./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2667886784 <...> Warning: Permanently added '10.128.1.30' (ED25519) to the list of known hosts. execve("./syz-executor2667886784", ["./syz-executor2667886784"], 0x7ffd016b0a20 /* 10 vars */) = 0 brk(NULL) = 0x555555fc9000 brk(0x555555fc9d00) = 0x555555fc9d00 arch_prctl(ARCH_SET_FS, 0x555555fc9380) = 0 set_tid_address(0x555555fc9650) = 5032 set_robust_list(0x555555fc9660, 24) = 0 rseq(0x555555fc9ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2667886784", 4096) = 28 getrandom("\xbd\xed\x5b\xa2\x3e\x21\xfb\x1b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555fc9d00 brk(0x555555fead00) = 0x555555fead00 brk(0x555555feb000) = 0x555555feb000 mprotect(0x7f11638a1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5033 attached , child_tidptr=0x555555fc9650) = 5033 [pid 5033] set_robust_list(0x555555fc9660, 24) = 0 [pid 5033] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5033] setpgid(0, 0) = 0 [pid 5033] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5033] write(3, "1000", 4) = 4 [pid 5033] close(3) = 0 [pid 5033] openat(AT_FDCWD, "/dev/nbd0", O_RDONLY) = 3 [pid 5033] socket(AF_INET, SOCK_SEQPACKET, IPPROTO_IP) = 4 [ 77.535389][ T27] audit: type=1400 audit(1697583557.816:83): avc: denied { write } for pid=5029 comm="strace-static-x" path="pipe:[4345]" dev="pipefs" ino=4345 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 77.565299][ T27] audit: type=1400 audit(1697583557.846:84): avc: denied { execmem } for pid=5032 comm="syz-executor266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 77.585445][ T27] audit: type=1400 audit(1697583557.846:85): avc: denied { read } for pid=5033 comm="syz-executor266" name="nbd0" dev="devtmpfs" ino=664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 77.610035][ T27] audit: type=1400 audit(1697583557.846:86): avc: denied { open } for pid=5033 comm="syz-executor266" path="/dev/nbd0" dev="devtmpfs" ino=664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 5033] ioctl(3, NBD_SET_SOCK, 4) = 0 [ 77.634507][ T27] audit: type=1400 audit(1697583557.846:87): avc: denied { ioctl } for pid=5033 comm="syz-executor266" path="/dev/nbd0" dev="devtmpfs" ino=664 ioctlcmd=0xab00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 77.681707][ T27] audit: type=1400 audit(1697583557.966:88): avc: denied { module_request } for pid=5033 comm="syz-executor266" kmod="crypto-hmac(md5)" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [pid 5033] listen(4, 7757) = 0 [ 81.655896][ T27] audit: type=1400 audit(1697583561.936:89): avc: denied { append } for pid=4465 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 81.678083][ T27] audit: type=1400 audit(1697583561.936:90): avc: denied { open } for pid=4465 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 81.701092][ T27] audit: type=1400 audit(1697583561.936:91): avc: denied { getattr } for pid=4465 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [pid 5033] ioctl(3, NBD_DO_IT [pid 5032] kill(-5033, SIGKILL) = 0 [pid 5032] kill(5033, SIGKILL) = 0 [ 82.570362][ T5033] block nbd0: shutting down sockets [pid 5032] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5032] newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0 [pid 5032] getdents64(3, 0x555555fca6f0 /* 2 entries */, 32768) = 48 [pid 5032] getdents64(3, 