ci-upstream-kasan-gce-selinux-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-selinux-root/syz-executor2367876574 <...> Warning: Permanently added '10.128.1.157' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-selinux-root/syz-executor2367876574", ["ci-upstream-kasan-gce-selinux-root/syz-executor2367876574"], 0x7ffcb4c648f0 /* 10 vars */) = 0 brk(NULL) = 0x55555a0bc000 brk(0x55555a0bcd80) = 0x55555a0bcd80 arch_prctl(ARCH_SET_FS, 0x55555a0bc400) = 0 set_tid_address(0x55555a0bc6d0) = 5621 set_robust_list(0x55555a0bc6e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-selinux-root/syz-executor2367876574", 4096) = 63 getrandom("\xb4\xd8\x66\xf9\x44\x27\xca\xb1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555a0bcd80 brk(0x55555a0ddd80) = 0x55555a0ddd80 brk(0x55555a0de000) = 0x55555a0de000 mprotect(0x7fa532f5c000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555a0bc6d0) = 5622 ci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5622 attached [pid 5621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5622] set_robust_list(0x55555a0bc6e0, 24) = 0 [pid 5622] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 66.825703][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 66.825717][ T29] audit: type=1400 audit(1785912367.786:129): avc: denied { execmem } for pid=5621 comm="syz-executor236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 5622] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5622] getppid() = 0 [pid 5622] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5622] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5622] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5622] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5622] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5622] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5622] unshare(CLONE_NEWNS) = 0 [pid 5622] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5622] unshare(CLONE_NEWIPC) = 0 [pid 5622] unshare(CLONE_NEWCGROUP) = 0 [pid 5622] unshare(CLONE_NEWUTS) = 0 [pid 5622] unshare(CLONE_SYSVSEM) = 0 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "16777216", 8) = 8 [pid 5622] close(3) = 0 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "536870912", 9) = 9 [pid 5622] close(3) = 0 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "1024", 4) = 4 [pid 5622] close(3) = 0 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "8192", 4) = 4 [pid 5622] close(3) = 0 [ 67.037053][ T29] audit: type=1400 audit(1785912367.996:130): avc: denied { mounton } for pid=5622 comm="syz-executor236" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "1024", 4) = 4 [pid 5622] close(3) = 0 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "1024", 4) = 4 [pid 5622] close(3) = 0 [pid 5622] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5622] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5622] close(3) = 0 [pid 5622] getpid() = 1 [pid 5622] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5622] rt_sigprocmask(SIG_SETMASK, [] [pid 5659] <... set_robust_list resumed>) = 0 [pid 5622] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5659] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5659] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5659] setpgid(0, 0) = 0 [pid 5659] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5659] write(3, "1000", 4) = 4 [ 80.155449][ T29] audit: type=1400 audit(1785912381.106:145): avc: denied { mount } for pid=5622 comm="syz-executor236" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [pid 5659] close(3) = 