./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor281904633 <...> Warning: Permanently added '10.128.1.98' (ED25519) to the list of known hosts. execve("./syz-executor281904633", ["./syz-executor281904633"], 0x7ffc75e73fa0 /* 10 vars */) = 0 brk(NULL) = 0x555557037000 brk(0x555557037d00) = 0x555557037d00 arch_prctl(ARCH_SET_FS, 0x555557037380) = 0 set_tid_address(0x555557037650) = 356 set_robust_list(0x555557037660, 24) = 0 rseq(0x555557037ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor281904633", 4096) = 27 getrandom("\x4a\xe5\x1c\x93\xab\xb2\x8e\x36", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555557037d00 brk(0x555557058d00) = 0x555557058d00 brk(0x555557059000) = 0x555557059000 mprotect(0x7f5bc5b0e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557037650) = 357 ./strace-static-x86_64: Process 357 attached [pid 356] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 357] set_robust_list(0x555557037660, 24./strace-static-x86_64: Process 358 attached [pid 358] set_robust_list(0x555557037660, 24) = 0 [pid 358] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 356] <... clone resumed>, child_tidptr=0x555557037650) = 358 [pid 357] <... set_robust_list resumed>) = 0 [pid 358] <... clone resumed>, child_tidptr=0x555557037650) = 359 [pid 356] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 359 attached [pid 359] set_robust_list(0x555557037660, 24) = 0 [pid 359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 359] setpgid(0, 0) = 0 [pid 359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 359] write(3, "1000", 4) = 4 [pid 356] <... clone resumed>, child_tidptr=0x555557037650) = 360 [pid 359] close(3) = 0 [pid 359] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 359] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 359] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 359] ioctl(3, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 359] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 4 [pid 359] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 359] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 359] exit_group(0) = ? [pid 356] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 359] +++ exited with 0 +++ [pid 358] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=359, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 358] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 360 attached ) = 0 [pid 358] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 361 attached [pid 356] <... clone resumed>, child_tidptr=0x555557037650) = 361 [pid 357] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 358] <... clone resumed>, child_tidptr=0x555557037650) = 362 [pid 360] set_robust_list(0x555557037660, 24) = 0 [pid 356] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 360] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557037650) = 363 ./strace-static-x86_64: Process 363 attached [pid 363] set_robust_list(0x555557037660, 24) = 0 [pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 363] setpgid(0, 0) = 0 [pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 356] <... clone resumed>, child_tidptr=0x555557037650) = 364 [pid 363] <... openat resumed>) = 3 [pid 363] write(3, "1000", 4) = 4 [pid 363] close(3) = 0 [pid 363] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 363] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 363] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 363] ioctl(3, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 363] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 4 [pid 363] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 363] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 363] exit_group(0) = ? [pid 357] <... clone resumed>, child_tidptr=0x555557037650) = 365 [pid 361] set_robust_list(0x555557037660, 24./strace-static-x86_64: Process 362 attached ) = 0 [pid 363] +++ exited with 0 +++ [pid 361] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 360] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 360] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 360] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555557037650) = 366 ./strace-static-x86_64: Process 365 attached [pid 365] set_robust_list(0x555557037660, 24) = 0 [pid 365] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x555557037660, 24 [pid 365] <... prctl resumed>) = 0 [pid 364] <... set_robust_list resumed>) = 0 [pid 365] setpgid(0, 0 [pid 364] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 365] <... setpgid resumed>) = 0 [pid 365] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 362] set_robust_list(0x555557037660, 24 [pid 361] <... clone resumed>, child_tidptr=0x555557037650) = 367 ./strace-static-x86_64: Process 366 attached [pid 362] <... set_robust_list resumed>) = 0 [pid 365] <... openat resumed>) = 3 [pid 365] write(3, "1000", 4) = 4 [pid 365] close(3) = 0 [pid 365] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 362] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 366] set_robust_list(0x555557037660, 24 [pid 365] <... openat resumed>) = 3 [pid 362] <... prctl resumed>) = 0 [pid 364] <... clone resumed>, child_tidptr=0x555557037650) = 368 [pid 365] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 365] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 365] ioctl(3, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 365] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 4 [pid 365] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 365] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 ./strace-static-x86_64: Process 368 attached ./strace-static-x86_64: Process 367 attached [pid 366] <... set_robust_list resumed>) = 0 [pid 362] setpgid(0, 0 [pid 365] exit_group(0) = ? [pid 362] <... setpgid resumed>) = 0 [pid 362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 365] +++ exited with 0 +++ [pid 357] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=365, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 357] restart_syscall(<... resuming interrupted clone ...> [pid 368] set_robust_list(0x555557037660, 24) = 0 [pid 368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 368] setpgid(0, 0) = 0 [pid 368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 368] write(3, "1000", 4) = 4 [pid 368] close(3) = 0 [pid 368] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 357] <... restart_syscall resumed>) = 0 [pid 357] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 368] <... openat resumed>) = 3 [pid 368] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 368] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 368] ioctl(3, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 368] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 4 [pid 368] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100) = 0 [pid 368] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 368] exit_group(0) = ? [pid 357] <... clone resumed>, child_tidptr=0x555557037650) = 369 [pid 362] <... openat resumed>) = 3 [pid 366] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 362] write(3, "1000", 4 [pid 366] <... prctl resumed>) = 0 [pid 368] +++ exited with 0 +++ [pid 364] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=368, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 364] restart_syscall(<... resuming interrupted clone ...> [pid 362] <... write resumed>) = 4 [pid 364] <... restart_syscall resumed>) = 0 [pid 362] close(3) = 0 [pid 364] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 369 attached [pid 367] set_robust_list(0x555557037660, 24 [pid 366] setpgid(0, 0 [pid 362] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 364] <... clone resumed>, child_tidptr=0x555557037650) = 370 ./strace-static-x86_64: Process 370 attached [pid 370] set_robust_list(0x555557037660, 24) = 0 [pid 370] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 370] setpgid(0, 0 [pid 362] <... openat resumed>) = 3 [pid 370] <... setpgid resumed>) = 0 [pid 370] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 370] write(3, "1000", 4 [pid 362] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 370] <... write resumed>) = 4 [pid 370] close(3) = 0 [pid 370] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 370] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 366] <... setpgid resumed>) = 0 [pid 362] <... ioctl resumed>) = 0 [pid 366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 362] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440) = 0 [pid 366] <... openat resumed>) = 3 [pid 366] write(3, "1000", 4) = 4 [pid 366] close(3) = 0 [pid 366] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 366] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 362] ioctl(3, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 366] <... ioctl resumed>) = 0 [pid 367] <... set_robust_list resumed>) = 0 [pid 366] ioctl(3, SNDRV_TIMER_IOCTL_PARAMS, 0x20000440 [pid 367] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 366] <... ioctl resumed>) = 0 [pid 366] ioctl(3, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 366] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 367] <... prctl resumed>) = 0 [pid 367] setpgid(0, 0 [pid 366] <... openat resumed>) = 4 [pid 367] <... setpgid resumed>) = 0 [pid 367] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 366] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [ 23.595036][ T23] audit: type=1400 audit(1713262963.340:66): avc: denied { execmem } for pid=356 comm="syz-executor281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 362] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY [pid 366] <... ioctl resumed>) = 0 [pid 362] <... openat resumed>) = 4 [pid 366] ioctl(4, SNDRV_TIMER_IOCTL_START, 0 [pid 362] ioctl(4, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 366] <... ioctl