./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4017410224
<...>
syzkaller
syzkaller login: [ 43.469845][ T26] kauditd_printk_skb: 42 callbacks suppressed
[ 43.469855][ T26] audit: type=1400 audit(1686488596.269:77): avc: denied { transition } for pid=4841 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 43.498728][ T26] audit: type=1400 audit(1686488596.279:78): avc: denied { noatsecure } for pid=4841 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 43.518473][ T26] audit: type=1400 audit(1686488596.309:79): avc: denied { write } for pid=4841 comm="sh" path="pipe:[1918]" dev="pipefs" ino=1918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 43.541041][ T26] audit: type=1400 audit(1686488596.319:80): avc: denied { rlimitinh } for pid=4841 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 43.559990][ T26] audit: type=1400 audit(1686488596.319:81): avc: denied { siginh } for pid=4841 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 44.203009][ T26] audit: type=1400 audit(1686488597.009:82): avc: denied { read } for pid=4428 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
Warning: Permanently added '10.128.0.29' (ECDSA) to the list of known hosts.
execve("./syz-executor4017410224", ["./syz-executor4017410224"], 0x7ffd881fed30 /* 10 vars */) = 0
brk(NULL) = 0x555555f1a000
brk(0x555555f1ac40) = 0x555555f1ac40
arch_prctl(ARCH_SET_FS, 0x555555f1a300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4017410224", 4096) = 28
brk(0x555555f3bc40) = 0x555555f3bc40
brk(0x555555f3c000) = 0x555555f3c000
mprotect(0x7f3b9fd24000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 4991
mkdir("./syzkaller.qQcCHC", 0700) = 0
chmod("./syzkaller.qQcCHC", 0777) = 0
chdir("./syzkaller.qQcCHC") = 0
[ 60.311229][ T26] audit: type=1400 audit(1686488613.119:83): avc: denied { write } for pid=4988 comm="strace-static-x" path="pipe:[29784]" dev="pipefs" ino=29784 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 60.335728][ T26] audit: type=1400 audit(1686488613.139:84): avc: denied { execmem } for pid=4991 comm="syz-executor401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3b9786a000
[ 60.344416][ T4991] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4991 'syz-executor401'
[ 60.357303][ T26] audit: type=1400 audit(1686488613.169:85): avc: denied { append } for pid=4428 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 60.387361][ T26] audit: type=1400 audit(1686488613.169:86): avc: denied { open } for pid=4428 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
munmap(0x7f3b9786a000, 4194304) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
[ 60.410369][ T26] audit: type=1400 audit(1686488613.169:87): avc: denied { getattr } for pid=4428 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 60.424001][ T4991] loop0: detected capacity change from 0 to 8192
[ 60.440543][ T26] audit: type=1400 audit(1686488613.229:88): avc: denied { read write } for pid=4991 comm="syz-executor401" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 60.447264][ T4991] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[ 60.465623][ T26] audit: type=1400 audit(1686488613.229:89): avc: denied { open } for pid=4991 comm="syz-executor401" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 60.477975][ T4991] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal
[ 60.502465][ T26] audit: type=1400 audit(1686488613.229:90): avc: denied { ioctl } for pid=4991 comm="syz-executor401" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 60.511448][ T4991] REISERFS (device loop0): using ordered data mode
[ 60.537283][ T26] audit: type=1400 audit(1686488613.249:91): avc: denied { mounton } for pid=4991 comm="syz-executor401" path="/root/syzkaller.qQcCHC/file0" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 60.543414][ T4991] reiserfs: using flush barriers
[ 60.569294][ T4991] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[ 60.589433][ T4991] REISERFS (device loop0): checking transaction log (loop0)
