./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4131281206

<...>
Starting sshd: OK
[    6.002809][  T133] rcS (133) used greatest stack depth: 24024 bytes left

syzkaller
syzkaller login: [   18.030578][   T23] kauditd_printk_skb: 60 callbacks suppressed
[   18.030583][   T23] audit: type=1400 audit(1669148068.579:71): avc:  denied  { transition } for  pid=286 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   18.037469][   T23] audit: type=1400 audit(1669148068.589:72): avc:  denied  { write } for  pid=286 comm="sh" path="pipe:[10328]" dev="pipefs" ino=10328 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[   19.390202][  T287] sshd (287) used greatest stack depth: 22936 bytes left
Warning: Permanently added '10.128.0.171' (ECDSA) to the list of known hosts.
execve("./syz-executor4131281206", ["./syz-executor4131281206"], 0x7ffec793e380 /* 10 vars */) = 0
brk(NULL)                               = 0x555555636000
brk(0x555555636c40)                     = 0x555555636c40
arch_prctl(ARCH_SET_FS, 0x555555636300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor4131281206", 4096) = 28
brk(0x555555657c40)                     = 0x555555657c40
brk(0x555555658000)                     = 0x555555658000
mprotect(0x7f1e6ff94000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555556365d0) = 305
./strace-static-x86_64: Process 305 attached
[pid   305] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid   305] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   305] setsid()                    = 1
[pid   305] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   305] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   305] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   305] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   305] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   305] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   305] unshare(CLONE_NEWNS)        = 0
[pid   305] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   305] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   305] unshare(CLONE_NEWCGROUP)    = 0
[pid   305] unshare(CLONE_NEWUTS)       = 0
[pid   305] unshare(CLONE_SYSVSEM)      = 0
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   305] getpid()                    = 1
[pid   305] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, inheritable=0}) = 0
[pid   305] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ, inheritable=0}) = 0
[   31.990366][   T23] audit: type=1400 audit(1669148082.539:73): avc:  denied  { execmem } for  pid=304 comm="syz-executor413" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   32.012602][   T23] audit: type=1400 audit(1669148082.559:74): avc:  denied  { mounton } for  pid=305 comm="syz-executor413" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[pid   305] unshare(CLONE_NEWNET)       = 0
[pid   305] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   305] write(3, "0 65535", 7)      = 7
[pid   305] close(3)                    = 0
[pid   305] mkdir("/dev/binderfs", 0777) = 0
[pid   305] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   305] symlink("/dev/binderfs", "./binderfs") = 0
[pid   305] memfd_create("syzkaller", 0) = 3
[pid   305] ftruncate(3, 262144)        = 0
[pid   305] mmap(NULL, 262144, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = 0x7f1e6fe99000
[pid   305] munmap(0x7f1e6fe99000, 262144) = 0
[pid   305] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   305] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   305] mkdir("./file0", 0777)      = 0
[   32.036642][   T23] audit: type=1400 audit(1669148082.569:75): avc:  denied  { mount } for  pid=305 comm="syz-executor413" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[   32.059071][   T23] audit: type=1400 audit(1669148082.569:76): avc:  denied  { mounton } for  pid=305 comm="syz-executor413" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[   32.080736][   T23] audit: type=1400 audit(1669148082.609:77): avc:  denied  { mounton } for  pid=305 comm="syz-executor413" path="/dev/binderfs" dev="devtmpfs" ino=10238 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[   32.096609][  T305] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.103810][   T23] audit: type=1400 audit(1669148082.609:78): avc:  denied  { mount } for  pid=305 comm="syz-executor413" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[pid   305] mount("/dev/loop0", "./file0", "ext4", 0, ",errors=continue") = 0
[pid   305] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 5
[pid   305] chdir("./file0")            = 0
[pid   305] ioctl(4, LOOP_CLR_FD)       = 0
[pid   305] close(4)                    = 0
[pid   305] close(3)                    = 0
[pid   305] openat(AT_FDCWD, "/dev/loop0", O_RDWR|O_NOCTTY|O_NONBLOCK|O_SYNC|O_DIRECT|O_LARGEFILE) = 3
[pid   305] fallocate(3, FALLOC_FL_KEEP_SIZE|FALLOC_FL_ZERO_RANGE, 0, 4294999552) = 0
[pid   305] exit_group(1)               = ?
[   32.112823][  T305] ext4 filesystem being mounted at /root/file0 supports timestamps until 2038 (0x7fffffff)
[   32.135482][   T23] audit: type=1400 audit(1669148082.609:79): avc:  denied  { read write } for  pid=305 comm="syz-executor413" name="loop0" dev="devtmpfs" ino=1651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   32.165238][    C1] blk_update_request: I/O error, dev loop0, sector 0 op 0x9:(WRITE_ZEROES) flags 0x1000800 phys_seg 0 prio class 0
[   32.169275][   T23] audit: type=1400 audit(1669148082.609:80): avc:  denied  { open } for  pid=305 comm="syz-executor413" path="/dev/loop0" dev="devtmpfs" ino=1651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   32.205506][   T23] audit: type=1400 audit(1669148082.609:81): avc:  denied  { ioctl } for  pid=305 comm="syz-executor413" path="/dev/loop0" dev="devtmpfs" ino=1651 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   32.231213][   T23] audit: type=1400 audit(1669148082.619:82): avc:  denied  { mounton } for  pid=305 comm="syz-executor413" path="/root/file0" dev="sda1" ino=1139 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[   32.231560][  T308] ------------[ cut here ]------------
[   32.259278][  T308] kernel BUG at fs/buffer.c:3027!
