./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2510427946 <...> Warning: Permanently added '10.128.1.79' (ED25519) to the list of known hosts. execve("./syz-executor2510427946", ["./syz-executor2510427946"], 0x7ffc0f54b560 /* 10 vars */) = 0 brk(NULL) = 0x55555599c000 brk(0x55555599cd00) = 0x55555599cd00 arch_prctl(ARCH_SET_FS, 0x55555599c380) = 0 set_tid_address(0x55555599c650) = 292 set_robust_list(0x55555599c660, 24) = 0 rseq(0x55555599cca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2510427946", 4096) = 28 getrandom("\xc7\x50\xa7\x23\x0f\xfb\x9b\x73", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555599cd00 brk(0x5555559bdd00) = 0x5555559bdd00 brk(0x5555559be000) = 0x5555559be000 mprotect(0x7f45ae6b8000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555599c650) = 293 ./strace-static-x86_64: Process 293 attached [pid 293] set_robust_list(0x55555599c660, 24) = 0 [pid 292] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] getrandom("\x05\x50\xd4\xf4\xfa\x2c\x55\x82", 8, GRND_NONBLOCK) = 8 [pid 293] mkdir("./syzkaller.nYRWTb", 0700./strace-static-x86_64: Process 294 attached [pid 292] <... clone resumed>, child_tidptr=0x55555599c650) = 294 [pid 292] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] set_robust_list(0x55555599c660, 24) = 0 ./strace-static-x86_64: Process 295 attached [pid 292] <... clone resumed>, child_tidptr=0x55555599c650) = 295 [pid 293] <... mkdir resumed>) = 0 [pid 293] chmod("./syzkaller.nYRWTb", 0777) = 0 [pid 292] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] chdir("./syzkaller.nYRWTb" [pid 294] mkdir("./syzkaller.Yo9NLD", 0700 [pid 293] <... chdir resumed>) = 0 [pid 293] mkdir("./0", 0777 [pid 292] <... clone resumed>, child_tidptr=0x55555599c650) = 296 [pid 293] <... mkdir resumed>) = 0 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... mkdir resumed>) = 0 [pid 292] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 293] <... clone resumed>, child_tidptr=0x55555599c650) = 297 [pid 292] <... clone resumed>, child_tidptr=0x55555599c650) = 298 [pid 294] chmod("./syzkaller.Yo9NLD", 0777./strace-static-x86_64: Process 298 attached [pid 298] set_robust_list(0x55555599c660, 24) = 0 [pid 295] set_robust_list(0x55555599c660, 24 [pid 294] <... chmod resumed>) = 0 ./strace-static-x86_64: Process 296 attached [pid 298] mkdir("./syzkaller.iwWFMU", 0700 [pid 296] set_robust_list(0x55555599c660, 24 [pid 295] <... set_robust_list resumed>) = 0 [pid 294] chdir("./syzkaller.Yo9NLD") = 0 [pid 294] mkdir("./0", 0777 [pid 298] <... mkdir resumed>) = 0 [pid 298] chmod("./syzkaller.iwWFMU", 0777) = 0 [pid 298] chdir("./syzkaller.iwWFMU") = 0 [pid 294] <... mkdir resumed>) = 0 [pid 298] mkdir("./0", 0777 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... mkdir resumed>) = 0 [pid 294] <... clone resumed>, child_tidptr=0x55555599c650) = 299 [pid 296] <... set_robust_list resumed>) = 0 [pid 295] mkdir("./syzkaller.kDPJIr", 0700 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... mkdir resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x55555599c650) = 300 ./strace-static-x86_64: Process 297 attached [pid 295] chmod("./syzkaller.kDPJIr", 0777 [pid 296] mkdir("./syzkaller.lauG7a", 0700 [pid 295] <... chmod resumed>) = 0 [pid 297] set_robust_list(0x55555599c660, 24 [pid 295] chdir("./syzkaller.kDPJIr" [pid 297] <... set_robust_list resumed>) = 0 [pid 297] chdir("./0" [pid 295] <... chdir resumed>) = 0 [pid 295] mkdir("./0", 0777 [pid 297] <... chdir resumed>) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] setpgid(0, 0) = 0 [pid 