./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor592345669
<...>
syzkaller
syzkaller login: [ 62.902274][ T26] kauditd_printk_skb: 42 callbacks suppressed
[ 62.902295][ T26] audit: type=1400 audit(1686875660.809:77): avc: denied { transition } for pid=4835 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 62.932126][ T26] audit: type=1400 audit(1686875660.809:78): avc: denied { noatsecure } for pid=4835 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 62.952629][ T26] audit: type=1400 audit(1686875660.819:79): avc: denied { write } for pid=4835 comm="sh" path="pipe:[29219]" dev="pipefs" ino=29219 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 62.975602][ T26] audit: type=1400 audit(1686875660.819:80): avc: denied { rlimitinh } for pid=4835 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 62.996072][ T26] audit: type=1400 audit(1686875660.819:81): avc: denied { siginh } for pid=4835 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 64.377219][ T26] audit: type=1400 audit(1686875662.289:82): avc: denied { read } for pid=4429 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
Warning: Permanently added '10.128.1.182' (ECDSA) to the list of known hosts.
execve("./syz-executor592345669", ["./syz-executor592345669"], 0x7ffc8646ef30 /* 10 vars */) = 0
brk(NULL) = 0x5555571d7000
brk(0x5555571d7c40) = 0x5555571d7c40
arch_prctl(ARCH_SET_FS, 0x5555571d7300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor592345669", 4096) = 27
brk(0x5555571f8c40) = 0x5555571f8c40
brk(0x5555571f9000) = 0x5555571f9000
mprotect(0x7fafc4b7a000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
[ 91.424517][ T26] audit: type=1400 audit(1686875689.339:83): avc: denied { write } for pid=4991 comm="strace-static-x" path="pipe:[30139]" dev="pipefs" ino=30139 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
memfd_create("syzkaller", 0) = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fafbc6bc000
[ 91.456681][ T26] audit: type=1400 audit(1686875689.369:84): avc: denied { execmem } for pid=4994 comm="syz-executor592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 91.461692][ T4994] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4994 'syz-executor592'
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
munmap(0x7fafbc6bc000, 16777216) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
ioctl(4, LOOP_SET_FD, 3) = 0
close(3) = 0
mkdir("./file0", 0777) = 0
[ 91.677732][ T26] audit: type=1400 audit(1686875689.589:85): avc: denied { read write } for pid=4994 comm="syz-executor592" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 91.682310][ T4994] loop0: detected capacity change from 0 to 32768
[ 91.702185][ T26] audit: type=1400 audit(1686875689.589:86): avc: denied { open } for pid=4994 comm="syz-executor592" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 91.721256][ T4994] BTRFS: device fsid 5ac8a51e-da3a-4998-8e66-e1df06b87bc8 devid 1 transid 8 /dev/loop0 scanned by syz-executor592 (4994)
[ 91.733468][ T26] audit: type=1400 audit(1686875689.589:87): avc: denied { ioctl } for pid=4994 comm="syz-executor592" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 91.771929][ T26] audit: type=1400 audit(1686875689.619:88): avc: denied { mounton } for pid=4994 comm="syz-executor592" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 91.801367][ T4994] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[ 91.811073][ T4994] BTRFS info (device loop0): using free space tree
