./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2487463383 <...> Warning: Permanently added '10.128.0.40' (ED25519) to the list of known hosts. execve("./syz-executor2487463383", ["./syz-executor2487463383"], 0x7ffee6f5e3e0 /* 10 vars */) = 0 brk(NULL) = 0x5555716b5000 brk(0x5555716b5d00) = 0x5555716b5d00 arch_prctl(ARCH_SET_FS, 0x5555716b5380) = 0 set_tid_address(0x5555716b5650) = 296 set_robust_list(0x5555716b5660, 24) = 0 rseq(0x5555716b5ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2487463383", 4096) = 28 getrandom("\x5e\xd3\x4e\x34\x3f\x4b\xa5\x48", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555716b5d00 brk(0x5555716d6d00) = 0x5555716d6d00 brk(0x5555716d7000) = 0x5555716d7000 mprotect(0x7f9d22e27000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555716b5650) = 297 ./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x5555716b5660, 24) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] getppid() = 0 [pid 297] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 297] unshare(CLONE_NEWNS) = 0 [pid 297] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 297] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 297] unshare(CLONE_NEWCGROUP) = 0 [pid 297] unshare(CLONE_NEWUTS) = 0 [pid 297] unshare(CLONE_SYSVSEM) = 0 [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] getpid() = 1 [pid 297] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 0b e9 3e ff ff ff e8 ba 98 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 22.219249][ T297] RSP: 0018:ffffc900012cf988 EFLAGS: 00010293 [ 22.243770][ T36] audit: type=1400 audit(1750449463.560:69): avc: denied { mount } for pid=297 comm="syz-executor248" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 22.252772][ T297] [ 22.252781][ T297] RAX: ffffffff8241e48a RBX: 0000000000000000 RCX: ffff888125b61300 [ 22.252795][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.257039][ T36] audit: type=1400 audit(1750449463.560:70): avc: denied { mounton } for pid=297 comm="syz-executor248" path="/root/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 22.270777][ T297] RBP: ffffc900012cf9b0 R08: ffff888111bba15f R09: 1ffff1102237742b [ 22.270798][ T297] R10: dffffc0000000000 R11: ffffed102237742c R12: 0000000000000000 [ 22.281534][ T36] audit: type=1400 audit(1750449463.560:71): avc: denied { mounton } for pid=297 comm="syz-executor248" path="/root/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2831 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 22.286665][ T297] R13: dffffc0000000000 R14: ffff888111bba0c0 R15: ffff88811303dbb0 [ 22.306677][ T36] audit: type=1400 audit(1750449463.560:72): avc: denied { unmount } for pid=297 comm="syz-executor248" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.312526][ T297] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 22.334660][ T36] audit: type=1400 audit(1750449463.580:73): avc: denied { mounton } for pid=297 comm="syz-executor248" path="/dev/gadgetfs" dev="devtmpfs" ino=434 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 22.336840][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.486320][ T297] CR2: 00007f9d22e2e0f0 CR3: 000000010b3ec000 CR4: 00000000003526b0 [ 22.494498][ T297] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.502505][ T297] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.510596][ T297] Call Trace: [ 22.513866][ T297] [ 22.516798][ T297] ovl_do_remove+0x7b8/0xcf0 [ 22.521413][ T297] ? ovl_set_redirect+0x780/0x780 [ 22.526421][ T297] ? down_write+0xe9/0x2a0 [ 22.530896][ T297] ? __cfi_down_write+0x10/0x10 [ 22.535747][ T297] ovl_rmdir+0x1e/0x30 [ 22.539821][ T297] vfs_rmdir+0x3dd/0x560 [ 22.544077][ T297] incfs_kill_sb+0x109/0x230 [ 22.548646][ T297] deactivate_locked_super+0xd5/0x2a0 [ 22.554052][ T297] deactivate_super+0xb8/0xe0 [ 22.558727][ T297] cleanup_mnt+0x3f1/0x480 [ 22.563150][ T297] __cleanup_mnt+0x1d/0x40 [ 22.567565][ T297] task_work_run+0x1e0/0x250 [ 22.572235][ T297] ? __cfi_task_work_run+0x10/0x10 [ 22.577459][ T297] ? free_nsproxy+0x223/0x290 [ 22.582202][ T297] do_exit+0x9b4/0x2630 [ 22.586361][ T297] ? __cfi_do_exit+0x10/0x10 [ 22.590969][ T297] ? __kasan_check_write+0x18/0x20 [ 22.596160][ T297] ? _raw_spin_lock_irq+0x8d/0x120 [ 22.601303][ T297] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 22.606934][ T297] ? zap_other_threads+0x334/0x370 [ 22.612069][ T297] do_group_exit+0x22a/0x300 [ 22.616664][ T297] __x64_sys_exit_group+0x43/0x50 [ 22.621756][ T297] x64_sys_call+0x2ed2/0x2ee0 [ 22.626521][ T297] do_syscall_64+0x58/0xf0 [ 22.630943][ T297] ? clear_bhb_loop+0x35/0x90 [ 22.635889][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.641839][ T297] RIP: 0033:0x7f9d22db1c49 [ 22.646284][ T297] Code: Unable to access opcode bytes at 0x7f9d22db1c1f. [ 22.653311][ T297] RSP: 002b:00007ffd89461dc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 22.661771][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f9d22db1c49 [ 22.670081][ T297] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 22.678066][ T297] RBP: 00007f9d22e2d290 R08: ffffffffffffffb8 R09: 0000000000000006 [ 22.686060][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9d22e2d290 [ 22.694165][ T297] R13: 0000000000000000 R14: 00007f9d22e2dce0 R15: 00007f9d22d83290 [ 22.702211][ T297] [ 22.705234][ T297] ---[ end trace 0000000000000000 ]--- [ 22.711275][ T297] ------------[ cut here ]------------ [ 22.716837][ T297] WARNING: CPU: 0 PID: 297 at fs/overlayfs/util.c:600 ovl_dir_modified+0x15a/0x190 [ 22.726455][ T297] Modules linked in: [ 22.730362][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor248 Tainted: G W 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 22.745767][ T297] Tainted: [W]=WARN [ 22.749608][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 22.759697][ T297] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 22.765347][ T297] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 5e 83 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 c6 98 43 ff <0f> 0b e9 3e ff ff ff e8 ba 98 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 22.785021][ T297] RSP: 0018:ffffc900012cf988 EFLAGS: 00010293 [ 22.791160][ T297] RAX: ffffffff8241e48a RBX: 0000000000000000 RCX: ffff888125b61300 [ 22.799120][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.807099][ T297] RBP: ffffc900012cf9b0 R08: ffff888111bba15f R09: 1ffff1102237742b [ 22.815118][ T297] R10: dffffc0000000000 R11: ffffed102237742c R12: 0000000000000000 [ 22.823163][ T297] R13: dffffc0000000000 R14: ffff888111bba0c0 R15: ffff88811303dbb0 [ 22.831396][ T297] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 22.840484][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.847071][ T297] CR2: 00007f9d22e2e0f0 CR3: 000000010b3ec000 CR4: 00000000003526b0 [ 22.855057][ T297] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.863032][ T297] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.871004][ T297] Call Trace: [ 22.874289][ T297] [ 22.877206][ T297] ovl_do_remove+0x7b8/0xcf0 [ 22.881796][ T297] ? ovl_set_redirect+0x780/0x780 [ 22.886811][ T297] ? down_write+0xe9/0x2a0 [ 22.891270][ T297] ? __cfi_down_write+0x10/0x10 [ 22.896144][ T297] ovl_rmdir+0x1e/0x30 [ 22.900250][ T297] vfs_rmdir+0x3dd/0x560 [ 22.904530][ T297] incfs_kill_sb+0x1a0/0x230 [ 22.909110][ T297] deactivate_locked_super+0xd5/0x2a0 [ 22.914491][ T297] deactivate_super+0xb8/0xe0 [ 22.919194][ T297] cleanup_mnt+0x3f1/0x480 [ 22.923748][ T297] __cleanup_mnt+0x1d/0x40 [ 22.928178][ T297] task_work_run+0x1e0/0x250 [ 22.932819][ T297] ? __cfi_task_work_run+0x10/0x10 [ 22.937926][ T297] ? free_nsproxy+0x223/0x290 [ 22.942660][ T297] do_exit+0x9b4/0x2630 [ 22.946898][ T297] ? __cfi_do_exit+0x10/0x10 [ 22.951967][ T297] ? __kasan_check_write+0x18/0x20 [ 22.957205][ T297] ? _raw_spin_lock_irq+0x8d/0x120 [ 22.962390][ T297] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 22.967958][ T297] ? zap_other_threads+0x334/0x370 [ 22.973105][ T297] do_group_exit+0x22a/0x300 [ 22.977708][ T297] __x64_sys_exit_group+0x43/0x50 [ 22.982765][ T297] x64_sys_call+0x2ed2/0x2ee0 [ 22.987458][ T297] do_syscall_64+0x58/0xf0 [ 22.992064][ T297] ? clear_bhb_loop+0x35/0x90 [ 22.996770][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.002741][ T297] RIP: 0033:0x7f9d22db1c49 [ 23.007173][ T297] Code: Unable to access opcode bytes at 0x7f9d22db1c1f. [ 23.014553][ T297] RSP: 002b:00007ffd89461dc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 297] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=297, si_uid=0, si_status=1, si_utime=0, si_stime=77} --- exit_group(0) = ? +++ exited with 0 +++ [ 23.022989][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000