./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3554094763

<...>
  denied  { siginh } for  pid=304 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.1.133' (ECDSA) to the list of known hosts.
execve("./syz-executor3554094763", ["./syz-executor3554094763"], 0x7fff8d3d1c00 /* 10 vars */) = 0
brk(NULL)                               = 0x555557054000
brk(0x555557054c40)                     = 0x555557054c40
arch_prctl(ARCH_SET_FS, 0x555557054300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
set_tid_address(0x5555570545d0)         = 362
set_robust_list(0x5555570545e0, 24)     = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7f84fb3bb610, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f84fb3bbce0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7f84fb3bb6b0, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f84fb3bbce0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3554094763", 4096) = 28
brk(0x555557075c40)                     = 0x555557075c40
brk(0x555557076000)                     = 0x555557076000
mprotect(0x7f84fb47f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f84fb38b000
mprotect(0x7f84fb38c000, 131072, PROT_READ|PROT_WRITE) = 0
clone(child_stack=0x7f84fb3ab3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[363], tls=0x7f84fb3ab700, child_tidptr=0x7f84fb3ab9d0) = 363
futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 363 attached
 <unfinished ...>
[pid   363] set_robust_list(0x7f84fb3ab9e0, 24) = 0
[pid   363] mkdirat(AT_FDCWD, "./file0", 000) = 0
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid   362] <... futex resumed>)        = 0
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   363] openat(AT_FDCWD, "/dev/fuse", O_RDWR|O_CREAT, 000) = 3
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   362] <... futex resumed>)        = 0
[pid   363] <... futex resumed>)        = 1
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   363] mount(NULL, "./file0", "fuse", 0, "fd=0x0000000000000003,rootmode=00000000000000000040000,user_id=00000000000000000000,group_id=0000000"...) = 0
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   362] <... futex resumed>)        = 0
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   363] <... futex resumed>)        = 1
[pid   363] read(3, "\x38\x00\x00\x00\x1a\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x02\x00\xfb\xff\xff\x83", 8224) = 56
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   362] <... futex resumed>)        = 0
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   363] <... futex resumed>)        = 1
[pid   363] write(3, "\x50\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x21\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 80) = 80
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   362] <... futex resumed>)        = 0
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   363] <... futex resumed>)        = 1
[   29.898087][   T23] audit: type=1400 audit(1684441995.870:66): avc:  denied  { execmem } for  pid=362 comm="syz-executor355" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   29.921344][   T23] audit: type=1400 audit(1684441995.890:67): avc:  denied  { read write } for  pid=362 comm="syz-executor355" name="fuse" dev="devtmpfs" ino=9263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[pid   363] read(3,  <unfinished ...>
[pid   362] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   362] futex(0x7f84fb4854dc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f84fb36a000
[pid   362] mprotect(0x7f84fb36b000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   362] clone(child_stack=0x7f84fb38a3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[365], tls=0x7f84fb38a700, child_tidptr=0x7f84fb38a9d0) = 365
[pid   362] futex(0x7f84fb4854d8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] futex(0x7f84fb4854dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 365 attached
 <unfinished ...>
[pid   365] set_robust_list(0x7f84fb38a9e0, 24) = 0
