./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2872544924 <...> syzkaller login: [ 14.191086][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 14.191092][ T23] audit: type=1400 audit(1655522493.559:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.197202][ T23] audit: type=1400 audit(1655522493.569:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[11323]" dev="pipefs" ino=11323 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 14.347534][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.656842][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 14.756736][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.766328][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.776362][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 14.836755][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 14.845636][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! Warning: Permanently added '10.128.1.47' (ECDSA) to the list of known hosts. execve("./syz-executor2872544924", ["./syz-executor2872544924"], 0x7ffc75fc57b0 /* 10 vars */) = 0 brk(NULL) = 0x555555d9f000 brk(0x555555d9fc40) = 0x555555d9fc40 arch_prctl(ARCH_SET_FS, 0x555555d9f300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x555555d9f5d0) = 371 set_robust_list(0x555555d9f5e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f30f1c94dc0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f30f1c95490}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f30f1c94e60, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f30f1c95490}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2872544924", 4096) = 28 brk(0x555555dc0c40) = 0x555555dc0c40 brk(0x555555dc1000) = 0x555555dc1000 mprotect(0x7f30f1d55000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000) = 0 mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f30f1c65000 mprotect(0x7f30f1c66000, 131072, PROT_READ|PROT_WRITE) = 0 clone(child_stack=0x7f30f1c853f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[372], tls=0x7f30f1c85700, child_tidptr=0x7f30f1c859d0) = 372 futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000) = 0 futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 372 attached [pid 372] set_robust_list(0x7f30f1c859e0, 24) = 0 [pid 372] openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 3 [pid 372] futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 371] futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] ioctl(3, TUNSETIFF, 0x20000200) = 0 [pid 372] futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 371] futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 372] futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 371] futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) = 5 [pid 372] futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 371] futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] ioctl(5, SIOCGIFINDEX, {ifr_name="rose0", ifr_ifindex=15}) = 0 [pid 372] futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 371] futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... futex resumed>) = 1 [pid 372] ioctl(3, TUNSETQUEUE, 0x20000340) = 0 [pid 372] futex(0x7f30f1d5b42c, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = 1 [pid 371] futex(0x7f30f1d5b428, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x34\x00\x00\x00\x11\x00\x01\xe9\x0d\x7d\x1f\xc7\x4e\x1b\xed\x42\xec\x45\xb2\xfc\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=53}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0 [pid 371] <... futex resumed>) = 0 [ 21.809180][ T23] audit: type=1400 audit(1655522501.179:73): avc: denied { execmem } for pid=371 comm="syz-executor287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.828731][ T23] audit: type=1400 audit(1655522501.179:74): avc: denied { create } for pid=371 comm="syz-executor287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 21.830127][ T372] netlink: 20 bytes leftover after parsing attributes in process `syz-executor287'. [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 