./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor939653964 <...> [ 3.060037][ T30] audit: type=1400 audit(1667360064.489:9): avc: denied { append open } for pid=164 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 3.063213][ T30] audit: type=1400 audit(1667360064.489:10): avc: denied { getattr } for pid=164 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 3.074657][ T166] acpid (166) used greatest stack depth: 24200 bytes left [ 3.346168][ T181] udevd[181]: starting version 3.2.10 [ 3.403593][ T182] udevd[182]: starting eudev-3.2.10 [ 3.405445][ T181] udevd (181) used greatest stack depth: 22976 bytes left [ 13.312529][ T30] kauditd_printk_skb: 49 callbacks suppressed [ 13.312538][ T30] audit: type=1400 audit(1667360074.759:60): avc: denied { transition } for pid=319 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.318021][ T30] audit: type=1400 audit(1667360074.759:61): avc: denied { write } for pid=319 comm="sh" path="pipe:[12623]" dev="pipefs" ino=12623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 14.584282][ T322] scp (322) used greatest stack depth: 22368 bytes left Warning: Permanently added '10.128.0.56' (ECDSA) to the list of known hosts. execve("./syz-executor939653964", ["./syz-executor939653964"], 0x7ffe14a898d0 /* 10 vars */) = 0 brk(NULL) = 0x555556fa0000 brk(0x555556fa0c40) = 0x555556fa0c40 arch_prctl(ARCH_SET_FS, 0x555556fa0300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor939653964", 4096) = 27 brk(0x555556fc1c40) = 0x555556fc1c40 brk(0x555556fc2000) = 0x555556fc2000 mprotect(0x7f72d7af8000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 ftruncate(3, 135266304) = 0 pwrite64(3, "\xe2\xe1\xf5\xe0\x95\x21\xe9\x3c\x02\x00\x00\x00\x0c\x00\x24", 15, 1024) = 15 pwrite64(3, "\x03\x00\x45\x31\x95\x44\x1e\x5a\x35\x5a", 10, 1152) = 10 pwrite64(3, "\xce\x37\x0d\x67\x73\x43\x27\x2d\x1c\x00\xb9\xf2\xf3\x04\x91\xb1\x6d\x13\xf8\x79\x7c\x5c\xc0\xc2\xff\xb5\x42\x87\xa7\x56\xd5\xcd\x99\x94\x2e\x8b\x32\x23\x6d", 39, 4096) = 39 pwrite64(3, "\xa8\x30\x3f\xe7\x90\x1a\xd2\x04\x51\xc7\xd5\x51\xec\x7a\x37\x3f\xcb\x1b\x06\x7a\x57\x27\x45\x62\x3d\x82\x00\xd6\x02\x92\x89\x0b\xd9\x69\xa6\xf0\x29\x57\x83\x51\x4e\x5e\xfc\x8d\xaa\x95\xbd\x91\x23\x0f\xdf\xaa\xd4\x02\x48\x10\x64\x62\x5f\x1f\xf8\x10\x8a\x09\x35\xaa\x40\x34\x12\x5d\xaa\xd0\xf9\x85\x72\xd5\x98\xe2\x24\x04\x63\xad\x34\x02\xe3\x57\x7b\xdd\xa3\xb1\xc3\x67\x5c\x0d\x5f\x29\xbe\x00\x66\xa2"..., 287, 51549) = 287 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 mkdir("./file0", 0777) = 0 [ 21.799322][ T30] audit: type=1400 audit(1667360083.239:62): avc: denied { execmem } for pid=409 comm="syz-executor939" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.803331][ T409] loop0: detected capacity change from 0 to 264192 [ 21.821240][ T30] audit: type=1400 audit(1667360083.249:63): avc: denied { read write } for pid=409 comm="syz-executor939" name="loop0" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 mount("/dev/loop0", "./file0", "erofs", 0, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 5 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 close(3) = 0 [ 21.836937][ T409] erofs: (device loop0): mounted with root inode @ nid 36. [ 21.849044][ T30] audit: type=1400 audit(1667360083.249:64): avc: denied { open } for pid=409 