ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor3060353867 <...> Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor3060353867", ["ci2-android-6-1/syz-executor3060353867"], 0x7ffc5ee19c50 /* 10 vars */) = 0 brk(NULL) = 0x55555b217000 brk(0x55555b217d40) = 0x55555b217d40 arch_prctl(ARCH_SET_FS, 0x55555b2173c0) = 0 set_tid_address(0x55555b217690) = 305 set_robust_list(0x55555b2176a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor3060353867", 4096) = 44 getrandom("\x79\xe0\x44\x48\x61\x9d\x95\xa5", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555b217d40 brk(0x55555b238d40) = 0x55555b238d40 brk(0x55555b239000) = 0x55555b239000 mprotect(0x7fb755fda000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555b217690) = 306 ci2-android-6-1/strace-static-x86_64: Process 306 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] set_robust_list(0x55555b2176a0, 24) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 306] getppid() = 0 [pid 306] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 306] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 306] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 306] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 306] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 306] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 306] unshare(CLONE_NEWNS) = 0 [pid 306] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 306] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 306] unshare(CLONE_NEWCGROUP) = 0 [pid 306] unshare(CLONE_NEWUTS) = 0 [pid 306] unshare(CLONE_SYSVSEM) = 0 [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 306] getpid() = 1 [pid 306] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< {parent_tid=[2]}, 88) = 2 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 311 attached [pid 311] set_robust_list(0x7fb755f0b9a0, 24) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 311] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] bind(4, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] listen(4, 5) = 0 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0 executing program [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_MSG, insn_cnt=4, insns=0x200000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_SK_MSG_VERDICT, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 6 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=6, attach_type=BPF_SK_MSG_VERDICT, attach_flags=0, replace_bpf_fd=0, relative_fd=0, expected_revision=0}, 32) = 0 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x200000000640, value=0x200000000680, flags=BPF_ANY}, 32) = 0 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [pid 311] sendto(3, "\x01", 1, 0, NULL, 0) = 1 [pid 311] futex(0x7fb755fe0b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 306] futex(0x7fb755fe0b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... futex resumed>) = 1 [ 20.516116][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 20.537577][ T28] audit: type=1400 audit(1793109288.920:73): avc: denied { mounton } for pid=306 comm="syz-executor306" path="/root/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [pid 311] sendto(3, "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 18446744073709551493, MSG_OOB|MSG_DONTROUTE|MSG_EOR|MSG_NOSIGNAL|MSG_MORE, NULL, 0 [pid 306] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] futex(0x7fb755fe0b7c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fb755eca000 [pid 306] mprotect(0x7fb755ecb000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fb755eea990, parent_tid=0x7fb755eea990, exit_signal=0, stack=0x7fb755eca000, stack_size=0x20300, tls=0x7fb755eea6c0}ci2-android-6-1/strace-static-x86_64: Process 312 attached => {parent_tid=[3]}, 88) = 3 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] futex(0x7fb755fe0b78, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] futex(0x7fb755fe0b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 312] set_robust_list(0x7fb755eea9a0, 24) = 0 [pid 312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 312] sendto(3, "\x7b\x65\xb6\x62\x76\x57\xb4\x07\x8b\x6b", 10, MSG_MORE, NULL, 0 [pid 306] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 306] futex(0x7fb755fe0b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 306] futex(0x7fb755fe0b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 306] futex(0x7fb755fe0b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 306] exit_group(1) = ? [pid 311] <... sendto resumed>) = ? [pid 311] +++ exited with 1 +++ [ 20.795044][ T312] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN [ 20.806794][ T312] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 20.815190][ T312] CPU: 0 PID: 312 Comm: syz-executor306 Not tainted syzkaller #0 [ 20.822902][ T312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 20.832935][ T312] RIP: 0010:sk_msg_free_elem+0x200/0x410 [ 20.838589][ T312] Code: 3c 08 00 74 12 4c 89 e7 e8 2d 5d af fd 48 b9 00 00 00 00 00 fc ff df 4d 8b 2c 24 49 83 e5 fc 4d 8d 7d 08 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 74 08 4c 89 ff e8 02 5d af fd 4d 8b 3f 44 89 fe 83 e6 [ 20.858210][ T312] RSP: 0018:ffffc90000f075e0 EFLAGS: 00010202 [ 20.864278][ T312] RAX: 0000000000000001 RBX: ffff888111eb7000 RCX: dffffc0000000000 [ 20.872226][ T312] RDX: 0000000000000000 RSI: 000000000000021f RDI: 0000000000000fff [ 20.880171][ T312] RBP: ffffc90000f07630 R08: 0000000000000003 R09: 0000000000000004 [ 20.888146][ T312] R10: dffffc0000000000 R11: fffff520001e0e28 R12: ffff888111eb7020 [ 20.896094][ T312] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000008 [ 20.904047][ T312] FS: 00007fb755eea6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 20.912957][ T312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 20.919532][ T312] CR2: 00007fb755faa13c CR3: 0000000121bc0000 CR4: 00000000003506b0 [ 20.927487][ T312] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 20.935434][ T312] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 20.943381][ T312] Call Trace: [ 20.946642][ T312] [ 20.949553][ T312] sk_msg_free+0xf0/0x330 [ 20.953870][ T312] tcp_bpf_send_verdict+0xe36/0xfb0 [ 20.959089][ T312] tcp_bpf_sendmsg+0x68b/0xa80 [ 20.963864][ T312] ? __cfi_tcp_bpf_sendmsg+0x10/0x10 [ 20.969153][ T312] ? __cfi_selinux_socket_sendmsg+0x10/0x10 [ 20.975053][ T312] ? __fget_files+0x2d1/0x330 [ 20.979727][ T312] ? inet_send_prepare+0x60/0x4d0 [ 20.984736][ T312] inet_sendmsg+0xb6/0xd0 [ 20.989054][ T312] __sys_sendto+0x4ac/0x660 [ 20.993551][ T312] ? __cfi___sys_sendto+0x10/0x10 [ 20.998564][ T312] ? cgroup_update_frozen+0x15c/0x970 [ 21.003942][ T312] ? __cfi_ptrace_notify+0x10/0x10 [ 21.009052][ T312] ? xfd_validate_state+0x70/0x150 [ 21.014169][ T312] __x64_sys_sendto+0xe5/0x100 [ 21.018920][ T312] x64_sys_call+0x83/0x9a0 [ 21.023374][ T312] do_syscall_64+0x4c/0xa0 [ 21.027767][ T312] ? clear_bhb_loop+0x30/0x80 [ 21.032425][ T312] ? clear_bhb_loop+0x30/0x80 [ 21.037088][ T312] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 21.042968][ T312] RIP: 0033:0x7fb755f2f099 [ 21.047392][ T312] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 [ 21.066981][ T312] RSP: 002b:00007fb755eea208 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 21.075378][ T312] RAX: ffffffffffffffda RBX: 00007fb755fe0b78 RCX: 00007fb755f2f099 [ 21.083331][ T312] RDX: 000000000000000a RSI: 0000200000000840 RDI: 0000000000000003 [ 21.091283][ T312] RBP: 00007fb755fe0b70 R08: 0000000000000000 R09: 0000000000000000 [ 21.099264][ T312] R10: 0000000000008000 R11: 0000000000000246 R12: 00007fb755fab028 [ 21.107225][ T312] R13: 0000200000000800 R14: 0000200000000840 R15: 07b4577662b6657b [ 21.115207][ T312] [ 21.118224][ T312] Modules linked in: [ 21.124637][ T312] ---[ end trace 0000000000000000 ]--- [ 21.130111][ T312] RIP: 0010:sk_msg_free_elem+0x200/0x410 [ 21.136044][ T312] Code: 3c 08 00 74 12 4c 89 e7 e8 2d 5d af fd 48 b9 00 00 00 00 00 fc ff df 4d 8b 2c 24 49 83 e5 fc 4d 8d 7d 08 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 74 08 4c 89 ff e8 02 5d af fd 4d 8b 3f 44 89 fe 83 e6 [ 21.155874][ T312] RSP: 0018:ffffc90000f075e0 EFLAGS: 00010202 [ 21.161962][ T312] RAX: 0000000000000001 RBX: ffff888111eb7000 RCX: dffffc0000000000 [ 21.169981][ T312] RDX: 0000000000000000 RSI: 000000000000021f RDI: 0000000000000fff [ 21.177987][ T312] RBP: ffffc90000f07630 R08: 0000000000000003 R09: 0000000000000004 [ 21.185979][ T312] R10: dffffc0000000000 R11: fffff520001e0e28 R12: ffff888111eb7020 [ 21.193969][ T312] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000008 [ 21.201927][ T312] FS: 00007fb755eea6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 21.210873][ T312] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.217728][ T312] CR2: 00007fb755faa13c CR3: 0000000121bc0000 CR4: 00000000003506b0 [ 21.225734][ T312] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.233701][ T312] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 21.241906][ T312] Kernel panic - not syncing: Fatal exception [ 21.248198][ T312] Kernel Offset: disabled [ 21.252505][ T312] Rebooting in 86400 seconds..