./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor147494300 <...> sshd_t tclass=fifo_file permissive=1 [ 27.243904][ T23] audit: type=1400 audit(1708442345.430:64): avc: denied { rlimitinh } for pid=337 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 27.263974][ T23] audit: type=1400 audit(1708442345.430:65): avc: denied { siginh } for pid=337 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.75' (ED25519) to the list of known hosts. execve("./syz-executor147494300", ["./syz-executor147494300"], 0x7ffeacae6110 /* 10 vars */) = 0 brk(NULL) = 0x555556cda000 brk(0x555556cdae00) = 0x555556cdae00 arch_prctl(ARCH_SET_FS, 0x555556cda480) = 0 set_tid_address(0x555556cda750) = 368 set_robust_list(0x555556cda760, 24) = 0 rseq(0x555556cdada0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor147494300", 4096) = 27 getrandom("\x67\xc1\x44\xba\x5a\x77\x70\xbe", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556cdae00 brk(0x555556cfbe00) = 0x555556cfbe00 brk(0x555556cfc000) = 0x555556cfc000 mprotect(0x7f9d6f5c8000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f9d6f525be0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f9d6f52cda0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f9d6f525be0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f9d6f52cda0}, NULL, 8) = 0 mkdir("./file0", 0200) = 0 [ 40.408731][ T23] audit: type=1400 audit(1708442358.600:66): avc: denied { execmem } for pid=368 comm="syz-executor147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 mount("./file0", "./file0", "incremental-fs", 0, NULL) = 0 openat(-1, ".pending_reads", O_RDONLY) = -1 EBADF (Bad file descriptor) openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [ 40.436887][ T23] audit: type=1400 audit(1708442358.630:67): avc: denied { mounton } for pid=368 comm="syz-executor147" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 40.460428][ T23] audit: type=1400 audit(1708442358.630:68): avc: denied { mount } for pid=368 comm="syz-executor147" name="/" dev="incremental-fs" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 write(3, "\x49\xcc\x03\xcf\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x69\x6e\x63\x72\x65\x6d\x65\x6e\x74\x61\x6c\x2d\x66\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1840702809) = 16777216 mmap(0x20000000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_NONBLOCK, 3, 0) = 0x20000000 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000100} --- open("./file0", O_RDONLY) = 4 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000080} --- --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000000} --- [ 40.832751][ T23] audit: type=1400 audit(1708442359.020:69): avc: denied { write } for pid=368 comm="syz-executor147" name="/" dev="incremental-fs" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.833597][ T368] kasan: CONFIG_KASAN_INLINE enabled [ 40.856112][ T23] audit: type=1400 audit(1708442359.020:70): avc: denied { add_name } for pid=368 comm="syz-executor147" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.860988][ T368] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 40.885729][ T23] audit: type=1400 audit(1708442359.020:71): avc: denied { link } for pid=368 comm="syz-executor147" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 40.893881][ T368] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 40.925478][ T368] CPU: 1 PID: 368 Comm: syz-executor147 Not tainted 5.4.265-syzkaller-00001-g1b3143b9b166 #0 [ 40.935541][ T368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 [ 40.945646][ T368] RIP: 0010:vfs_link+0x3b/0x8a0 [ 40.950704][ T368] Code: 24 30 49 89 d6 49 89 f5 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 b5 1c c6 ff 48 89 5c 24 28 48 83 c3 30 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 47 ef f5 ff 48 8b 2b 4d 8d 7d 28 4d [ 40.970201][ T368] RSP: 0018:ffff8881dcb8fbb0 EFLAGS: 00010206 [ 40.976102][ T368] RAX: 0000000000000006 RBX: 0000000000000030 RCX: ffff8881dc858fc0 [ 40.983931][ T368] RDX: 0000000000000000 RSI: ffff8881e83f2518 RDI: 0000000000000000 [ 40.991992][ T368] RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed103d07e4b9 [ 40.999981][ T368] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881e83fe990 [ 41.007883][ T368] R13: ffff8881e83f2518 R14: ffff8881e83fe990 R15: ffff8881e83f2518 [ 41.016248][ T368] FS: 0000555556cda480(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 41.029658][ T368] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.036076][ T368] CR2: 0000000020000000 CR3: 00000001dca27000 CR4: 00000000003406a0 [ 41.043903][ T368] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.051876][ T368] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.059686][ T368] Call Trace: [ 41.062829][ T368] ? __die+0xb4/0x100 [ 41.066628][ T368] ? die+0x26/0x50 [ 41.070186][ T368] ? do_general_protection+0x266/0x3c0 [ 41.075479][ T368] ? do_trap+0x340/0x340 [ 41.079560][ T368] ? general_protection+0x28/0x30 [ 41.084428][ T368] ? vfs_link+0x3b/0x8a0 [ 41.088502][ T368] dir_link+0x37f/0x510 [ 41.092501][ T368] ? dir_lookup+0x690/0x690 [ 41.097624][ T368] ? down_write+0xd7/0x150 [ 41.102106][ T368] ? down_read_killable+0x220/0x220 [ 41.107766][ T368] ? generic_permission+0x198/0x3e0 [ 41.112797][ T368] ? security_inode_link+0xcc/0x110 [ 41.117936][ T368] vfs_link+0x69b/0x8a0 [ 41.121909][ T368] do_linkat+0x46c/0x8b0 [ 41.125994][ T368] ? fsnotify_link+0x150/0x150 [ 41.130612][ T368] ? do_syscall_64+0x1c0/0x1c0 [ 41.135379][ T368] ? force_sig_fault+0x125/0x1c0 [ 41.140506][ T368] ? force_sig_fault_to_task+0x1c0/0x1c0 [ 41.145981][ T368] __x64_sys_linkat+0xb1/0xc0 [ 41.150479][ T368] do_syscall_64+0xca/0x1c0 [ 41.154908][ T368] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 41.160803][ T368] Modules linked in: [ 41.164728][ T368] ---[ end trace 52481c0c82d34b71 ]--- [ 41.170096][ T368] RIP: 0010:vfs_link+0x3b/0x8a0 [ 41.174793][ T368] Code: 24 30 49 89 d6 49 89 f5 48 89 fb 48 bd 00 00 00 00 00 fc ff df e8 b5 1c c6 ff 48 89 5c 24 28 48 83 c3 30 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 47 ef f5 ff 48 8b 2b 4d 8d 7d 28 4d [ 41.194238][ T368] RSP: 0018:ffff8881dcb8fbb0 EFLAGS: 00010206 [ 41.200105][ T368] RAX: 0000000000000006 RBX: 0000000000000030 RCX: ffff8881dc858fc0 [ 41.208022][ T368] RDX: 0000000000000000 RSI: ffff8881e83f2518 RDI: 0000000000000000 [ 41.215843][ T368] RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed103d07e4b9 [ 41.223582][ T368] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881e83fe990 [ 41.231440][ T368] R13: ffff8881e83f2518 R14: ffff8881e83fe990 R15: ffff8881e83f2518 [ 41.239231][ T368] FS: 0000555556cda480(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 41.248016][ T368] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.254423][ T368] CR2: 0000000020000000 CR3: 00000001dca27000 CR4: 00000000003406a0 [ 41.262210][ T368] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.270065][ T368] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.278065][ T368] Kernel panic - not syncing: Fatal exception [ 41.284194][ T368] Kernel Offset: disabled [ 41.288328][ T368] Rebooting in 86400 seconds..