0x555555fca6f0 /* 0 entries */, 32768) = 0 [pid 5032] close(3) = 0 [ 87.150937][ T26] cfg80211: failed to load regulatory.db [ 286.828967][ T28] INFO: task syz-executor266:5033 blocked for more than 143 seconds. [ 286.837149][ T28] Not tainted 6.6.0-rc6-syzkaller-00029-g213f891525c2 #0 [ 286.844816][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.854041][ T28] task:syz-executor266 state:D stack:26096 pid:5033 ppid:5032 flags:0x00004006 [ 286.863363][ T28] Call Trace: [ 286.866640][ T28] [ 286.869636][ T28] __schedule+0xee1/0x5a10 [ 286.874210][ T28] ? __lock_acquire+0x182f/0x5de0 [ 286.879357][ T28] ? io_schedule_timeout+0x150/0x150 [ 286.884684][ T28] schedule+0xe7/0x1b0 [ 286.888833][ T28] schedule_timeout+0x278/0x2c0 [ 286.893774][ T28] ? usleep_range_state+0x1a0/0x1a0 [ 286.899045][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.904293][ T28] __wait_for_common+0x3e0/0x5f0 [ 286.909301][ T28] ? usleep_range_state+0x1a0/0x1a0 [ 286.914532][ T28] ? bit_wait_io+0xe0/0xe0 [ 286.919020][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.924265][ T28] ? flush_workqueue_prep_pwqs+0x28f/0x4e0 [ 286.930149][ T28] ? check_flush_dependency+0x86/0x450 [ 286.935643][ T28] __flush_workqueue+0x3e0/0x1320 [ 286.940743][ T28] ? blk_mq_run_hw_queue+0x2b7/0x9a0 [ 286.946136][ T28] ? check_flush_dependency+0x450/0x450 [ 286.951735][ T28] ? _raw_spin_unlock_irqrestore+0x4e/0x70 [ 286.957585][ T28] ? nbd_ioctl+0x308/0xd60 [ 286.962184][ T28] nbd_ioctl+0x308/0xd60 [ 286.966471][ T28] ? nbd_start_device+0xd70/0xd70 [ 286.971589][ T28] ? cpuacct_percpu_seq_show+0x10/0x10 [ 286.977200][ T28] ? nbd_start_device+0xd70/0xd70 [ 286.982329][ T28] blkdev_ioctl+0x2f9/0x770 [ 286.986867][ T28] ? blkdev_common_ioctl+0x1ce0/0x1ce0 [ 286.992379][ T28] ? selinux_file_ioctl+0x17d/0x270 [ 286.997673][ T28] ? selinux_file_ioctl+0xb5/0x270 [ 287.002878][ T28] ? blkdev_common_ioctl+0x1ce0/0x1ce0 [ 287.008375][ T28] __x64_sys_ioctl+0x18f/0x210 [ 287.013229][ T28] do_syscall_64+0x38/0xb0 [ 287.017681][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 287.023719][ T28] RIP: 0033:0x7f116382e879 [ 287.028158][ T28] RSP: 002b:00007fffa70fb5c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 287.036772][ T28] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f116382e879 [ 287.044905][ T28] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 [ 287.053457][ T28] RBP: 00007f11638a15f0 R08: 0000000000000006 R09: 0000000000000006 [ 287.061495][ T28] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000001 [ 287.069536][ T28] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 [ 287.077571][ T28] [ 287.080666][ T28] [ 287.080666][ T28] Showing all locks held in the system: [ 287.088394][ T28] 1 lock held by khungtaskd/28: [ 287.093293][ T28] #0: ffffffff8cba7960 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 [ 287.103257][ T28] 2 locks held by kworker/u4:5/942: [ 287.108482][ T28] #0: ffff888012c77938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x787/0x15c0 [ 287.119643][ T28] #1: ffffc90004e07d80 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0x7e9/0x15c0 [ 287.131855][ T28] 2 locks held by kworker/u5:1/4435: [ 287.137177][ T28] #0: ffff888141372d38 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at: process_one_work+0x787/0x15c0 [ 287.147914][ T28] #1: