./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3868392067 <...> syzkaller syzkaller login: [ 63.289863][ T26] kauditd_printk_skb: 42 callbacks suppressed [ 63.289890][ T26] audit: type=1400 audit(1686866849.608:77): avc: denied { transition } for pid=4844 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 63.319109][ T26] audit: type=1400 audit(1686866849.608:78): avc: denied { noatsecure } for pid=4844 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 63.339452][ T26] audit: type=1400 audit(1686866849.618:79): avc: denied { write } for pid=4844 comm="sh" path="pipe:[29723]" dev="pipefs" ino=29723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 63.362198][ T26] audit: type=1400 audit(1686866849.618:80): avc: denied { rlimitinh } for pid=4844 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 63.382822][ T26] audit: type=1400 audit(1686866849.618:81): avc: denied { siginh } for pid=4844 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 64.958946][ T26] audit: type=1400 audit(1686866851.278:82): avc: denied { read } for pid=4428 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.10.29' (ECDSA) to the list of known hosts. execve("./syz-executor3868392067", ["./syz-executor3868392067"], 0x7ffc09fdec20 /* 10 vars */) = 0 brk(NULL) = 0x555555672000 brk(0x555555672c40) = 0x555555672c40 arch_prctl(ARCH_SET_FS, 0x555555672300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3868392067", 4096) = 28 brk(0x555555693c40) = 0x555555693c40 brk(0x555555694000) = 0x555555694000 mprotect(0x7fe88ed04000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 [ 82.404390][ T26] audit: type=1400 audit(1686866868.718:83): avc: denied { write } for pid=4991 comm="strace-static-x" path="pipe:[28609]" dev="pipefs" ino=28609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 82.433877][ T26] audit: type=1400 audit(1686866868.748:84): avc: denied { execmem } for pid=4994 comm="syz-executor386" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe88684a000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 munmap(0x7fe88684a000, 524288) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 82.434879][ T4994] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4994 'syz-executor386' [ 82.473386][ T26] audit: type=1400 audit(1686866868.788:85): avc: denied { read write } for pid=4994 comm="syz-executor386" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 82.476595][ T4994] loop0: detected capacity change from 0 to 1024 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 mount("/dev/loop0", "./file0", "hfsplus", MS_SYNCHRONOUS|MS_RELATIME|MS_I_VERSION|MS_LAZYTIME, "force") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 82.504719][ T26] audit: type=1400 audit(1686866868.788:86): avc: denied { open } for pid=4994 comm="syz-executor386" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 82.529782][ T26] audit: type=1400 audit(1686866868.798:87): avc: denied { ioctl } for pid=4994 comm="syz-executor386" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 82.557148][ T26] audit: type=1400 audit(1686866868.828:88): avc: denied { mounton } for pid=4994 comm="syz-executor386" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 82.580583][ T26] audit: type=1400 audit(1686866868.858:89): avc: denied { mount } for pid=4994 comm="syz-executor386" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 82.588093][ T4994] hfsplus: request for non-existent node 393216 in B*Tree [ 82.611370][ T4994] hfsplus: request for non-existent node 393216 in B*Tree [ 82.620334][ T4994] ================================================================== [ 82.628429][ T4994] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x144/0x150 [ 82.636368][ T4994] Read of size 8 at addr ffff88802206d3c0 by task syz-executor386/4994 [ 82.644617][ T4994] [ 82.646942][ T4994] CPU: 0 PID: 4994 Comm: syz-executor386 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 [ 82.657358][ T4994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 82.667509][ T4994] Call Trace: [ 82.670790][ T4994] [ 82.673724][ T4994] dump_stack_lvl+0xd9/0x150 [ 82.678335][ T4994] print_address_description.constprop.0+0x2c/0x3c0 [ 82.685034][ T4994] ? hfsplus_bnode_read+0x144/0x150 [ 82.690295][ T4994] kasan_report+0x11c/0x130 [ 82.694912][ T4994] ? hfsplus_bnode_read+0x144/0x150 [ 82.700144][ T4994] hfsplus_bnode_read+0x144/0x150 [ 82.705199][ T4994] hfsplus_bnode_dump+0x2c6/0x3a0 [ 82.710344][ T4994] ? hfsplus_bnode_read+0xb8/0x150 [ 82.715479][ T4994] ? hfsplus_bnode_move+0x8f0/0x8f0 [ 82.720699][ T4994] ? hfsplus_bnode_write_u16+0x84/0xb0 [ 82.726187][ T4994] ? hfsplus_bnode_move+0x2b/0x8f0 [ 82.731333][ T4994] ? __mark_inode_dirty+0x297/0xd60 [ 82.736675][ T4994] hfsplus_brec_remove+0x3db/0x4f0 [ 82.741813][ T4994] __hfsplus_delete_attr+0x28a/0x3a0 [ 82.747122][ T4994] ? hfsplus_find_exit+0xc0/0xc0 [ 82.752072][ T4994] ? hfsplus_part_find+0xb80/0xb80 [ 82.757236][ T4994] ? rcu_is_watching+0x12/0xb0 [ 82.762028][ T4994] hfsplus_delete_all_attrs+0x25d/0x320 [ 82.767596][ T4994] ? do_raw_spin_lock+0x124/0x2b0 [ 82.772662][ T4994] ? hfsplus_delete_attr+0x300/0x300 [ 82.777970][ T4994] ? spin_bug+0x1c0/0x1c0 [ 82.782328][ T4994] ? rcu_is_watching+0x12/0xb0 [ 82.787117][ T4994] ? __mark_inode_dirty+0x5a7/0xd60 [ 82.792433][ T4994] hfsplus_delete_cat+0x86a/0xe40 [ 82.797482][ T4994] ? hfsplus_create_cat+0x10d0/0x10d0 [ 82.802900][ T4994] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 82.808477][ T4994] ? lock_sync+0x190/0x190 [ 82.812923][ T4994] hfsplus_unlink+0x1e3/0x830 [ 82.817642][ T4994] ? hfsplus_symlink+0x2e0/0x2e0 [ 82.822696][ T4994] ? down_write+0x14f/0x200 [ 82.827226][ T4994] ? rwsem_down_write_slowpath+0x1220/0x1220 [ 82.833237][ T4994] vfs_unlink+0x355/0x930 [ 82.837593][ T4994] do_unlinkat+0x3e3/0x680 [ 82.842052][ T4994] ? __ia32_sys_rmdir+0x110/0x110 [ 82.847274][ T4994] ? __check_object_size+0x323/0x730 [ 82.852595][ T4994] ? getname_flags.part.0+0x1dd/0x4f0 [ 82.858012][ T4994] __x64_sys_unlink+0xca/0x110 [ 82.862808][ T4994] do_syscall_64+0x39/0xb0 [ 82.867239][ T4994] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 82.873165][ T4994] RIP: 0033:0x7fe88ec96829 [ 82.877589][ T4994] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 82.897235][ T4994] RSP: 002b:00007ffe775eb748 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 82.905746][ T4994] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe88ec96829 [ 82.913732][ T4994] RDX: 00007fe88ec54ea3 RSI: 0000000000000000 RDI: 0000000020000000 [ 82.921807][ T4994] RBP: 00007fe88ec560c0 R08: 00000000000005f2 R09: 0000000000000000 [ 82.929790][ T4994] R10: 00007ffe775eb610 R11: 0000000000000246 R12: 00007fe88ec56150 [ 82.937865][ T4994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 82.945845][ T4994] [ 82.948865][ T4994] [ 82.951186][ T4994] Allocated by task 4994: [ 82.955511][ T4994] kasan_save_stack+0x22/0x40 [ 82.960203][ T4994] kasan_set_track+0x25/0x30 [ 82.965071][ T4994] __kasan_kmalloc+0xa3/0xb0 [ 82.969676][ T4994] __kmalloc+0x5e/0x190 [ 82.973846][ T4994] __hfs_bnode_create+0x107/0x840 [ 82.978912][ T4994] hfsplus_bnode_find+0x41c/0xc60 [ 82.983961][ T4994] hfsplus_brec_find+0x2b3/0x520 [ 82.988910][ T4994] hfsplus_delete_all_attrs+0x236/0x320 [ 82.994470][ T4994] hfsplus_delete_cat+0x86a/0xe40 [ 82.999514][ T4994] hfsplus_unlink+0x1e3/0x830 [ 83.004210][ T4994] vfs_unlink+0x355/0x930 [ 83.008552][ T4994] do_unlinkat+0x3e3/0x680 [ 83.012989][ T4994] __x64_sys_unlink+0xca/0x110 [ 83.017782][ T4994] do_syscall_64+0x39/0xb0 [ 83.022210][ T4994] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 83.028134][ T4994] [ 83.030459][ T4994] Last potentially related work creation: [ 83.036185][ T4994] kasan_save_stack+0x22/0x40 [ 83.040873][ T4994] __kasan_record_aux_stack+0x7b/0x90 [ 83.046264][ T4994] insert_work+0x48/0x360 [ 83.050694][ T4994] __queue_work+0x625/0x1120 [ 83.055296][ T4994] queue_work_on+0xf2/0x110 [ 83.059814][ T4994] call_usermodehelper_exec+0x1d2/0x4c0 [ 83.065369][ T4994] kobject_uevent_env+0xefc/0x16c0 [ 83.070492][ T4994] driver_register+0x2df/0x4a0 [ 83.075263][ T4994] __mhi_driver_register+0x10d/0x160 [ 83.080554][ T4994] do_one_initcall+0x102/0x540 [ 83.085332][ T4994] kernel_init_freeable+0x64e/0xba0 [ 83.090551][ T4994] kernel_init+0x1e/0x2c0 [ 83.094904][ T4994] ret_from_fork+0x1f/0x30 [ 83.099351][ T4994] [ 83.101683][ T4994] The buggy address belongs to the object at ffff88802206d300 [ 83.101683][ T4994] which belongs to the cache kmalloc-192 of size 192 [ 83.115748][ T4994] The buggy address is located 40 bytes to the right of [ 83.115748][ T4994] allocated 152-byte region [ffff88802206d300, ffff88802206d398) [ 83.130425][ T4994] [ 83.132749][ T4994] The buggy address belongs to the physical page: [ 83.139158][ T4994] page:ffffea0000881b40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2206d [ 83.149314][ T4994] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 83.156858][ T4994] page_type: 0x10() [ 83.160668][ T4994] raw: 00fff00000000200 ffff888012440000 ffffea000087dfd0 ffff888012441150 [ 83.169257][ T4994] raw: 0000000000000000 ffff88802206d000 0000000100000010 0000000000000000 [ 83.177862][ T4994] page dumped because: kasan: bad access detected [ 83.184275][ T4994] page_owner tracks the page as allocated [ 83.189986][ T4994] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 13296283732, free_ts 13294766286 [ 83.209274][ T4994] post_alloc_hook+0x2db/0x350 [ 83.214049][ T4994] get_page_from_freelist+0xf41/0x2c00 [ 83.219521][ T4994] __alloc_pages+0x1cb/0x4a0 [ 83.224123][ T4994] cache_grow_begin+0x9b/0x3b0 [ 83.228915][ T4994] cache_alloc_refill+0x27f/0x380 [ 83.233956][ T4994] __kmem_cache_alloc_node+0x360/0x3f0 [ 83.239423][ T4994] __kmalloc_node_track_caller+0x4f/0x1a0 [ 83.245156][ T4994] kmemdup+0x2c/0x60 [ 83.249058][ T4994] neigh_parms_alloc+0x82/0x5f0 [ 83.253927][ T4994] inetdev_init+0x133/0x580 [ 83.258443][ T4994] inetdev_event+0xe7c/0x1720 [ 83.263123][ T4994] notifier_call_chain+0xb6/0x3c0 [ 83.268174][ T4994] call_netdevice_notifiers_info+0xb9/0x130 [ 83.274074][ T4994] register_netdevice+0xfb4/0x1640 [ 83.279201][ T4994] init_mac80211_hwsim+0x762/0x830 [ 83.284347][ T4994] do_one_initcall+0x102/0x540 [ 83.289220][ T4994] page last free stack trace: [ 83.293887][ T4994] free_unref_page_prepare+0x62e/0xcb0 [ 83.299354][ T4994] free_unref_page+0x33/0x370 [ 83.304052][ T4994] vfree+0x180/0x7e0 [ 83.307953][ T4994] delayed_vfree_work+0x57/0x70 [ 83.312835][ T4994] process_one_work+0x99a/0x15e0 [ 83.317786][ T4994] worker_thread+0x67d/0x10c0 [ 83.322477][ T4994] kthread+0x344/0x440 [ 83.326724][ T4994] ret_from_fork+0x1f/0x30 [ 83.331248][ T4994] [ 83.333612][ T4994] Memory state around the buggy address: [ 83.339355][ T4994] ffff88802206d280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 83.347786][ T4994] ffff88802206d300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 83.355935][ T4994] >ffff88802206d380: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.364026][ T4994] ^ [ 83.370277][ T4994] ffff88802206d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 83.378437][ T4994] ffff88802206d480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 83.386780][ T4994] ================================================================== [ 83.395410][ T4994] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 83.402729][ T4994] CPU: 1 PID: 4994 Comm: syz-executor386 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 [ 83.413346][ T4994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 83.423416][ T4994] Call Trace: [ 83.426799][ T4994] [ 83.429738][ T4994] dump_stack_lvl+0xd9/0x150 [ 83.434361][ T4994] panic+0x686/0x730 [ 83.438285][ T4994] ? panic_smp_self_stop+0xa0/0xa0 [ 83.443511][ T4994] ? preempt_schedule_thunk+0x1a/0x20 [ 83.449186][ T4994] ? preempt_schedule_common+0x45/0xb0 [ 83.454670][ T4994] check_panic_on_warn+0xb1/0xc0 [ 83.459636][ T4994] end_report+0xe9/0x120 [ 83.464076][ T4994] ? hfsplus_bnode_read+0x144/0x150 [ 83.469400][ T4994] kasan_report+0xf9/0x130 [ 83.473926][ T4994] ? hfsplus_bnode_read+0x144/0x150 [ 83.479339][ T4994] hfsplus_bnode_read+0x144/0x150 [ 83.484402][ T4994] hfsplus_bnode_dump+0x2c6/0x3a0 [ 83.489463][ T4994] ? hfsplus_bnode_read+0xb8/0x150 [ 83.494705][ T4994] ? hfsplus_bnode_move+0x8f0/0x8f0 [ 83.499951][ T4994] ? hfsplus_bnode_write_u16+0x84/0xb0 [ 83.505567][ T4994] ? hfsplus_bnode_move+0x2b/0x8f0 [ 83.510726][ T4994] ? __mark_inode_dirty+0x297/0xd60 [ 83.516137][ T4994] hfsplus_brec_remove+0x3db/0x4f0 [ 83.521280][ T4994] __hfsplus_delete_attr+0x28a/0x3a0 [ 83.526589][ T4994] ? hfsplus_find_exit+0xc0/0xc0 [ 83.531551][ T4994] ? hfsplus_part_find+0xb80/0xb80 [ 83.536682][ T4994] ? rcu_is_watching+0x12/0xb0 [ 83.541488][ T4994] hfsplus_delete_all_attrs+0x25d/0x320 [ 83.547142][ T4994] ? do_raw_spin_lock+0x124/0x2b0 [ 83.552201][ T4994] ? hfsplus_delete_attr+0x300/0x300 [ 83.557507][ T4994] ? spin_bug+0x1c0/0x1c0 [ 83.561868][ T4994] ? rcu_is_watching+0x12/0xb0 [ 83.566753][ T4994] ? __mark_inode_dirty+0x5a7/0xd60 [ 83.571995][ T4994] hfsplus_delete_cat+0x86a/0xe40 [ 83.577061][ T4994] ? hfsplus_create_cat+0x10d0/0x10d0 [ 83.582469][ T4994] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 83.588049][ T4994] ? lock_sync+0x190/0x190 [ 83.592490][ T4994] hfsplus_unlink+0x1e3/0x830 [ 83.597200][ T4994] ? hfsplus_symlink+0x2e0/0x2e0 [ 83.602173][ T4994] ? down_write+0x14f/0x200 [ 83.606704][ T4994] ? rwsem_down_write_slowpath+0x1220/0x1220 [ 83.612805][ T4994] vfs_unlink+0x355/0x930 [ 83.617166][ T4994] do_unlinkat+0x3e3/0x680 [ 83.621614][ T4994] ? __ia32_sys_rmdir+0x110/0x110 [ 83.626671][ T4994] ? __check_object_size+0x323/0x730 [ 83.631986][ T4994] ? getname_flags.part.0+0x1dd/0x4f0 [ 83.637384][ T4994] __x64_sys_unlink+0xca/0x110 [ 83.642184][ T4994] do_syscall_64+0x39/0xb0 [ 83.646617][ T4994] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 83.652544][ T4994] RIP: 0033:0x7fe88ec96829 [ 83.656981][ T4994] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 83.676604][ T4994] RSP: 002b:00007ffe775eb748 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 83.685035][ T4994] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe88ec96829 [ 83.693029][ T4994] RDX: 00007fe88ec54ea3 RSI: 0000000000000000 RDI: 0000000020000000 [ 83.701105][ T4994] RBP: 00007fe88ec560c0 R08: 00000000000005f2 R09: 0000000000000000 [ 83.709091][ T4994] R10: 00007ffe775eb610 R11: 0000000000000246 R12: 00007fe88ec56150 [ 83.717160][ T4994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.725149][ T4994] [ 83.728359][ T4994] Kernel Offset: disabled [ 83.732698][ T4994] Rebooting in 86400 seconds..