ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor1581106810
<...>
Warning: Permanently added '10.128.0.221' (ED25519) to the list of known hosts.
execve("ci2-android-6-1/syz-executor1581106810", ["ci2-android-6-1/syz-executor1581106810"], 0x7ffeba2a8740 /* 10 vars */) = 0
brk(NULL) = 0x555562c59000
brk(0x555562c59d40) = 0x555562c59d40
arch_prctl(ARCH_SET_FS, 0x555562c593c0) = 0
set_tid_address(0x555562c59690) = 304
set_robust_list(0x555562c596a0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor1581106810", 4096) = 44
getrandom("\xa8\xd4\xfe\x0e\xdd\x6f\x1c\x35", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555562c59d40
brk(0x555562c7ad40) = 0x555562c7ad40
brk(0x555562c7b000) = 0x555562c7b000
mprotect(0x7f8e1e83d000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
getrandom("\xa4\xc2\xfa\xdf\x4f\x05\xe3\x78", 8, GRND_NONBLOCK) = 8
mkdir("./syzkaller.isG4Mj", 0700) = 0
chmod("./syzkaller.isG4Mj", 0777) = 0
chdir("./syzkaller.isG4Mj") = 0
executing program
write(1, "executing program\n", 18) = 18
socket(AF_PPPOX, SOCK_STREAM, 1) = 3
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
connect(3, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00\x04\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x02\x20\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00"}, 50) = 0
ioctl(3, TIOCOUTQ, NULL) = -1 ENOTTY (Inappropriate ioctl for device)
exit_group(0) = ?
[ 32.160359][ T28] audit: type=1400 audit(1791754249.021:64): avc: denied { execmem } for pid=304 comm="syz-executor158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 32.179821][ T28] audit: type=1400 audit(1791754249.031:65): avc: denied { create } for pid=304 comm="syz-executor158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[ 32.200079][ T304] ==================================================================
[ 32.201927][ T28] audit: type=1400 audit(1791754249.031:66): avc: denied { connect } for pid=304 comm="syz-executor158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[ 32.208167][ T304] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0
[ 32.228607][ T28] audit: type=1400 audit(1791754249.041:67): avc: denied { ioctl } for pid=304 comm="syz-executor158" path="socket:[13063]" dev="sockfs" ino=13063 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[ 32.236005][ T304] Read of size 4 at addr ffff88812394b800 by task syz-executor158/304
[ 32.236025][ T304]
[ 32.236031][ T304] CPU: 0 PID: 304 Comm: syz-executor158 Not tainted syzkaller #0
[ 32.279110][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 32.289176][ T304] Call Trace:
[ 32.292452][ T304]
[ 32.295378][ T304] __dump_stack+0x21/0x24
[ 32.299718][ T304] dump_stack_lvl+0x110/0x170
[ 32.304415][ T304] ? __cfi_dump_stack_lvl+0x8/0x8
[ 32.309466][ T304] ? _raw_spin_lock_bh+0x94/0xf0
[ 32.314422][ T304] ? pppol2tp_sock_to_session+0x1a0/0x1b0
[ 32.320146][ T304] print_address_description+0x71/0x200
[ 32.325700][ T304] print_report+0x4a/0x60
[ 32.330031][ T304] kasan_report+0x122/0x150
[ 32.334539][ T304] ? pppol2tp_sock_to_session+0x1a0/0x1b0
[ 32.340261][ T304] __asan_report_load4_noabort+0x14/0x20
[ 32.345888][ T304] pppol2tp_sock_to_session+0x1a0/0x1b0
