./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2982640279
<...>
Warning: Permanently added '10.128.1.162' (ED25519) to the list of known hosts.
execve("./syz-executor2982640279", ["./syz-executor2982640279"], 0x7ffcedcad2d0 /* 10 vars */) = 0
brk(NULL) = 0x5555572ed000
brk(0x5555572edd00) = 0x5555572edd00
arch_prctl(ARCH_SET_FS, 0x5555572ed380) = 0
set_tid_address(0x5555572ed650) = 5055
set_robust_list(0x5555572ed660, 24) = 0
rseq(0x5555572edca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2982640279", 4096) = 28
getrandom("\x2f\x88\x03\x4e\x5b\x26\xf9\x74", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555572edd00
brk(0x55555730ed00) = 0x55555730ed00
brk(0x55555730f000) = 0x55555730f000
mprotect(0x7fb8a57d6000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.JlLryQ", 0700) = 0
chmod("./syzkaller.JlLryQ", 0777) = 0
chdir("./syzkaller.JlLryQ") = 0
mkdir("./0", 0777) = 0
[ 73.795969][ T27] audit: type=1400 audit(1703544629.204:83): avc: denied { execmem } for pid=5055 comm="syz-executor298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 73.823509][ T27] audit: type=1400 audit(1703544629.234:84): avc: denied { append } for pid=4492 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
[ 73.845690][ T27] audit: type=1400 audit(1703544629.234:85): avc: denied { open } for pid=4492 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 73.868235][ T27] audit: type=1400 audit(1703544629.234:86): avc: denied { getattr } for pid=4492 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555572ed650) = 5056
./strace-static-x86_64: Process 5056 attached
[pid 5056] set_robust_list(0x5555572ed660, 24) = 0
[pid 5056] chdir("./0") = 0
[pid 5056] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5056] setpgid(0, 0) = 0
[pid 5056] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5056] write(3, "1000", 4) = 4
[pid 5056] close(3) = 0
[pid 5056] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5056] memfd_create("syzkaller", 0) = 3
[pid 5056] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb89d304000
[ 73.891644][ T27] audit: type=1400 audit(1703544629.254:87): avc: denied { read write } for pid=5055 comm="syz-executor298" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5056] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 5056] munmap(0x7fb89d304000, 138412032) = 0
[ 73.939910][ T27] audit: type=1400 audit(1703544629.254:88): avc: denied { open } for pid=5055 comm="syz-executor298" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 73.964589][ T27] audit: type=1400 audit(1703544629.254:89): avc: denied { ioctl } for pid=5055 comm="syz-executor298" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5056] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5056] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5056] close(3) = 0
[pid 5056] mkdir("./file0", 0777) = 0
[ 74.003619][ T5056] loop0: detected capacity change from 0 to 2048
[ 74.024213][ T5056] =======================================================
[ 74.024213][ T5056] WARNING: The mand mount option has been deprecated and
[ 74.024213][ T5056] and is ignored by this kernel. Remove the mand
[ 74.024213][ T5056] option from the mount to silence this warning.
[ 74.024213][ T5056] =======================================================
[ 74.024244][ T27] audit: type=1400 audit(1703544629.434:90): avc: denied { mounton } for pid=5056 comm="syz-executor298" path="/root/syzkaller.JlLryQ/0/file0" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 74.066154][ T5056] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[pid 5056] mount("/dev/loop0", "./file0", "udf", MS_NODEV|MS_MANDLOCK|MS_NOATIME|MS_REC|MS_POSIXACL, "") = 0
[pid 5056] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5056] chdir("./file0") = 0
[pid 5056] ioctl(4, LOOP_CLR_FD) = 0
[pid 5056] close(4) = 0
[ 74.097284][ T5056] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[ 74.108894][ T27] audit: type=1400 audit(1703544629.514:91): avc: denied { mount } for pid=5056 comm="syz-executor298" name="/" dev="loop0" ino=1376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1
[pid 5056] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4
[pid 5056] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 5056] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 5056] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[pid 5056] memfd_create("syzkaller", 0) = 6
[pid 5056] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb89d304000
[ 74.171413][ T27] audit: type=1400 audit(1703544629.574:92): avc: denied { mounton } for pid=5056 comm="syz-executor298" path="/root/syzkaller.JlLryQ/0/file0/bus" dev="loop0" ino=1367 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=file permissive=1
[pid 5056] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 5056] munmap(0x7fb89d304000, 138412032) = 0
[pid 5056] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 5056] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 5056] ioctl(7, LOOP_CLR_FD) = 0
[pid 5056] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 5056] close(7) = 0
[pid 5056] close(6) = 0
[pid 5056] exit_group(0) = ?