[   29.945298][   T23] audit: type=1400 audit(1684441995.890:68): avc:  denied  { open } for  pid=362 comm="syz-executor355" path="/dev/fuse" dev="devtmpfs" ino=9263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[   29.968671][   T23] audit: type=1400 audit(1684441995.890:69): avc:  denied  { mounton } for  pid=362 comm="syz-executor355" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[pid   365] read(3,  <unfinished ...>
[pid   362] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   362] futex(0x7f84fb4854dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   362] futex(0x7f84fb4854dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   362] futex(0x7f84fb4854ec, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   362] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f84fb349000
[pid   362] mprotect(0x7f84fb34a000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   362] clone(child_stack=0x7f84fb3693f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[366], tls=0x7f84fb369700, child_tidptr=0x7f84fb3699d0) = 366
[pid   362] futex(0x7f84fb4854e8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 366 attached
) = 0
[pid   362] futex(0x7f84fb4854ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   366] set_robust_list(0x7f84fb3699e0, 24) = 0
[pid   366] openat(AT_FDCWD, "./file0/file0", O_RDONLY|O_CREAT, 000 <unfinished ...>
[pid   363] <... read resumed>"\x2e\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6e\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 46
[pid   363] write(3, "\x90\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 144) = 144
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   363] futex(0x7f84fb4854c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   365] <... read resumed>"\x3e\x00\x00\x00\x23\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6e\x01\x00\x00\x00\x00\x00\x00\x40\x80\x00\x00\x00\x80\x00\x00\x3f\x00\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 62
[pid   365] write(3, "\xa0\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 160) = 160
[pid   365] futex(0x7f84fb4854dc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[   29.991800][   T23] audit: type=1400 audit(1684441995.900:70): avc:  denied  { mount } for  pid=362 comm="syz-executor355" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[pid   365] futex(0x7f84fb4854d8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   362] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid   363] <... futex resumed>)        = 0
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   363] read(3, "\x28\x00\x00\x00\xe0\x07\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6e\x01\x00\x00\x00\x00\x00\x00", 8224) = 40
[pid   363] futex(0x7f84fb4854cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   362] <... futex resumed>)        = 0
[pid   363] <... futex resumed>)        = 1
[pid   362] futex(0x7f84fb4854c8, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   363] futex(0x7f84fb4854c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   362] <... futex resumed>)        = 0
[pid   363] <... futex resumed>)        = -1 EAGAIN (Resource temporarily unavailable)
[pid   362] futex(0x7f84fb4854cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[   30.088800][  T363] BUG: unable to handle page fault for address: ffffed105c5c55ff
[   30.096602][  T363] #PF: supervisor read access in kernel mode
[   30.102440][  T363] #PF: error_code(0x0000) - not-present page
[   30.108368][  T363] PGD 23fff3067 P4D 23fff3067 PUD 23fff1067 PMD 0 
[   30.114696][  T363] Oops: 0000 [#1] PREEMPT SMP KASAN
[   30.119834][  T363] CPU: 1 PID: 363 Comm: syz-executor355 Not tainted 5.4.233-syzkaller-00003-gf423d52eea72 #0
[   30.129905][  T363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[   30.139805][  T363] RIP: 0010:fuse_dev_do_write+0x21f0/0x4e00
[   30.145537][  T363] Code: d0 b3 ff 4d 8b 3f 4c 89 e0 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 cc 26 00 00 45 8b 24 24 41 ff cc 4d 01 fc 4c 89 e0 48 c1 e8 03 <0f> b6 04 18 84 c0 0f 85 cd 26 00 00 41 c6 04 24 00 41 80 3c 1e 00
[   30.165197][  T363] RSP: 0018:ffff8881dfb0f7e0 EFLAGS: 00010a07
