./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3271547061 <...> Warning: Permanently added '10.128.1.162' (ED25519) to the list of known hosts. execve("./syz-executor3271547061", ["./syz-executor3271547061"], 0x7ffef72a7530 /* 10 vars */) = 0 brk(NULL) = 0x555578731000 brk(0x555578731d00) = 0x555578731d00 arch_prctl(ARCH_SET_FS, 0x555578731380) = 0 set_tid_address(0x555578731650) = 282 set_robust_list(0x555578731660, 24) = 0 rseq(0x555578731ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3271547061", 4096) = 28 getrandom("\x22\x54\x9a\xd1\x5f\x84\xb7\x15", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555578731d00 brk(0x555578752d00) = 0x555578752d00 brk(0x555578753000) = 0x555578753000 mprotect(0x7f599ad7b000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0executing program ) = 0x200001000000 write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f59928cb000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f59928cb000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 26.840924][ T24] audit: type=1400 audit(1748678227.360:64): avc: denied { execmem } for pid=282 comm="syz-executor327" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 26.865999][ T24] audit: type=1400 audit(1748678227.390:65): avc: denied { read write } for pid=282 comm="syz-executor327" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.891104][ T24] audit: type=1400 audit(1748678227.390:66): avc: denied { open } for pid=282 comm="syz-executor327" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 close(4) = 0 mkdir("./file2", 0777) = 0 [ 26.916493][ T24] audit: type=1400 audit(1748678227.390:67): avc: denied { ioctl } for pid=282 comm="syz-executor327" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.945225][ T24] audit: type=1400 audit(1748678227.470:68): avc: denied { mounton } for pid=282 comm="syz-executor327" path="/root/file2" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 27.005805][ T282] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 27.020305][ T282] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 27.032627][ T282] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2815: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 27.047313][ T282] EXT4-fs (loop0): 1 truncate cleaned up mount("/dev/loop0", "./file2", "ext4", MS_NOEXEC|MS_DIRSYNC, "nogrpid,min_batch_time=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,nobarrier,nodisc"...) = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 truncate("./file2", 23) = 0 lsetxattr("./file1", "trusted.overlay.upper", "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 40, 0) = 0 [ 27.053423][ T282] EXT4-fs (loop0): mounted filesystem without journal. Opts: nogrpid,min_batch_time=0x0000000000000000,debug_want_extra_isize=0x0000000000000068,nobarrier,nodiscard,quota,,errors=continue [ 27.073138][ T24] audit: type=1400 audit(1748678227.600:69): avc: denied { mount } for pid=282 comm="syz-executor327" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 27.080232][ T282] ================================================================== [ 27.101455][ T24] audit: type=1400 audit(1748678227.600:70): avc: denied { write } for pid=282 comm="syz-executor327" name="file2" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.104398][ T282] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1339/0x36c0 [ 27.104408][ T282] Read of size 18446744073709551540 at addr ffff88811da35870 by task syz-executor327/282 [ 27.104423][ T282] [ 27.129006][ T24] audit: type=1400 audit(1748678227.600:71): avc: denied { open } for pid=282 comm="syz-executor327" name="file2" dev="loop0" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.137708][ T282] CPU: 1 PID: 282 Comm: syz-executor327 Not tainted 5.10.237-syzkaller-00010-gcf6ed0f1511d #0 [ 27.137715][ T282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 27.137719][ T282] Call Trace: [ 27.137745][ T282] __dump_stack+0x21/0x24 [ 27.137755][ T282] dump_stack_lvl+0x169/0x1d8 [ 27.137778][ T282] ? show_regs_print_info+0x18/0x18 [ 27.148275][ T24] audit: type=1400 audit(1748678227.600:72): avc: denied { setattr } for pid=282 comm="syz-executor327" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 27.150385][ T282] ? thaw_kernel_threads+0x220/0x220 [ 27.242777][ T282] print_address_description+0x7f/0x2c0 [ 27.248610][ T282] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 27.254171][ T282] kasan_report+0xe2/0x130 [ 27.258578][ T282] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 27.264118][ T282] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 27.269780][ T282] kasan_check_range+0x280/0x290 [ 27.274900][ T282] memmove+0x2d/0x70 [ 27.278992][ T282] ext4_xattr_set_entry+0x1339/0x36c0 [ 27.284472][ T282] ? fscrypt_drop_inode+0xad/0x110 [ 27.290040][ T282] ? ext4_xattr_ibody_set+0x360/0x360 [ 27.295530][ T282] ? slab_post_alloc_hook+0x7d/0x2f0 [ 27.301188][ T282] ? __ext4_journal_get_write_access+0x21b/0x490 [ 27.307717][ T282] ? __wake_up_bit+0x100/0x100 [ 27.313154][ T282] ? ext4_xattr_block_set+0x847/0x2a50 [ 27.318749][ T282] ? __kmalloc_track_caller+0x181/0x320 [ 