mount("/dev/loop0", "./file0", "btrfs", 0, "noflushoncommit,rescan_uuid_tree,noacl,noautodefrag,datacow,") = 0
openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
ioctl(4, LOOP_CLR_FD) = 0
close(4) = 0
[ 91.835172][ T4994] BTRFS info (device loop0): enabling ssd optimizations
[ 91.843285][ T4994] BTRFS info (device loop0): auto enabling async discard
[ 91.853491][ T4994] BTRFS info (device loop0): checking UUID tree
ioctl(3, BTRFS_IOC_SUBVOL_SETFLAGS, BTRFS_SUBVOL_RDONLY) = 0
[ 91.864761][ T26] audit: type=1400 audit(1686875689.779:89): avc: denied { mount } for pid=4994 comm="syz-executor592" name="/" dev="loop0" ino=256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 91.897791][ T4994] ------------[ cut here ]------------
[ 91.903443][ T4994] WARNING: CPU: 0 PID: 4994 at fs/read_write.c:504 __kernel_write_iter+0x5f9/0x7a0
[ 91.912924][ T4994] Modules linked in:
[ 91.916830][ T4994] CPU: 0 PID: 4994 Comm: syz-executor592 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0
[ 91.927326][ T4994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 91.937494][ T4994] RIP: 0010:__kernel_write_iter+0x5f9/0x7a0
[ 91.943498][ T4994] Code: 05 00 00 4c 89 e2 48 c7 c6 40 96 5b 8a 48 c7 c7 e0 95 5b 8a e8 98 38 83 ff 49 c7 c6 ea ff ff ff e9 c0 fe ff ff e8 d7 54 9f ff <0f> 0b 49 c7 c6 f7 ff ff ff e9 ad fe ff ff e8 c4 54 9f ff 4c 89 ea
[ 91.963236][ T4994] RSP: 0018:ffffc900033bf6c0 EFLAGS: 00010293
[ 91.969359][ T4994] RAX: 0000000000000000 RBX: 00000000000a801d RCX: 0000000000000000
[ 91.977436][ T4994] RDX: ffff888079d14000 RSI: ffffffff81e412d9 RDI: 0000000000000005
[ 91.985542][ T4994] RBP: 1ffff92000677eda R08: 0000000000000005 R09: 0000000000000000
[ 91.993694][ T4994] R10: 0000000000000000 R11: 0000000000000005 R12: ffff888016b60a40
[ 92.001718][ T4994] R13: ffff888016b60abc R14: 0000000000000000 R15: ffff88807d1b0008
[ 92.009833][ T4994] FS: 00005555571d7300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 92.018957][ T4994] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 92.026559][ T4994] CR2: 0000000020001540 CR3: 0000000077066000 CR4: 00000000003506f0
[ 92.034648][ T4994] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 92.042729][ T4994] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 92.050754][ T4994] Call Trace:
[ 92.054158][ T4994]
[ 92.057130][ T4994] ? __warn+0xe6/0x390
[ 92.061264][ T4994] ? __kernel_write_iter+0x5f9/0x7a0
[ 92.066721][ T4994] ? report_bug+0x2da/0x500
[ 92.071319][ T4994] ? handle_bug+0x3c/0x70
[ 92.075761][ T4994] ? exc_invalid_op+0x18/0x50
[ 92.080491][ T4994] ? asm_exc_invalid_op+0x1a/0x20
[ 92.085750][ T4994] ? __kernel_write_iter+0x5f9/0x7a0
[ 92.091095][ T4994] ? __kernel_write_iter+0x5f9/0x7a0
[ 92.096734][ T4994] ? vfs_read+0x8a0/0x8a0
[ 92.098041][ T26] audit: type=1400 audit(1686875690.009:90): avc: denied { append } for pid=4429 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 92.101096][ T4994] ? avc_policy_seqno+0x9/0x10
[ 92.128068][ T4994] ? selinux_file_permission+0x96/0x520
[ 92.133734][ T4994] ? security_file_permission+0xaf/0xd0
[ 92.139351][ T4994] kernel_write+0x1c1/0x670
[ 92.142115][ T26] audit: type=1400 audit(1686875690.009:91): avc: denied { open } for pid=4429 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 92.143970][ T4994] ? btrfs_destroy_cachep+0x30/0x30
[ 92.171480][ T4994] ? __kernel_write+0x110/0x110
[ 92.176489][ T4994] btrfs_ioctl_send+0x2317/0x67b0
[ 92.181596][ T4994] ? changed_cb+0x3530/0x3530