297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 299 attached [pid 296] <... mkdir resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555599c650) = 301 [pid 296] chmod("./syzkaller.lauG7a", 0777) = 0 ./strace-static-x86_64: Process 301 attached [pid 299] set_robust_list(0x55555599c660, 24 [pid 297] <... openat resumed>) = 3 [pid 297] write(3, "1000", 4) = 4 [pid 297] close(3 [pid 301] set_robust_list(0x55555599c660, 24 [pid 299] <... set_robust_list resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] chdir("./syzkaller.lauG7a"./strace-static-x86_64: Process 300 attached [pid 301] <... set_robust_list resumed>) = 0 [pid 299] chdir("./0" [pid 297] symlink("/dev/binderfs", "./binderfs" [pid 296] <... chdir resumed>) = 0 [pid 296] mkdir("./0", 0777 [pid 299] <... chdir resumed>) = 0 [pid 297] <... symlink resumed>) = 0 [pid 297] write(1, "executing program\n", 18 [pid 296] <... mkdir resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 301] chdir("./0"executing program [pid 299] <... prctl resumed>) = 0 [pid 301] <... chdir resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x55555599c650) = 302 [pid 301] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 299] setpgid(0, 0./strace-static-x86_64: Process 302 attached [pid 301] <... prctl resumed>) = 0 [pid 299] <... setpgid resumed>) = 0 [pid 300] set_robust_list(0x55555599c660, 24 [pid 302] set_robust_list(0x55555599c660, 24 [pid 301] setpgid(0, 0 [pid 300] <... set_robust_list resumed>) = 0 [pid 299] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... write resumed>) = 18 [pid 302] <... set_robust_list resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 299] write(3, "1000", 4 [pid 301] <... setpgid resumed>) = 0 [pid 299] <... write resumed>) = 4 [pid 299] close(3) = 0 [pid 299] symlink("/dev/binderfs", "./binderfs" [pid 301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LRU_PERCPU_HASH, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 302] chdir("./0" [pid 301] <... openat resumed>) = 3 [pid 300] chdir("./0" [pid 299] <... symlink resumed>) = 0 executing program [pid 301] write(3, "1000", 4 [pid 299] write(1, "executing program\n", 18) = 18 [pid 302] <... chdir resumed>) = 0 [pid 302] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 302] setpgid(0, 0) = 0 [pid 302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LRU_PERCPU_HASH, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 301] <... write resumed>) = 4 [pid 302] <... openat resumed>) = 3 [ 20.193902][ T30] audit: type=1400 audit(1717827340.850:66): avc: denied { execmem } for pid=292 comm="syz-executor251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 302] write(3, "1000", 4) = 4 [pid 301] close(3 [pid 300] <... chdir resumed>) = 0 [pid 299] <... bpf resumed>) = 3 [pid 297] <... bpf resumed>) = 3 [pid 299] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x200002c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144executing program [pid 301] <... close resumed>) = 0 [pid 301] symlink("/dev/binderfs", "./binderfs") = 0 [pid 301] write(1, "executing program\n", 18) = 18 [pid 301] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LRU_PERCPU_HASH, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [pid 301] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x200002c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 297] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x200002c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 302] close(3) = 0 [pid 300] write(3, "1000", 4) = 4 [pid 302] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 