371] futex(0x7f30f1d5b42c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 371] futex(0x7f30f1d5b43c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f30f1c44000 [pid 371] mprotect(0x7f30f1c45000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 371] clone(child_stack=0x7f30f1c643f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[375], tls=0x7f30f1c64700, child_tidptr=0x7f30f1c649d0) = 375 [pid 371] futex(0x7f30f1d5b438, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f30f1d5b43c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 375 attached [pid 375] set_robust_list(0x7f30f1c649e0, 24) = 0 [ 21.849217][ T23] audit: type=1400 audit(1655522501.179:75): avc: denied { ioctl } for pid=371 comm="syz-executor287" path="socket:[11477]" dev="sockfs" ino=11477 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 21.883476][ T23] audit: type=1400 audit(1655522501.179:76): avc: denied { read } for pid=198 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 21.910791][ T375] ------------[ cut here ]------------ [ 21.916438][ T375] WARNING: CPU: 1 PID: 375 at net/core/dev.c:6742 netif_napi_add+0x8f2/0xa20 [ 21.925484][ T375] Modules linked in: [ 21.929459][ T375] CPU: 1 PID: 375 Comm: syz-executor287 Not tainted 5.10.117-syzkaller-00814-gfdd06dc6b0f8 #0 [ 21.940015][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 21.950211][ T375] RIP: 0010:netif_napi_add+0x8f2/0xa20 [pid 375] ioctl(3, TUNSETIFF, 0x20000200 [pid 371] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 21.955668][ T375] Code: c2 e0 25 79 85 48 c7 c1 90 f0 c1 85 45 89 e8 31 c0 e8 66 97 cc 00 e9 12 fc ff ff e8 b8 d7 a8 fd e9 d5 fe ff ff e8 ae d7 a8 fd <0f> 0b eb a0 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 2e f8 ff ff e8 75 [ 21.975702][ T375] RSP: 0018:ffffc9000097faf0 EFLAGS: 00010293 [ 21.981907][ T375] RAX: ffffffff83c3daa2 RBX: ffff8881197ac000 RCX: ffff8881065c8000 [ 21.990055][ T375] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 21.998064][ T375] RBP: ffffc9000097fb40 R08: ffffffff83c3d1fc R09: ffffed10232f5886 [ 22.006040][ T375] R10: ffffed10232f5886 R11: 1ffff110232f5885 R12: ffff8881197ac428 [ 22.014064][ T375] R13: 0000000000000040 R14: ffff8881197ac418 R15: ffffffff82eee9a0 [ 22.022050][ T375] FS: 00007f30f1c64700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 22.030986][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.037574][ T375] CR2: 00007f30f1c64718 CR3: 000000011e215000 CR4: 00000000003506a0 [ 22.045541][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.053545][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [pid 371] exit_group(0) = ? [ 22.061548][ T375] Call Trace: [ 22.064819][ T375] ? xdp_rxq_info_reg+0x194/0x2f0 [ 22.069851][ T375] tun_attach+0x877/0x14c0 [ 22.074274][ T375] tun_set_iff+0xadf/0x1100 [ 22.078876][ T375] __tun_chr_ioctl+0x8ab/0x2130 [ 22.083735][ T375] ? tun_flow_create+0x320/0x320 [ 22.088776][ T375] ? __fget_files+0x310/0x370 [ 22.093451][ T375] tun_chr_ioctl+0x2a/0x40 [ 22.097894][ T375] ? tun_chr_poll+0x650/0x650 [ 22.102563][ T375] __se_sys_ioctl+0x115/0x190 [ 22.107252][ T375] __x64_sys_ioctl+0x7b/0x90 [ 22.111842][ T375] do_syscall_64+0x34/0x70 [ 22.116266][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 22.122174][ T375] RIP: 0033:0x7f30f1cd2e29 [ 22.126595][ T375] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 22.146482][ T375] RSP: 002b:00007f30f1c64308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 22.154892][ T375] RAX: ffffffffffffffda RBX: 00007f30f1d5b438 RCX: 00007f30f1cd2e29 [ 22.162971][ T375] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003 [ 22.170940][ T375] RBP: 00007f30f1d5b430 R08: 00007f30f1c64700 R09: 0000000000000000 [ 22.178924][ T375] R10: 00007f30f1c64700 R11: 0000000000000246 R12: 00007f30f1d5b43c [ 22.186900][ T375] R13: 00007f30f1d29004 R14: 74656e2f7665642f R15: 0000000000022000 [ 22.194857][ T375] ---[ end trace ef21a734aa0275be ]--- [ 22.200513][ T375] ------------[ cut here ]------------ [ 