ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor2011283347
<...>
Warning: Permanently added '10.128.1.24' (ED25519) to the list of known hosts.
execve("ci2-android-5-15/syz-executor2011283347", ["ci2-android-5-15/syz-executor2011283347"], 0x7ffdcf1301a0 /* 10 vars */) = 0
brk(NULL) = 0x55557a9cb000
brk(0x55557a9cbd40) = 0x55557a9cbd40
arch_prctl(ARCH_SET_FS, 0x55557a9cb3c0) = 0
set_tid_address(0x55557a9cb690) = 304
set_robust_list(0x55557a9cb6a0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor2011283347", 4096) = 45
getrandom("\x40\x22\xe6\x96\x1d\xa1\x49\xc3", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55557a9cbd40
brk(0x55557a9ecd40) = 0x55557a9ecd40
brk(0x55557a9ed000) = 0x55557a9ed000
mprotect(0x7f97288ef000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18) = 18
executing program
socket(AF_PPPOX, SOCK_STREAM, 1) = 3
socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP) = 4
[ 27.266924][ T30] audit: type=1400 audit(1791198792.290:64): avc: denied { execmem } for pid=304 comm="syz-executor201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 27.287851][ T30] audit: type=1400 audit(1791198792.310:65): avc: denied { create } for pid=304 comm="syz-executor201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
connect(3, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x20\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00"}, 50) = 0
ioctl(3, VFAT_IOCTL_READDIR_BOTH, 0) = -1 ENOTTY (Inappropriate ioctl for device)
exit_group(0) = ?
[ 27.307859][ T30] audit: type=1400 audit(1791198792.310:66): avc: denied { connect } for pid=304 comm="syz-executor201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[ 27.328000][ T30] audit: type=1400 audit(1791198792.350:67): avc: denied { ioctl } for pid=304 comm="syz-executor201" path="socket:[14132]" dev="sockfs" ino=14132 ioctlcmd=0x7201 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1
[ 27.353607][ T304] ==================================================================
[ 27.361679][ T304] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0
[ 27.369747][ T304] Read of size 4 at addr ffff8881096b3000 by task syz-executor201/304
[ 27.377884][ T304]
[ 27.380206][ T304] CPU: 0 PID: 304 Comm: syz-executor201 Not tainted syzkaller #0
[ 27.387909][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 27.397959][ T304] Call Trace:
[ 27.401231][ T304]
[ 27.404151][ T304] __dump_stack+0x21/0x30
[ 27.408476][ T304] dump_stack_lvl+0x110/0x170
[ 27.413144][ T304] ? show_regs_print_info+0x20/0x20
[ 27.418334][ T304] ? load_image+0x3f0/0x3f0
[ 27.422826][ T304] ? __local_bh_enable_ip+0x58/0x80
[ 27.428018][ T304] print_address_description+0x7f/0x2c0
[ 27.433561][ T304] ? pppol2tp_sock_to_session+0x1a0/0x1b0
[ 27.439274][ T304] kasan_report+0x10f/0x150
[ 27.443770][ T304] ? pppol2tp_sock_to_session+0x1a0/0x1b0
[ 27.449481][ T304] __asan_report_load4_noabort+0x14/0x20
[ 27.455101][ T304] pppol2tp_sock_to_session+0x1a0/0x1b0
[ 27.460632][ T304] pppol2tp_release+0x150/0x2b0
[ 27.465474][ T304] sock_close+0xb8/0x200
[ 27.469731][ T304] ? sock_mmap+0xa0/0xa0
[ 27.473966][ T304] __fput+0x22b/0x900
[ 27.477941][ T304] ____fput+0x15/0x20
[ 27.481910][ T304] task_work_run+0x127/0x190
[ 27.486490][ T304] do_exit+0xb70/0x29a0
[ 27.490639][ T304] ? ptrace_stop+0x6d8/0xa70
[ 27.495227][ T304] ? put_task_struct+0x90/0x90
[ 27.499975][ T304] ? ptrace_notify+0x1ea/0x270
[ 27.504736][ T304] ? do_notify_parent+0x830/0x830
[ 27.509755][ T304] do_group_exit+0x149/0x310
[ 27.514335][ T304] __x64_sys_exit_group+0x3f/0x40
[ 27.519351][ T304] x64_sys_call+0x832/0x9a0
[ 27.523842][ T304] do_syscall_64+0x4c/0xa0
[ 27.528248][ T304] ? clear_bhb_loop+0x50/0xa0
[ 27.532919][ T304] ? clear_bhb_loop+0x50/0xa0
[ 27.537584][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 27.543473][ T304] RIP: 0033:0x7f972885e305
[ 27.547878][ T304] Code: Unable to access opcode bytes at RIP 0x7f972885e2db.