[   30.171090][  T363] RAX: 1ffff1105c5c55ff RBX: dffffc0000000000 RCX: ffff8881e2db5e80
[   30.178902][  T363] RDX: 0000000000000000 RSI: 00000000000007e0 RDI: 00000000000007e0
[   30.186721][  T363] RBP: ffff8881dfb0fb30 R08: ffffffff81e005b0 R09: fffff94000ef44ff
[   30.194523][  T363] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8882e2e2afff
[   30.202336][  T363] R13: 0000000000000010 R14: 1ffff1103c5c4d70 R15: ffff8881e2e2b000
[   30.210150][  T363] FS:  00007f84fb3ab700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[   30.218917][  T363] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   30.225335][  T363] CR2: ffffed105c5c55ff CR3: 00000001e2e2d000 CR4: 00000000003406a0
[   30.233150][  T363] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   30.240966][  T363] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   30.248767][  T363] Call Trace:
[   30.252007][  T363]  ? ttwu_do_wakeup+0x161/0x480
[   30.256807][  T363]  ? check_preemption_disabled+0x9f/0x320
[   30.262879][  T363]  ? try_to_wake_up+0x790/0x14a0
[   30.267652][  T363]  ? debug_smp_processor_id+0x20/0x20
[   30.272868][  T363]  ? put_page+0xb0/0xb0
[   30.276834][  T363]  ? check_preemption_disabled+0x9f/0x320
[   30.282749][  T363]  ? check_preemption_disabled+0x9f/0x320
[   30.288301][  T363]  ? debug_smp_processor_id+0x20/0x20
[   30.293509][  T363]  ? check_preemption_disabled+0x9f/0x320
[   30.301927][  T363]  ? check_preemption_disabled+0x9f/0x320
[   30.307480][  T363]  ? debug_smp_processor_id+0x20/0x20
[   30.312689][  T363]  ? debug_smp_processor_id+0x20/0x20
[   30.317900][  T363]  ? switch_mm_irqs_off+0x325/0xab0
[   30.323078][  T363]  ? _raw_spin_unlock_irq+0x4a/0x60
[   30.328201][  T363]  ? finish_task_switch+0x130/0x590
[   30.333242][  T363]  fuse_dev_write+0x15b/0x1e0
[   30.337738][  T363]  ? fuse_dev_read+0x220/0x220
[   30.342334][  T363]  ? cgroup_update_frozen+0x157/0xab0
[   30.347543][  T363]  ? cgroup_leave_frozen+0x13c/0x290
[   30.352657][  T363]  ? iov_iter_init+0x82/0x160
[   30.357184][  T363]  __vfs_write+0x5d3/0x750
[   30.361423][  T363]  ? __kernel_write+0x350/0x350
[   30.366135][  T363]  ? selinux_file_permission+0x2be/0x530
[   30.371601][  T363]  ? security_file_permission+0x117/0x2f0
[   30.377135][  T363]  vfs_write+0x206/0x4e0
[   30.381214][  T363]  ksys_write+0x199/0x2c0
[   30.385383][  T363]  ? do_syscall_64+0x1c0/0x1c0
[   30.389980][  T363]  ? __ia32_sys_read+0x80/0x80
[   30.394578][  T363]  do_syscall_64+0xca/0x1c0
[   30.398921][  T363]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[   30.404656][  T363] Modules linked in:
[   30.408376][  T363] CR2: ffffed105c5c55ff
[   30.412400][  T363] ---[ end trace 0c0537fd75ec3f71 ]---
[   30.417698][  T363] RIP: 0010:fuse_dev_do_write+0x21f0/0x4e00
[   30.423547][  T363] Code: d0 b3 ff 4d 8b 3f 4c 89 e0 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 cc 26 00 00 45 8b 24 24 41 ff cc 4d 01 fc 4c 89 e0 48 c1 e8 03 <0f> b6 04 18 84 c0 0f 85 cd 26 00 00 41 c6 04 24 00 41 80 3c 1e 00
[   30.443266][  T363] RSP: 0018:ffff8881dfb0f7e0 EFLAGS: 00010a07
[   30.449291][  T363] RAX: 1ffff1105c5c55ff RBX: dffffc0000000000 RCX: ffff8881e2db5e80
[   30.457488][  T363] RDX: 0000000000000000 RSI: 00000000000007e0 RDI: 00000000000007e0
[   30.465262][  T363] RBP: ffff8881dfb0fb30 R08: ffffffff81e005b0 R09: fffff94000ef44ff
[   30.473592][  T363] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8882e2e2afff
[   30.481762][  T363] R13: 0000000000000010 R14: 1ffff1103c5c4d70 R15: ffff8881e2e2b000
[   30.489573][  T363] FS:  00007f84fb3ab700(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[   30.498327][  T363] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   30.504756][  T363] CR2: ffffed105c5c55ff CR3: 00000001e2e2d000 CR4: 00000000003406a0
[   30.512688][  T363] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   30.520494][  T363] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   30.528299][  T363] Kernel panic - not syncing: Fatal exception
[   30.534638][  T363] Kernel Offset: disabled
[   30.538771][  T363] Rebooting in 86400 seconds..