ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor110270746 <...> Warning: Permanently added '10.128.0.237' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor110270746", ["ci2-android-5-15/syz-executor110270746"], 0x7fff0fbccf70 /* 10 vars */) = 0 brk(NULL) = 0x555577442000 brk(0x555577442d40) = 0x555577442d40 arch_prctl(ARCH_SET_FS, 0x5555774423c0) = 0 set_tid_address(0x555577442690) = 303 set_robust_list(0x5555774426a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor110270746", 4096) = 44 getrandom("\xef\xbe\x97\xd0\x69\xda\x5b\xe4", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555577442d40 brk(0x555577463d40) = 0x555577463d40 brk(0x555577464000) = 0x555577464000 mprotect(0x7f5631176000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 executing program socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3 socket(AF_PPPOX, SOCK_STREAM, 1) = 4 connect(4, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x02\x00\x11\x5c\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"}, 38) = 0 ioctl(4, F2FS_IOC_RELEASE_VOLATILE_WRITE, 0) = -1 ENOTTY (Inappropriate ioctl for device) exit_group(0) = ? [ 20.175789][ T30] audit: type=1400 audit(1791260431.505:64): avc: denied { execmem } for pid=303 comm="syz-executor110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.180233][ T30] audit: type=1400 audit(1791260431.515:65): avc: denied { create } for pid=303 comm="syz-executor110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 20.185000][ T30] audit: type=1400 audit(1791260431.515:66): avc: denied { connect } for pid=303 comm="syz-executor110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 20.190397][ T30] audit: type=1400 audit(1791260431.525:67): avc: denied { ioctl } for pid=303 comm="syz-executor110" path="socket:[15034]" dev="sockfs" ino=15034 ioctlcmd=0xf504 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 20.196285][ T303] ================================================================== [ 20.204382][ T303] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 20.211170][ T303] Write of size 8 at addr ffff888125075d50 by task syz-executor110/303 [ 20.219420][ T303] [ 20.221776][ T303] CPU: 0 PID: 303 Comm: syz-executor110 Not tainted syzkaller #0 [ 20.229469][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 20.239523][ T303] Call Trace: [ 20.242799][ T303] [ 20.245755][ T303] __dump_stack+0x21/0x30 [ 20.250105][ T303] dump_stack_lvl+0x110/0x170 [ 20.254889][ T303] ? show_regs_print_info+0x20/0x20 [ 20.260084][ T303] ? load_image+0x3f0/0x3f0 [ 20.264586][ T303] print_address_description+0x7f/0x2c0 [ 20.270124][ T303] ? mutex_lock+0x8e/0x1c0 [ 20.274530][ T303] kasan_report+0x10f/0x150 [ 20.279024][ T303] ? mutex_lock+0x8e/0x1c0 [ 20.283433][ T303] kasan_check_range+0x249/0x2a0 [ 20.288359][ T303] __kasan_check_write+0x14/0x20 [ 20.293288][ T303] mutex_lock+0x8e/0x1c0 [ 20.297517][ T303] ? wait_for_completion_killable_timeout+0x10/0x10 [ 20.304095][ T303] ? l2tp_session_put+0xaf/0x1a0 [ 20.309022][ T303] ? l2tp_session_delete+0x3a9/0x4a0 [ 20.314296][ T303] pppol2tp_release+0x178/0x2b0 [ 20.319133][ T303] sock_close+0xb8/0x200 [ 20.323365][ T303] ? sock_mmap+0xa0/0xa0 [ 20.327595][ T303] __fput+0x22b/0x900 [ 20.331568][ T303] ____fput+0x15/0x20 [ 20.335541][ T303] task_work_run+0x127/0x190 [ 20.340121][ T303] do_exit+0xb70/0x29a0 [ 20.344265][ T303] ? ptrace_stop+0x6d8/0xa70 [ 20.348844][ T303] ? put_task_struct+0x90/0x90 [ 20.353595][ T303] ? ptrace_notify+0x1ea/0x270 [ 20.358509][ T303] ? do_notify_parent+0x830/0x830 [ 20.363533][ T303] do_group_exit+0x149/0x310 [ 20.368228][ T303] __x64_sys_exit_group+0x3f/0x40 [ 20.373253][ T303] x64_sys_call+0x832/0x9a0 [ 20.377871][ T303] do_syscall_64+0x4c/0xa0 [ 20.382379][ T303] ? clear_bhb_loop+0x50/0xa0 [ 20.387042][ T303] ? clear_bhb_loop+0x50/0xa0 [ 20.391735][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 20.397630][ T303] RIP: 0033:0x7f56310e5305 [ 20.402029][ T303] Code: Unable to access opcode bytes at RIP 0x7f56310e52db. [ 20.409375][ T303] RSP: 002b:00007ffce241e4b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 