./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3427945796
<...>
syzkaller
syzkaller login: [ 62.278985][ T26] kauditd_printk_skb: 42 callbacks suppressed
[ 62.279000][ T26] audit: type=1400 audit(1687334377.766:77): avc: denied { transition } for pid=4847 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 62.308362][ T26] audit: type=1400 audit(1687334377.776:78): avc: denied { noatsecure } for pid=4847 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 62.328320][ T26] audit: type=1400 audit(1687334377.796:79): avc: denied { write } for pid=4847 comm="sh" path="pipe:[29463]" dev="pipefs" ino=29463 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 62.351340][ T26] audit: type=1400 audit(1687334377.796:80): avc: denied { rlimitinh } for pid=4847 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 62.371759][ T26] audit: type=1400 audit(1687334377.796:81): avc: denied { siginh } for pid=4847 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 63.562691][ T26] audit: type=1400 audit(1687334379.056:82): avc: denied { read } for pid=4428 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
Warning: Permanently added '10.128.1.117' (ECDSA) to the list of known hosts.
execve("./syz-executor3427945796", ["./syz-executor3427945796"], 0x7ffddb7f50e0 /* 10 vars */) = 0
brk(NULL) = 0x555556ee0000
brk(0x555556ee0c40) = 0x555556ee0c40
arch_prctl(ARCH_SET_FS, 0x555556ee0300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3427945796", 4096) = 28
brk(0x555556f01c40) = 0x555556f01c40
brk(0x555556f02000) = 0x555556f02000
mprotect(0x7fa5d8e3f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556ee05d0) = 5001
[ 81.794353][ T26] audit: type=1400 audit(1687334397.286:83): avc: denied { write } for pid=4997 comm="strace-static-x" path="pipe:[29935]" dev="pipefs" ino=29935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
./strace-static-x86_64: Process 5001 attached
[pid 5001] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[ 81.831659][ T26] audit: type=1400 audit(1687334397.316:84): avc: denied { execmem } for pid=5000 comm="syz-executor342" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 81.851615][ T26] audit: type=1400 audit(1687334397.326:85): avc: denied { read write } for pid=5000 comm="syz-executor342" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5001] setpgid(0, 0) = 0
[pid 5001] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5001] write(3, "1000", 4) = 4
[pid 5001] close(3) = 0
[pid 5001] memfd_create("syzkaller", 0) = 3
[pid 5001] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa5d0980000
[ 81.876929][ T26] audit: type=1400 audit(1687334397.326:86): avc: denied { open } for pid=5000 comm="syz-executor342" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 81.902079][ T26] audit: type=1400 audit(1687334397.326:87): avc: denied { ioctl } for pid=5000 comm="syz-executor342" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 81.932807][ T5001] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5001 'syz-executor342'
[pid 5001] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5001] munmap(0x7fa5d0980000, 16777216) = 0
[pid 5001] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5001] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5001] close(3) = 0
[pid 5001] mkdir("./file0", 0777) = 0
[ 82.152501][ T5001] loop0: detected capacity change from 0 to 32768
[ 82.164856][ T26] audit: type=1400 audit(1687334397.656:88): avc: denied { mounton } for pid=5001 comm="syz-executor342" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 82.173296][ T5001] BTRFS: device fsid a830dcec-d20e-42dc-8160-bf13f3286f97 devid 1 transid 8 /dev/loop0 scanned by syz-executor342 (5001)
