./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3612888638 <...> syzkaller syzkaller login: [ 62.461853][ T26] kauditd_printk_skb: 42 callbacks suppressed [ 62.461874][ T26] audit: type=1400 audit(1688742227.297:77): avc: denied { transition } for pid=4866 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 62.490295][ T26] audit: type=1400 audit(1688742227.297:78): avc: denied { noatsecure } for pid=4866 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 62.510061][ T26] audit: type=1400 audit(1688742227.307:79): avc: denied { write } for pid=4866 comm="sh" path="pipe:[29399]" dev="pipefs" ino=29399 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 62.534103][ T26] audit: type=1400 audit(1688742227.307:80): avc: denied { rlimitinh } for pid=4866 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 62.553171][ T26] audit: type=1400 audit(1688742227.307:81): avc: denied { siginh } for pid=4866 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 63.415543][ T26] audit: type=1400 audit(1688742228.247:82): avc: denied { read } for pid=4450 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.0.194' (ECDSA) to the list of known hosts. execve("./syz-executor3612888638", ["./syz-executor3612888638"], 0x7ffe80d4e150 /* 10 vars */) = 0 brk(NULL) = 0x555556614000 brk(0x555556614c40) = 0x555556614c40 arch_prctl(ARCH_SET_FS, 0x555556614300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3612888638", 4096) = 28 brk(0x555556635c40) = 0x555556635c40 brk(0x555556636000) = 0x555556636000 mprotect(0x7f485e6bc000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555566145d0) = 5017 ./strace-static-x86_64: Process 5017 attached [ 82.249639][ T26] audit: type=1400 audit(1688742247.087:83): avc: denied { write } for pid=5013 comm="strace-static-x" path="pipe:[30253]" dev="pipefs" ino=30253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [pid 5017] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5017] setpgid(0, 0) = 0 [pid 5017] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5017] write(3, "1000", 4) = 4 [pid 5017] close(3) = 0 [pid 5017] openat(AT_FDCWD, "/dev/nbd0", O_RDONLY) = 3 [pid 5017] socket(AF_AX25, SOCK_DGRAM, 0 /* AX25_P_??? */) = 4 [pid 5017] dup(4) = 5 [ 82.280258][ T26] audit: type=1400 audit(1688742247.117:84): avc: denied { append } for pid=4450 comm="syslogd" name="messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.304337][ T26] audit: type=1400 audit(1688742247.117:85): avc: denied { open } for pid=4450 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.327285][ T26] audit: type=1400 audit(1688742247.117:86): avc: denied { getattr } for pid=4450 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [pid 5017] ioctl(3, NBD_SET_SOCK, 5) = 0 [ 82.350372][ T26] audit: type=1400 audit(1688742247.117:87): avc: denied { execmem } for pid=5016 comm="syz-executor361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 82.370184][ T26] audit: type=1400 audit(1688742247.117:88): avc: denied { read } for pid=5017 comm="syz-executor361" name="nbd0" dev="devtmpfs" ino=664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 82.394251][ T26] audit: type=1400 audit(1688742247.117:89): avc: denied { open } for pid=5017 comm="syz-executor361" path="/dev/nbd0" dev="devtmpfs" ino=664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 82.418458][ T26] audit: type=1400 audit(1688742247.117:90): avc: denied { create } for pid=5017 comm="syz-executor361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 82.438307][ T26] audit: type=1400 audit(1688742247.147:91): avc: denied { ioctl } for pid=5017 