[ 27.555232][ T304] RSP: 002b:00007ffd08535838 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
[ 27.563654][ T304] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f972885e305
[ 27.571619][ T304] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000
[ 27.579583][ T304] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffd085359c8
[ 27.587542][ T304] R10: 000000000000000a R11: 0000000000000202 R12: 0000000000000000
[ 27.595518][ T304] R13: 00007f97288f4110 R14: 00007f97288f63a8 R15: 00007f97288f63c0
[ 27.603496][ T304]
[ 27.606515][ T304]
[ 27.608832][ T304] Allocated by task 304:
[ 27.613066][ T304] __kasan_kmalloc+0xd4/0x100
[ 27.617752][ T304] __kmalloc+0x13d/0x2c0
[ 27.621980][ T304] l2tp_session_create+0x39/0xb60
[ 27.626999][ T304] pppol2tp_connect+0xbf5/0x1640
[ 27.631936][ T304] __sys_connect+0x3cb/0x450
[ 27.636530][ T304] __x64_sys_connect+0x7a/0x90
[ 27.641296][ T304] x64_sys_call+0x7c/0x9a0
[ 27.645719][ T304] do_syscall_64+0x4c/0xa0
[ 27.650145][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 27.656046][ T304]
[ 27.658390][ T304] Freed by task 45:
[ 27.662198][ T304] kasan_set_track+0x4a/0x70
[ 27.666786][ T304] kasan_set_free_info+0x23/0x40
[ 27.671722][ T304] ____kasan_slab_free+0x125/0x160
[ 27.676835][ T304] __kasan_slab_free+0x11/0x20
[ 27.681604][ T304] slab_free_freelist_hook+0xc2/0x190
[ 27.686978][ T304] kfree+0xc4/0x270
[ 27.690799][ T304] l2tp_session_put+0xaf/0x1a0
[ 27.695572][ T304] l2tp_session_delete+0x3a9/0x4a0
[ 27.700723][ T304] l2tp_tunnel_del_work+0x180/0x3d0
[ 27.705924][ T304] process_one_work+0x6c8/0xbb0
[ 27.710795][ T304] worker_thread+0xaa0/0x1250
[ 27.715493][ T304] kthread+0x3f5/0x4f0
[ 27.719595][ T304] ret_from_fork+0x1f/0x30
[ 27.724029][ T304]
[ 27.726362][ T304] Last potentially related work creation:
[ 27.732077][ T304] kasan_save_stack+0x3a/0x60
[ 27.736759][ T304] __kasan_record_aux_stack+0xd2/0x100
[ 27.742223][ T304] kasan_record_aux_stack_noalloc+0xb/0x10
[ 27.748036][ T304] call_rcu+0x10b/0xf60
[ 27.752196][ T304] blkg_release+0x23/0x30
[ 27.756522][ T304] percpu_ref_switch_to_atomic_rcu+0x611/0x620
[ 27.762680][ T304] rcu_do_batch+0x4c1/0xbf0
[ 27.767186][ T304] rcu_core+0x4a3/0xef0
[ 27.771352][ T304] rcu_core_si+0x9/0x10
[ 27.775534][ T304] handle_softirqs+0x250/0x560
[ 27.780309][ T304] run_ksoftirqd+0x28/0x40
[ 27.784732][ T304] smpboot_thread_fn+0x446/0x880
[ 27.789675][ T304] kthread+0x3f5/0x4f0
[ 27.793750][ T304] ret_from_fork+0x1f/0x30
[ 27.798175][ T304]
[ 27.800507][ T304] The buggy address belongs to the object at ffff8881096b3000
[ 27.800507][ T304] which belongs to the cache kmalloc-512 of size 512
[ 27.814559][ T304] The buggy address is located 0 bytes inside of
[ 27.814559][ T304] 512-byte region [ffff8881096b3000, ffff8881096b3200)
[ 27.827665][ T304] The buggy address belongs to the page:
[ 27.833316][ T304] page:ffffea000425ac00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1096b0
[ 27.843566][ T304] head:ffffea000425ac00 order:2 compound_mapcount:0 compound_pincount:0
[ 27.851901][ T304] flags: 0x4000000000010200(slab|head|zone=1)
[ 27.858009][ T304] raw: 4000000000010200 ffffea000425ab00 0000000500000005 ffff888100042f00
[ 27.866606][ T304] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 27.875190][ T304] page dumped because: kasan: bad access detected
[ 27.881593][ T304] page_owner tracks the page as allocated
[ 27.887316][ T304] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 2571902272, free_ts 0
[ 27.905203][ T304] post_alloc_hook+0x192/0x1b0
[ 27.909989][ T304] prep_new_page+0x1c/0x110
[ 27.914508][ T304] get_page_from_freelist+0x2c3a/0x2cd0
[ 27.920071][ T304] __alloc_pages+0x1a2/0x460
[ 27.924668][ T304] new_slab+0xa0/0x4d0
[ 27.928765][ T304] ___slab_alloc+0x3ac/0x840
[ 27.933392][ T304] __slab_alloc+0x49/0x90
[ 27.937732][ T304] kmem_cache_alloc_trace+0x146/0x270
[ 27.943114][ T304] blkg_alloc+0x82/0x5d0
[ 27.947363][ T304] blkcg_init_queue+0x29/0x210
[ 27.952131][ T304] blk_alloc_queue+0x3be/0x550
[ 27.956897][ T304] blk_mq_init_queue+0x37/0xd0
[ 27.961685][ T304] scsi_alloc_sdev+0x66c/0x9c0
[ 27.966454][ T304] scsi_probe_and_add_lun+0x180/0x35d0
[ 27.971925][ T304] __scsi_scan_target+0x1d2/0xb70
[ 27.976976][ T304] scsi_scan_host_selected+0x34e/0x600
[ 27.982437][ T304] page_owner free stack trace missing