[ 32.351436][ T304] pppol2tp_release+0x150/0x2b0
[ 32.356288][ T304] sock_close+0xc9/0x220
[ 32.360525][ T304] ? __cfi_sock_close+0x10/0x10
[ 32.365376][ T304] __fput+0x1fd/0x8f0
[ 32.369359][ T304] ____fput+0x15/0x20
[ 32.373338][ T304] task_work_run+0x1e1/0x250
[ 32.377929][ T304] ? __cfi_task_work_run+0x10/0x10
[ 32.383037][ T304] ? __kasan_check_write+0x14/0x20
[ 32.388140][ T304] do_exit+0xb0d/0x29f0
[ 32.392312][ T304] ? ptrace_stop+0x6dc/0x8e0
[ 32.396897][ T304] ? __cfi_do_exit+0x10/0x10
[ 32.401484][ T304] ? __kasan_check_write+0x14/0x20
[ 32.406603][ T304] ? _raw_spin_lock_irq+0x95/0xf0
[ 32.411630][ T304] ? __cfi__raw_spin_lock_irq+0x10/0x10
[ 32.417177][ T304] ? irqtime_account_irq+0x17c/0x240
[ 32.422471][ T304] ? zap_other_threads+0x321/0x3a0
[ 32.427620][ T304] do_group_exit+0x21b/0x2e0
[ 32.432225][ T304] __x64_sys_exit_group+0x3f/0x40
[ 32.437253][ T304] x64_sys_call+0x7b4/0x9a0
[ 32.441758][ T304] do_syscall_64+0x4c/0xa0
[ 32.446176][ T304] ? clear_bhb_loop+0x30/0x80
[ 32.450846][ T304] ? clear_bhb_loop+0x30/0x80
[ 32.455516][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.461413][ T304] RIP: 0033:0x7f8e1e7ac385
[ 32.465834][ T304] Code: Unable to access opcode bytes at 0x7f8e1e7ac35b.
[ 32.472861][ T304] RSP: 002b:00007fff9a18d128 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
[ 32.481274][ T304] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f8e1e7ac385
[ 32.489250][ T304] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000
[ 32.497220][ T304] RBP: 0000000000000000 R08: 0000000000000000 R09: 6c616b7a79732f2e
[ 32.505194][ T304] R10: 000000000000000a R11: 0000000000000206 R12: 0000000000000000
[ 32.513175][ T304] R13: 00007f8e1e842110 R14: 00007f8e1e8443a8 R15: 00007f8e1e8443c0
[ 32.521164][ T304]
[ 32.524190][ T304]
[ 32.526507][ T304] Allocated by task 304:
[ 32.530740][ T304] kasan_set_track+0x4b/0x70
[ 32.535331][ T304] kasan_save_alloc_info+0x1f/0x30
[ 32.540454][ T304] __kasan_kmalloc+0x95/0xb0
[ 32.545106][ T304] __kmalloc+0xb4/0x1e0
[ 32.549273][ T304] l2tp_session_create+0x38/0xbd0
[ 32.554307][ T304] pppol2tp_connect+0xbf5/0x1640
[ 32.559253][ T304] __sys_connect+0x3da/0x460
[ 32.563841][ T304] __x64_sys_connect+0x7a/0x90
[ 32.568609][ T304] x64_sys_call+0x88d/0x9a0
[ 32.573126][ T304] do_syscall_64+0x4c/0xa0
[ 32.577547][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 32.583441][ T304]
[ 32.585774][ T304] Freed by task 8:
[ 32.589482][ T304] kasan_set_track+0x4b/0x70
[ 32.594077][ T304] kasan_save_free_info+0x2b/0x40
[ 32.599104][ T304] ____kasan_slab_free+0x132/0x180
[ 32.604219][ T304] __kasan_slab_free+0x11/0x20
[ 32.608993][ T304] slab_free_freelist_hook+0xc2/0x190
[ 32.614359][ T304] __kmem_cache_free+0xb7/0x1b0
[ 32.619209][ T304] kfree+0x6f/0xf0
[ 32.622920][ T304] l2tp_session_put+0xaf/0x1a0
[ 32.627680][ T304] l2tp_session_delete+0x3df/0x4d0
[ 32.632790][ T304] l2tp_tunnel_del_work+0x199/0x410
[ 32.637983][ T304] process_one_work+0x717/0xc30
[ 32.642846][ T304] worker_thread+0xa4d/0x11d0
[ 32.647518][ T304] kthread+0x281/0x320
[ 32.651581][ T304] ret_from_fork+0x1f/0x30
[ 32.655994][ T304]
[ 32.658310][ T304] The buggy address belongs to the object at ffff88812394b800
