./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor885915663 <...> forked to background, child pid 197 Starting sshd: OK syzkaller syzkaller login: [ 11.167005][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 11.167013][ T23] audit: type=1400 audit(1656886315.560:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.173463][ T23] audit: type=1400 audit(1656886315.570:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[255]" dev="pipefs" ino=255 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 11.329026][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! Warning: Permanently added '10.128.1.13' (ECDSA) to the list of known hosts. execve("./syz-executor885915663", ["./syz-executor885915663"], 0x7fffa5872e50 /* 10 vars */) = 0 brk(NULL) = 0x555555f5e000 brk(0x555555f5ec40) = 0x555555f5ec40 arch_prctl(ARCH_SET_FS, 0x555555f5e300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x555555f5e5d0) = 371 set_robust_list(0x555555f5e5e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7fa6c19aa380, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fa6c19aaa50}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7fa6c19aa420, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa6c19aaa50}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor885915663", 4096) = 27 brk(0x555555f7fc40) = 0x555555f7fc40 brk(0x555555f80000) = 0x555555f80000 mprotect(0x7fa6c1a6a000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555f5e5d0) = 372 ./strace-static-x86_64: Process 372 attached [pid 372] set_robust_list(0x555555f5e5e0, 24) = 0 [pid 372] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 372] setpgid(0, 0) = 0 [pid 372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 372] write(3, "1000", 4) = 4 [pid 372] close(3) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fa6c197a000 [pid 372] mprotect(0x7fa6c197b000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 372] clone(child_stack=0x7fa6c199a3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[373], tls=0x7fa6c199a700, child_tidptr=0x7fa6c199a9d0) = 373 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 373 attached [pid 373] set_robust_list(0x7fa6c199a9e0, 24) = 0 [pid 373] openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 3 [pid 373] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] ioctl(3, TUNSETIFF, 0x20000200) = 0 [pid 373] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 373] futex(0x7fa6c1a70428, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 0 [pid 373] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 373] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) = 5 [pid 373] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] ioctl(5, SIOCGIFINDEX, {ifr_name="rose0", ifr_ifindex=15}) = 0 [pid 373] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] ioctl(3, TUNSETQUEUE, 0x20000340) = 0 [pid 373] futex(0x7fa6c1a7042c, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... futex resumed>) = 0 [pid 372] futex(0x7fa6c1a70428, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] futex(0x7fa6c1a7042c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 1 [pid 373] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x34\x00\x00\x00\x11\x00\x01\xe9\x0d\x7d\x1f\xc7\x4e\x1b\xed\x42\xec\x45\xb2\xfc\x0f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=52}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0 [pid 372] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 372] futex(0x7fa6c1a7043c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fa6c1959000 [pid 372] mprotect(0x7fa6c195a000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 372] clone(child_stack=0x7fa6c19793f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 376 attached , parent_tid=[376], tls=0x7fa6c1979700, child_tidptr=0x7fa6c19799d0) = 376 [pid 376] set_robust_list(0x7fa6c19799e0, 24) = 0 [pid 376] futex(0x7fa6c1a70438, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] futex(0x7fa6c1a70438, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] <... futex