22.205963][ T375] kernel BUG at include/linux/netdevice.h:518! [ 22.212132][ T375] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 22.218223][ T375] CPU: 1 PID: 375 Comm: syz-executor287 Tainted: G W 5.10.117-syzkaller-00814-gfdd06dc6b0f8 #0 [ 22.229923][ T375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 22.240157][ T375] RIP: 0010:tun_attach+0x14b3/0x14c0 [ 22.245431][ T375] Code: 89 df e8 e0 ba b7 fe e9 cf fa ff ff e8 f6 e4 7d fe 48 c7 c7 a0 12 68 86 48 89 de e8 67 7c 7b ff e9 e0 fb ff ff e8 dd e4 7d fe <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 [ 22.265033][ T375] RSP: 0018:ffffc9000097fb50 EFLAGS: 00010293 [ 22.271094][ T375] RAX: ffffffff82eecd73 RBX: 0000000000000000 RCX: ffff8881065c8000 [ 22.279058][ T375] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.287007][ T375] RBP: ffffc9000097fc70 R08: ffffffff82eec175 R09: ffffed10232f5886 [ 22.294957][ T375] R10: ffffed10232f5886 R11: 1ffff110232f5885 R12: ffff8881197ac428 [ 22.302918][ T375] R13: ffff88811777c980 R14: ffff88811777c000 R15: dffffc0000000000 [ 22.310864][ T375] FS: 00007f30f1c64700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 22.319780][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.326349][ T375] CR2: 00007f30f1c64718 CR3: 000000011e215000 CR4: 00000000003506a0 [ 22.334299][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.342460][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.350410][ T375] Call Trace: [ 22.353804][ T375] tun_set_iff+0xadf/0x1100 [ 22.358283][ T375] __tun_chr_ioctl+0x8ab/0x2130 [ 22.363122][ T375] ? tun_flow_create+0x320/0x320 [ 22.368036][ T375] ? __fget_files+0x310/0x370 [ 22.372684][ T375] tun_chr_ioctl+0x2a/0x40 [ 22.377075][ T375] ? tun_chr_poll+0x650/0x650 [ 22.381763][ T375] __se_sys_ioctl+0x115/0x190 [ 22.386410][ T375] __x64_sys_ioctl+0x7b/0x90 [ 22.390972][ T375] do_syscall_64+0x34/0x70 [ 22.395359][ T375] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 22.401239][ T375] RIP: 0033:0x7f30f1cd2e29 [ 22.405643][ T375] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 81 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 22.425219][ T375] RSP: 002b:00007f30f1c64308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 22.433604][ T375] RAX: ffffffffffffffda RBX: 00007f30f1d5b438 RCX: 00007f30f1cd2e29 [ 22.441548][ T375] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003 [ 22.449504][ T375] RBP: 00007f30f1d5b430 R08: 00007f30f1c64700 R09: 0000000000000000 [ 22.457879][ T375] R10: 00007f30f1c64700 R11: 0000000000000246 R12: 00007f30f1d5b43c [ 22.465831][ T375] R13: 00007f30f1d29004 R14: 74656e2f7665642f R15: 0000000000022000 [ 22.473773][ T375] Modules linked in: [ 22.477710][ T375] ---[ end trace ef21a734aa0275bf ]--- [ 22.483178][ T375] RIP: 0010:tun_attach+0x14b3/0x14c0 [ 22.488486][ T375] Code: 89 df e8 e0 ba b7 fe e9 cf fa ff ff e8 f6 e4 7d fe 48 c7 c7 a0 12 68 86 48 89 de e8 67 7c 7b ff e9 e0 fb ff ff e8 dd e4 7d fe <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 [ 22.508090][ T375] RSP: 0018:ffffc9000097fb50 EFLAGS: 00010293 [ 22.514158][ T375] RAX: ffffffff82eecd73 RBX: 0000000000000000 RCX: ffff8881065c8000 [ 22.522150][ T375] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.530227][ T375] RBP: ffffc9000097fc70 R08: ffffffff82eec175 R09: ffffed10232f5886 [ 22.538248][ T375] R10: ffffed10232f5886 R11: 1ffff110232f5885 R12: ffff8881197ac428 [ 22.546234][ T375] R13: ffff88811777c980 R14: ffff88811777c000 R15: dffffc0000000000 [ 22.554235][ T375] FS: 00007f30f1c64700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 22.563169][ T375] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.569761][ T375] CR2: 00007f30f1c64718 CR3: 000000011e215000 CR4: 00000000003506a0 [ 22.577733][ T375] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.585701][ T375] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.593690][ T375] Kernel panic - not syncing: Fatal exception [ 22.599933][ T375] Kernel Offset: disabled [ 22.604243][ T375] Rebooting in 86400 seconds..