comm="syz-executor361" path="/dev/nbd0" dev="devtmpfs" ino=664 ioctlcmd=0xab00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 5017] ioctl(3, NBD_DO_IT [pid 5016] kill(-5017, SIGKILL) = 0 [pid 5016] kill(5017, SIGKILL) = 0 [ 87.289443][ T5017] block nbd0: shutting down sockets [pid 5016] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5016] fstat(3, {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 [pid 5016] getdents64(3, 0x555556615620 /* 2 entries */, 32768) = 48 [pid 5016] getdents64(3, 0x555556615620 /* 0 entries */, 32768) = 0 [pid 5016] close(3) = 0 [ 91.968841][ T6] cfg80211: failed to load regulatory.db [ 286.526774][ T27] INFO: task syz-executor361:5017 blocked for more than 143 seconds. [ 286.535060][ T27] Not tainted 6.4.0-syzkaller-12155-ga452483508d7 #0 [ 286.542364][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 286.551271][ T27] task:syz-executor361 state:D stack:27680 pid:5017 ppid:5016 flags:0x00004006 [ 286.561034][ T27] Call Trace: [ 286.564358][ T27] [ 286.567592][ T27] __schedule+0xc9a/0x5880 [ 286.572106][ T27] ? io_schedule_timeout+0x150/0x150 [ 286.577697][ T27] ? __lock_acquire+0x1984/0x5e20 [ 286.582835][ T27] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 286.589190][ T27] schedule+0xde/0x1a0 [ 286.593312][ T27] schedule_timeout+0x276/0x2b0 [ 286.598489][ T27] ? usleep_range_state+0x1b0/0x1b0 [ 286.603746][ T27] ? __wait_for_common+0x1c4/0x5c0 [ 286.609180][ T27] ? lock_downgrade+0x690/0x690 [ 286.614086][ T27] ? do_raw_spin_lock+0x124/0x2b0 [ 286.619453][ T27] ? spin_bug+0x1c0/0x1c0 [ 286.623827][ T27] ? _raw_spin_unlock_irq+0x23/0x50 [ 286.629425][ T27] __wait_for_common+0x1ce/0x5c0 [ 286.634419][ T27] ? usleep_range_state+0x1b0/0x1b0 [ 286.639880][ T27] ? bit_wait_timeout+0x160/0x160 [ 286.644953][ T27] ? flush_workqueue_prep_pwqs+0x290/0x4f0 [ 286.651060][ T27] ? check_flush_dependency+0x86/0x3f0 [ 286.657009][ T27] __flush_workqueue+0x3f5/0x13a0 [ 286.662078][ T27] ? check_flush_dependency+0x3f0/0x3f0 [ 286.667687][ T27] ? blk_mq_run_hw_queues+0x200/0x290 [ 286.673148][ T27] ? blk_mq_unquiesce_queue+0xbf/0x100 [ 286.678695][ T27] nbd_ioctl+0x305/0xce0 [ 286.683018][ T27] ? nbd_start_device+0xdd0/0xdd0 [ 286.688115][ T27] ? prepare_to_swait_exclusive+0x240/0x240 [ 286.694050][ T27] ? ptrace_notify+0xfe/0x140 [ 286.698876][ T27] ? nbd_start_device+0xdd0/0xdd0 [ 286.703944][ T27] blkdev_ioctl+0x2f8/0x760 [ 286.708515][ T27] ? blkdev_common_ioctl+0x1be0/0x1be0 [ 286.714026][ T27] ? selinux_file_ioctl+0xba/0x280 [ 286.719262][ T27] ? blkdev_common_ioctl+0x1be0/0x1be0 [ 286.724783][ T27] __x64_sys_ioctl+0x19d/0x210 [ 286.729675][ T27] do_syscall_64+0x39/0xb0 [ 286.734253][ T27] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 286.740342][ T27] RIP: 0033:0x7f485e64f379 [ 286.744786][ T27] RSP: 002b:00007ffc4a9bb538 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 286.753273][ T27] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f485e64f379 [ 286.761311][ T27] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 [ 286.769636][ T27] RBP: 0000000000000000 R08: 00007ffc4a9bb6d8 R09: 00007ffc4a9bb6d8 [ 286.777693][ T27] R10: 00007ffc4a9bb6d8 R11: 0000000000000246 R12: 00007f485e60e690 [ 286.785702][ T27] R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 [ 286.793759][ T27] [ 286.796848][ T27] [ 286.796848][ T27] Showing all locks held in the system: [ 286.804660][ T27] 1 lock held by rcu_tasks_kthre/12: [ 286.810027][ T27] #0: ffffffff8c9a0ab0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0xd80 [ 286.820653][ T27] 1 lock held by rcu_tasks_trace/13: [ 286.825941][ T27] #0: ffffffff8c9a07b0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x31/0xd80 [ 286.837063][ T27] 1 lock held by khungtaskd/27: [ 286.841930][ T27] #0: ffffffff8c9a16c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x340 [ 286.851916][ T27] 2 locks held by kworker/u5:1/4420: [ 286.857302][ T27] #0: ffff888141346938 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at: process_one_work+0x8fd/0x16f0 [ 286.868042][ T27] #1: ffffc9000304fdb0 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x930/0x16f0 [ 286.879519][ T27] 2 locks held by getty/4771: [ 286.884212][ T27] #0: ffff88802bbec098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 [ 286.894117][ T27] #1: ffffc900020382f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xf08/0x13f0 [ 286.904398][ T27] [ 286.906775][ T27] ============================================= [ 286.906775][ T27] [ 286.915189][ T27] NMI backtrace for cpu 0 [ 286.919511][ T27] CPU: 0 PID: 27 Comm: khungtaskd Not tainted 6.4.0-syzkaller-12155-ga452483508d7 #0 [ 286.928967][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 286.939026][ T27] Call Trace: [ 286.942304][ T27] [ 286.945236][ T27] dump_stack_lvl+0xd9/0x150 [ 286.949971][ T27] nmi_cpu_backtrace+0x29c/0x350 [ 286.954935][ T27] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 286.960165][ T27] nmi_trigger_cpumask_backtrace+0x2a4/0x300 [ 286.966160][ T27] watchdog+0xe16/0x1090 [ 286.970433][ T27] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 286.976432][ T27] kthread+0x344/0x440 [ 286.980509][ T27] ? kthread_complete_and_exit+0x40/0x40 [ 286.986151][ T27] ret_from_fork+0x1f/0x30 [ 286.990614][ T27] [ 286.993757][ T27] Sending NMI from CPU 0 to CPUs 1: [ 286.999047][ C1] NMI backtrace for cpu 1 [ 286.999060][ C1] CPU: 1 PID: 4457 Comm: klogd Not tainted 6.4.0-syzkaller-12155-ga452483508d7 #0 [ 286.999085][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 286.999099][ C1] RIP: 0010:__free_pages+0x23/0x250 [ 286.999138][ C1] Code: 00 00 00 0f 1f 40 00 f3 0f 1e fa 48 b8 00 00 00 00 00 fc ff df 48 89 fa 41 56 41 89 f6 48 c1 ea 03 41 55 49 89 fd 41 54 55 53 <80> 3c 02 00 0f 85 02 02 00 00 49 8b 45 00 48 83 f8 ff 0f 84 b8 01 [ 286.999165][ C1] RSP: 0018:ffffc9000346f710 EFLAGS: 00000806 [ 286.999184][ C1] RAX: dffffc0000000000 RBX: ffffea00007e7d80 RCX: 00000000000000ef [ 286.999200][ C1] RDX: 1ffffd40000fd4f0 RSI: 0000000000000001 RDI: ffffea00007ea780 [ 286.999215][ C1] RBP: ffff888140065000 R08: fffffffffffffffe R09: 0000000000040388 [ 286.999230][ C1] R10: ffffe8ffffd02343 R11: 0000000000000001 R12: ffffc9000346f798 [ 286.999245][ C1] R13: ffffea00007ea780 R14: 0000000000000001 R15: ffffea00007ea780 [ 286.999261][ C1] FS: 00007fcf0c652380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 286.999284][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.999300][ C1] CR2: 000055bf31966680 CR3: 000000007d606000 CR4: 00000000003506e0 [ 286.999315][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.999329][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.999343][ C1] Call Trace: [ 286.999348][ C1] [ 286.999355][ C1] ? nmi_cpu_backtrace+0x1d0/0x350 [ 286.999392][ C1] ? nmi_cpu_backtrace_handler+0xc/0x10 [ 286.999427][ C1] ? nmi_handle+0x13d/0x400 [ 286.999466][ C1] ? __free_pages+0x23/0x250 [ 286.999489][ C1] ? default_do_nmi+0x6b/0x170 [ 286.999513][ C1] ? exc_nmi+0x171/0x1e0 [ 286.999535][ C1] ? end_repeat_nmi+0x16/0x31 [ 286.999584][ C1] ? __free_pages+0x23/0x250 [ 286.999606][ C1] ? __free_pages+0x23/0x250 [ 286.999629][ C1] ? __free_pages+0x23/0x250 [ 286.999651][ C1] [ 286.999657][ C1] [ 286.999664][ C1] slabs_destroy+0x85/0xc0 [ 286.999697][ C1] ___cache_free+0x2c5/0x410 [ 286.999730][ C1] ? qlist_free_all+0xa8/0x1a0 [ 286.999756][ C1] qlist_free_all+0x4f/0x1a0 [ 286.999781][ C1] kasan_quarantine_reduce+0x195/0x220 [ 286.999809][ C1] __kasan_slab_alloc+0x63/0x90 [ 286.999845][ C1] kmem_cache_alloc_node+0x2a0/0x530 [ 286.999880][ C1] __alloc_skb+0x288/0x330 [ 286.999960][ C1] ? __napi_build_skb+0x50/0x50 [ 287.000000][ C1] alloc_skb_with_frags+0x9a/0x6f0 [ 287.000031][ C1] ? avc_has_perm_noaudit+0x10b/0x3a0 [ 287.000066][ C1] ? lock_downgrade+0x690/0x690 [ 287.000106][ C1] sock_alloc_send_pskb+0x7a7/0x930 [ 287.000137][ C1] ? sk_dst_check+0x460/0x460 [ 287.000167][ C1] ? lock_downgrade+0x690/0x690 [ 287.000192][ C1] ? do_raw_spin_lock+0x124/0x2b0 [ 287.000221][ C1] ? spin_bug+0x1c0/0x1c0 [ 287.000249][ C1] unix_dgram_sendmsg+0x422/0x1b70 [ 287.000301][ C1] ? tomoyo_socket_sendmsg_permission+0x134/0x3a0 [ 287.000332][ C1] ? tomoyo_socket_bind_permission+0x330/0x330 [ 287.000361][ C1] ? unix_dgram_connect+0xb80/0xb80 [ 287.000386][ C1] ? unix_dgram_connect+0xb80/0xb80 [ 287.000407][ C1] sock_sendmsg+0xde/0x190 [ 287.000471][ C1] __sys_sendto+0x254/0x350 [ 287.000491][ C1] ? __ia32_sys_getpeername+0xb0/0xb0 [ 287.000513][ C1] ? lock_downgrade+0x690/0x690 [ 287.000543][ C1] ? rcu_is_watching+0x12/0xb0 [ 287.000580][ C1] ? xfd_validate_state+0x5d/0x180 [ 287.000616][ C1] ? restore_fpregs_from_fpstate+0xc1/0x1c0 [ 287.000660][ C1] ? kernel_fpu_begin_mask+0x270/0x270 [ 287.000690][ C1] ? folio_memcg_unlock+0x2d0/0x2d0 [ 287.000728][ C1] __x64_sys_sendto+0xe1/0x1b0 [ 287.000747][ C1] ? syscall_enter_from_user_mode+0x26/0x80 [ 287.000776][ C1] do_syscall_64+0x39/0xb0 [ 287.000811][ C1] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 287.000849][ C1] RIP: 0033:0x7fcf0c7b49b5 [ 287.000864][ C1] Code: 8b 44 24 08 48 83 c4 28 48 98 c3 48 98 c3 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 26 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 7a 48 8b 15 44 c4 0c 00 f7 d8 64 89 02 48 83 [ 287.000884][ C1] RSP: 002b:00007ffc50df15d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 287.000903][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcf0c7b49b5 [ 287.000917][ C1] RDX: 000000000000005c RSI: 0000558b52d3f880 RDI: 0000000000000003 [ 287.000931][ C1] RBP: 0000558b52d392c0 R08: 0000000000000000 R09: 0000000000000000 [ 287.000944][ C1] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000013 [ 287.000957][ C1] R13: 00007fcf0c942212 R14: 00007ffc50df16d8 R15: 0000000000000000 [ 287.000974][ C1] [ 287.000981][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.934 msecs [ 287.001045][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 287.462272][ T27] CPU: 0 PID: 27 Comm: khungtaskd Not tainted 6.4.0-syzkaller-12155-ga452483508d7 #0 [ 287.471751][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 287.481821][ T27] Call Trace: [ 287.485111][ T27] [ 287.488057][ T27] dump_stack_lvl+0xd9/0x150 [ 287.492695][ T27] panic+0x686/0x730 [ 287.496614][ T27] ? panic_smp_self_stop+0xa0/0xa0 [ 287.501755][ T27] ? __irq_work_queue_local+0x132/0x3f0 [ 287.507324][ T27] ? irq_work_queue+0x2d/0x80 [ 287.512022][ T27] ? watchdog+0xbe8/0x1090 [ 287.516468][ T27] watchdog+0xbf9/0x1090 [ 287.520758][ T27] ? proc_dohung_task_timeout_secs+0x80/0x80 [ 287.526769][ T27] kthread+0x344/0x440 [ 287.530855][ T27] ? kthread_complete_and_exit+0x40/0x40 [ 287.536516][ T27] ret_from_fork+0x1f/0x30 [ 287.540964][ T27] [ 287.544329][ T27] Kernel Offset: disabled [ 287.548667][ T27] Rebooting in 86400 seconds..