mount("/dev/loop0", "./file0", "reiserfs", MS_DIRSYNC, "") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
chdir("./file0") = 0
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 60.629608][ T4991] REISERFS (device loop0): Using r5 hash to sort names
[ 60.637776][ T4991] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
[ 60.647990][ T26] audit: type=1400 audit(1686488613.459:92): avc: denied { mount } for pid=4991 comm="syz-executor401" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1
[ 60.653970][ T4991] ==================================================================
open(".", O_RDONLY) = 4
[ 60.678139][ T4991] BUG: KASAN: use-after-free in strlen+0x7d/0xa0
[ 60.684522][ T4991] Read of size 1 at addr ffff88806e08f9cc by task syz-executor401/4991
[ 60.692774][ T4991]
[ 60.695115][ T4991] CPU: 1 PID: 4991 Comm: syz-executor401 Not tainted 6.4.0-rc5-syzkaller-00305-g022ce8862dff #0
[ 60.705547][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
[ 60.715612][ T4991] Call Trace:
[ 60.718888][ T4991]
[ 60.721816][ T4991] dump_stack_lvl+0xd9/0x150
[ 60.726499][ T4991] print_address_description.constprop.0+0x2c/0x3c0
[ 60.733094][ T4991] ? strlen+0x7d/0xa0
[ 60.737090][ T4991] kasan_report+0x11c/0x130
[ 60.741598][ T4991] ? strlen+0x7d/0xa0
[ 60.745583][ T4991] strlen+0x7d/0xa0
[ 60.749392][ T4991] set_de_name_and_namelen+0x4c4/0x6a0
[ 60.754856][ T4991] search_by_entry_key+0x4f3/0x960
[ 60.759976][ T4991] reiserfs_readdir_inode+0x24f/0x13b0
[ 60.765443][ T4991] ? __lock_acquire+0x28bf/0x5f30
[ 60.770475][ T4991] ? reiserfs_dir_fsync+0x140/0x140
[ 60.775685][ T4991] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 60.781673][ T4991] ? lock_sync+0x190/0x190
[ 60.786111][ T4991] ? down_read_killable+0x14a/0x4f0
[ 60.791314][ T4991] ? down_read+0x480/0x480
[ 60.795733][ T4991] ? fsnotify_perm.part.0+0x221/0x610
[ 60.801108][ T4991] iterate_dir+0x56e/0x6f0
[ 60.805529][ T4991] __x64_sys_getdents64+0x13e/0x2c0
[ 60.810733][ T4991] ? __ia32_sys_getdents+0x2c0/0x2c0
[ 60.816016][ T4991] ? compat_fillonedir+0x470/0x470
[ 60.821130][ T4991] ? lockdep_hardirqs_on+0x7d/0x100
[ 60.826335][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50
[ 60.831540][ T4991] ? ptrace_notify+0xfe/0x140
[ 60.836306][ T4991] do_syscall_64+0x39/0xb0
[ 60.840731][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 60.846635][ T4991] RIP: 0033:0x7f3b9fcb6859
[ 60.851049][ T4991] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 60.870657][ T4991] RSP: 002b:00007ffd82d64558 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 60.879078][ T4991] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b9fcb6859
[ 60.887049][ T4991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[ 60.895018][ T4991] RBP: 00007ffd82d64560 R08: 6c616b7a79732f2e R09: 6c616b7a79732f2e
[ 60.903247][ T4991] R10: 00000000000010e3 R11: 0000000000000246 R12: 00007f3b9fc76130
[ 60.911218][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 60.919276][ T4991]
[ 60.922290][ T4991]
[ 60.924607][ T4991] The buggy address belongs to the physical page:
[ 60.931008][ T4991] page:ffffea0001b823c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6e08f
[ 60.941157][ T4991] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 60.948274][ T4991] page_type: 0xffffffff()
[ 60.952598][ T4991] raw: 00fff00000000000 ffffea0001b82408 ffffea0001b82388 0000000000000000
[ 60.961179][ T4991] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 60.969755][ T4991] page dumped because: kasan: bad access detected
[ 60.976157][ T4991] page_owner tracks the page as freed
[ 60.981513][ T4991] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 13385607540, free_ts 14296278095
[ 60.996881][ T4991] post_alloc_hook+0x2db/0x350
[ 61.001651][ T4991] split_map_pages+0x1ef/0x520
[ 61.006424][ T4991] isolate_freepages_range+0x313/0x350
[ 61.012066][ T4991] alloc_contig_range+0x2fa/0x4a0
[ 61.017108][ T4991] alloc_contig_pages+0x361/0x4d0