20.417789][ T303] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f56310e5305 [ 20.425747][ T303] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 20.433792][ T303] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffce241e648 [ 20.441896][ T303] R10: 0000000000000001 R11: 0000000000000206 R12: 0000000000000000 [ 20.449880][ T303] R13: 00007f563117b110 R14: 00007f563117d3a8 R15: 00007f563117d3c0 [ 20.457846][ T303] [ 20.460852][ T303] [ 20.463160][ T303] Allocated by task 303: [ 20.467383][ T303] __kasan_kmalloc+0xd4/0x100 [ 20.472050][ T303] __kmalloc+0x13d/0x2c0 [ 20.476280][ T303] l2tp_session_create+0x39/0xb60 [ 20.481295][ T303] pppol2tp_connect+0xbf5/0x1640 [ 20.486213][ T303] __sys_connect+0x3cb/0x450 [ 20.490787][ T303] __x64_sys_connect+0x7a/0x90 [ 20.495536][ T303] x64_sys_call+0x7c/0x9a0 [ 20.499935][ T303] do_syscall_64+0x4c/0xa0 [ 20.504344][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 20.510222][ T303] [ 20.512549][ T303] Freed by task 303: [ 20.516418][ T303] kasan_set_track+0x4a/0x70 [ 20.520992][ T303] kasan_set_free_info+0x23/0x40 [ 20.525913][ T303] ____kasan_slab_free+0x125/0x160 [ 20.531009][ T303] __kasan_slab_free+0x11/0x20 [ 20.535760][ T303] slab_free_freelist_hook+0xc2/0x190 [ 20.541118][ T303] kfree+0xc4/0x270 [ 20.544912][ T303] l2tp_session_put+0xaf/0x1a0 [ 20.549662][ T303] l2tp_session_delete+0x3a9/0x4a0 [ 20.554769][ T303] pppol2tp_release+0x169/0x2b0 [ 20.559607][ T303] sock_close+0xb8/0x200 [ 20.563834][ T303] __fput+0x22b/0x900 [ 20.567799][ T303] ____fput+0x15/0x20 [ 20.571767][ T303] task_work_run+0x127/0x190 [ 20.576343][ T303] do_exit+0xb70/0x29a0 [ 20.580489][ T303] do_group_exit+0x149/0x310 [ 20.585064][ T303] __x64_sys_exit_group+0x3f/0x40 [ 20.590100][ T303] x64_sys_call+0x832/0x9a0 [ 20.594590][ T303] do_syscall_64+0x4c/0xa0 [ 20.598993][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 20.604880][ T303] [ 20.607216][ T303] The buggy address belongs to the object at ffff888125075c00 [ 20.607216][ T303] which belongs to the cache kmalloc-512 of size 512 [ 20.621250][ T303] The buggy address is located 336 bytes inside of [ 20.621250][ T303] 512-byte region [ffff888125075c00, ffff888125075e00) [ 20.634522][ T303] The buggy address belongs to the page: [ 20.640157][ T303] page:ffffea0004941d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x125074 [ 20.650401][ T303] head:ffffea0004941d00 order:2 compound_mapcount:0 compound_pincount:0 [ 20.658735][ T303] flags: 0x4000000000010200(slab|head|zone=1) [ 20.664839][ T303] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 20.673419][ T303] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 20.681987][ T303] page dumped because: kasan: bad access detected [ 20.688383][ T303] page_owner tracks the page as allocated [ 20.694088][ T303] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 300, ts 20106322165, free_ts 0 [ 20.712223][ T303] post_alloc_hook+0x192/0x1b0 [ 20.717003][ T303] prep_new_page+0x1c/0x110 [ 20.721506][ T303] get_page_from_freelist+0x2c3a/0x2cd0 [ 20.727052][ T303] __alloc_pages+0x1a2/0x460 [ 20.731640][ T303] new_slab+0xa0/0x4d0 [ 20.735705][ T303] ___slab_alloc+0x3ac/0x840 [ 20.740278][ T303] __slab_alloc+0x49/0x90 [ 20.744596][ T303] __kmalloc_track_caller+0x169/0x2c0 [ 20.749960][ T303] __alloc_skb+0x210/0x730 [ 20.754375][ T303] sock_wmalloc+0xb5/0x130 [ 20.758799][ T303] unix_stream_connect+0x33c/0x1020 [ 20.764032][ T303] __sys_connect+0x3cb/0x450 [ 20.768615][ T303] __x64_sys_connect+0x7a/0x90 [ 20.773378][ T303] x64_sys_call+0x7c/0x9a0 [ 20.777804][ T303] do_syscall_64+0x4c/0xa0 [ 20.782230][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 20.788207][ T303] page_owner free stack trace missing [ 20.793559][ T303] [ 20.795865][ T303] Memory state around the buggy address: [ 20.801472][ T303] ffff888125075c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.809516][ T303] ffff888125075c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 20.817558][ T303] >ffff888125075d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +++ exited with 0 +++ [ 20.825600][ T303]