./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1528280718 <...> [ 28.538424][ T3186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 28.550596][ T3186] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller syzkaller login: [ 40.124826][ T27] kauditd_printk_skb: 37 callbacks suppressed [ 40.124842][ T27] audit: type=1400 audit(1663445078.504:73): avc: denied { transition } for pid=3438 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 40.170327][ T27] audit: type=1400 audit(1663445078.514:74): avc: denied { write } for pid=3438 comm="sh" path="pipe:[28531]" dev="pipefs" ino=28531 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 Warning: Permanently added '10.128.0.95' (ECDSA) to the list of known hosts. execve("./syz-executor1528280718", ["./syz-executor1528280718"], 0x7ffdc551f4f0 /* 10 vars */) = 0 brk(NULL) = 0x555556aa3000 brk(0x555556aa3c40) = 0x555556aa3c40 arch_prctl(ARCH_SET_FS, 0x555556aa3300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1528280718", 4096) = 28 brk(0x555556ac4c40) = 0x555556ac4c40 brk(0x555556ac5000) = 0x555556ac5000 mprotect(0x7f5ff796e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "/dev/fb0", O_RDONLY) = 3 mmap(0x20002000, 16384, PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSDOWN, MAP_PRIVATE|MAP_FIXED, 3, 0xa9000) = 0x20002000 openat(AT_FDCWD, "cpuacct.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [ 50.955502][ T27] audit: type=1400 audit(1663445089.334:75): avc: denied { execmem } for pid=3607 comm="syz-executor152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 50.977063][ T27] audit: type=1400 audit(1663445089.354:76): avc: denied { read } for pid=3607 comm="syz-executor152" name="fb0" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 50.983519][ T3607] ------------[ cut here ]------------ [ 51.001006][ T27] audit: type=1400 audit(1663445089.354:77): avc: denied { open } for pid=3607 comm="syz-executor152" path="/dev/fb0" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 51.006910][ T3607] kernel BUG at mm/memory.c:2218! [ 51.029925][ T27] audit: type=1400 audit(1663445089.354:78): avc: denied { map } for pid=3607 comm="syz-executor152" path="/dev/fb0" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 51.029970][ T27] audit: type=1400 audit(1663445089.354:79): avc: denied { execute } for pid=3607 comm="syz-executor152" path="/dev/fb0" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 51.082907][ T3607] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 51.088960][ T3607] CPU: 1 PID: 3607 Comm: syz-executor152 Not tainted 6.0.0-rc5-syzkaller-00094-ga335366bad13 #0 [ 51.099350][ T3607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 51.109387][ T3607] RIP: 0010:vmf_insert_pfn_prot+0x248/0x460 [ 51.115269][ T3607] Code: 0f 0b e8 ab 47 c7 ff 4d 89 f7 bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 77 44 c7 ff 49 83 ff 20 0f 85 a5 fe ff ff e8 88 47 c7 ff <0f> 0b 49 be ff ff ff ff ff ff 0f 00 e8 77 47 c7 ff 4d 21 ee 4c 89 [ 51.134858][ T3607] RSP: 0018:ffffc90002f67628 EFLAGS: 00010293 [ 51.140910][ T3607] RAX: 0000000000000000 RBX: 1ffff920005ecec7 RCX: 0000000000000000 [ 51.148862][ T3607] RDX: ffff888072b02040 RSI: ffffffff81b3f098 RDI: 0000000000000007 [ 51.156816][ T3607] RBP: ffff88801d967880 R08: 0000000000000007 R09: 0000000000000020 [ 51.164769][ T3607] R10: 0000000000000020 R11: 0000000000000003 R12: 0000000020002000 [ 51.172724][ T3607] R13: 000000000001d86d R14: 000000000c140476 R15: 0000000000000020 [ 51.180695][ T3607] FS: 0000555556aa3300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 51.189608][ T3607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.196179][ T3607] CR2: 000056169ec75108 CR3: 00000000282f2000 CR4: 00000000003506e0 [ 51.204136][ T3607] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.212088][ T3607] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.220039][ T3607] Call Trace: [ 51.223319][ T3607] [ 51.226234][ T3607] ? __lock_acquire+0xbc3/0x56d0 [ 51.231156][ T3607] ? insert_pfn+0x680/0x680 [ 51.235647][ T3607] drm_gem_shmem_fault+0x1e3/0x290 [ 51.240756][ T3607] __do_fault+0x10d/0x610 [ 51.245071][ T3607] __handle_mm_fault+0x2130/0x39b0 [ 51.250189][ T3607] ? vm_iomap_memory+0x190/0x190 [ 51.255113][ T3607] handle_mm_fault+0x1c8/0x780 [ 51.259863][ T3607] do_user_addr_fault+0x475/0x1210 [ 51.264977][ T3607] exc_page_fault+0x94/0x170 [ 51.269555][ T3607] asm_exc_page_fault+0x22/0x30 [ 51.274406][ T3607] RIP: 0010:fault_in_readable+0x175/0x290 [ 51.280114][ T3607] Code: 0c ca ff 49 39 dd 0f 84 06 01 00 00 45 31 f6 eb 11 e8 5f 0c ca ff 48 81 c3 00 10 00 00 4c 39 eb 74 1d e8 4e 0c ca ff 45 89 f7 <8a> 03 31 ff 44 89 fe 88 44 24 28 e8 fb 08 ca ff 45 85 ff 74 d2 e8 [ 51.299962][ T3607] RSP: 0018:ffffc90002f67a40 EFLAGS: 00050293 [ 51.306010][ T3607] RAX: 0000000000000000 RBX: 0000000020002000 RCX: 0000000000000000 [ 51.313962][ T3607] RDX: ffff888072b02040 RSI: ffffffff81b12bd2 RDI: 0000000000000005 [ 51.321916][ T3607] RBP: 0000000020001040 R08: 0000000000000005 R09: 0000000000000000 [ 51.329869][ T3607] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000001000 [ 51.337820][ T3607] R13: 0000000020003000 R14: 0000000000000000 R15: 0000000000000000 [ 51.345774][ T3607] ? fault_in_readable+0x172/0x290 [ 51.350873][ T3607] ? fault_in_subpage_writeable+0x20/0x20 [ 51.356574][ T3607] ? balance_dirty_pages_ratelimited_flags+0x8b/0x1630 [ 51.363408][ T3607] fault_in_iov_iter_readable+0x24e/0x2c0 [ 51.369133][ T3607] generic_perform_write+0x19e/0x560 [ 51.374418][ T3607] ? folio_add_wait_queue+0x1b0/0x1b0 [ 51.379781][ T3607] ? discard_new_inode+0x190/0x190 [ 51.385020][ T3607] ? down_write_killable_nested+0x180/0x180 [ 51.390919][ T3607] ext4_buffered_write_iter+0x15b/0x460 [ 51.396462][ T3607] ext4_file_write_iter+0x44a/0x1660 [ 51.401742][ T3607] ? lock_release+0x780/0x780 [ 51.406403][ T3607] ? ext4_buffered_write_iter+0x460/0x460 [ 51.412115][ T3607] vfs_write+0x9e9/0xdd0 [ 51.416348][ T3607] ? vfs_read+0x930/0x930 [ 51.420665][ T3607] ? find_held_lock+0x2d/0x110 [ 51.425433][ T3607] ? lock_downgrade+0x6e0/0x6e0 [ 51.430272][ T3607] ? __fget_light+0x20a/0x270 [ 51.434938][ T3607] ksys_write+0x127/0x250 [ 51.439256][ T3607] ? __ia32_sys_read+0xb0/0xb0 [ 51.444007][ T3607] ? lockdep_hardirqs_on+0x79/0x100 [ 51.449187][ T3607] ? _raw_spin_unlock_irq+0x2a/0x40 [ 51.454372][ T3607] ? ptrace_notify+0xfa/0x140 [ 51.459031][ T3607] do_syscall_64+0x35/0xb0 [ 51.463432][ T3607] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 51.469311][ T3607] RIP: 0033:0x7f5ff7901b89 [ 51.473708][ T3607] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.493648][ T3607] RSP: 002b:00007fff1554e1c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 51.502042][ T3607] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5ff7901b89 [ 51.510012][ T3607] RDX: 000000000000fea7 RSI: 0000000020000040 RDI: 0000000000000004 [ 51.517963][ T3607] RBP: 00007f5ff78c5d30 R08: 00000000000a9000 R09: 0000000000000000 [ 51.525916][ T3607] R10: 00000000000a9000 R11: 0000000000000246 R12: 00007f5ff78c5dc0 [ 51.533869][ T3607] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.541828][ T3607] [ 51.544872][ T3607] Modules linked in: [ 51.549144][ T3607] ---[ end trace 0000000000000000 ]--- [ 51.554700][ T3607] RIP: 0010:vmf_insert_pfn_prot+0x248/0x460 [ 51.560621][ T3607] Code: 0f 0b e8 ab 47 c7 ff 4d 89 f7 bf 20 00 00 00 41 83 e7 28 4c 89 fe e8 77 44 c7 ff 49 83 ff 20 0f 85 a5 fe ff ff e8 88 47 c7 ff <0f> 0b 49 be ff ff ff ff ff ff 0f 00 e8 77 47 c7 ff 4d 21 ee 4c 89 [ 51.580365][ T3607] RSP: 0018:ffffc90002f67628 EFLAGS: 00010293 [ 51.586418][ T3607] RAX: 0000000000000000 RBX: 1ffff920005ecec7 RCX: 0000000000000000 [ 51.594473][ T3607] RDX: ffff888072b02040 RSI: ffffffff81b3f098 RDI: 0000000000000007 [ 51.602515][ T3607] RBP: ffff88801d967880 R08: 0000000000000007 R09: 0000000000000020 [ 51.610502][ T3607] R10: 0000000000000020 R11: 0000000000000003 R12: 0000000020002000 [ 51.618473][ T3607] R13: 000000000001d86d R14: 000000000c140476 R15: 0000000000000020 [ 51.626462][ T3607] FS: 0000555556aa3300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 [ 51.635415][ T3607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.642024][ T3607] CR2: 000056169ec75108 CR3: 00000000282f2000 CR4: 00000000003506e0 [ 51.650027][ T3607] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.657988][ T3607] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.666014][ T3607] Kernel panic - not syncing: Fatal exception [ 51.672145][ T3607] Kernel Offset: disabled [ 51.676467][ T3607] Rebooting in 86400 seconds..