[ 92.186429][ T4994] ? __might_fault+0xe2/0x190
[ 92.191170][ T4994] ? lock_downgrade+0x690/0x690
[ 92.196182][ T4994] ? _copy_from_user+0x5c/0xf0
[ 92.196552][ T26] audit: type=1400 audit(1686875690.009:92): avc: denied { getattr } for pid=4429 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 92.200990][ T4994] _btrfs_ioctl_send+0x100/0x2d0
[ 92.228693][ T4994] ? exclop_start_or_cancel_reloc+0x230/0x230
[ 92.234920][ T4994] ? avc_ss_reset+0x140/0x140
[ 92.239661][ T4994] ? tomoyo_path_number_perm+0x245/0x570
[ 92.245425][ T4994] ? lock_downgrade+0x690/0x690
[ 92.250337][ T4994] ? __kmem_cache_free+0x182/0x2c0
[ 92.255588][ T4994] ? tomoyo_path_number_perm+0x43b/0x570
[ 92.261398][ T4994] btrfs_ioctl+0x3c0f/0x5b30
[ 92.266130][ T4994] ? tomoyo_path_number_perm+0x166/0x570
[ 92.271839][ T4994] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 92.277893][ T4994] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 92.284414][ T4994] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 92.290362][ T4994] ? do_vfs_ioctl+0x132/0x1670
[ 92.295211][ T4994] ? vfs_fileattr_set+0xc40/0xc40
[ 92.300276][ T4994] ? ioctl_has_perm.constprop.0.isra.0+0x28c/0x420
[ 92.306861][ T4994] ? ioctl_has_perm.constprop.0.isra.0+0x295/0x420
[ 92.313446][ T4994] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 92.319445][ T4994] ? find_held_lock+0x2d/0x110
[ 92.324275][ T4994] ? name_to_dev_t+0x62/0x9e0
[ 92.329002][ T4994] ? lock_downgrade+0x690/0x690
[ 92.333945][ T4994] ? selinux_file_ioctl+0xba/0x280
[ 92.339097][ T4994] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 92.345733][ T4994] __x64_sys_ioctl+0x197/0x210
[ 92.350537][ T4994] do_syscall_64+0x39/0xb0
[ 92.355035][ T4994] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 92.360995][ T4994] RIP: 0033:0x7fafc4b08b69
[ 92.365522][ T4994] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 92.385323][ T4994] RSP: 002b:00007ffe93c25c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 92.393821][ T4994] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fafc4b08b69
[ 92.401830][ T4994] RDX: 00000000200003c0 RSI: 0000000040489426 RDI: 0000000000000003
[ 92.409901][ T4994] RBP: 00007fafc4ac8430 R08: 0000000000000000 R09: 0000000000000000
[ 92.417929][ T4994] R10: 00000000000051af R11: 0000000000000246 R12: 00007fafc4ac84c0
[ 92.425990][ T4994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 92.434019][ T4994]
[ 92.437052][ T4994] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 92.444520][ T4994] CPU: 0 PID: 4994 Comm: syz-executor592 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0
[ 92.454978][ T4994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 92.465051][ T4994] Call Trace:
[ 92.468336][ T4994]
[ 92.471270][ T4994] dump_stack_lvl+0xd9/0x150
[ 92.475876][ T4994] panic+0x686/0x730
[ 92.479800][ T4994] ? panic_smp_self_stop+0xa0/0xa0
[ 92.484936][ T4994] ? show_trace_log_lvl+0x284/0x390
[ 92.490161][ T4994] ? __kernel_write_iter+0x5f9/0x7a0
[ 92.495472][ T4994] check_panic_on_warn+0xb1/0xc0
[ 92.500450][ T4994] __warn+0xf2/0x390
[ 92.504382][ T4994] ? __kernel_write_iter+0x5f9/0x7a0
[ 92.509700][ T4994] report_bug+0x2da/0x500
[ 92.514076][ T4994] handle_bug+0x3c/0x70
[ 92.518256][ T4994] exc_invalid_op+0x18/0x50
[ 92.522873][ T4994] asm_exc_invalid_op+0x1a/0x20
[ 92.527776][ T4994] RIP: 0010:__kernel_write_iter+0x5f9/0x7a0
[ 92.533699][ T4994] Code: 05 00 00 4c 89 e2 48 c7 c6 40 96 5b 8a 48 c7 c7 e0 95 5b 8a e8 98 38 83 ff 49 c7 c6 ea ff ff ff e9 c0 fe ff ff e8 d7 54 9f ff <0f> 0b 49 c7 c6 f7 ff ff ff e9 ad fe ff ff e8 c4 54 9f ff 4c 89 ea