[ 32.658310][ T304] which belongs to the cache kmalloc-512 of size 512
[ 32.672353][ T304] The buggy address is located 0 bytes inside of
[ 32.672353][ T304] 512-byte region [ffff88812394b800, ffff88812394ba00)
[ 32.685456][ T304]
[ 32.687790][ T304] The buggy address belongs to the physical page:
[ 32.694188][ T304] page:ffffea00048e5200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123948
[ 32.704442][ T304] head:ffffea00048e5200 order:2 compound_mapcount:0 compound_pincount:0
[ 32.712759][ T304] flags: 0x4000000000010200(slab|head|zone=1)
[ 32.718835][ T304] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00
[ 32.727410][ T304] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 32.735983][ T304] page dumped because: kasan: bad access detected
[ 32.742391][ T304] page_owner tracks the page as allocated
[ 32.748093][ T304] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 300, tgid 300 (sshd-session), ts 32082411562, free_ts 0
[ 32.768398][ T304] post_alloc_hook+0x1f5/0x210
[ 32.773188][ T304] prep_new_page+0x1c/0x110
[ 32.777694][ T304] get_page_from_freelist+0x2ca9/0x2d20
[ 32.783242][ T304] __alloc_pages+0x1fa/0x610
[ 32.787835][ T304] alloc_slab_page+0x6e/0xf0
[ 32.792421][ T304] new_slab+0x98/0x3e0
[ 32.796479][ T304] ___slab_alloc+0x70f/0xb70
[ 32.801065][ T304] __slab_alloc+0x5e/0xa0
[ 32.805391][ T304] __kmem_cache_alloc_node+0x204/0x2d0
[ 32.810861][ T304] __kmalloc_node_track_caller+0xa1/0x1e0
[ 32.816571][ T304] __alloc_skb+0x226/0x4a0
[ 32.820980][ T304] alloc_skb_with_frags+0xa8/0x620
[ 32.826084][ T304] sock_alloc_send_pskb+0x87f/0x9a0
[ 32.831281][ T304] unix_stream_sendmsg+0x431/0xa80
[ 32.836381][ T304] sock_write_iter+0x2ea/0x3f0
[ 32.841139][ T304] vfs_write+0x5ef/0xd00
[ 32.845374][ T304] page_owner free stack trace missing
[ 32.850727][ T304]
[ 32.853043][ T304] Memory state around the buggy address:
[ 32.858660][ T304] ffff88812394b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 32.866717][ T304] ffff88812394b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 32.874768][ T304] >ffff88812394b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 32.882834][ T304] ^
[ 32.886893][ T304] ffff88812394b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 32.894949][ T304] ffff88812394b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 32.903001][ T304] ==================================================================
[ 32.911322][ T304] Disabling lock debugging due to kernel taint
[ 32.917816][ T304] ------------[ cut here ]------------
[ 32.923344][ T304] WARNING: CPU: 0 PID: 304 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0
[ 32.926682][ T28] audit: type=1400 audit(1791754249.791:68): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 32.933421][ T304] Modules linked in:
[ 32.958973][ T304] CPU: 0 PID: 304 Comm: syz-executor158 Tainted: G B syzkaller #0
[ 32.958990][ T28] audit: type=1400 audit(1791754249.791:69): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 32.968217][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 32.968231][ T304] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0
