./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4017410224 <...> syzkaller syzkaller login: [ 43.469845][ T26] kauditd_printk_skb: 42 callbacks suppressed [ 43.469855][ T26] audit: type=1400 audit(1686488596.269:77): avc: denied { transition } for pid=4841 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 43.498728][ T26] audit: type=1400 audit(1686488596.279:78): avc: denied { noatsecure } for pid=4841 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 43.518473][ T26] audit: type=1400 audit(1686488596.309:79): avc: denied { write } for pid=4841 comm="sh" path="pipe:[1918]" dev="pipefs" ino=1918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 43.541041][ T26] audit: type=1400 audit(1686488596.319:80): avc: denied { rlimitinh } for pid=4841 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 43.559990][ T26] audit: type=1400 audit(1686488596.319:81): avc: denied { siginh } for pid=4841 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 44.203009][ T26] audit: type=1400 audit(1686488597.009:82): avc: denied { read } for pid=4428 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.0.29' (ECDSA) to the list of known hosts. execve("./syz-executor4017410224", ["./syz-executor4017410224"], 0x7ffd881fed30 /* 10 vars */) = 0 brk(NULL) = 0x555555f1a000 brk(0x555555f1ac40) = 0x555555f1ac40 arch_prctl(ARCH_SET_FS, 0x555555f1a300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor4017410224", 4096) = 28 brk(0x555555f3bc40) = 0x555555f3bc40 brk(0x555555f3c000) = 0x555555f3c000 mprotect(0x7f3b9fd24000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 4991 mkdir("./syzkaller.qQcCHC", 0700) = 0 chmod("./syzkaller.qQcCHC", 0777) = 0 chdir("./syzkaller.qQcCHC") = 0 [ 60.311229][ T26] audit: type=1400 audit(1686488613.119:83): avc: denied { write } for pid=4988 comm="strace-static-x" path="pipe:[29784]" dev="pipefs" ino=29784 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 60.335728][ T26] audit: type=1400 audit(1686488613.139:84): avc: denied { execmem } for pid=4991 comm="syz-executor401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3b9786a000 [ 60.344416][ T4991] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4991 'syz-executor401' [ 60.357303][ T26] audit: type=1400 audit(1686488613.169:85): avc: denied { append } for pid=4428 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 60.387361][ T26] audit: type=1400 audit(1686488613.169:86): avc: denied { open } for pid=4428 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f3b9786a000, 4194304) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 60.410369][ T26] audit: type=1400 audit(1686488613.169:87): avc: denied { getattr } for pid=4428 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 60.424001][ T4991] loop0: detected capacity change from 0 to 8192 [ 60.440543][ T26] audit: type=1400 audit(1686488613.229:88): avc: denied { read write } for pid=4991 comm="syz-executor401" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 60.447264][ T4991] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 60.465623][ T26] audit: type=1400 audit(1686488613.229:89): avc: denied { open } for pid=4991 comm="syz-executor401" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 60.477975][ T4991] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 60.502465][ T26] audit: type=1400 audit(1686488613.229:90): avc: denied { ioctl } for pid=4991 comm="syz-executor401" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 60.511448][ T4991] REISERFS (device loop0): using ordered data mode [ 60.537283][ T26] audit: type=1400 audit(1686488613.249:91): avc: denied { mounton } for pid=4991 comm="syz-executor401" path="/root/syzkaller.qQcCHC/file0" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 60.543414][ T4991] reiserfs: using flush barriers [ 60.569294][ T4991] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 60.589433][ T4991] REISERFS (device loop0): checking transaction log (loop0) mount("/dev/loop0", "./file0", "reiserfs", MS_DIRSYNC, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 60.629608][ T4991] REISERFS (device loop0): Using r5 hash to sort names [ 60.637776][ T4991] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 60.647990][ T26] audit: type=1400 audit(1686488613.459:92): avc: denied { mount } for pid=4991 comm="syz-executor401" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 60.653970][ T4991] ================================================================== open(".", O_RDONLY) = 4 [ 60.678139][ T4991] BUG: KASAN: use-after-free in strlen+0x7d/0xa0 [ 60.684522][ T4991] Read of size 1 at addr ffff88806e08f9cc by task syz-executor401/4991 [ 60.692774][ T4991] [ 60.695115][ T4991] CPU: 1 PID: 4991 Comm: syz-executor401 Not tainted 6.4.0-rc5-syzkaller-00305-g022ce8862dff #0 [ 60.705547][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 60.715612][ T4991] Call Trace: [ 60.718888][ T4991] [ 60.721816][ T4991] dump_stack_lvl+0xd9/0x150 [ 60.726499][ T4991] print_address_description.constprop.0+0x2c/0x3c0 [ 60.733094][ T4991] ? strlen+0x7d/0xa0 [ 60.737090][ T4991] kasan_report+0x11c/0x130 [ 60.741598][ T4991] ? strlen+0x7d/0xa0 [ 60.745583][ T4991] strlen+0x7d/0xa0 [ 60.749392][ T4991] set_de_name_and_namelen+0x4c4/0x6a0 [ 60.754856][ T4991] search_by_entry_key+0x4f3/0x960 [ 60.759976][ T4991] reiserfs_readdir_inode+0x24f/0x13b0 [ 60.765443][ T4991] ? __lock_acquire+0x28bf/0x5f30 [ 60.770475][ T4991] ? reiserfs_dir_fsync+0x140/0x140 [ 60.775685][ T4991] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 60.781673][ T4991] ? lock_sync+0x190/0x190 [ 60.786111][ T4991] ? down_read_killable+0x14a/0x4f0 [ 60.791314][ T4991] ? down_read+0x480/0x480 [ 60.795733][ T4991] ? fsnotify_perm.part.0+0x221/0x610 [ 60.801108][ T4991] iterate_dir+0x56e/0x6f0 [ 60.805529][ T4991] __x64_sys_getdents64+0x13e/0x2c0 [ 60.810733][ T4991] ? __ia32_sys_getdents+0x2c0/0x2c0 [ 60.816016][ T4991] ? compat_fillonedir+0x470/0x470 [ 60.821130][ T4991] ? lockdep_hardirqs_on+0x7d/0x100 [ 60.826335][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50 [ 60.831540][ T4991] ? ptrace_notify+0xfe/0x140 [ 60.836306][ T4991] do_syscall_64+0x39/0xb0 [ 60.840731][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 60.846635][ T4991] RIP: 0033:0x7f3b9fcb6859 [ 60.851049][ T4991] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 60.870657][ T4991] RSP: 002b:00007ffd82d64558 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 60.879078][ T4991] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b9fcb6859 [ 60.887049][ T4991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 60.895018][ T4991] RBP: 00007ffd82d64560 R08: 6c616b7a79732f2e R09: 6c616b7a79732f2e [ 60.903247][ T4991] R10: 00000000000010e3 R11: 0000000000000246 R12: 00007f3b9fc76130 [ 60.911218][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 60.919276][ T4991] [ 60.922290][ T4991] [ 60.924607][ T4991] The buggy address belongs to the physical page: [ 60.931008][ T4991] page:ffffea0001b823c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x6e08f [ 60.941157][ T4991] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 60.948274][ T4991] page_type: 0xffffffff() [ 60.952598][ T4991] raw: 00fff00000000000 ffffea0001b82408 ffffea0001b82388 0000000000000000 [ 60.961179][ T4991] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 60.969755][ T4991] page dumped because: kasan: bad access detected [ 60.976157][ T4991] page_owner tracks the page as freed [ 60.981513][ T4991] page last allocated via order 0, migratetype Movable, gfp_mask 0x8(__GFP_MOVABLE), pid 1, tgid 1 (swapper/0), ts 13385607540, free_ts 14296278095 [ 60.996881][ T4991] post_alloc_hook+0x2db/0x350 [ 61.001651][ T4991] split_map_pages+0x1ef/0x520 [ 61.006424][ T4991] isolate_freepages_range+0x313/0x350 [ 61.012066][ T4991] alloc_contig_range+0x2fa/0x4a0 [ 61.017108][ T4991] alloc_contig_pages+0x361/0x4d0 [ 61.022134][ T4991] debug_vm_pgtable+0x91f/0x4210 [ 61.027078][ T4991] do_one_initcall+0x102/0x540 [ 61.031846][ T4991] kernel_init_freeable+0x64e/0xba0 [ 61.037053][ T4991] kernel_init+0x1e/0x2c0 [ 61.041387][ T4991] ret_from_fork+0x1f/0x30 [ 61.045836][ T4991] page last free stack trace: [ 61.050584][ T4991] free_unref_page_prepare+0x62e/0xcb0 [ 61.056043][ T4991] free_unref_page+0x33/0x370 [ 61.060720][ T4991] free_contig_range+0xb5/0x180 [ 61.065571][ T4991] destroy_args+0x6c4/0x920 [ 61.070091][ T4991] debug_vm_pgtable+0x2412/0x4210 [ 61.075144][ T4991] do_one_initcall+0x102/0x540 [ 61.079921][ T4991] kernel_init_freeable+0x64e/0xba0 [ 61.085135][ T4991] kernel_init+0x1e/0x2c0 [ 61.089475][ T4991] ret_from_fork+0x1f/0x30 [ 61.093898][ T4991] [ 61.096236][ T4991] Memory state around the buggy address: [ 61.101880][ T4991] ffff88806e08f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 61.109937][ T4991] ffff88806e08f900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 61.117992][ T4991] >ffff88806e08f980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 61.126043][ T4991] ^ [ 61.132450][ T4991] ffff88806e08fa00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 61.140513][ T4991] ffff88806e08fa80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 61.148564][ T4991] ================================================================== [ 61.161728][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.169036][ T4991] CPU: 1 PID: 4991 Comm: syz-executor401 Not tainted 6.4.0-rc5-syzkaller-00305-g022ce8862dff #0 [ 61.179480][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 61.189632][ T4991] Call Trace: [ 61.192913][ T4991] [ 61.195940][ T4991] dump_stack_lvl+0xd9/0x150 [ 61.200557][ T4991] panic+0x686/0x730 [ 61.204472][ T4991] ? panic_smp_self_stop+0xa0/0xa0 [ 61.209681][ T4991] ? preempt_schedule_thunk+0x1a/0x20 [ 61.215068][ T4991] ? preempt_schedule_common+0x45/0xb0 [ 61.220540][ T4991] check_panic_on_warn+0xb1/0xc0 [ 61.225486][ T4991] end_report+0xe9/0x120 [ 61.229729][ T4991] ? strlen+0x7d/0xa0 [ 61.233712][ T4991] kasan_report+0xf9/0x130 [ 61.238130][ T4991] ? strlen+0x7d/0xa0 [ 61.242113][ T4991] strlen+0x7d/0xa0 [ 61.245920][ T4991] set_de_name_and_namelen+0x4c4/0x6a0 [ 61.251382][ T4991] search_by_entry_key+0x4f3/0x960 [ 61.256496][ T4991] reiserfs_readdir_inode+0x24f/0x13b0 [ 61.261975][ T4991] ? __lock_acquire+0x28bf/0x5f30 [ 61.267017][ T4991] ? reiserfs_dir_fsync+0x140/0x140 [ 61.272232][ T4991] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 61.278234][ T4991] ? lock_sync+0x190/0x190 [ 61.282664][ T4991] ? down_read_killable+0x14a/0x4f0 [ 61.287867][ T4991] ? down_read+0x480/0x480 [ 61.292724][ T4991] ? fsnotify_perm.part.0+0x221/0x610 [ 61.298101][ T4991] iterate_dir+0x56e/0x6f0 [ 61.302612][ T4991] __x64_sys_getdents64+0x13e/0x2c0 [ 61.307809][ T4991] ? __ia32_sys_getdents+0x2c0/0x2c0 [ 61.313110][ T4991] ? compat_fillonedir+0x470/0x470 [ 61.318236][ T4991] ? lockdep_hardirqs_on+0x7d/0x100 [ 61.323452][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50 [ 61.328679][ T4991] ? ptrace_notify+0xfe/0x140 [ 61.333378][ T4991] do_syscall_64+0x39/0xb0 [ 61.337806][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.343722][ T4991] RIP: 0033:0x7f3b9fcb6859 [ 61.348152][ T4991] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 61.367773][ T4991] RSP: 002b:00007ffd82d64558 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 61.376221][ T4991] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3b9fcb6859 [ 61.384278][ T4991] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 61.392248][ T4991] RBP: 00007ffd82d64560 R08: 6c616b7a79732f2e R09: 6c616b7a79732f2e [ 61.400218][ T4991] R10: 00000000000010e3 R11: 0000000000000246 R12: 00007f3b9fc76130 [ 61.408187][ T4991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 61.416158][ T4991] [ 61.419326][ T4991] Kernel Offset: disabled [ 61.423644][ T4991] Rebooting in 86400 seconds..