[ 92.553333][ T4994] RSP: 0018:ffffc900033bf6c0 EFLAGS: 00010293
[ 92.559425][ T4994] RAX: 0000000000000000 RBX: 00000000000a801d RCX: 0000000000000000
[ 92.567424][ T4994] RDX: ffff888079d14000 RSI: ffffffff81e412d9 RDI: 0000000000000005
[ 92.575419][ T4994] RBP: 1ffff92000677eda R08: 0000000000000005 R09: 0000000000000000
[ 92.583419][ T4994] R10: 0000000000000000 R11: 0000000000000005 R12: ffff888016b60a40
[ 92.591414][ T4994] R13: ffff888016b60abc R14: 0000000000000000 R15: ffff88807d1b0008
[ 92.599411][ T4994] ? __kernel_write_iter+0x5f9/0x7a0
[ 92.604727][ T4994] ? vfs_read+0x8a0/0x8a0
[ 92.609170][ T4994] ? avc_policy_seqno+0x9/0x10
[ 92.613971][ T4994] ? selinux_file_permission+0x96/0x520
[ 92.619549][ T4994] ? security_file_permission+0xaf/0xd0
[ 92.625136][ T4994] kernel_write+0x1c1/0x670
[ 92.629667][ T4994] ? btrfs_destroy_cachep+0x30/0x30
[ 92.634907][ T4994] ? __kernel_write+0x110/0x110
[ 92.639795][ T4994] btrfs_ioctl_send+0x2317/0x67b0
[ 92.644874][ T4994] ? changed_cb+0x3530/0x3530
[ 92.649590][ T4994] ? __might_fault+0xe2/0x190
[ 92.654298][ T4994] ? lock_downgrade+0x690/0x690
[ 92.659188][ T4994] ? _copy_from_user+0x5c/0xf0
[ 92.663995][ T4994] _btrfs_ioctl_send+0x100/0x2d0
[ 92.668965][ T4994] ? exclop_start_or_cancel_reloc+0x230/0x230
[ 92.675074][ T4994] ? avc_ss_reset+0x140/0x140
[ 92.679776][ T4994] ? tomoyo_path_number_perm+0x245/0x570
[ 92.685449][ T4994] ? lock_downgrade+0x690/0x690
[ 92.690338][ T4994] ? __kmem_cache_free+0x182/0x2c0
[ 92.695476][ T4994] ? tomoyo_path_number_perm+0x43b/0x570
[ 92.701154][ T4994] btrfs_ioctl+0x3c0f/0x5b30
[ 92.705779][ T4994] ? tomoyo_path_number_perm+0x166/0x570
[ 92.711886][ T4994] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 92.717740][ T4994] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 92.724718][ T4994] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 92.730649][ T4994] ? do_vfs_ioctl+0x132/0x1670
[ 92.735438][ T4994] ? vfs_fileattr_set+0xc40/0xc40
[ 92.740488][ T4994] ? ioctl_has_perm.constprop.0.isra.0+0x28c/0x420
[ 92.747032][ T4994] ? ioctl_has_perm.constprop.0.isra.0+0x295/0x420
[ 92.753563][ T4994] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 92.759569][ T4994] ? find_held_lock+0x2d/0x110
[ 92.764364][ T4994] ? name_to_dev_t+0x62/0x9e0
[ 92.769164][ T4994] ? lock_downgrade+0x690/0x690
[ 92.774048][ T4994] ? selinux_file_ioctl+0xba/0x280
[ 92.779180][ T4994] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 92.785631][ T4994] __x64_sys_ioctl+0x197/0x210
[ 92.790422][ T4994] do_syscall_64+0x39/0xb0
[ 92.794866][ T4994] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 92.800808][ T4994] RIP: 0033:0x7fafc4b08b69
[ 92.805244][ T4994] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 92.824888][ T4994] RSP: 002b:00007ffe93c25c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 92.833333][ T4994] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fafc4b08b69
[ 92.841328][ T4994] RDX: 00000000200003c0 RSI: 0000000040489426 RDI: 0000000000000003
[ 92.849329][ T4994] RBP: 00007fafc4ac8430 R08: 0000000000000000 R09: 0000000000000000
[ 92.857332][ T4994] R10: 00000000000051af R11: 0000000000000246 R12: 00007fafc4ac84c0
[ 92.865359][ T4994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 92.873360][ T4994]
[ 92.876685][ T4994] Kernel Offset: disabled
[ 92.881114][ T4994] Rebooting in 86400 seconds..