0 executing program [pid 5659] write(1, "executing program\n", 18) = 18 [pid 5659] mkdirat(AT_FDCWD, "./debug", 0777) = 0 [pid 5659] mount(NULL, "./debug", "debugfs", 0, NULL) = 0 [pid 5659] openat(AT_FDCWD, "./debug/netdevsim/netdevsim0/ports/0/queue_reset", O_WRONLY) = 3 [pid 5659] write(3, "0 0", 3) = 3 [pid 5659] socket(AF_XDP, SOCK_RAW, 0) = 4 [pid 5659] setsockopt(4, SOL_XDP, XDP_UMEM_REG, "\x00\x00\x00\x00\x00\x20\x00\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 32) = 0 [pid 5659] setsockopt(4, SOL_XDP, XDP_TX_RING, [1], 4) = 0 [pid 5659] socketpair(AF_UNIX, SOCK_STREAM, 0, [5, 6]) = 0 [pid 5659] ioctl(6, SIOCGIFINDEX, {ifr_name="netdevsim0", ifr_ifindex=65}) = 0 [pid 5659] setsockopt(4, SOL_XDP, XDP_UMEM_COMPLETION_RING, [32], 4) = 0 [pid 5659] setsockopt(4, SOL_XDP, XDP_UMEM_FILL_RING, [16384], 4) = 0 [ 80.317398][ T5659] ================================================================== [ 80.325500][ T5659] BUG: KASAN: slab-use-after-free in xsk_bind+0x1582/0x16c0 [ 80.332798][ T5659] Read of size 4 at addr ffff88802a91a18c by task syz-executor236/5659 [ 80.341019][ T5659] [ 80.343325][ T5659] CPU: 1 UID: 0 PID: 5659 Comm: syz-executor236 Not tainted syzkaller #0 PREEMPT(full) [ 80.343338][ T5659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 80.343345][ T5659] Call Trace: [ 80.343349][ T5659] [ 80.343353][ T5659] dump_stack_lvl+0x100/0x190 [ 80.343368][ T5659] print_report+0x13d/0x4b0 [ 80.343383][ T5659] ? __virt_addr_valid+0x239/0x430 [ 80.343397][ T5659] ? xsk_bind+0x1582/0x16c0 [ 80.343405][ T5659] kasan_report+0xdf/0x1c0 [ 80.343420][ T5659] ? xsk_bind+0x1582/0x16c0 [ 80.343430][ T5659] xsk_bind+0x1582/0x16c0 [ 80.343440][ T5659] ? __pfx_xsk_bind+0x10/0x10 [ 80.343450][ T5659] __sys_bind+0x1a9/0x260 [ 80.343462][ T5659] ? __pfx___sys_bind+0x10/0x10 [ 80.343475][ T5659] ? rcu_is_watching+0x12/0xc0 [ 80.343490][ T5659] ? _raw_spin_unlock_irq+0x23/0x50 [ 80.343502][ T5659] __x64_sys_bind+0x72/0xb0 [ 80.343513][ T5659] do_syscall_64+0x115/0x870 [ 80.343526][ T5659] ? clear_bhb_loop+0x40/0x90 [ 80.343537][ T5659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.343548][ T5659] RIP: 0033:0x7fa532ec49c9 [ 80.343557][ T5659] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 80.343567][ T5659] RSP: 002b:00007ffca3bd2128 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 80.343578][ T5659] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa532ec49c9 [ 80.343585][ T5659] RDX: 0000000000000010 RSI: 00002000000003c0 RDI: 0000000000000004 [ 80.343591][ T5659] RBP: 00000000000f4240 R08: 0000000000000001 R09: 0000000000000001 [ 80.343597][ T5659] R10: 0000000000000004 R11: 0000000000000246 R12: 00007ffca3bd2180 [ 80.343603][ T5659] R13: 00007fa532f3040a R14: 0000000000000003 R15: 00007ffca3bd2160 [ 80.343612][ T5659] [ 80.343615][ T5659] [ 80.521759][ T5659] Allocated by task 5622: [ 80.526055][ T5659] kasan_save_stack+0x30/0x50 [ 80.530708][ T5659] kasan_save_track+0x14/0x30 [ 80.535369][ T5659] __kasan_kmalloc+0xaa/0xb0 [ 80.539940][ T5659] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 80.545290][ T5659] nsim_queue_alloc+0x3c/0x140 [ 80.550028][ T5659] nsim_create+0xb13/0x1420 [ 80.554514][ T5659] __nsim_dev_port_add+0x3ba/0x8f0 [ 80.559597][ T5659] nsim_drv_probe+0xdbd/0x13a0 [ 80.564338][ T5659] really_probe+0x241/0xa60 [ 80.568845][ T5659] __driver_probe_device+0x20e/0x450 [ 80.574114][ T5659] driver_probe_device+0x4a/0x140 [ 80.579119][ T5659] __device_attach_driver+0x1df/0x320 [ 80.584465][ T5659] bus_for_each_drv+0x159/0x1e0 [ 