[ 82.212303][ T5001] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[ 82.221779][ T5001] BTRFS info (device loop0): using free space tree
[ 82.250174][ T5001] BTRFS info (device loop0): enabling ssd optimizations
[pid 5001] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5001] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5001] chdir("./file0") = 0
[pid 5001] ioctl(4, LOOP_CLR_FD) = 0
[pid 5001] close(4) = 0
[ 82.257324][ T5001] BTRFS info (device loop0): auto enabling async discard
[ 82.272111][ T26] audit: type=1400 audit(1687334397.756:89): avc: denied { mount } for pid=5001 comm="syz-executor342" name="/" dev="loop0" ino=256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[pid 5001] openat(AT_FDCWD, "./file2", O_RDONLY) = 4
[ 82.294982][ T26] audit: type=1400 audit(1687334397.776:90): avc: denied { read } for pid=5001 comm="syz-executor342" name="file2" dev="loop0" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[ 82.318406][ T26] audit: type=1400 audit(1687334397.776:91): avc: denied { open } for pid=5001 comm="syz-executor342" path="/root/file0/file2" dev="loop0" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[ 82.342188][ T26] audit: type=1400 audit(1687334397.796:92): avc: denied { ioctl } for pid=5001 comm="syz-executor342" path="/root/file0/file2" dev="loop0" ino=261 ioctlcmd=0x9420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1
[ 82.391431][ T5001] BTRFS info (device loop0): balance: start -d -m
[ 82.405343][ T55] ------------[ cut here ]------------
[ 82.411101][ T55] BTRFS: Transaction aborted (error -28)
[ 82.422635][ T5001] BTRFS info (device loop0: state A): relocating block group 6881280 flags data|metadata
[ 82.434229][ T55] WARNING: CPU: 1 PID: 55 at fs/btrfs/block-group.c:3758 btrfs_chunk_alloc+0x108d/0x1120
[ 82.444267][ T55] Modules linked in:
[ 82.448233][ T55] CPU: 1 PID: 55 Comm: kworker/u4:4 Not tainted 6.4.0-rc7-syzkaller-00019-g99ec1ed7c2ed #0
[ 82.458402][ T55] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 82.468588][ T55] Workqueue: events_unbound btrfs_async_reclaim_metadata_space
[ 82.476311][ T55] RIP: 0010:btrfs_chunk_alloc+0x108d/0x1120
[ 82.482368][ T55] Code: 24 48 e8 16 4c 4c fe e9 00 f8 ff ff e8 0c 4c 4c fe e9 8f fa ff ff e8 42 77 fa fd 44 89 f6 48 c7 c7 80 34 97 8a e8 23 32 c2 fd <0f> 0b 41 bf 01 00 00 00 e9 f1 fa ff ff 48 8b 7c 24 48 e8 dc 4b 4c
[ 82.502265][ T55] RSP: 0018:ffffc9000201fa80 EFLAGS: 00010286
[ 82.508490][ T55] RAX: 0000000000000000 RBX: 00000000ffffffe4 RCX: 0000000000000000
[ 82.516691][ T55] RDX: ffff888018ac0040 RSI: ffffffff814b2427 RDI: 0000000000000001
[ 82.524796][ T55] RBP: ffff88802117d800 R08: 0000000000000001 R09: 0000000000000000
[ 82.532900][ T55] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802d4b2800
[ 82.540943][ T55] R13: ffff888021154888 R14: ffffffffffffffe4 R15: 000000002d4b2801
[ 82.549101][ T55] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 82.558155][ T55] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 82.564899][ T55] CR2: 00007fb00a332d00 CR3: 0000000028b1a000 CR4: 00000000003506e0
[ 82.573001][ T55] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 82.581052][ T55] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 82.589189][ T55] Call Trace:
[ 82.592801][ T55]
[ 82.595792][ T55] ? __warn+0xe6/0x390
[ 82.599944][ T55] ? btrfs_chunk_alloc+0x108d/0x1120
[ 82.605427][ T55] ? report_bug+0x2da/0x500
[ 82.610105][ T55] ? handle_bug+0x3c/0x70
[ 82.614588][ T55] ? exc_invalid_op+0x18/0x50
[ 82.619421][ T55] ? asm_exc_invalid_op+0x1a/0x20
[ 82.624719][ T55] ? __warn_printk+0x187/0x310
[ 82.629829][ T55] ? btrfs_chunk_alloc+0x108d/0x1120