[pid 5056] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5056, si_uid=0, si_status=0, si_utime=0, si_stime=13 /* 0.13 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555572ee6f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 74.411064][ T5055] ==================================================================
[ 74.419160][ T5055] BUG: KASAN: use-after-free in crc_itu_t+0xd7/0xe0
[ 74.425795][ T5055] Read of size 1 at addr ffff88807faf2000 by task syz-executor298/5055
[ 74.434045][ T5055]
[ 74.436371][ T5055] CPU: 1 PID: 5055 Comm: syz-executor298 Not tainted 6.7.0-rc7-syzkaller #0
[ 74.445070][ T5055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 74.455132][ T5055] Call Trace:
[ 74.458395][ T5055]
[ 74.461310][ T5055] dump_stack_lvl+0xd9/0x1b0
[ 74.465900][ T5055] print_report+0xc4/0x620
[ 74.470300][ T5055] ? __virt_addr_valid+0x5e/0x2d0
[ 74.475407][ T5055] ? __phys_addr+0xc6/0x140
[ 74.479913][ T5055] kasan_report+0xda/0x110
[ 74.484320][ T5055] ? crc_itu_t+0xd7/0xe0
[ 74.488556][ T5055] ? crc_itu_t+0xd7/0xe0
[ 74.492789][ T5055] crc_itu_t+0xd7/0xe0
[ 74.496869][ T5055] udf_finalize_lvid+0xf2/0x1f0
[ 74.501714][ T5055] ? udf_mount+0x40/0x40
[ 74.505952][ T5055] udf_sync_fs+0xea/0x150
[ 74.510268][ T5055] ? udf_finalize_lvid+0x1f0/0x1f0
[ 74.515375][ T5055] sync_filesystem+0x109/0x280
[ 74.520136][ T5055] generic_shutdown_super+0x7e/0x3d0
[ 74.525430][ T5055] kill_block_super+0x3b/0x90
[ 74.530788][ T5055] deactivate_locked_super+0xbc/0x1a0
[ 74.536161][ T5055] deactivate_super+0xde/0x100
[ 74.540922][ T5055] cleanup_mnt+0x222/0x450
[ 74.545346][ T5055] task_work_run+0x14d/0x240
[ 74.549937][ T5055] ? task_work_cancel+0x30/0x30
[ 74.554789][ T5055] ptrace_notify+0x10d/0x130
[ 74.559379][ T5055] syscall_exit_to_user_mode_prepare+0x126/0x230
[ 74.565875][ T5055] syscall_exit_to_user_mode+0xe/0x60
[ 74.571285][ T5055] do_syscall_64+0x4d/0x110
[ 74.575796][ T5055] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 74.581876][ T5055] RIP: 0033:0x7fb8a5744547
[ 74.586295][ T5055] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 74.605904][ T5055] RSP: 002b:00007ffe57296f08 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 74.614302][ T5055] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb8a5744547
[ 74.622261][ T5055] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe57296fc0
[ 74.630228][ T5055] RBP: 00007ffe57296fc0 R08: 0000000000000000 R09: 0000000000000000
[ 74.638184][ T5055] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffe57298030
[ 74.646142][ T5055] R13: 00005555572ee6c0 R14: 431bde82d7b634db R15: 00007ffe57298050
[ 74.654116][ T5055]
[ 74.657130][ T5055]
[ 74.659431][ T5055] The buggy address belongs to the physical page:
[ 74.665821][ T5055] page:ffffea0001febc80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x7faf2
[ 74.676137][ T5055] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 74.683313][ T5055] page_type: 0xffffffff()
[ 74.687640][ T5055] raw: 00fff00000000000 ffffea0001c40788 ffffea0001cd1088 0000000000000000
[ 74.696208][ T5055] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 74.704779][ T5055] page dumped because: kasan: bad access detected
[ 74.711168][ T5055] page_owner tracks the page as freed
[ 74.716513][ T5055] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 5056, tgid 5056 (syz-executor298), ts 74222370651, free_ts 74268579702
[ 74.735421][ T5055] post_alloc_hook+0x2d0/0x350
[ 74.740172][ T5055] get_page_from_freelist+0xa25/0x36d0
[ 74.745613][ T5055] __alloc_pages+0x22e/0x2420
[ 74.750280][ T5055] alloc_pages_mpol+0x258/0x5f0
[ 74.755111][ T5055] vma_alloc_folio+0xad/0x220
[ 74.759767][ T5055] __handle_mm_fault+0xe07/0x3d70
[ 74.764774][ T5055] handle_mm_fault+0x47a/0xa10
[ 74.769518][ T5055] do_user_addr_fault+0x30b/0x1000
[ 74.774626][ T5055] exc_page_fault+0x5d/0xc0