[ 61.022134][ T4991] debug_vm_pgtable+0x91f/0x4210
[ 61.027078][ T4991] do_one_initcall+0x102/0x540
[ 61.031846][ T4991] kernel_init_freeable+0x64e/0xba0
[ 61.037053][ T4991] kernel_init+0x1e/0x2c0
[ 61.041387][ T4991] ret_from_fork+0x1f/0x30
[ 61.045836][ T4991] page last free stack trace:
[ 61.050584][ T4991] free_unref_page_prepare+0x62e/0xcb0
[ 61.056043][ T4991] free_unref_page+0x33/0x370
[ 61.060720][ T4991] free_contig_range+0xb5/0x180
[ 61.065571][ T4991] destroy_args+0x6c4/0x920
[ 61.070091][ T4991] debug_vm_pgtable+0x2412/0x4210
[ 61.075144][ T4991] do_one_initcall+0x102/0x540
[ 61.079921][ T4991] kernel_init_freeable+0x64e/0xba0
[ 61.085135][ T4991] kernel_init+0x1e/0x2c0
[ 61.089475][ T4991] ret_from_fork+0x1f/0x30
[ 61.093898][ T4991]
[ 61.096236][ T4991] Memory state around the buggy address:
[ 61.101880][ T4991] ffff88806e08f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.109937][ T4991] ffff88806e08f900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.117992][ T4991] >ffff88806e08f980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.126043][ T4991] ^
[ 61.132450][ T4991] ffff88806e08fa00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.140513][ T4991] ffff88806e08fa80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 61.148564][ T4991] ==================================================================
[ 61.161728][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 61.169036][ T4991] CPU: 1 PID: 4991 Comm: syz-executor401 Not tainted 6.4.0-rc5-syzkaller-00305-g022ce8862dff #0
[ 61.179480][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
[ 61.189632][ T4991] Call Trace:
[ 61.192913][ T4991]
[ 61.195940][ T4991] dump_stack_lvl+0xd9/0x150
[ 61.200557][ T4991] panic+0x686/0x730
[ 61.204472][ T4991] ? panic_smp_self_stop+0xa0/0xa0
[ 61.209681][ T4991] ? preempt_schedule_thunk+0x1a/0x20
[ 61.215068][ T4991] ? preempt_schedule_common+0x45/0xb0
[ 61.220540][ T4991] check_panic_on_warn+0xb1/0xc0
[ 61.225486][ T4991] end_report+0xe9/0x120
[ 61.229729][ T4991] ? strlen+0x7d/0xa0
[ 61.233712][ T4991] kasan_report+0xf9/0x130
[ 61.238130][ T4991] ? strlen+0x7d/0xa0
[ 61.242113][ T4991] strlen+0x7d/0xa0
[ 61.245920][ T4991] set_de_name_and_namelen+0x4c4/0x6a0
[ 61.251382][ T4991] search_by_entry_key+0x4f3/0x960
[ 61.256496][ T4991] reiserfs_readdir_inode+0x24f/0x13b0
[ 61.261975][ T4991] ? __lock_acquire+0x28bf/0x5f30
[ 61.267017][ T4991] ? reiserfs_dir_fsync+0x140/0x140
[ 61.272232][ T4991] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 61.278234][ T4991] ? lock_sync+0x190/0x190
[ 61.282664][ T4991] ? down_read_killable+0x14a/0x4f0
[ 61.287867][ T4991] ? down_read+0x480/0x480
[ 61.292724][ T4991] ? fsnotify_perm.part.0+0x221/0x610
[ 61.298101][ T4991] iterate_dir+0x56e/0x6f0
[ 61.302612][ T4991] __x64_sys_getdents64+0x13e/0x2c0
[ 61.307809][ T4991] ? __ia32_sys_getdents+0x2c0/0x2c0
[ 61.313110][ T4991] ? compat_fillonedir+0x470/0x470
[ 61.318236][ T4991] ? lockdep_hardirqs_on+0x7d/0x100
[ 61.323452][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50
[ 61.328679][ T4991] ? ptrace_notify+0xfe/0x140
[ 61.333378][ T4991] do_syscall_64+0x39/0xb0
[ 61.337806][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 61.343722][ T4991] RIP: 0033:0x7f3b9fcb6859
[ 61.348152][ T4991] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 61.367773][ T4991] RSP: 002b:00007ffd82d64558 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[ 61.376221][ T4991] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b9fcb6859
[ 61.384278][ T4991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[ 61.392248][ T4991] RBP: 00007ffd82d64560 R08: 6c616b7a79732f2e R09: 6c616b7a79732f2e
[ 61.400218][ T4991] R10: 00000000000010e3 R11: 0000000000000246 R12: 00007f3b9fc76130
[ 61.408187][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 61.416158][ T4991]
[ 61.419326][ T4991] Kernel Offset: disabled
[ 61.423644][ T4991] Rebooting in 86400 seconds..