./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3900449839 <...> d { noatsecure } for pid=249 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.708020][ T24] audit: type=1400 audit(1720900902.970:63): avc: denied { write } for pid=249 comm="sh" path="pipe:[1419]" dev="pipefs" ino=1419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.711168][ T24] audit: type=1400 audit(1720900902.970:64): avc: denied { rlimitinh } for pid=249 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.713718][ T24] audit: type=1400 audit(1720900902.970:65): avc: denied { siginh } for pid=249 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.194' (ED25519) to the list of known hosts. execve("./syz-executor3900449839", ["./syz-executor3900449839"], 0x7ffeb8d2ecd0 /* 10 vars */) = 0 brk(NULL) = 0x555555a61000 brk(0x555555a61d00) = 0x555555a61d00 arch_prctl(ARCH_SET_FS, 0x555555a61380) = 0 set_tid_address(0x555555a61650) = 291 set_robust_list(0x555555a61660, 24) = 0 rseq(0x555555a61ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3900449839", 4096) = 28 getrandom("\xf6\x74\x48\xfb\x87\x37\x32\x07", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555a61d00 brk(0x555555a82d00) = 0x555555a82d00 brk(0x555555a83000) = 0x555555a83000 mprotect(0x7f04b2b0f000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.tQBIK4", 0700) = 0 chmod("./syzkaller.tQBIK4", 0777) = 0 chdir("./syzkaller.tQBIK4") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555a61650) = 293 ./strace-static-x86_64: Process 293 attached [pid 293] set_robust_list(0x555555a61660, 24) = 0 [pid 293] chdir("./0") = 0 [ 24.896707][ T24] audit: type=1400 audit(1720900912.160:66): avc: denied { execmem } for pid=291 comm="syz-executor390" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.919409][ T24] audit: type=1400 audit(1720900912.190:67): avc: denied { read write } for pid=291 comm="syz-executor390" name="loop0" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 293] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 293] setpgid(0, 0) = 0 [pid 293] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 293] write(3, "1000", 4) = 4 [pid 293] close(3) = 0 [pid 293] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 293] write(1, "executing program\n", 18) = 18 [pid 293] memfd_create("syzkaller", 0) = 3 [pid 293] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f04aa65c000 [pid 293] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 293] munmap(0x7f04aa65c000, 138412032) = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 293] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 293] close(3) = 0 [pid 293] close(4) = 0 [pid 293] mkdir("./file0", 0777) = 0 [ 24.943857][ T24] audit: type=1400 audit(1720900912.190:68): avc: denied { open } for pid=291 comm="syz-executor390" path="/dev/loop0" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.960671][ T293] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 24.968476][ T24] audit: type=1400 audit(1720900912.210:69): avc: denied { ioctl } for pid=291 comm="syz-executor390" path="/dev/loop0" dev="devtmpfs" ino=111 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.976977][ T293] EXT4-fs error (device loop0): ext4_xattr_inode_iget:404: comm syz-executor390: inode #1: comm syz-executor390: iget: illegal inode # [ 25.000288][ T24] audit: type=1400 audit(1720900912.210:70): avc: denied { mounton } for pid=293 comm="syz-executor390" path="/root/syzkaller.tQBIK4/0/file0" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 25.014316][ T293] EXT4-fs error (device loop0): ext4_xattr_inode_iget:409: comm syz-executor390: error while reading EA inode 1 err=-117 [ 25.050837][ T293] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2800: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 25.063779][ T293] EXT4-fs error (device loop0): ext4_xattr_inode_iget:404: comm syz-executor390: inode #1: comm syz-executor390: iget: illegal inode # [ 25.077714][ T293] EXT4-fs error (device loop0): ext4_xattr_inode_iget:409: comm syz-executor390: error while reading EA inode 1 err=-117 [ 25.090511][ T293] EXT4-fs (loop0): 1 orphan inode deleted [pid 293] mount("/dev/loop0", "./file0", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_I_VERSION|0x200, "journal_ioprio=0x0000000000000005,journal_dev=0x0000000000008000,debug_want_extra_isize=0x0000000000"...) = 0 [pid 293] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 293] chdir("./file0") = 0 [pid 293] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 293] ioctl(4, LOOP_CLR_FD) = 0 [pid 293] close(4) = 0 [pid 293] mount("./file0", "./file0", "incremental-fs", 0, NULL) = 0 [pid 293] exit_group(0) = ? [pid 293] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=293, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [ 25.096026][ T293] EXT4-fs (loop0): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000005,journal_dev=0x0000000000008000,debug_want_extra_isize=0x000000000000005c,minixdf,resgid=0x0000000000000000,nombcache,mblk_io_submit,,errors=continue [ 25.119575][ T24] audit: type=1400 audit(1720900912.400:71): avc: denied { mount } for pid=293 comm="syz-executor390" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555555a626f0 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0755, st_size=1024, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=1024, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555555a6a730 /* 5 entries */, 32768) = 144 umount2("./0/file0/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0/lost+found", {st_mode=S_IFBLK|S_ISVTX|0614, st_rdev=makedev(0, 0xe), ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/file0/lost+found") = 0 umount2("./0/file0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0/file1", {st_mode=S_IFDIR|0700, st_size=60, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5 newfstatat(5, "", {st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0 getdents64(5, 0x555555a72770 /* 2 entries */, 32768) = 48 getdents64(5, 0x555555a72770 /* 0 entries */, 32768) = 0 close(5) = 0 rmdir("./0/file0/file1") = 0 [ 25.144717][ T24] audit: type=1400 audit(1720900912.420:72): avc: denied { mounton } for pid=293 comm="syz-executor390" path="/root/syzkaller.tQBIK4/0/file0/file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.154690][ T291] EXT4-fs error (device loop0): htree_dirblock_to_tree:1091: inode #2: block 13: comm syz-executor390: bad entry in directory: rec_len is smaller than minimal - offset=76, inode=0, rec_len=0, size=1024 fake=0 [ 25.170157][ T24] audit: type=1400 audit(1720900912.420:73): avc: denied { write } for pid=293 comm="syz-executor390" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.211766][ T24] audit: type=1400 audit(1720900912.420:74): avc: denied { add_name } for pid=293 comm="syz-executor390" name=".index" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.211904][ T291] ------------[ cut here ]------------ [ 25.232610][ T24] audit: type=1400 audit(1720900912.420:75): avc: denied { create } for pid=293 comm="syz-executor390" name=".index" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 25.238093][ T291] kernel BUG at fs/namei.c:2786! [ 25.263013][ T291] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 25.268892][ T291] CPU: 1 PID: 291 Comm: syz-executor390 Not tainted 5.10.218-syzkaller-00638-g3feee789f446 #0 [ 25.279116][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 25.289399][ T291] RIP: 0010:may_delete+0x755/0x760 [ 25.294305][ T291] Code: 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c db fd ff ff 4c 89 ef e8 ac 33 f4 ff e9 ce fd ff ff e8 12 a0 b6 ff 0f 0b e8 0b a0 b6 ff <0f> 0b 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 [ 25.313752][ T291] RSP: 0018:ffffc90000b27bb8 EFLAGS: 00010293 [ 25.319649][ T291] RAX: ffffffff81b40a75 RBX: ffff88811d129250 RCX: ffff88811f082780 [ 25.327558][ T291] RDX: 0000000000000000 RSI: 0000000000200000 RDI: 0000000000000000 [ 25.335359][ T291] RBP: ffffc90000b27c38 R08: ffffffff81b40393 R09: 0000000000000003 [ 25.343171][ T291] R10: fffff52000164f5c R11: dffffc0000000001 R12: 0000000000000001 [ 25.350980][ T291] R13: ffff88811d14e220 R14: ffff8881101d77b8 R15: dffffc0000000000 [ 25.358792][ T291] FS: 0000555555a61380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.367567][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.373980][ T291] CR2: 0000561544d511f8 CR3: 000000011a308000 CR4: 00000000003506a0 [ 25.381793][ T291] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.389687][ T291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.397495][ T291] Call Trace: [ 25.400722][ T291] ? __die_body+0x62/0xb0 [ 25.404877][ T291] ? die+0x88/0xb0 [ 25.408436][ T291] ? do_trap+0x1a4/0x310 [ 25.412526][ T291] ? may_delete+0x755/0x760 [ 25.416874][ T291] ? handle_invalid_op+0x95/0xc0 [ 25.421634][ T291] ? may_delete+0x755/0x760 [ 25.425974][ T291] ? exc_invalid_op+0x32/0x50 [ 25.430500][ T291] ? asm_exc_invalid_op+0x12/0x20 [ 25.435362][ T291] ? may_delete+0x73/0x760 [ 25.439598][ T291] ? may_delete+0x755/0x760 [ 25.443937][ T291] ? may_delete+0x755/0x760 [ 25.448274][ T291] ? may_delete+0x755/0x760 [ 25.452613][ T291] vfs_rmdir+0x2c/0x3f0 [ 25.456607][ T291] incfs_kill_sb+0x108/0x220 [ 25.461047][ T291] deactivate_locked_super+0xad/0x110 [ 25.466385][ T291] deactivate_super+0xbe/0xf0 [ 25.470885][ T291] cleanup_mnt+0x45c/0x510 [ 25.475127][ T291] __cleanup_mnt+0x19/0x20 [ 25.479392][ T291] task_work_run+0x129/0x190 [ 25.483806][ T291] ptrace_notify+0x29e/0x350 [ 25.488249][ T291] ? do_notify_parent+0xa10/0xa10 [ 25.493096][ T291] ? user_path_at_empty+0x40/0x50 [ 25.498088][ T291] ? __x64_sys_umount+0x122/0x170 [ 25.502948][ T291] ? path_umount+0xea0/0xea0 [ 25.507366][ T291] syscall_exit_to_user_mode+0xf5/0x1a0 [ 25.512747][ T291] do_syscall_64+0x40/0x70 [ 25.516999][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.522865][ T291] RIP: 0033:0x7f04b2a9c507 [ 25.527066][ T291] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 25.546517][ T291] RSP: 002b:00007ffc464fd628 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 25.554747][ T291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f04b2a9c507 [ 25.562619][ T291] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc464fd6e0 [ 25.570371][ T291] RBP: 00007ffc464fd6e0 R08: 0000000000000000 R09: 0000000000000000 [ 25.578186][ T291] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffc464fe7d0 [ 25.586399][ T291] R13: 0000555555a6a700 R14: 431bde82d7b634db R15: 00007ffc464ff860 [ 25.594257][ T291] Modules linked in: [ 25.598056][ T291] ---[ end trace 0fa576c3ed604b08 ]--- [ 25.603271][ T291] RIP: 0010:may_delete+0x755/0x760 [ 25.608176][ T291] Code: 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c db fd ff ff 4c 89 ef e8 ac 33 f4 ff e9 ce fd ff ff e8 12 a0 b6 ff 0f 0b e8 0b a0 b6 ff <0f> 0b 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 [ 25.627653][ T291] RSP: 0018:ffffc90000b27bb8 EFLAGS: 00010293 [ 25.633565][ T291] RAX: ffffffff81b40a75 RBX: ffff88811d129250 RCX: ffff88811f082780 [ 25.641377][ T291] RDX: 0000000000000000 RSI: 0000000000200000 RDI: 0000000000000000 [ 25.649175][ T291] RBP: ffffc90000b27c38 R08: ffffffff81b40393 R09: 0000000000000003 [ 25.656954][ T291] R10: fffff52000164f5c R11: dffffc0000000001 R12: 0000000000000001 [ 25.664834][ T291] R13: ffff88811d14e220 R14: ffff8881101d77b8 R15: dffffc0000000000 [ 25.672621][ T291] FS: 0000555555a61380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.681375][ T291] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.687776][ T291] CR2: 0000561544d511f8 CR3: 000000011a308000 CR4: 00000000003506a0 [ 25.695634][ T291] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.703408][ T291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.711232][ T291] Kernel panic - not syncing: Fatal exception [ 25.717460][ T291] Kernel Offset: disabled [ 25.721582][ T291] Rebooting in 86400 seconds..