[ 32.990135][ T28] audit: type=1400 audit(1791754249.791:70): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 32.999558][ T304] Code: 5d c3 e8 dc 3c d5 fc be 02 00 00 00 eb 0a e8 d0 3c d5 fc be 01 00 00 00 4c 89 f7 e8 83 01 cd fd e9 0f ff ff ff e8 b9 3c d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 a8 3c d5 fc 4c 89 f7 be 03
[ 33.006320][ T28] audit: type=1400 audit(1791754249.791:71): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 33.026963][ T304] RSP: 0018:ffffc90000ef7b30 EFLAGS: 00010293
[ 33.026982][ T304] RAX: ffffffff849c3187 RBX: ffff88810951b000 RCX: ffff88810fcee540
[ 33.047240][ T28] audit: type=1400 audit(1791754249.791:72): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 33.067030][ T304] RDX: 0000000000000000 RSI: 000000000dbb86c0 RDI: 000000000c04eb7d
[ 33.073511][ T28] audit: type=1400 audit(1791754249.791:73): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 33.081112][ T304] RBP: ffffc90000ef7b50 R08: ffffffff87b767e7 R09: 1ffffffff0f6ecfc
[ 33.140123][ T304] R10: dffffc0000000000 R11: fffffbfff0f6ecfd R12: dffffc0000000000
[ 33.148090][ T304] R13: dffffc0000000000 R14: 000000000dbb86c0 R15: ffff88812394b800
[ 33.156096][ T304] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 33.165066][ T304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 33.171685][ T304] CR2: 00007f8e1e8125fc CR3: 000000000700f000 CR4: 00000000003506b0
[ 33.179672][ T304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 33.187676][ T304] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 33.195686][ T304] Call Trace:
[ 33.198966][ T304]
[ 33.201931][ T304] pppol2tp_release+0x150/0x2b0
[ 33.206838][ T304] sock_close+0xc9/0x220
[ 33.211115][ T304] ? __cfi_sock_close+0x10/0x10
[ 33.216006][ T304] __fput+0x1fd/0x8f0
[ 33.220030][ T304] ____fput+0x15/0x20
[ 33.224033][ T304] task_work_run+0x1e1/0x250
[ 33.228622][ T304] ? __cfi_task_work_run+0x10/0x10
[ 33.233773][ T304] ? __kasan_check_write+0x14/0x20
[ 33.238912][ T304] do_exit+0xb0d/0x29f0
[ 33.243123][ T304] ? ptrace_stop+0x6dc/0x8e0
[ 33.247732][ T304] ? __cfi_do_exit+0x10/0x10
[ 33.252366][ T304] ? __kasan_check_write+0x14/0x20
[ 33.257492][ T304] ? _raw_spin_lock_irq+0x95/0xf0
[ 33.262550][ T304] ? __cfi__raw_spin_lock_irq+0x10/0x10
[ 33.268115][ T304] ? irqtime_account_irq+0x17c/0x240
[ 33.273460][ T304] ? zap_other_threads+0x321/0x3a0
[ 33.278623][ T304] do_group_exit+0x21b/0x2e0
[ 33.283264][ T304] __x64_sys_exit_group+0x3f/0x40
[ 33.288319][ T304] x64_sys_call+0x7b4/0x9a0
[ 33.292873][ T304] do_syscall_64+0x4c/0xa0
[ 33.297310][ T304] ? clear_bhb_loop+0x30/0x80
[ 33.302016][ T304] ? clear_bhb_loop+0x30/0x80
[ 33.306705][ T304] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 33.312632][ T304] RIP: 0033:0x7f8e1e7ac385
[ 33.317059][ T304] Code: Unable to access opcode bytes at 0x7f8e1e7ac35b.
[ 33.324102][ T304] RSP: 002b:00007fff9a18d128 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
[ 33.332541][ T304] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f8e1e7ac385
[ 33.340542][ T304] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000
[ 33.348523][ T304] RBP: 0000000000000000 R08: 0000000000000000 R09: 6c616b7a79732f2e
[ 33.356527][ T304] R10: 000000000000000a R11: 0000000000000206 R12: 0000000000000000
+++ exited with 0 +++
[ 33.364523][