80.589287][ T5659] __device_attach+0x1e4/0x4d0 [ 80.594024][ T5659] device_initial_probe+0xaf/0xd0 [ 80.599036][ T5659] bus_probe_device+0x64/0x160 [ 80.603784][ T5659] device_add+0x121d/0x1970 [ 80.608276][ T5659] new_device_store+0x40b/0x700 [ 80.613097][ T5659] bus_attr_store+0x74/0xb0 [ 80.617575][ T5659] sysfs_kf_write+0xf2/0x150 [ 80.622141][ T5659] kernfs_fop_write_iter+0x3e0/0x5f0 [ 80.627398][ T5659] vfs_write+0x6ac/0x1050 [ 80.631702][ T5659] ksys_write+0x12a/0x250 [ 80.635999][ T5659] do_syscall_64+0x115/0x870 [ 80.640565][ T5659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.646441][ T5659] [ 80.648739][ T5659] Freed by task 5659: [ 80.652694][ T5659] kasan_save_stack+0x30/0x50 [ 80.657350][ T5659] kasan_save_track+0x14/0x30 [ 80.662012][ T5659] kasan_save_free_info+0x3b/0x70 [ 80.667023][ T5659] __kasan_slab_free+0x5f/0x80 [ 80.671761][ T5659] kfree+0x22b/0x6c0 [ 80.675636][ T5659] nsim_queue_mem_free+0xfe/0x190 [ 80.680659][ T5659] netdev_rx_queue_reconfig+0x405/0x630 [ 80.686195][ T5659] netdev_rx_queue_restart+0x8f/0xc0 [ 80.691466][ T5659] nsim_qreset_write+0x2e3/0x410 [ 80.696385][ T5659] full_proxy_write+0x135/0x1a0 [ 80.701220][ T5659] vfs_write+0x2aa/0x1050 [ 80.705551][ T5659] ksys_write+0x12a/0x250 [ 80.709847][ T5659] do_syscall_64+0x115/0x870 [ 80.714420][ T5659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.720282][ T5659] [ 80.722587][ T5659] The buggy address belongs to the object at ffff88802a91a000 [ 80.722587][ T5659] which belongs to the cache kmalloc-cg-1k of size 1024 [ 80.736880][ T5659] The buggy address is located 396 bytes inside of [ 80.736880][ T5659] freed 1024-byte region [ffff88802a91a000, ffff88802a91a400) [ 80.750742][ T5659] [ 80.753050][ T5659] The buggy address belongs to the physical page: [ 80.759429][ T5659] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a918 [ 80.768167][ T5659] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 80.776644][ T5659] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 80.784188][ T5659] page_type: f5(slab) [ 80.788166][ T5659] raw: 00fff00000000040 ffff88813fe2d280 dead000000000100 dead000000000122 [ 80.796721][ T5659] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 80.805282][ T5659] head: 00fff00000000040 ffff88813fe2d280 dead000000000100 dead000000000122 [ 80.813924][ T5659] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 80.822576][ T5659] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 80.831221][ T5659] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 80.839861][ T5659] page dumped because: kasan: bad access detected [ 80.846243][ T5659] page_owner tracks the page as allocated [ 80.851927][ T5659] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5622, tgid 5622 (syz-executor236), ts 69567522694, free_ts 58081032970 [ 80.873519][ T5659] post_alloc_hook+0xfd/0x120 [ 80.878182][ T5659] get_page_from_freelist+0xf48/0x3530 [ 80.883616][ T5659] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 80.889492][ T5659] new_slab+0xa2/0x640 [ 80.893543][ T5659] refill_objects+0xe3/0x410 [ 80.898103][ T5659] __pcs_replace_empty_main+0x376/0x680 [ 80.903627][ T5659] __kmalloc_noprof+0x66d/0x820 [ 80.908466][ T5659] __register_sysctl_table+0xac/0x1650 [ 80.913897][ T5659] neigh_sysctl_register+0x326/0x660 [ 80.919173][ T5659] devinet_sysctl_register+0xb6/0x210 [ 80.924535][ T5659] inetdev_init+0x2b8/0x570 [ 80.929011][ T5659] inetdev_event+0x7fa/0x17f0 [ 80.933673][ T5659] notifier_call_chain+0x99/0x3f0 [ 80.938686][ T5659] call_netdevice_notifiers_info+0xbe/0x110 [ 