[   32.264887][  T308] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   32.271180][  T308] CPU: 1 PID: 308 Comm: kmmpd-loop0 Not tainted 5.4.210-syzkaller-00006-gc80a5b2e7f63 #0
[   32.280945][  T308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[   32.290988][  T308] RIP: 0010:submit_bh_wbc+0x76e/0x790
[   32.296330][  T308] Code: 08 80 e1 07 80 c1 03 38 c1 0f 8c be fe ff ff 48 8b 7c 24 08 e8 23 7d ed ff e9 af fe ff ff e8 f9 18 bf ff 0f 0b e8 f2 18 bf ff <0f> 0b e8 eb 18 bf ff 0f 0b e8 e4 18 bf ff 0f 0b e8 dd 18 bf ff 0f
[   32.315908][  T308] RSP: 0018:ffff8881dcf47c48 EFLAGS: 00010293
[   32.321944][  T308] RAX: ffffffff81a6267e RBX: 0000000000000000 RCX: ffff8881e3274ec0
[   32.329885][  T308] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   32.338257][  T308] RBP: 1ffff1103ccdf6bd R08: ffffffff81a61fa9 R09: ffffed103ccdf6be
[   32.346201][  T308] R10: ffffed103ccdf6be R11: 1ffff1103ccdf6bd R12: 0000000000000001
[   32.354144][  T308] R13: ffff8881e66fb5e8 R14: dffffc0000000000 R15: 0000000000003800
[   32.362109][  T308] FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[   32.371009][  T308] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   32.377564][  T308] CR2: 000055c8e750f3b0 CR3: 00000001ed57a000 CR4: 00000000003406e0
[   32.385511][  T308] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   32.393451][  T308] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   32.401391][  T308] Call Trace:
[   32.404658][  T308]  ? _raw_spin_unlock_irqrestore+0x57/0x80
[   32.410438][  T308]  ? try_to_del_timer_sync+0x313/0x460
[   32.415875][  T308]  submit_bh+0x21/0x30
[   32.419959][  T308]  write_mmp_block+0x390/0x550
[   32.424694][  T308]  ? read_mmp_block+0x830/0x830
[   32.429513][  T308]  kmmpd+0x2a5/0xa10
[   32.433387][  T308]  ? write_mmp_block+0x550/0x550
[   32.438296][  T308]  ? __wake_up_locked+0xc2/0x120
[   32.443205][  T308]  ? __kthread_parkme+0xb1/0x1b0
[   32.448113][  T308]  kthread+0x2d8/0x360
[   32.452391][  T308]  ? write_mmp_block+0x550/0x550
[   32.457320][  T308]  ? kthread_destroy_worker+0x280/0x280
[   32.462841][  T308]  ret_from_fork+0x1f/0x30
[   32.467228][  T308] Modules linked in:
[   32.471273][  T308] ---[ end trace 3c3a47752d835253 ]---
[   32.476756][  T308] RIP: 0010:submit_bh_wbc+0x76e/0x790
[   32.482108][  T308] Code: 08 80 e1 07 80 c1 03 38 c1 0f 8c be fe ff ff 48 8b 7c 24 08 e8 23 7d ed ff e9 af fe ff ff e8 f9 18 bf ff 0f 0b e8 f2 18 bf ff <0f> 0b e8 eb 18 bf ff 0f 0b e8 e4 18 bf ff 0f 0b e8 dd 18 bf ff 0f
[   32.501794][  T308] RSP: 0018:ffff8881dcf47c48 EFLAGS: 00010293
[   32.507864][  T308] RAX: ffffffff81a6267e RBX: 0000000000000000 RCX: ffff8881e3274ec0
[   32.515831][  T308] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   32.523798][  T308] RBP: 1ffff1103ccdf6bd R08: ffffffff81a61fa9 R09: ffffed103ccdf6be
[   32.531739][  T308] R10: ffffed103ccdf6be R11: 1ffff1103ccdf6bd R12: 0000000000000001
[   32.539711][  T308] R13: ffff8881e66fb5e8 R14: dffffc0000000000 R15: 0000000000003800
[   32.547679][  T308] FS:  0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[   32.556598][  T308] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   32.563167][  T308] CR2: 000055c8e750f3b0 CR3: 00000001ed57a000 CR4: 00000000003406e0
[   32.571237][  T308] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   32.579207][  T308] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   32.587178][  T308] Kernel panic - not syncing: Fatal exception
[   32.593402][  T308] Kernel Offset: disabled
[   32.597797][  T308] Rebooting in 86400 seconds..