resumed>) = 0 [pid 376] ioctl(3, TUNSETIFF, 0x20000200 [ 18.673921][ T23] audit: type=1400 audit(1656886323.070:73): avc: denied { execmem } for pid=371 comm="syz-executor885" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.684909][ T23] audit: type=1400 audit(1656886323.080:74): avc: denied { create } for pid=372 comm="syz-executor885" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 18.689095][ T23] audit: type=1400 audit(1656886323.080:75): avc: denied { ioctl } for pid=372 comm="syz-executor885" path="socket:[11621]" dev="sockfs" ino=11621 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 18.693184][ T373] netlink: 20 bytes leftover after parsing attributes in process `syz-executor885'. [ 18.697835][ T23] audit: type=1400 audit(1656886323.080:76): avc: denied { read } for pid=198 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 18.745496][ T376] ------------[ cut here ]------------ [ 18.751067][ T376] WARNING: CPU: 0 PID: 376 at net/core/dev.c:6742 netif_napi_add+0x8f2/0xa20 [ 18.759947][ T376] Modules linked in: [ 18.763851][ T376] CPU: 0 PID: 376 Comm: syz-executor885 Not tainted 5.10.118-syzkaller-00163-gfa7f6a5f56d9 #0 [ 18.774192][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 18.784349][ T376] RIP: 0010:netif_napi_add+0x8f2/0xa20 [pid 372] futex(0x7fa6c1a7043c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 ETIMEDOUT (Connection timed out) [ 18.790014][ T376] Code: c2 e0 28 79 85 48 c7 c1 30 23 c2 85 45 89 e8 31 c0 e8 56 9d cc 00 e9 12 fc ff ff e8 08 93 a8 fd e9 d5 fe ff ff e8 fe 92 a8 fd <0f> 0b eb a0 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 2e f8 ff ff e8 b5 [ 18.810105][ T376] RSP: 0018:ffffc90000b57af0 EFLAGS: 00010293 [ 18.816257][ T376] RAX: ffffffff83c41ff2 RBX: ffff8881055ab000 RCX: ffff8881065ee2c0 [ 18.824389][ T376] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 18.832563][ T376] RBP: ffffc90000b57b40 R08: ffffffff83c4174c R09: ffffed1020ab5686 [ 18.840716][ T376] R10: ffffed1020ab5686 R11: 1ffff11020ab5685 R12: ffff8881055ab428 [ 18.848789][ T376] R13: 0000000000000040 R14: ffff8881055ab418 R15: ffffffff82ef15a0 [ 18.856855][ T376] FS: 00007fa6c1979700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 18.866117][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 18.872965][ T376] CR2: 00007fa6c1a29c10 CR3: 000000011da3b000 CR4: 00000000003506a0 [ 18.881101][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 18.889161][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 18.897141][ T376] Call Trace: [ 18.900562][ T376] ? xdp_rxq_info_reg+0x194/0x2f0 [ 18.905580][ T376] tun_attach+0x877/0x14c0 [ 18.910017][ T376] tun_set_iff+0xadf/0x1100 [ 18.914615][ T376] __tun_chr_ioctl+0x8ab/0x2130 [ 18.919700][ T376] ? tun_flow_create+0x320/0x320 [ 18.924815][ T376] ? __fget_files+0x310/0x370 [ 18.929632][ T376] tun_chr_ioctl+0x2a/0x40 [ 18.934156][ T376] ? tun_chr_poll+0x650/0x650 [ 18.938978][ T376] __se_sys_ioctl+0x115/0x190 [ 18.943740][ T376] __x64_sys_ioctl+0x7b/0x90 [ 18.948477][ T376] do_syscall_64+0x34/0x70 [ 18.953006][ T376] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 18.959047][ T376] RIP: 0033:0x7fa6c19e8a69 [ 18.963541][ T376] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 18.983382][ T376] RSP: 002b:00007fa6c1979308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [pid 372] exit_group(0) = ? [ 18.991996][ T376] RAX: ffffffffffffffda RBX: 00007fa6c1a70438 RCX: 00007fa6c19e8a69 [ 19.000109][ T376] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003 [ 19.008204][ T376] RBP: 00007fa6c1a70430 R08: 0000000000000000 R09: 0000000000000000 [ 19.016248][ T376] R10: 00007fa6c1979700 R11: 0000000000000246 R12: 00007fa6c1a7043c [ 19.024301][ T376] R13: 00007fa6c1a3e064 R14: 74656e2f7665642f R15: 0000000000022000 [ 19.032347][ T376] ---[ end trace 13da049e63cace7e ]--- [ 19.037971][ T376] ------------[ cut here ]------------ [ 19.043505][ T376] kernel BUG at include/linux/netdevice.h:518! [ 19.049729][ T376] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 19.055776][ T376] CPU: 0 PID: 376 Comm: syz-executor885 Tainted: G W 5.10.118-syzkaller-00163-gfa7f6a5f56d9 #0 [ 19.067369][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 [ 19.077428][ T376] RIP: 0010:tun_attach+0x14b3/0x14c0 [ 19.082689][ T376] Code: 89 df e8 70 b5 b7 fe e9 cf fa ff ff e8 96 b9 7d fe 48 c7 c7 20 13 68 86 48 89 de e8 47 7a 7b ff e9 e0 fb ff ff e8 7d b9 7d fe <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 [ 19.102276][ T376] RSP: 0018:ffffc90000b57b50 EFLAGS: 00010293 [ 19.108314][ T376] RAX: ffffffff82eef973 RBX: 0000000000000000 RCX: ffff8881065ee2c0 [ 19.116258][ T376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 19.124203][ T376] RBP: ffffc90000b57c70 R08: ffffffff82eeed75 R09: ffffed1020ab5686 [ 19.132147][ T376] R10: ffffed1020ab5686 R11: 1ffff11020ab5685 R12: ffff8881055ab428 [ 19.140094][ T376] R13: ffff8881051d8980 R14: ffff8881051d8000 R15: dffffc0000000000 [ 19.148069][ T376] FS: 00007fa6c1979700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 19.156993][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 19.163551][ T376] CR2: 00007ffdbf456e28 CR3: 000000011da3b000 CR4: 00000000003506b0 [ 19.171502][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 19.179449][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 19.187391][ T376] Call Trace: [ 19.190662][ T376] tun_set_iff+0xadf/0x1100 [ 19.195156][ T376] __tun_chr_ioctl+0x8ab/0x2130 [ 19.199982][ T376] ? tun_flow_create+0x320/0x320 [ 19.204979][ T376] ? __fget_files+0x310/0x370 [ 19.209632][ T376] tun_chr_ioctl+0x2a/0x40 [ 19.214051][ T376] ? tun_chr_poll+0x650/0x650 [ 19.218703][ T376] __se_sys_ioctl+0x115/0x190 [ 19.223364][ T376] __x64_sys_ioctl+0x7b/0x90 [ 19.227926][ T376] do_syscall_64+0x34/0x70 [ 19.232318][ T376] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 19.238184][ T376] RIP: 0033:0x7fa6c19e8a69 [ 19.242578][ T376] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 19.262157][ T376] RSP: 002b:00007fa6c1979308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 19.270541][ T376] RAX: ffffffffffffffda RBX: 00007fa6c1a70438 RCX: 00007fa6c19e8a69 [ 19.278485][ T376] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003 [ 19.286428][ T376] RBP: 00007fa6c1a70430 R08: 0000000000000000 R09: 0000000000000000 [ 19.294375][ T376] R10: 00007fa6c1979700 R11: 0000000000000246 R12: 00007fa6c1a7043c [ 19.302329][ T376] R13: 00007fa6c1a3e064 R14: 74656e2f7665642f R15: 0000000000022000 [ 19.310272][ T376] Modules linked in: [ 19.314397][ T376] ---[ end trace 13da049e63cace7f ]--- [ 19.319938][ T376] RIP: 0010:tun_attach+0x14b3/0x14c0 [ 19.325208][ T376] Code: 89 df e8 70 b5 b7 fe e9 cf fa ff ff e8 96 b9 7d fe 48 c7 c7 20 13 68 86 48 89 de e8 47 7a 7b ff e9 e0 fb ff ff e8 7d b9 7d fe <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 [ 19.344982][ T376] RSP: 0018:ffffc90000b57b50 EFLAGS: 00010293 [ 19.351125][ T376] RAX: ffffffff82eef973 RBX: 0000000000000000 RCX: ffff8881065ee2c0 [ 19.359166][ T376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 19.367135][ T376] RBP: ffffc90000b57c70 R08: ffffffff82eeed75 R09: ffffed1020ab5686 [ 19.375227][ T376] R10: ffffed1020ab5686 R11: 1ffff11020ab5685 R12: ffff8881055ab428 [ 19.383264][ T376] R13: ffff8881051d8980 R14: ffff8881051d8000 R15: dffffc0000000000 [ 19.391400][ T376] FS: 00007fa6c1979700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 19.400399][ T376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 19.406978][ T376] CR2: 00007ffdbf456e28 CR3: 000000011da3b000 CR4: 00000000003506b0 [ 19.415070][ T376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 19.423111][ T376] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 19.431147][ T376] Kernel panic - not syncing: Fatal exception [ 19.437350][ T376] Kernel Offset: disabled [ 19.441651][ T376] Rebooting in 86400 seconds..