cf0 R08: ffffffff81b3eaac R09: 0000000000000000 [pid 309] exit_group(0 [pid 313] <... futex resumed>) = ? [pid 309] <... exit_group resumed>) = ? [pid 313] +++ exited with 0 +++ [ 23.836125][ T310] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 23.843933][ T310] R13: ffff88811c4de880 R14: 0000000000000008 R15: 0000000000000040 [ 23.851745][ T310] FS: 00007fb5681616c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 23.860522][ T310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.867458][ T310] CR2: 00007fb56811fd58 CR3: 000000011e256000 CR4: 00000000003506a0 [ 23.875373][ T310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.883180][ T310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.891063][ T310] Call Trace: [ 23.894217][ T310] ? __die_body+0x62/0xb0 [ 23.898357][ T310] ? die_addr+0x9f/0xd0 [ 23.902353][ T310] ? exc_general_protection+0x3ff/0x490 [ 23.907735][ T310] ? asm_exc_general_protection+0x1e/0x30 [ 23.913294][ T310] ? vfs_rename+0xcc/0xda0 [ 23.917537][ T310] ? vfs_rename+0x103/0xda0 [ 23.921877][ T310] ? __kasan_check_write+0x14/0x20 [ 23.926822][ T310] ? lockref_put_return+0x1b7/0x210 [ 23.931865][ T310] ? lockref_get_or_lock+0x2b0/0x2b0 [ 23.936980][ T310] ? __ia32_sys_link+0x70/0x70 [ 23.941582][ T310] ? dput+0x2b0/0x310 [ 23.945396][ T310] ? __lookup_hash+0x203/0x290 [ 23.949995][ T310] do_renameat2+0x88d/0x1130 [ 23.954423][ T310] ? fsnotify_move+0x290/0x290 [ 23.959019][ T310] ? getname_flags+0x1fd/0x520 [ 23.963632][ T310] __x64_sys_rename+0x86/0x90 [ 23.968232][ T310] do_syscall_64+0x34/0x70 [ 23.972479][ T310] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 23.978209][ T310] RIP: 0033:0x7fb5681a1069 [ 23.982457][ T310] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 24.007235][ T310] RSP: 002b:00007fb568161218 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 24.015468][ T310] RAX: ffffffffffffffda RBX: 00007fb568231408 RCX: 00007fb5681a1069 [ 24.023280][ T310] RDX: 00007fb5681a1069 RSI: 0000000020000140 RDI: 0000000020000100 [ 24.031090][ T310] RBP: 00007fb568231400 R08: 0000000000000000 R09: 0000000000000000 [ 24.038905][ T310] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb5681fe114 [ 24.046712][ T310] R13: 0030656c69662f2e R14: 00007fb5681f8045 R15: 00007fb5681fc110 [ 24.054523][ T310] Modules linked in: [ 24.058828][ T310] ---[ end trace b8aeb2cba33e1144 ]--- [ 24.064153][ T310] RIP: 0010:vfs_rename+0x103/0xda0 [ 24.069080][ T310] Code: c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 e5 09 f4 ff 48 8b 03 48 89 44 24 48 4c 89 74 24 20 4d 8d 7e 30 4d 89 fe 49 c1 ee 03 <43> 80 3c 26 00 74 08 4c 89 ff e8 be 09 f4 ff 49 8b 07 48 89 44 24 [ 24.090784][ T310] RSP: 0018:ffffc90000b57ba0 EFLAGS: 00010202 [ 24.096635][ T310] RAX: ffff88811c4dc000 RBX: ffff88811c49a360 RCX: ffff88811e70e2c0 [ 24.104566][ T310] RDX: ffff88811e70e2c0 RSI: 0000000000400000 RDI: 0000000000200000 [ 24.112362][ T310] RBP: ffffc90000b57cf0 R08: ffffffff81b3eaac R09: 0000000000000000 [ 24.120184][ T310] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 24.127981][ T310] R13: ffff88811c4de880 R14: 0000000000000008 R15: 0000000000000040 [ 24.135780][ T310] FS: 00007fb5681616c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 24.144688][ T310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.151097][ T310] CR2: 00007fb56811fd58 CR3: 000000011e256000 CR4: 00000000003506a0 [ 24.158927][ T310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.167339][ T310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.176076][ T310] Kernel panic - not syncing: Fatal exception [ 24.182779][ T310] Kernel Offset: disabled [ 24.189049][ T310] Rebooting in 86400 seconds..