comm="syz-executor939" path="/dev/loop0" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 21.880856][ T30] audit: type=1400 audit(1667360083.249:65): avc: denied { ioctl } for pid=409 comm="syz-executor939" path="/dev/loop0" dev="devtmpfs" ino=111 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 21.883885][ T409] erofs: (device loop0): z_erofs_pcluster_readmore: readmore error at page 3 @ nid 36 [ 21.906742][ T30] audit: type=1400 audit(1667360083.279:66): avc: denied { mounton } for pid=409 comm="syz-executor939" path="/root/file0" dev="sda1" ino=1138 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 21.915867][ T409] attempt to access beyond end of device [ 21.915867][ T409] loop0: rw=0, want=2201354232, limit=264192 [ 21.938263][ T30] audit: type=1400 audit(1667360083.309:67): avc: denied { mount } for pid=409 comm="syz-executor939" name="/" dev="loop0" ino=36 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 21.949520][ T409] attempt to access beyond end of device [ 21.949520][ T409] loop0: rw=0, want=20841953384, limit=264192 [ 21.983179][ T409] BUG: unable to handle page fault for address: fffff52100053e27 [ 21.990691][ T409] #PF: supervisor read access in kernel mode [ 21.996504][ T409] #PF: error_code(0x0000) - not-present page [ 22.002326][ T409] PGD 23ffef067 P4D 23ffef067 PUD 0 [ 22.007442][ T409] Oops: 0000 [#1] PREEMPT SMP KASAN [ 22.012480][ T409] CPU: 0 PID: 409 Comm: syz-executor939 Not tainted 5.15.74-syzkaller-04383-g7f2e600bf63a #0 [ 22.022458][ T409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 [ 22.032349][ T409] RIP: 0010:z_erofs_decompress_queue+0xc7c/0x1cd0 [ 22.038598][ T409] Code: 00 00 00 fc ff df 41 0f b6 04 1e 84 c0 0f 85 8d 03 00 00 41 8b 45 00 c1 f8 02 48 8b 4c 24 60 4c 8d 2c c1 4d 89 ee 49 c1 ee 03 <41> 80 3c 1e 00 74 08 4c 89 ef e8 75 ff 7c ff 4d 8b 7d 00 4d 85 ff [ 22.058038][ T409] RSP: 0018:ffffc9000029f000 EFLAGS: 00010a06 [ 22.063951][ T409] RAX: 00000000ffffffff RBX: dffffc0000000000 RCX: ffffc9000029f140 [ 22.071839][ T409] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea00047b8768 [ 22.079648][ T409] RBP: ffffc9000029f570 R08: dffffc0000000000 R09: fffff940008f70ee [ 22.087462][ T409] R10: fffff940008f70ee R11: 1ffffd40008f70ed R12: ffffea00047b8740 [ 22.095273][ T409] R13: ffffc9080029f138 R14: 1ffff92100053e27 R15: ffff88810feeecd8 [ 22.103106][ T409] FS: 0000555556fa0300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 22.111851][ T409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.118281][ T409] CR2: fffff52100053e27 CR3: 000000011e5c1000 CR4: 00000000003506b0 [ 22.126173][ T409] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.133982][ T409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.141792][ T409] Call Trace: [ 22.144920][ T409] [ 22.147701][ T409] ? z_erofs_onlinepage_endio+0x170/0x170 [ 22.153249][ T409] ? erofs_namei+0x178/0x1050 [ 22.157773][ T409] ? _raw_spin_unlock_irqrestore+0x5c/0x80 [ 22.163406][ T409] ? z_erofs_decompress_kickoff+0x17b/0x300 [ 22.169136][ T409] ? z_erofs_decompressqueue_endio+0x520/0x520 [ 22.175123][ T409] ? submit_bio_noacct+0xa80/0xa80 [ 22.180071][ T409] ? bio_add_page+0x2cc/0x450 [ 22.184584][ T409] z_erofs_runqueue+0x148d/0x1570 [ 22.189448][ T409] ? z_erofs_do_read_page+0x2ab0/0x2ab0 [ 22.194825][ T409] ? __kasan_check_write+0x14/0x20 [ 22.199771][ T409] ? mutex_unlock+0xa2/0x110 [ 22.204198][ T409] ? __mutex_lock_slowpath+0x10/0x10 [ 22.209421][ T409] ? z_erofs_pcluster_readmore+0x4a9/0x590 [ 22.215053][ T409] z_erofs_readpage+0x323/0x5c0 [ 22.219742][ T409] ? z_erofs_rcu_callback+0x160/0x160 [ 22.224942][ T409] ? add_to_page_cache_lru+0x225/0x2c0 [ 22.230236][ T409] ? add_to_page_cache_locked+0x40/0x40 [ 22.235617][ T409] do_read_cache_page+0x68b/0xa70 [ 22.240476][ T409] read_cache_page+0x4d/0x70 [ 22.244904][ T409] erofs_namei+0x178/0x1050 [ 22.249244][ T409] erofs_lookup+0x141/0x3b0 [ 22.253583][ T409] ? erofs_namei+0x1050/0x1050 [ 22.258185][ T409] ? _raw_spin_unlock+0x4d/0x70 [ 22.262954][ T409] ? d_alloc+0x198/0x1d0 [ 22.267035][ T409] __lookup_hash+0x141/0x290 [ 22.271460][ T409] filename_create+0x276/0x4f0 [ 22.276061][ T409] ? kern_path_create+0x1b0/0x1b0 [ 22.280923][ T409] do_mknodat+0x16c/0x5b0 [ 22.285087][ T409] ? strncpy_from_user+0x179/0x2b0 [ 22.290039][ T409] ? may_open+0x440/0x440 [ 22.294202][ T409] ? getname_flags+0x1fb/0x510 [ 22.298800][ T409] __x64_sys_mknodat+0xa9/0xc0 [ 22.303400][ T409] do_syscall_64+0x44/0xd0 [ 22.307657][ T409] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.313382][ T409] RIP: 0033:0x7f72d7a8be19 [ 22.317636][ T409] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 22.337078][ T409] RSP: 002b:00007ffef48689c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000103 [ 22.345321][ T409] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f72d7a8be19 [ 22.353130][ T409] RDX: 0000000000000004 RSI: 0000000020000080 RDI: 0000000000000005 [ 22.360942][ T409] RBP: 00007f72d7a4b610 R08: 0000555556fa02c0 R09: 0000000000000000 [ 22.368756][ T409] R10: 0000000000000700 R11: 0000000000000246 R12: 00007f72d7a4b6a0 [ 22.376568][ T409] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 22.384380][ T409] [ 22.387241][ T409] Modules linked in: [ 22.390983][ T409] CR2: fffff52100053e27 [ 22.394969][ T409] ---[ end trace 322452632683d957 ]--- [ 22.400260][ T409] RIP: 0010:z_erofs_decompress_queue+0xc7c/0x1cd0 [ 22.406769][ T409] Code: 00 00 00 fc ff df 41 0f b6 04 1e 84 c0 0f 85 8d 03 00 00 41 8b 45 00 c1 f8 02 48 8b 4c 24 60 4c 8d 2c c1 4d 89 ee 49 c1 ee 03 <41> 80 3c 1e 00 74 08 4c 89 ef e8 75 ff 7c ff 4d 8b 7d 00 4d 85 ff [ 22.426211][ T409] RSP: 0018:ffffc9000029f000 EFLAGS: 00010a06 [ 22.432113][ T409] RAX: 00000000ffffffff RBX: dffffc0000000000 RCX: ffffc9000029f140 [ 22.439924][ T409] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea00047b8768 [ 22.447737][ T409] RBP: ffffc9000029f570 R08: dffffc0000000000 R09: fffff940008f70ee [ 22.455758][ T409] R10: fffff940008f70ee R11: 1ffffd40008f70ed R12: ffffea00047b8740 [ 22.463558][ T409] R13: ffffc9080029f138 R14: 1ffff92100053e27 R15: ffff88810feeecd8 [ 22.471368][ T409] FS: 0000555556fa0300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 22.480138][ T409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.486571][ T409] CR2: fffff52100053e27 CR3: 000000011e5c1000 CR4: 00000000003506b0 [ 22.494374][ T409] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.502184][ T409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.509997][ T409] Kernel panic - not syncing: Fatal exception [ 22.516059][ T409] Kernel Offset: disabled [ 22.520181][ T409] Rebooting in 86400 seconds..