resumed>) = 0 [pid 362] <... ioctl resumed>) = 0 [pid 362] ioctl(4, SNDRV_TIMER_IOCTL_START, 0) = 0 [pid 362] exit_group(0) = ? [pid 366] exit_group(0) = ? [pid 367] <... openat resumed>) = 3 [pid 367] write(3, "1000", 4) = 4 [pid 367] close(3) = 0 [pid 367] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [pid 367] ioctl(3, SNDRV_TIMER_IOCTL_SELECT, 0x20000100 [pid 369] set_robust_list(0x555557037660, 24) = 0 [pid 369] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 369] setpgid(0, 0) = 0 [pid 369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 369] write(3, "1000", 4) = 4 [pid 369] close(3) = 0 [pid 369] openat(AT_FDCWD, "/dev/snd/timer", O_RDONLY) = 3 [ 178.184861][ C1] watchdog: BUG: soft lockup - CPU#1 stuck for 122s! [kworker/u4:2:179] [ 178.193012][ C1] Modules linked in: [ 178.196753][ C1] CPU: 1 PID: 179 Comm: kworker/u4:2 Not tainted 5.4.268-syzkaller-00003-g2d5d8240a7cb #0 [ 178.206458][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 178.216402][ C1] Workqueue: events_unbound toggle_allocation_gate [ 178.222788][ C1] RIP: 0010:smp_call_function_single+0x235/0x4a0 [ 178.228946][ C1] Code: 0f 85 df 01 00 00 44 8b 74 24 58 44 89 f6 83 e6 01 31 ff e8 6d b0 0a 00 41 83 e6 01 75 0a e8 72 ad 0a 00 e9 f4 00 00 00 f3 90 <42> 0f b6 04 2b 84 c0 75 15 f7 44 24 58 01 00 00 00 0f 84 d6 00 00 [ 178.248908][ C1] RSP: 0018:ffff8881e578f8a0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 178.257154][ C1] RAX: ffffffff815999d1 RBX: 1ffff1103caf1f1f RCX: ffff8881ec982f40 [ 178.264963][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 178.272778][ C1] RBP: ffff8881e578f990 R08: ffffffff815999a3 R09: ffffed103edcb189 [ 178.280588][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1103caf1f18 [ 178.288398][ C1] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 178.296210][ C1] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 178.304979][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 178.311398][ C1] CR2: 00007f80faf39308 CR3: 00000001dc15e000 CR4: 00000000003406a0 [ 178.319211][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 178.327024][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 178.334831][ C1] Call Trace: [ 178.337959][ C1] [ 178.340675][ C1] ? watchdog_timer_fn+0x53d/0x600 [ 178.345600][ C1] ? proc_watchdog_cpumask+0xc0/0xc0 [ 178.350720][ C1] ? __hrtimer_run_queues+0x3e9/0xb90 [ 178.355930][ C1] ? hrtimer_interrupt+0x890/0x890 [ 178.360874][ C1] ? kvm_sched_clock_read+0x14/0x40 [ 178.365907][ C1] ? sched_clock+0x36/0x40 [ 178.370160][ C1] ? ktime_get+0xf9/0x130 [ 178.374327][ C1] ? ktime_get_update_offsets_now+0x26c/0x280 [ 178.380351][ C1] ? hrtimer_interrupt+0x38a/0x890 [ 178.385291][ C1] ? smp_apic_timer_interrupt+0x110/0x460 [ 178.390852][ C1] ? apic_timer_interrupt+0xf/0x20 [ 178.396090][ C1] [ 178.399002][ C1] ? smp_call_function_single+0x223/0x4a0 [ 178.404548][ C1] ? smp_call_function_single+0x251/0x4a0 [ 178.410104][ C1] ? smp_call_function_single+0x235/0x4a0 [ 178.415671][ C1] ? text_poke_bp_batch+0x2b0/0x2b0 [ 178.420696][ C1] ? check_preemption_disabled+0x9f/0x320 [ 178.426246][ C1] ? generic_smp_call_function_single_interrupt+0x10/0x10 [ 178.433185][ C1] ? check_preemption_disabled+0x9f/0x320 [ 178.438739][ C1] ? text_poke_bp_batch+0x2b0/0x2b0 [ 178.443791][ C1] ? debug_smp_processor_id+0x20/0x20 [ 178.448984][ C1] ? check_preemption_disabled+0x9f/0x320 [ 178.454542][ C1] ? find_next_and_bit+0x156/0x190 [ 178.459486][ C1] ? cpumask_next_and+0x11/0x30 [ 178.464173][ C1] smp_call_function_many+0x6fe/0x9b0 [ 178.469383][ C1] ? cpumask_any_but+0x9c/0xb0 [ 178.473980][ C1] ? text_poke_bp_batch+0x2b0/0x2b0 [ 178.479015][ C1] ? flush_tlb_mm_range+0x214/0x2b0 [ 178.484046][ C1] ? smp_call_function_any+0x190/0x190 [ 178.489342][ C1] ? _raw_spin_unlock+0x49/0x60 [ 178.494031][ C1] ? text_poke_bp_batch+0x2b0/0x2b0 [ 178.499064][ C1] on_each_cpu+0xa5/0x1a0 [ 178.503227][ C1] ? text_poke+0x10/0x10 [ 178.507338][ C1] ? _raw_spin_lock+0xa4/0x1b0 [ 178.511910][ C1] ? smp_call_function+0x90/0x90 [ 178.516681][ C1] ? _nohz_idle_balance+0x2e9/0x490 [ 178.521720][ C1] text_poke_bp_batch+0x11a/0x2b0 [ 178.526584][ C1] ? patch_cmp+0x40/0x40 [ 178.530659][ C1] arch_jump_label_transform_apply+0x27/0x40 [ 178.536471][ C1] static_key_enable_cpuslocked+0x12c/0x240 [ 178.542202][ C1] static_key_enable+0x16/0x20 [ 178.546801][ C1] toggle_allocation_gate+0xb1/0x240 [ 178.551920][ C1] ? kfence_protect+0x1e0/0x1e0 [ 178.556609][ C1] ? __schedule+0xb0d/0x1320 [ 178.561033][ C1] ? _raw_spin_lock_irqsave+0x210/0x210 [ 178.566416][ C1] ? read_word_at_a_time+0xe/0x20 [ 178.571280][ C1] ? strscpy+0x89/0x220 [ 178.575270][ C1] process_one_work+0x765/0xd20 [ 178.579957][ C1] worker_thread+0xaef/0x1470 [ 178.584474][ C1] kthread+0x2da/0x360 [ 178.588372][ C1] ? worker_clr_flags+0x170/0x170 [ 178.593233][ C1] ? kthread_blkcg+0xd0/0xd0 [ 178.597659][ C1] ret_from_fork+0x1f/0x30