300] close(3) = 0 [pid 300] symlink("/dev/binderfs", "./binderfs") = 0 [pid 302] write(1, "executing program\n", 18) = 18 executing program [pid 300] write(1, "executing program\n", 18) = 18 [pid 302] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LRU_PERCPU_HASH, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 300] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_LRU_PERCPU_HASH, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72 [pid 302] <... bpf resumed>) = 3 [pid 302] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x200002c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 300] <... bpf resumed>) = 3 [ 20.225751][ T30] audit: type=1400 audit(1717827340.880:67): avc: denied { map_create } for pid=299 comm="syz-executor251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 20.245706][ T30] audit: type=1400 audit(1717827340.880:68): avc: denied { bpf } for pid=299 comm="syz-executor251" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 20.266633][ T30] audit: type=1400 audit(1717827340.880:69): avc: denied { map_read map_write } for pid=299 comm="syz-executor251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 20.286700][ T30] audit: type=1400 audit(1717827340.880:70): avc: denied { map_create } for pid=297 comm="syz-executor251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 20.306078][ T30] audit: type=1400 audit(1717827340.880:71): avc: denied { map_read map_write } for pid=297 comm="syz-executor251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 20.326133][ T30] audit: type=1400 audit(1717827340.880:72): avc: denied { prog_load } for pid=299 comm="syz-executor251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 20.345517][ T30] audit: type=1400 audit(1717827340.890:73): avc: denied { perfmon } for pid=299 comm="syz-executor251" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 300] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x200002c0, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 144 [pid 302] <... bpf resumed>) = 4 [pid 300] <... bpf resumed>) = 4 [pid 299] <... bpf resumed>) = 4 [pid 297] <... bpf resumed>) = 4 [pid 299] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="ext4_ext_remove_space_done", prog_fd=4}}, 16 [pid 301] <... bpf resumed>) = 4 [pid 302] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="ext4_ext_remove_space_done", prog_fd=4}}, 16 [pid 300] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="ext4_ext_remove_space_done", prog_fd=4}}, 16 [pid 297] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="ext4_ext_remove_space_done", prog_fd=4}}, 16 [pid 302] <... bpf resumed>) = 5 [pid 301] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="ext4_ext_remove_space_done", prog_fd=4}}, 16 [pid 300] <... bpf resumed>) = 5 [pid 299] <... bpf resumed>) = 5 [pid 297] <... bpf resumed>) = 5 [pid 302] exit_group(0 [pid 300] exit_group(0 [pid 297] exit_group(0 [pid 299] exit_group(0 [pid 302] <... exit_group resumed>) = ? [pid 300] <... exit_group resumed>) = ? [pid 297] <... exit_group resumed>) = ? [pid 302] +++ exited with 0 +++ [pid 301] <... bpf resumed>) = 5 [pid 300] +++ exited with 0 +++ [pid 299] <... exit_group resumed>) = ? [pid 297] +++ exited with 0 +++ [pid 301] exit_group(0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=300, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=302, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 293] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=297, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 301] <... exit_group resumed>) = ? [pid 298] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 296] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 293] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 293] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 293] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... getdents64 resumed>0x55555599d6f0 /* 3 entries */, 32768) = 80 [pid 296] <... getdents64 resumed>0x55555599d6f0 /* 3 entries */, 32768) = 80 [pid 293] <... openat resumed>) = 3 [pid 298] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 296] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./0/binderfs", [pid 296] newfstatat(AT_FDCWD, "./0/binderfs", [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./0/binderfs" [pid 296] unlink("./0/binderfs" [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 293] newfstatat(3, "", [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 298] <... getdents64 resumed>0x55555599d6f0 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x55555599d6f0 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 296] close(3 [pid 298] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 298] rmdir("./0" [pid 296] rmdir("./0" [pid 293] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 20.432085][ T30] audit: type=1400 audit(1717827341.090:74): avc: denied { confidentiality } for pid=299 comm="syz-executor251" lockdown_reason="use of bpf to read kernel RAM" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [ 20.456454][ T30] audit: type=1400 audit(1717827341.090:75): avc: denied { confidentiality } for pid=301 comm="syz-executor251" lockdown_reason="use of bpf to read kernel RAM" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [pid 293] getdents64(3, 0x55555599d6f0 /* 3 entries */, 32768) = 80 [pid 293] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 293] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 293] unlink("./0/binderfs") = 0 [pid 293] getdents64(3, 0x55555599d6f0 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [ 20.487139][ T296] BUG: unable to handle page fault for address: ffffffffff600000 [ 20.494701][ T296] #PF: supervisor read access in kernel mode [ 20.500585][ T296] #PF: error_code(0x0001) - permissions violation [ 20.506834][ T296] PGD 6812067 P4D 6812067 PUD 6814067 PMD 6816067 PTE 8000000006809165 [ 20.514901][ T296] Oops: 0001 [#1] PREEMPT SMP KASAN [ 20.519937][ T296] CPU: 0 PID: 296 Comm: syz-executor251 Not tainted 5.15.149-syzkaller-00131-g79bd336c7a94 #0 [ 20.530001][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 20.539905][ T296] RIP: 0010:copy_from_kernel_nofault+0x86/0x2e0 [ 20.545971][ T296] Code: 48 89 55 d0 0f 85 ea 01 00 00 ff 02 bf 07 00 00 00 4c 89 ee e8 cb 92 d6 ff 49 83 fd 07 76 5c 4d 89 fe 49 83 c5 f8 49 83 c7 08 <49> 8b 1c 24 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 [ 20.565424][ T296] RSP: 0018:ffffc900009c74d0 EFLAGS: 00010292 [ 20.571315][ T296] RAX: 0000000000000000 RBX: 00007ffffffff000 RCX: ffff888120a7bb40 [ 20.579138][ T296] RDX: ffff888120a7c6d0 RSI: 0000000000000008 RDI: 0000000000000007 [ 20.586937][ T296] RBP: ffffc900009c7508 R08: ffffffff8199a795 R09: ffffed102414f769 [ 20.594749][ T296] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffff600000 [ 20.602560][ T296] R13: 0000000000000000 R14: ffffc900009c7568 R15: ffffc900009c7570 [ 20.610463][ T296] FS: 000055555599c380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 20.619232][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 20.625666][ T296] CR2: ffffffffff600000 CR3: 0000000120883000 CR4: 00000000003506b0 [ 20.633636][ T296] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 20.641423][ T296] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 20.649333][ T296] Call Trace: [ 20.652459][ T296] [ 20.655239][ T296] ? __die_body+0x62/0xb0 [ 20.659403][ T296] ? __die+0x7e/0x90 [ 20.663136][ T296] ? page_fault_oops+0x7f9/0xa90 [ 20.667912][ T296] ? __ext4_handle_dirty_metadata+0x2ce/0x830 [ 20.673809][ T296] ? kernelmode_fixup_or_oops+0x270/0x270 [ 20.679365][ T296] ? ext4_inode_csum+0x84e/0xc10 [ 20.684162][ T296] ? ext4_has_metadata_csum+0x1f0/0x1f0 [ 20.689522][ T296] ? exc_page_fault+0x521/0x830 [ 20.694207][ T296] ? asm_exc_page_fault+0x27/0x30 [ 20.699066][ T296] ? copy_from_kernel_nofault+0x75/0x2e0 [ 20.704544][ T296] ? copy_from_kernel_nofault+0x86/0x2e0 [ 20.710006][ T296] bpf_probe_read_compat+0x112/0x180 [ 20.715125][ T296] bpf_prog_baa065642a502c00+0x64/0x2d0 [ 20.720507][ T296] bpf_trace_run6+0x18d/0x2c0 [ 20.725018][ T296] ? bpf_trace_run5+0x290/0x290 [ 20.729702][ T296] ? sb_end_intwrite+0x120/0x120 [ 20.734476][ T296] __bpf_trace_ext4_ext_remove_space_done+0x4a/0x60 [ 20.740902][ T296] ? __bpf_trace_ext4_ext_remove_space+0x40/0x40 [ 20.747060][ T296] __traceiter_ext4_ext_remove_space_done+0x94/0xf0 [ 20.753494][ T296] ext4_ext_remove_space+0x48b4/0x4a60 [ 20.758878][ T296] ? ext4_ext_index_trans_blocks+0x120/0x120 [ 20.764682][ T296] ? ext4_es_remove_extent+0x297/0x460 [ 20.769977][ T296] ? ext4_es_lookup_extent+0x940/0x940 [ 20.775270][ T296] ext4_ext_truncate+0x19a/0x240 [ 20.780044][ T296] ext4_truncate+0x96c/0xfa0 [ 20.784469][ T296] ? __ext4_mark_inode_dirty+0x7a0/0x7a0 [ 20.789937][ T296] ? __kasan_check_read+0x11/0x20 [ 20.794795][ T296] ? ext4_inode_is_fast_symlink+0x322/0x3d0 [ 20.800524][ T296] ? ext4_evict_inode+0xb8d/0x14e0 [ 20.805469][ T296] ext4_evict_inode+0xcee/0x14e0 [ 20.810245][ T296] ? _raw_spin_unlock+0x4d/0x70 [ 20.814933][ T296] ? ext4_inode_is_fast_symlink+0x3d0/0x3d0 [ 20.820663][ T296] ? _raw_spin_unlock+0x4d/0x70 [ 20.825345][ T296] ? inode_io_list_del+0x18b/0x1a0 [ 20.830294][ T296] ? ext4_inode_is_fast_symlink+0x3d0/0x3d0 [ 20.836021][ T296] evict+0x2a3/0x630 [ 20.839759][ T296] iput+0x63b/0x7e0 [ 20.843399][ T296] vfs_rmdir+0x359/0x470 [ 20.847479][ T296] do_rmdir+0x3ab/0x630 [ 20.851482][ T296] ? d_delete_notify+0x160/0x160 [ 20.856244][ T296] ? getname_flags+0x1fd/0x520 [ 20.860848][ T296] __x64_sys_rmdir+0x49/0x50 [ 20.865270][ T296] do_syscall_64+0x3d/0xb0 [ 20.869523][ T296] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 20.875250][ T296] RIP: 0033:0x7f45ae644eb7 [ 20.879506][ T296] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 20.899082][ T296] RSP: 002b:00007ffcacae9e18 EFLAGS: 00000207 ORIG_RAX: 0000000000000054 [ 20.907328][ T296] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45ae644eb7 [ 20.915133][ T296] RDX: fffffffffffff000 RSI: 0000000000000000 RDI: 00007ffcacaeaf40 [ 20.922971][ T296] RBP: 0000000000000065 R08: 000055555599d73b R09: 0000000000000000 [ 20.930753][ T296] R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffcacaeaf40 [ 20.938674][ T296] R13: 000055555599d6c0 R14: 00007ffcacaeaf40 R15: 0000000000000001 [ 20.946474][ T296] [ 20.949335][ T296] Modules linked in: [ 20.953069][ T296] CR2: ffffffffff600000 [ 20.957085][ T296] ---[ end trace dbe90e0ef63089f0 ]--- [ 20.957111][ T293] BUG: unable to handle page fault for address: ffffffffff600000 [ 20.962354][ T296] RIP: 0010:copy_from_kernel_nofault+0x86/0x2e0 [ 20.969983][ T293] #PF: supervisor read access in kernel mode [ 20.976058][ T296] Code: 48 89 55 d0 0f 85 ea 01 00 00 ff 02 bf 