[ 82.635302][ T55] ? btrfs_get_alloc_profile+0x2f4/0x7c0
[ 82.641006][ T55] flush_space+0x945/0xde0
[ 82.645531][ T55] ? do_raw_spin_lock+0x124/0x2b0
[ 82.650617][ T55] ? find_held_lock+0x2d/0x110
[ 82.655499][ T55] ? btrfs_space_info_update_bytes_may_use+0x590/0x590
[ 82.662480][ T55] ? lock_downgrade+0x690/0x690
[ 82.667398][ T55] ? _raw_spin_unlock+0x28/0x40
[ 82.672342][ T55] btrfs_async_reclaim_metadata_space+0x39e/0xa90
[ 82.678815][ T55] process_one_work+0x99a/0x15e0
[ 82.683891][ T55] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 82.689324][ T55] ? spin_bug+0x1c0/0x1c0
[ 82.693802][ T55] ? _raw_spin_lock_irq+0x45/0x50
[ 82.698890][ T55] worker_thread+0x67d/0x10c0
[ 82.703730][ T55] ? process_one_work+0x15e0/0x15e0
[ 82.709009][ T55] kthread+0x344/0x440
[ 82.713167][ T55] ? kthread_complete_and_exit+0x40/0x40
[ 82.718857][ T55] ret_from_fork+0x1f/0x30
[ 82.723454][ T55]
[ 82.726609][ T55] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 82.733926][ T55] CPU: 1 PID: 55 Comm: kworker/u4:4 Not tainted 6.4.0-rc7-syzkaller-00019-g99ec1ed7c2ed #0
[ 82.744031][ T55] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 82.754130][ T55] Workqueue: events_unbound btrfs_async_reclaim_metadata_space
[ 82.761741][ T55] Call Trace:
[ 82.765064][ T55]
[ 82.768020][ T55] dump_stack_lvl+0xd9/0x150
[ 82.772646][ T55] panic+0x686/0x730
[ 82.776598][ T55] ? panic_smp_self_stop+0xa0/0xa0
[ 82.781958][ T55] ? show_trace_log_lvl+0x284/0x390
[ 82.787233][ T55] ? btrfs_chunk_alloc+0x108d/0x1120
[ 82.792581][ T55] check_panic_on_warn+0xb1/0xc0
[ 82.797587][ T55] __warn+0xf2/0x390
[ 82.801549][ T55] ? btrfs_chunk_alloc+0x108d/0x1120
[ 82.806884][ T55] report_bug+0x2da/0x500
[ 82.811251][ T55] handle_bug+0x3c/0x70
[ 82.815449][ T55] exc_invalid_op+0x18/0x50
[ 82.819983][ T55] asm_exc_invalid_op+0x1a/0x20
[ 82.824882][ T55] RIP: 0010:btrfs_chunk_alloc+0x108d/0x1120
[ 82.830814][ T55] Code: 24 48 e8 16 4c 4c fe e9 00 f8 ff ff e8 0c 4c 4c fe e9 8f fa ff ff e8 42 77 fa fd 44 89 f6 48 c7 c7 80 34 97 8a e8 23 32 c2 fd <0f> 0b 41 bf 01 00 00 00 e9 f1 fa ff ff 48 8b 7c 24 48 e8 dc 4b 4c
[ 82.850451][ T55] RSP: 0018:ffffc9000201fa80 EFLAGS: 00010286
[ 82.856555][ T55] RAX: 0000000000000000 RBX: 00000000ffffffe4 RCX: 0000000000000000
[ 82.864552][ T55] RDX: ffff888018ac0040 RSI: ffffffff814b2427 RDI: 0000000000000001
[ 82.872546][ T55] RBP: ffff88802117d800 R08: 0000000000000001 R09: 0000000000000000
[ 82.880542][ T55] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802d4b2800
[ 82.888554][ T55] R13: ffff888021154888 R14: ffffffffffffffe4 R15: 000000002d4b2801
[ 82.896827][ T55] ? __warn_printk+0x187/0x310
[ 82.901643][ T55] ? btrfs_get_alloc_profile+0x2f4/0x7c0
[ 82.907321][ T55] flush_space+0x945/0xde0
[ 82.911874][ T55] ? do_raw_spin_lock+0x124/0x2b0
[ 82.916970][ T55] ? find_held_lock+0x2d/0x110
[ 82.921801][ T55] ? btrfs_space_info_update_bytes_may_use+0x590/0x590
[ 82.928691][ T55] ? lock_downgrade+0x690/0x690
[ 82.933844][ T55] ? _raw_spin_unlock+0x28/0x40
[ 82.938743][ T55] btrfs_async_reclaim_metadata_space+0x39e/0xa90
[ 82.945193][ T55] process_one_work+0x99a/0x15e0
[ 82.950369][ T55] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 82.955906][ T55] ? spin_bug+0x1c0/0x1c0
[ 82.960406][ T55] ? _raw_spin_lock_irq+0x45/0x50
[ 82.965501][ T55] worker_thread+0x67d/0x10c0
[ 82.970232][ T55] ? process_one_work+0x15e0/0x15e0
[ 82.975478][ T55] kthread+0x344/0x440
[ 82.979598][ T55] ? kthread_complete_and_exit+0x40/0x40
[ 82.985372][ T55] ret_from_fork+0x1f/0x30
[ 82.989840][ T55]
[ 82.992934][ T55] Kernel Offset: disabled
[ 82.997390][ T55] Rebooting in 86400 seconds..