[ 74.779189][ T5055] asm_exc_page_fault+0x26/0x30
[ 74.784038][ T5055] page last free stack trace:
[ 74.788689][ T5055] free_unref_page_prepare+0x4fa/0xaa0
[ 74.794135][ T5055] free_unref_page_list+0xe6/0xb40
[ 74.799235][ T5055] release_pages+0x32a/0x14f0
[ 74.803899][ T5055] tlb_batch_pages_flush+0x9a/0x190
[ 74.809086][ T5055] tlb_finish_mmu+0x14b/0x6f0
[ 74.813745][ T5055] unmap_region.constprop.0+0x2e6/0x3b0
[ 74.819293][ T5055] do_vmi_align_munmap+0xde6/0x1600
[ 74.824479][ T5055] do_vmi_munmap+0x20e/0x450
[ 74.829048][ T5055] __vm_munmap+0x144/0x390
[ 74.833445][ T5055] __x64_sys_munmap+0x62/0x80
[ 74.838101][ T5055] do_syscall_64+0x40/0x110
[ 74.842588][ T5055] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 74.848474][ T5055]
[ 74.850775][ T5055] Memory state around the buggy address:
[ 74.856380][ T5055] ffff88807faf1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 74.864420][ T5055] ffff88807faf1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 74.872555][ T5055] >ffff88807faf2000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.880596][ T5055] ^
[ 74.884641][ T5055] ffff88807faf2080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.892708][ T5055] ffff88807faf2100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 74.900749][ T5055] ==================================================================
[ 74.909059][ T5055] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 74.916350][ T5055] CPU: 1 PID: 5055 Comm: syz-executor298 Not tainted 6.7.0-rc7-syzkaller #0
[ 74.925021][ T5055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
[ 74.935068][ T5055] Call Trace:
[ 74.938338][ T5055]
[ 74.941259][ T5055] dump_stack_lvl+0xd9/0x1b0
[ 74.945850][ T5055] panic+0x6dc/0x790
[ 74.949751][ T5055] ? panic_smp_self_stop+0xa0/0xa0
[ 74.954868][ T5055] ? preempt_schedule_thunk+0x1a/0x30
[ 74.960242][ T5055] ? preempt_schedule_common+0x45/0xc0
[ 74.965701][ T5055] ? check_panic_on_warn+0x1f/0xb0
[ 74.970808][ T5055] check_panic_on_warn+0xab/0xb0
[ 74.975744][ T5055] end_report+0x108/0x150
[ 74.980068][ T5055] kasan_report+0xea/0x110
[ 74.984483][ T5055] ? crc_itu_t+0xd7/0xe0
[ 74.988726][ T5055] ? crc_itu_t+0xd7/0xe0
[ 74.992969][ T5055] crc_itu_t+0xd7/0xe0
[ 74.997042][ T5055] udf_finalize_lvid+0xf2/0x1f0
[ 75.002326][ T5055] ? udf_mount+0x40/0x40
[ 75.006568][ T5055] udf_sync_fs+0xea/0x150
[ 75.010891][ T5055] ? udf_finalize_lvid+0x1f0/0x1f0
[ 75.016013][ T5055] sync_filesystem+0x109/0x280
[ 75.020805][ T5055] generic_shutdown_super+0x7e/0x3d0
[ 75.026091][ T5055] kill_block_super+0x3b/0x90
[ 75.030767][ T5055] deactivate_locked_super+0xbc/0x1a0
[ 75.036140][ T5055] deactivate_super+0xde/0x100
[ 75.040905][ T5055] cleanup_mnt+0x222/0x450
[ 75.045324][ T5055] task_work_run+0x14d/0x240
[ 75.049919][ T5055] ? task_work_cancel+0x30/0x30
[ 75.054863][ T5055] ptrace_notify+0x10d/0x130
[ 75.059468][ T5055] syscall_exit_to_user_mode_prepare+0x126/0x230
[ 75.065879][ T5055] syscall_exit_to_user_mode+0xe/0x60
[ 75.071255][ T5055] do_syscall_64+0x4d/0x110
[ 75.075756][ T5055] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 75.081665][ T5055] RIP: 0033:0x7fb8a5744547
[ 75.086069][ T5055] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 75.105669][ T5055] RSP: 002b:00007ffe57296f08 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 75.114077][ T5055] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb8a5744547
[ 75.122040][ T5055] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffe57296fc0
[ 75.130011][ T5055] RBP: 00007ffe57296fc0 R08: 0000000000000000 R09: 0000000000000000
[ 75.137974][ T5055] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffe57298030
[ 75.145936][ T5055] R13: 00005555572ee6c0 R14: 431bde82d7b634db R15: 00007ffe57298050
[ 75.153905][ T5055]
[ 75.157163][ T5055] Kernel Offset: disabled
[ 75.161472][ T5055] Rebooting in 86400 seconds..