07 00 00 00 4c 89 ee e8 cb 92 d6 ff 49 83 fd 07 76 5c 4d 89 fe 49 83 c5 f8 49 83 c7 08 <49> 8b 1c 24 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 [ 20.981876][ T293] #PF: error_code(0x0001) - permissions violation [ 21.001313][ T296] RSP: 0018:ffffc900009c74d0 EFLAGS: 00010292 [ 21.007564][ T293] PGD 6812067 P4D 6812067 PUD 6814067 PMD 6816067 [ 21.013464][ T296] RAX: 0000000000000000 RBX: 00007ffffffff000 RCX: ffff888120a7bb40 [ 21.013478][ T296] RDX: ffff888120a7c6d0 RSI: 0000000000000008 RDI: 0000000000000007 [ 21.019800][ T293] PTE 8000000006809165 [ 21.019811][ T293] Oops: 0001 [#2] PREEMPT SMP KASAN [ 21.027624][ T296] RBP: ffffc900009c7508 R08: ffffffff8199a795 R09: ffffed102414f769 [ 21.035429][ T293] CPU: 1 PID: 293 Comm: syz-executor251 Tainted: G D 5.15.149-syzkaller-00131-g79bd336c7a94 #0 [ 21.039329][ T296] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffff600000 [ 21.044363][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 21.052180][ T296] R13: 0000000000000000 R14: ffffc900009c7568 R15: ffffc900009c7570 [ 21.063630][ T293] RIP: 0010:copy_from_kernel_nofault+0x86/0x2e0 [ 21.071442][ T296] FS: 000055555599c380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 21.081335][ T293] Code: 48 89 55 d0 0f 85 ea 01 00 00 ff 02 bf 07 00 00 00 4c 89 ee e8 cb 92 d6 ff 49 83 fd 07 76 5c 4d 89 fe 49 83 c5 f8 49 83 c7 08 <49> 8b 1c 24 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 [ 21.089145][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.095333][ T293] RSP: 0018:ffffc90000ad74d0 EFLAGS: 00010292 [ 21.104186][ T296] CR2: ffffffffff600000 CR3: 0000000120883000 CR4: 00000000003506b0 [ 21.123711][ T293] [ 21.123717][ T293] RAX: 0000000000000000 RBX: 00007ffffffff000 RCX: ffff888120a7a780 [ 21.130139][ T296] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.136038][ T293] RDX: ffff888120a7b310 RSI: 0000000000000008 RDI: 0000000000000007 [ 21.143849][ T296] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 21.146017][ T293] RBP: ffffc90000ad7508 R08: ffffffff8199a795 R09: ffffed102414f4f1 [ 21.153853][ T296] Kernel panic - not syncing: Fatal exception [ 21.162245][ T293] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffff600000 [ 21.199399][ T293] R13: 0000000000000000 R14: ffffc90000ad7568 R15: ffffc90000ad7570 [ 21.207209][ T293] FS: 000055555599c380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 21.215972][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.222395][ T293] CR2: ffffffffff600000 CR3: 00000001209a7000 CR4: 00000000003506a0 [ 21.230209][ T293] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.238019][ T293] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 21.245828][ T293] Call Trace: [ 21.248954][ T293] [ 21.251734][ T293] ? __die_body+0x62/0xb0 [ 21.255896][ T293] ? __die+0x7e/0x90 [ 21.259630][ T293] ? page_fault_oops+0x7f9/0xa90 [ 21.264403][ T293] ? __ext4_handle_dirty_metadata+0x2ce/0x830 [ 21.270304][ T293] ? kernelmode_fixup_or_oops+0x270/0x270 [ 21.275860][ T293] ? ext4_inode_csum+0x84e/0xc10 [ 21.280631][ T293] ? ext4_has_metadata_csum+0x1f0/0x1f0 [ 21.286014][ T293] ? exc_page_fault+0x521/0x830 [ 21.290704][ T293] ? asm_exc_page_fault+0x27/0x30 [ 21.295571][ T293] ? copy_from_kernel_nofault+0x75/0x2e0 [ 21.301038][ T293] ? copy_from_kernel_nofault+0x86/0x2e0 [ 21.306497][ T293] bpf_probe_read_compat+0x112/0x180 [ 21.311621][ T293] bpf_prog_baa065642a502c00+0x64/0x2d0 [ 21.317000][ T293] bpf_trace_run6+0x18d/0x2c0 [ 21.321514][ T293] ? bpf_trace_run5+0x290/0x290 [ 21.326199][ T293] ? sb_end_intwrite+0x120/0x120 [ 21.330975][ T293] __bpf_trace_ext4_ext_remove_space_done+0x4a/0x60 [ 21.337395][ T293] ? __bpf_trace_ext4_ext_remove_space+0x40/0x40 [ 21.343555][ T293] __traceiter_ext4_ext_remove_space_done+0x94/0xf0 [ 21.349978][ T293] ext4_ext_remove_space+0x48b4/0x4a60 [ 21.355282][ T293] ? ext4_ext_index_trans_blocks+0x120/0x120 [ 21.361093][ T293] ? ext4_es_remove_extent+0x297/0x460 [ 21.366385][ T293] ? ext4_es_lookup_extent+0x940/0x940 [ 21.371686][ T293] ext4_ext_truncate+0x19a/0x240 [ 21.376450][ T293] ext4_truncate+0x96c/0xfa0 [ 21.380879][ T293] ? __ext4_mark_inode_dirty+0x7a0/0x7a0 [ 21.386359][ T293] ? __kasan_check_read+0x11/0x20 [ 21.391206][ T293] ? ext4_inode_is_fast_symlink+0x322/0x3d0 [ 21.396933][ T293] ? ext4_evict_inode+0xb8d/0x14e0 [ 21.401880][ T293] ext4_evict_inode+0xcee/0x14e0 [ 21.406665][ T293] ? _raw_spin_unlock+0x4d/0x70 [ 21.411342][ T293] ? ext4_inode_is_fast_symlink+0x3d0/0x3d0 [ 21.417072][ T293] ? _raw_spin_unlock+0x4d/0x70 [ 21.421756][ T293] ? inode_io_list_del+0x18b/0x1a0 [ 21.426701][ T293] ? ext4_inode_is_fast_symlink+0x3d0/0x3d0 [ 21.432429][ T293] evict+0x2a3/0x630 [ 21.436162][ T293] iput+0x63b/0x7e0 [ 21.439813][ T293] vfs_rmdir+0x359/0x470 [ 21.443889][ T293] do_rmdir+0x3ab/0x630 [ 21.447880][ T293] ? d_delete_notify+0x160/0x160 [ 21.452652][ T293] ? getname_flags+0x1fd/0x520 [ 21.457339][ T293] __x64_sys_rmdir+0x49/0x50 [ 21.461765][ T293] do_syscall_64+0x3d/0xb0 [ 21.466112][ T293] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.471837][ T293] RIP: 0033:0x7f45ae644eb7 [ 21.476094][ T293] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 21.495618][ T293] RSP: 002b:00007ffcacae9e18 EFLAGS: 00000207 ORIG_RAX: 0000000000000054 [ 21.503858][ T293] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45ae644eb7 [ 21.511670][ T293] RDX: fffffffffffff000 RSI: 0000000000000000 RDI: 00007ffcacaeaf40 [ 21.519481][ T293] RBP: 0000000000000065 R08: 000055555599d73b R09: 0000000000000000 [ 21.527292][ T293] R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffcacaeaf40 [ 21.535104][ T293] R13: 000055555599d6c0 R14: 00007ffcacaeaf40 R15: 0000000000000001 [ 21.542920][ T293] [ 21.545779][ T293] Modules linked in: [ 21.549512][ T293] CR2: ffffffffff600000 [ 21.553505][ T293] ---[ end trace dbe90e0ef63089f1 ]--- [ 21.558805][ T293] RIP: 0010:copy_from_kernel_nofault+0x86/0x2e0 [ 21.564874][ T293] Code: 48 89 55 d0 0f 85 ea 01 00 00 ff 02 bf 07 00 00 00 4c 89 ee e8 cb 92 d6 ff 49 83 fd 07 76 5c 4d 89 fe 49 83 c5 f8 49 83 c7 08 <49> 8b 1c 24 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 [ 21.584313][ T293] RSP: 0018:ffffc900009c74d0 EFLAGS: 00010292 [ 21.590218][ T293] RAX: 0000000000000000 RBX: 00007ffffffff000 RCX: ffff888120a7bb40 [ 21.598027][ T293] RDX: ffff888120a7c6d0 RSI: 0000000000000008 RDI: 0000000000000007 [ 21.605874][ T293] RBP: ffffc900009c7508 R08: ffffffff8199a795 R09: ffffed102414f769 [ 21.613650][ T293] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffffffff600000 [ 21.621459][ T293] R13: 0000000000000000 R14: ffffc900009c7568 R15: ffffc900009c7570 [ 21.629273][ T293] FS: 000055555599c380(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 21.638038][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.644468][ T293] CR2: ffffffffff600000 CR3: 00000001209a7000 CR4: 00000000003506a0 [ 21.652463][ T293] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.660341][ T293] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.284632][ T296] Shutting down cpus with NMI [ 22.289313][ T296] Kernel Offset: disabled [ 22.293432][ T296] Rebooting in 86400 seconds..