syzkaller syzkaller login: [ 12.319181][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 12.319190][ T23] audit: type=1400 audit(1677108718.570:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.325850][ T23] audit: type=1400 audit(1677108718.570:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[1279]" dev="pipefs" ino=1279 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 12.599279][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 13.349337][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.429428][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! Warning: Permanently added '10.128.10.25' (ECDSA) to the list of known hosts. executing program [ 53.666787][ T23] audit: type=1400 audit(1677108759.910:73): avc: denied { execmem } for pid=365 comm="syz-executor241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 53.686597][ T23] audit: type=1400 audit(1677108759.930:74): avc: denied { read write } for pid=365 comm="syz-executor241" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 53.711180][ T23] audit: type=1400 audit(1677108759.930:75): avc: denied { open } for pid=365 comm="syz-executor241" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 53.723876][ T367] EXT4-fs error (device loop0): ext4_orphan_get:1416: comm syz-executor241: bad orphan inode 15 [ 53.735483][ T23] audit: type=1400 audit(1677108759.930:76): avc: denied { ioctl } for pid=365 comm="syz-executor241" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 53.746188][ T367] ext4_test_bit(bit=14, block=18) = 1 [ 53.771678][ T23] audit: type=1400 audit(1677108759.950:77): avc: denied { mounton } for pid=367 comm="syz-executor241" path="/root/file0" dev="sda1" ino=1137 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 53.776715][ T367] is_bad_inode(inode)=0 [ 53.803999][ T367] NEXT_ORPHAN(inode)=0 [ 53.808055][ T367] max_ino=32 [ 53.811322][ T367] i_nlink=1 [ 53.814453][ T367] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 53.823703][ T23] audit: type=1400 audit(1677108760.070:78): avc: denied { mount } for pid=367 comm="syz-executor241" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 53.823720][ T367] ext4 filesystem being mounted at /root/file0 supports timestamps until 2038 (0x7fffffff) [ 53.858574][ T367] ================================================================== [ 53.862041][ T23] audit: type=1400 audit(1677108760.100:79): avc: denied { write } for pid=367 comm="syz-executor241" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 53.866657][ T367] BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x42e/0x4a0 [ 53.866676][ T367] Read of size 4 at addr ffff88811cb4c000 by task syz-executor241/367 [ 53.888537][ T23] audit: type=1400 audit(1677108760.100:80): avc: denied { add_name } for pid=367 comm="syz-executor241" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 53.896394][ T367] [ 53.896409][ T367] CPU: 1 PID: 367 Comm: syz-executor241 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0 [ 53.896414][ T367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 53.896426][ T367] Call Trace: [ 53.905246][ T23] audit: type=1400 audit(1677108760.100:81): avc: denied { create } for pid=367 comm="syz-executor241" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 53.925220][ T367] dump_stack_lvl+0x1e2/0x24b [ 53.925232][ T367] ? bfq_pos_tree_add_move+0x43e/0x43e [ 53.925241][ T367] ? panic+0x7d7/0x7d7 [ 53.925264][ T367] print_address_description+0x81/0x3c0 [ 53.928006][ T23] audit: type=1400 audit(1677108760.100:82): avc: denied { remove_name } for pid=367 comm="syz-executor241" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 53.937810][ T367] kasan_report+0x1a4/0x1f0 [ 53.937822][ T367] ? ext4_rename_dir_prepare+0x42e/0x4a0 [ 53.937833][ T367] ? ext4_rename_dir_prepare+0x42e/0x4a0 [ 53.937853][ T367] __asan_report_load4_noabort+0x14/0x20 [ 54.035031][ T367] ext4_rename_dir_prepare+0x42e/0x4a0 [ 54.040474][ T367] ? ext4_add_nondir+0x270/0x270 [ 54.045420][ T367] ? __kasan_check_read+0x11/0x20 [ 54.050533][ T367] ? __ext4_journal_start_sb+0x2d9/0x480 [ 54.056151][ T367] ext4_rename2+0x1f37/0x45a0 [ 54.060818][ T367] ? ext4_mknod+0x550/0x550 [ 54.065305][ T367] ? avc_has_perm+0x218/0x260 [ 54.069964][ T367] ? avc_has_perm_noaudit+0x4c0/0x4c0 [ 54.075339][ T367] ? selinux_inode_permission+0x439/0x670 [ 54.081047][ T367] ? selinux_inode_rename+0x8da/0xb60 [ 54.086413][ T367] ? take_dentry_name_snapshot+0xca/0x110 [ 54.092115][ T367] vfs_rename+0x95e/0xde0 [ 54.096436][ T367] ? __ia32_sys_link+0x70/0x70 [ 54.101185][ T367] ? d_lookup+0x8e/0xb0 [ 54.105329][ T367] ? __lookup_hash+0x6d/0x290 [ 54.109990][ T367] ? lock_rename+0xdd/0xf0 [ 54.114416][ T367] do_renameat2+0x83e/0x1190 [ 54.118994][ T367] ? do_linkat+0x8e0/0x8e0 [ 54.123405][ T367] ? do_mkdirat+0x27c/0x2d0 [ 54.127907][ T367] __x64_sys_renameat2+0xbf/0xd0 [ 54.132832][ T367] do_syscall_64+0x34/0x70 [ 54.137236][ T367] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 54.143217][ T367] RIP: 0033:0x7f85c66e82b9 [ 54.147625][ T367] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 54.167212][ T367] RSP: 002b:00007ffc25e70e38 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 54.175610][ T367] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f85c66e82b9 [ 54.183568][ T367] RDX: 0000000000000004 RSI: 0000000020000240 RDI: 0000000000000004 [ 54.191537][ T367] RBP: 0000000000000000 R08: 0000000000000002 R09: 00007f85c6756ec0 [ 54.199493][ T367] R10: 0000000020000000 R11: 0000000000000246 R12: 00007ffc25e70e60 [ 54.207451][ T367] R13: 0000000000000000 R14: 431bde82d7b634db R15: 0000000000000000 [ 54.215406][ T367] [ 54.217718][ T367] The buggy address belongs to the page: [ 54.223345][ T367] page:ffffea000472d300 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x11cb4c [ 54.233570][ T367] flags: 0x8000000000000000() [ 54.238239][ T367] raw: 8000000000000000 ffffea000472d348 ffff8881f715acc0 0000000000000000 [ 54.246901][ T367] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 54.255559][ T367] page dumped because: kasan: bad access detected [ 54.261974][ T367] page_owner tracks the page as freed [ 54.267333][ T367] page last allocated via order 0, migratetype Movable, gfp_mask 0x3100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO|0x2000000), pid 360, ts 48288182492, free_ts 48295631287 [ 54.283863][ T367] get_page_from_freelist+0x755/0x810 [ 54.289217][ T367] __alloc_pages_nodemask+0x3b6/0x890 [ 54.294571][ T367] do_anonymous_page+0x307/0x1050 [ 54.299587][ T367] handle_pte_fault+0x4cd/0x9d0 [ 54.304602][ T367] handle_mm_fault+0xf22/0x19f0 [ 54.309450][ T367] do_user_addr_fault+0x67e/0xce0 [ 54.314457][ T367] exc_page_fault+0x71/0x1b0 [ 54.319032][ T367] asm_exc_page_fault+0x1e/0x30 [ 54.323857][ T367] page last free stack trace: [ 54.328520][ T367] free_pcp_prepare+0x18c/0x1c0 [ 54.333377][ T367] free_unref_page_list+0x11d/0x660 [ 54.338579][ T367] release_pages+0xc24/0xc60 [ 54.343151][ T367] free_pages_and_swap_cache+0x97/0xb0 [ 54.348588][ T367] tlb_flush_mmu+0x8a0/0xa80 [ 54.353163][ T367] tlb_finish_mmu+0xd2/0x1f0 [ 54.357735][ T367] unmap_region+0x346/0x390 [ 54.362245][ T367] __do_munmap+0x696/0x8c0 [ 54.366779][ T367] __se_sys_munmap+0x121/0x1b0 [ 54.371625][ T367] __x64_sys_munmap+0x5b/0x70 [ 54.376284][ T367] do_syscall_64+0x34/0x70 [ 54.380685][ T367] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 54.386550][ T367] [ 54.388872][ T367] Memory state around the buggy address: [ 54.394483][ T367] ffff88811cb4bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.402521][ T367] ffff88811cb4bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 54.410564][ T367] >ffff88811cb4c000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff executing program executing program executing program executing program executing program executing program executing program executing program [ 54.418703][ T367] ^ [ 54.422757][ T367] ffff88811cb4c080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.430814][ T367] ffff88811cb4c100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 54.438858][ T367] ================================================================== [ 54.446922][ T367] Disabling lock debugging due to kernel taint executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program