ffffc90002fcfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x7e9/0x15c0 [ 287.159165][ T28] 2 locks held by getty/4789: [ 287.163836][ T28] #0: ffff88814be0c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 287.174275][ T28] #1: ffffc900020682f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc5/0x1480 [ 287.184441][ T28] [ 287.186755][ T28] ============================================= [ 287.186755][ T28] [ 287.195233][ T28] NMI backtrace for cpu 0 [ 287.199572][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.6.0-rc6-syzkaller-00029-g213f891525c2 #0 [ 287.209366][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 287.219424][ T28] Call Trace: [ 287.222711][ T28] [ 287.225634][ T28] dump_stack_lvl+0xd9/0x1b0 [ 287.230265][ T28] nmi_cpu_backtrace+0x277/0x380 [ 287.235399][ T28] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 287.240598][ T28] nmi_trigger_cpumask_backtrace+0x299/0x300 [ 287.246597][ T28] watchdog+0xf87/0x1210 [ 287.250894][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 287.257113][ T28] ? lockdep_hardirqs_on+0x7d/0x100 [ 287.262366][ T28] ? __kthread_parkme+0x14b/0x220 [ 287.267426][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 287.273428][ T28] kthread+0x33c/0x440 [ 287.277521][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 287.282755][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 287.288505][ T28] ret_from_fork+0x45/0x80 [ 287.292971][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 287.298610][ T28] ret_from_fork_asm+0x11/0x20 [ 287.303399][ T28] [ 287.306491][ T28] Sending NMI from CPU 0 to CPUs 1: [ 287.311840][ C1] NMI backtrace for cpu 1 [ 287.311850][ C1] CPU: 1 PID: 942 Comm: kworker/u4:5 Not tainted 6.6.0-rc6-syzkaller-00029-g213f891525c2 #0 [ 287.311871][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 287.311882][ C1] Workqueue: events_unbound toggle_allocation_gate [ 287.311938][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 [ 287.311968][ C1] Code: 81 e1 00 01 00 00 65 48 8b 14 25 00 bd 03 00 a9 00 01 ff 00 74 0e 85 c9 74 35 8b 82 04 16 00 00 85 c0 74 2b 8b 82 e0 15 00 00 <83> f8 02 75 20 48 8b 8a e8 15 00 00 8b 92 e4 15 00 00 48 8b 01 48 [ 287.311986][ C1] RSP: 0018:ffffc90004e07960 EFLAGS: 00000246 [ 287.312000][ C1] RAX: 0000000000000000 RBX: ffff888012c68558 RCX: 0000000000000000 [ 287.312012][ C1] RDX: ffff88801e14a180 RSI: ffffffff81c766bd RDI: 0000000000000006 [ 287.312024][ C1] RBP: 0000000012c68007 R08: 0000000000000006 R09: 0000000012c68067 [ 287.312036][ C1] R10: 0000000012c68067 R11: 0000000000000000 R12: ffff888012c62040 [ 287.312048][ C1] R13: 00002aaaaaaab000 R14: ffffc90004e07a10 R15: 8000000000000063 [ 287.312060][ C1] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 287.312079][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 287.312092][ C1] CR2: 00007f09a3fc56c0 CR3: 000000000c976000 CR4: 00000000003506e0 [ 287.312104][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 287.312114][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 287.312126][ C1] Call Trace: [ 287.312132][ C1] [ 287.312138][ C1] ? show_regs+0x8f/0xa0 [ 287.312159][ C1] ? nmi_cpu_backtrace+0x1d4/0x380 [ 287.312178][ C1] ? nmi_cpu_backtrace_handler+0xc/0x10 [ 287.312203][ C1] ? nmi_handle+0x1a6/0x570 [ 287.312223][ C1] ? __sanitizer_cov_trace_pc+0x3b/0x70 [ 287.312249][ C1] ? default_do_nmi+0x69/0x160 [ 287.312272][ C1] ? exc_nmi+0x171/0x1e0 [ 287.312298][ C1] ? end_repeat_nmi+0x16/0x31 [ 287.312323][ C1] ? __get_locked_pte+0x7d/0xc0 [ 287.312347][ C1] ? __sanitizer_cov_trace_pc+0x3b/0x70 [ 287.312373][ C1] ? __sanitizer_cov_trace_pc+0x3b/0x70 [ 287.312399][ C1] ? __sanitizer_cov_trace_pc+0x3b/0x70 [ 287.312425][ C1] [ 287.312430][ C1] [ 287.312435][ C1] __get_locked_pte+0x7d/0xc0 [ 287.312458][ C1] ? kmem_cache_alloc+0xb7/0x400 [ 287.312476][ C1] __text_poke+0x224/0xc90 [ 287.312492][ C1] ? setup_data_read+0x280/0x280 [ 287.312510][ C1] ? apply_relocation+0x830/0x830 [ 287.312528][ C1] ? kmem_cache_alloc+0xb7/0x400 [ 287.312544][ C1] text_poke_bp_batch+0x62e/0x960 [ 287.312562][ C1] ? __kmem_cache_alloc_node+0xb9/0x470 [ 287.312582][ C1] ? do_sync_core+0x40/0x40 [ 287.312597][ C1] ? __jump_label_patch+0x1db/0x3f0 [ 287.312620][ C1] ? text_poke_queue+0xef/0x180 [ 287.312647][ C1] ? arch_jump_label_transform_queue+0xc0/0x110 [ 287.312674][ C1] text_poke_finish+0x30/0x40 [ 287.312692][ C1] arch_jump_label_transform_apply+0x1c/0x30 [ 287.312717][ C1] jump_label_update+0x32e/0x410 [ 287.312750][ C1] static_key_disable_cpuslocked+0x154/0x1b0 [ 287.312773][ C1] static_key_disable+0x1a/0x20 [ 287.312793][ C1] toggle_allocation_gate+0x13f/0x250 [ 287.312818][ C1] ? wake_up_kfence_timer+0x30/0x30 [ 287.312845][ C1] process_one_work+0x884/0x15c0 [ 287.312868][ C1] ? lock_sync+0x190/0x190 [ 287.312890][ C1] ? init_worker_pool+0x770/0x770 [ 287.312912][ C1] ? assign_work+0x1a0/0x240 [ 287.312931][ C1] worker_thread+0x8b9/0x1290 [ 287.312953][ C1] ? process_one_work+0x15c0/0x15c0 [ 287.312973][ C1] kthread+0x33c/0x440 [ 287.312990][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 287.313008][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 287.313026][ C1] ret_from_fork+0x45/0x80 [ 287.313046][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 287.313065][ C1] ret_from_fork_asm+0x11/0x20 [ 287.313092][ C1] [ 287.313099][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.259 msecs [ 287.313952][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 287.703152][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.6.0-rc6-syzkaller-00029-g213f891525c2 #0 [ 287.712939][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 287.722982][ T28] Call Trace: [ 287.726247][ T28] [ 287.729172][ T28] dump_stack_lvl+0xd9/0x1b0 [ 287.733757][ T28] panic+0x6a6/0x750 [ 287.737640][ T28] ? panic_smp_self_stop+0xa0/0xa0 [ 287.743263][ T28] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 287.748449][ T28] ? preempt_schedule_thunk+0x1a/0x30 [ 287.753813][ T28] ? watchdog+0xd3e/0x1210 [ 287.758240][ T28] watchdog+0xd4f/0x1210 [ 287.762485][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 287.768457][ T28] ? lockdep_hardirqs_on+0x7d/0x100 [ 287.773671][ T28] ? __kthread_parkme+0x14b/0x220 [ 287.778721][ T28] ? proc_dohung_task_timeout_secs+0x90/0x90 [ 287.784708][ T28] kthread+0x33c/0x440 [ 287.788771][ T28] ? _raw_spin_unlock_irq+0x23/0x50 [ 287.793957][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 287.799577][ T28] ret_from_fork+0x45/0x80 [ 287.803981][ T28] ? kthread_complete_and_exit+0x40/0x40 [ 287.809616][ T28] ret_from_fork_asm+0x11/0x20 [ 287.814399][ T28] [ 287.817640][ T28] Kernel Offset: disabled [ 287.821963][ T28] Rebooting in 86400 seconds..