27.324882][ T282] ? memcpy+0x56/0x70 [ 27.328952][ T282] ext4_xattr_block_set+0x92f/0x2a50 [ 27.334418][ T282] ? __kasan_check_read+0x11/0x20 [ 27.339533][ T282] ? __ext4_xattr_check_block+0x265/0x8e0 [ 27.345432][ T282] ? ext4_xattr_block_find+0x4f0/0x4f0 [ 27.350879][ T282] ? __kasan_check_write+0x14/0x20 [ 27.356325][ T282] ext4_xattr_set_handle+0xba5/0x12a0 [ 27.361681][ T282] ? ext4_xattr_set_entry+0x36c0/0x36c0 [ 27.367300][ T282] ? __kasan_check_read+0x11/0x20 [ 27.372310][ T282] ? __ext4_journal_start_sb+0x2e2/0x490 [ 27.378422][ T282] ext4_xattr_set+0x1ec/0x320 [ 27.383170][ T282] ? ext4_xattr_set_credits+0x290/0x290 [ 27.388958][ T282] ext4_xattr_trusted_set+0x3b/0x50 [ 27.394480][ T282] ? ext4_xattr_trusted_get+0x40/0x40 [ 27.400074][ T282] __vfs_setxattr+0x42a/0x480 [ 27.404863][ T282] __vfs_setxattr_noperm+0x11e/0x4e0 [ 27.410242][ T282] __vfs_setxattr_locked+0x203/0x220 [ 27.415602][ T282] vfs_setxattr+0x8d/0x1c0 [ 27.420291][ T282] setxattr+0x1a9/0x370 [ 27.424448][ T282] ? path_setxattr+0x210/0x210 [ 27.429211][ T282] ? __mnt_want_write+0x1e6/0x260 [ 27.434757][ T282] ? mnt_want_write+0x19d/0x270 [ 27.439650][ T282] path_setxattr+0x110/0x210 [ 27.444526][ T282] ? simple_xattr_list_add+0x120/0x120 [ 27.450267][ T282] ? fpu__clear_all+0x20/0x20 [ 27.454934][ T282] ? filp_close+0x105/0x150 [ 27.459421][ T282] __x64_sys_lsetxattr+0xc2/0xe0 [ 27.464450][ T282] do_syscall_64+0x31/0x40 [ 27.469048][ T282] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.475078][ T282] RIP: 0033:0x7f599ad08a79 [ 27.479683][ T282] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 27.500801][ T282] RSP: 002b:00007ffcceaad758 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 27.509573][ T282] RAX: ffffffffffffffda RBX: 0072657070752e79 RCX: 00007f599ad08a79 [ 27.517911][ T282] RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 0000200000000100 [ 27.526336][ T282] RBP: 0031656c69662f2e R08: 0000000000000000 R09: 0000000000000000 [ 27.534731][ T282] R10: 000000000000fe37 R11: 0000000000000246 R12: 0000000000000001 [ 27.543263][ T282] R13: 00007ffcceaad938 R14: 0000000000000001 R15: 0000000000000001 [ 27.551900][ T282] [ 27.555002][ T282] Allocated by task 0: [ 27.559299][ T282] (stack is not available) [ 27.564177][ T282] [ 27.566508][ T282] The buggy address belongs to the object at ffff88811da35800 [ 27.566508][ T282] which belongs to the cache kmalloc-1k of size 1024 [ 27.581369][ T282] The buggy address is located 112 bytes inside of [ 27.581369][ T282] 1024-byte region [ffff88811da35800, ffff88811da35c00) [ 27.594950][ T282] The buggy address belongs to the page: [ 27.600777][ T282] page:ffffea0004768c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11da30 [ 27.611410][ T282] head:ffffea0004768c00 order:3 compound_mapcount:0 compound_pincount:0 [ 27.620250][ T282] flags: 0x4000000000010200(slab|head) [ 27.626081][ T282] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 27.634761][ T282] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.643323][ T282] page dumped because: kasan: bad access detected [ 27.649912][ T282] page_owner tracks the page as allocated [ 27.655900][ T282] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 282, ts 27076466667, free_ts 27075995498 [ 27.674482][ T282] prep_new_page+0x179/0x180 [ 27.679156][ T282] get_page_from_freelist+0x2235/0x23d0 [ 27.684683][ T282] __alloc_pages_nodemask+0x268/0x5f0 [ 27.690484][ T282] new_slab+0x84/0x3f0 [ 27.694658][ T282] ___slab_alloc+0x2a6/0x450 [ 27.699522][ T282] __slab_alloc+0x63/0xa0 [ 27.704270][ T282] __kmalloc_track_caller+0x1ef/0x320 [ 27.710289][ T282] __alloc_skb+0xdc/0x520 [ 27.714868][ T282] __napi_alloc_skb+0x158/0x2e0 [ 27.719812][ T282] page_to_skb+0x40/0x8b0 [ 27.724617][ T282] receive_buf+0xba1/0x4590 [ 27.729721][ T282] virtnet_poll+0x4f2/0xef0 [ 27.734502][ T282] net_rx_action+0x432/0xdd0 [ 27.739305][ T282] __do_softirq+0x255/0x563 [ 27.744101][ T282] page last free stack trace: [ 27.748836][ T282] __free_pages_ok+0x7fc/0x820 [ 27.753880][ T282] free_compound_page+0x73/0x90 [ 27.758910][ T282] __put_compound_page+0x77/0xb0 [ 27.764418][ T282] __put_page+0xbd/0xe0 [ 27.768826][ T282] page_to_skb+0x3bf/0x8b0 [ 27.773617][ T282] receive_buf+0xba1/0x4590 [ 27.778880][ T282] virtnet_poll+0x4f2/0xef0 [ 27.783467][ T282] net_rx_action+0x432/0xdd0 [ 27.788407][ T282] __do_softirq+0x255/0x563 [ 27.792996][ T282] [ 27.795900][ T282] Memory state around the buggy address: [ 27.801759][ T282] ffff88811da35700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.810383][ T282] ffff88811da35780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.818556][ T282] >ffff88811da35800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.827169][ T282] ^ [ 27.836828][ T282] ffff88811da35880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.847313][ T282] ffff88811da35900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 lsetxattr("./file1", "trusted.overlay.upper", "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65079, 0) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 27.856062][ T282] =============