80.944560][ T5659] register_netdevice+0x1998/0x25a0 [ 80.949745][ T5659] ipvlan_link_new+0x3a4/0xc60 [ 80.954481][ T5659] page last free pid 187 tgid 187 stack trace: [ 80.960617][ T5659] free_pages_prepare+0x586/0xd80 [ 80.965619][ T5659] __free_contig_range_common+0x14f/0x250 [ 80.971322][ T5659] free_pages_bulk+0x12a/0x200 [ 80.976069][ T5659] vm_area_free_pages+0xad/0x2b0 [ 80.980976][ T5659] vfree+0x107/0x750 [ 80.984856][ T5659] delayed_vfree_work+0x56/0x80 [ 80.989679][ T5659] process_one_work+0xa23/0x1940 [ 80.994587][ T5659] worker_thread+0x5ef/0xe50 [ 80.999168][ T5659] kthread+0x370/0x450 [ 81.003224][ T5659] ret_from_fork+0x72b/0xd50 [ 81.007801][ T5659] ret_from_fork_asm+0x1a/0x30 [ 81.012560][ T5659] [ 81.014869][ T5659] Memory state around the buggy address: [ 81.020467][ T5659] ffff88802a91a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.028501][ T5659] ffff88802a91a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.036531][ T5659] >ffff88802a91a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.044568][ T5659] ^ [ 81.048865][ T5659] ffff88802a91a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.056895][ T5659] ffff88802a91a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.064933][ T5659] ================================================================== [ 81.075084][ T5659] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 81.082295][ T5659] CPU: 1 UID: 0 PID: 5659 Comm: syz-executor236 Not tainted syzkaller #0 PREEMPT(full) [ 81.091992][ T5659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 81.102030][ T5659] Call Trace: [ 81.105292][ T5659] [ 81.108204][ T5659] dump_stack_lvl+0x100/0x190 [ 81.112869][ T5659] vpanic+0x552/0x970 [ 81.116849][ T5659] ? __pfx_vpanic+0x10/0x10 [ 81.121330][ T5659] ? mark_held_locks+0x40/0x70 [ 81.126081][ T5659] ? xsk_bind+0x1582/0x16c0 [ 81.130564][ T5659] panic+0xd1/0xe0 [ 81.134264][ T5659] ? __pfx_panic+0x10/0x10 [ 81.138661][ T5659] ? xsk_bind+0x1582/0x16c0 [ 81.143139][ T5659] ? preempt_schedule_common+0x42/0xc0 [ 81.148580][ T5659] ? check_panic_on_warn+0x1f/0x90 [ 81.153677][ T5659] check_panic_on_warn.cold+0x19/0x34 [ 81.159031][ T5659] end_report.part.0+0x3a/0x90 [ 81.163782][ T5659] kasan_report.cold+0xe/0x18 [ 81.168458][ T5659] ? xsk_bind+0x1582/0x16c0 [ 81.172963][ T5659] xsk_bind+0x1582/0x16c0 [ 81.177274][ T5659] ? __pfx_xsk_bind+0x10/0x10 [ 81.181930][ T5659] __sys_bind+0x1a9/0x260 [ 81.186261][ T5659] ? __pfx___sys_bind+0x10/0x10 [ 81.191099][ T5659] ? rcu_is_watching+0x12/0xc0 [ 81.195861][ T5659] ? _raw_spin_unlock_irq+0x23/0x50 [ 81.201042][ T5659] __x64_sys_bind+0x72/0xb0 [ 81.205526][ T5659] do_syscall_64+0x115/0x870 [ 81.210098][ T5659] ? clear_bhb_loop+0x40/0x90 [ 81.214756][ T5659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.220642][ T5659] RIP: 0033:0x7fa532ec49c9 [ 81.225039][ T5659] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 81.244628][ T5659] RSP: 002b:00007ffca3bd2128 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 81.253023][ T5659] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa532ec49c9 [ 81.260981][ T5659] RDX: 0000000000000010 RSI: 00002000000003c0 RDI: 0000000000000004 [ 81.268944][ T5659] RBP: 00000000000f4240 R08: 0000000000000001 R09: 0000000000000001 [ 81.276896][ T5659] R10: 0000000000000004 R11: 0000000000000246 R12: 00007ffca3bd2180 [ 81.284845][ T5659] R13: 00007fa532f3040a R14: 0000000000000003 R15: 00007ffca3bd2160 [ 81.292800][ T5659] [ 81.296031][ T5659] Kernel Offset: disabled [ 81.300352][ T5659] Rebooting in 86400 seconds..