[ 27.987801][ T304]
[ 27.990127][ T304] Memory state around the buggy address:
[ 27.995765][ T304] ffff8881096b2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 28.003825][ T304] ffff8881096b2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 28.011886][ T304] >ffff8881096b3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.019953][ T304] ^
[ 28.024014][ T304] ffff8881096b3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.032079][ T304] ffff8881096b3100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.040140][ T304] ==================================================================
[ 28.048204][ T304] Disabling lock debugging due to kernel taint
[ 28.054717][ T304] ------------[ cut here ]------------
[ 28.060232][ T304] WARNING: CPU: 0 PID: 304 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0
[ 28.066559][ T30] audit: type=1400 audit(1791198793.090:68): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 28.070804][ T304] Modules linked in:
[ 28.095806][ T304] CPU: 0 PID: 304 Comm: syz-executor201 Tainted: G B syzkaller #0
[ 28.098212][ T30] audit: type=1400 audit(1791198793.110:69): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 28.104917][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 28.126757][ T30] audit: type=1400 audit(1791198793.110:70): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 28.136342][ T304] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0
[ 28.157930][ T30] audit: type=1400 audit(1791198793.110:71): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 28.163750][ T304] Code: 5d c3 e8 3c ac 0a fd be 02 00 00 00 eb 0a e8 30 ac 0a fd be 01 00 00 00 4c 89 f7 e8 73 2e f1 fd e9 0f ff ff ff e8 19 ac 0a fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 08 ac 0a fd 4c 89 f7 be 03
[ 28.184705][ T30] audit: type=1400 audit(1791198793.110:72): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 28.203792][ T304] RSP: 0018:ffffc900009a7b90 EFLAGS: 00010293
[ 28.230192][ T304] RAX: ffffffff845f2f47 RBX: ffff888107fbd000 RCX: ffff88810b13a800
[ 28.238211][ T304] RDX: 0000000000000000 RSI: 0000000007fb9000 RDI: 000000000c04eb7d
[ 28.238699][ T30] audit: type=1400 audit(1791198793.110:73): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 28.246227][ T304] RBP: ffffc900009a7bb0 R08: 0000000000000003 R09: 0000000000000004
[ 28.277114][ T304] R10: dffffc0000000000 R11: fffffbfff0e1904c R12: dffffc0000000000
[ 28.285092][ T304] R13: dffffc0000000000 R14: 0000000007fb9000 R15: ffff8881096b3000
[ 28.293101][ T304] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[ 28.302213][ T304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 28.308822][ T304] CR2: 00007f97288c417c CR3: 000000000660f000 CR4: 00000000003506b0
[ 28.316835][ T304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 28.324827][ T304] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 28.332923][ T304] Call Trace:
[ 28.336224][ T304]
[ 28.339148][ T304] pppol2tp_release+0x150/0x2b0
[ 28.343992][ T304] sock_close+0xb8/0x200
[ 28.348265][ T304] ? sock_mmap+0xa0/0xa0
[ 28.352536][ T304] __fput+0x22b/0x900
[ 28.356553][ T304] ____fput+0x15/0x20
[ 28.360551][ T304] task_work_run+0x127/0x190
[ 28.365137][ T304] do_exit+0xb70/0x29a0
[ 28.369316][ T304] ? ptrace_stop+0x6d8/0xa70
[ 28.373924][ T304] ? put_task_struct+0x90/0x90
[ 28.378717][ T304] ? ptrace_notify+0x1ea/0x270
[ 28.383497][ T304] ? do_notify_parent+0x830/0x830
[ 28.388549][ T304] do_group_exit+0x149/0x310
[ 28.393158][ T304] __x64_sys_exit_group+0x3f/0x40
[ 28.398206][ T304] x64_sys_call+0x832/0x9a0
[ 28.402724][ T304] do_syscall_64+0x4c/0xa0
[ 28.407164][ T304] ? clear_bhb_loop+0x50/0xa0
[ 28.411865][ T304] ? clear_bhb_loop+0x50/0xa0
[ 28.416575][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 28.422507][ T304] RIP: 0033:0x7f972885e305
[ 28.426953][ T304] Code: Unable to access opcode bytes at RIP 0x7f972885e2db.
[ 28.434328][ T304] RSP: 002b:00007ffd08535838 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
[ 28.442787][ T304] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f972885e305
[ 28.451170][ T304] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000
[ 28.459173][ T304] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffd085359c8
+++ exited with 0 +++
[ 28.467183][ T304] R10: 000000000000000a R11: 0000000000