./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3934504104 <...> DUID 00:04:d5:88:a2:45:01:7a:01:9f:d9:e7:e0:bd:57:90:bc:b4 forked to background, child pid 209 Starting sshd: OK syzkaller syzkaller login: [ 15.208286][ T23] kauditd_printk_skb: 60 callbacks suppressed [ 15.208297][ T23] audit: type=1400 audit(1671055335.679:71): avc: denied { transition } for pid=325 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.212901][ T23] audit: type=1400 audit(1671055335.679:72): avc: denied { write } for pid=325 comm="sh" path="pipe:[11328]" dev="pipefs" ino=11328 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 Warning: Permanently added '10.128.1.133' (ECDSA) to the list of known hosts. execve("./syz-executor3934504104", ["./syz-executor3934504104"], 0x7ffdd8728fa0 /* 10 vars */) = 0 brk(NULL) = 0x555555d96000 brk(0x555555d96c40) = 0x555555d96c40 arch_prctl(ARCH_SET_FS, 0x555555d96300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3934504104", 4096) = 28 brk(0x555555db7c40) = 0x555555db7c40 brk(0x555555db8000) = 0x555555db8000 mprotect(0x7f870dfca000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555d965d0) = 384 ./strace-static-x86_64: Process 384 attached [pid 384] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 384] setsid() = 1 [pid 384] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 384] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 384] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 384] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 384] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 384] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 384] unshare(CLONE_NEWNS) = 0 [pid 384] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 384] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 384] unshare(CLONE_NEWCGROUP) = 0 [pid 384] unshare(CLONE_NEWUTS) = 0 [pid 384] unshare(CLONE_SYSVSEM) = 0 [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 384] getpid() = 1 [pid 384] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 0b 66 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 [ 24.326186][ T384] RSP: 0018:ffffc900009bf520 EFLAGS: 00010293 [ 24.332241][ T384] RAX: ffffffff83c4f928 RBX: 000000000000fcd3 RCX: ffff8881067f62c0 [ 24.340199][ T384] RDX: 0000000000000000 RSI: 000000000000fcd3 RDI: 000000000000fccf [ 24.348280][ T384] RBP: ffffc900009bf5e8 R08: ffffffff83c4f5d8 R09: ffffffff83c4f215 [ 24.356234][ T384] R10: 0000000000000002 R11: ffff8881067f62c0 R12: ffff88810c3d96b4 [ 24.364188][ T384] R13: 000000000000b9c6 R14: 0000000000000012 R15: 000000000000fccf [ 24.372145][ T384] FS: 0000555555d96300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 24.381053][ T384] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.387633][ T384] CR2: 000000002000f000 CR3: 00000001047bc000 CR4: 00000000003506a0 [ 24.395613][ T384] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.403578][ T384] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.411532][ T384] Call Trace: [ 24.414812][ T384] ? skb_network_protocol+0x650/0x650 [ 24.420184][ T384] ? __kasan_check_write+0x14/0x20 [ 24.425274][ T384] ? __up_read+0x29/0x1c0 [ 24.429583][ T384] __skb_gso_segment+0x31b/0x4b0 [ 24.434505][ T384] validate_xmit_skb+0x2eb/0xc80 [ 24.439431][ T384] ? validate_xmit_skb_list+0x140/0x140 [ 24.444996][ T384] ? __alloc_skb+0x3b7/0x580 [ 24.449565][ T384] ? netdev_core_pick_tx+0xc9/0x320 [ 24.454739][ T384] __dev_queue_xmit+0x1231/0x2a20 [ 24.459742][ T384] ? exc_page_fault+0x7e/0x1b0 [ 24.464484][ T384] ? dev_queue_xmit+0x20/0x20 [ 24.469139][ T384] ? virtio_net_hdr_to_skb+0x9f8/0x1100 [ 24.474663][ T384] ? fanout_demux_rollover+0xbe0/0xbe0 [ 24.480098][ T384] dev_queue_xmit+0x17/0x20 [ 24.484582][ T384] packet_sendmsg+0x4d32/0x6860 [ 24.489415][ T384] ? avc_has_perm+0x218/0x260 [ 24.494070][ T384] ? avc_has_perm_noaudit+0x4c0/0x4c0 [ 24.499419][ T384] ? selinux_socket_sendmsg+0x23f/0x340 [ 24.504942][ T384] ? selinux_socket_accept+0x5b0/0x5b0 [ 24.510406][ T384] ? finish_task_switch+0x1b9/0x580 [ 24.515582][ T384] ? packet_getsockopt+0xea0/0xea0 [ 24.520689][ T384] ? __switch_to_asm+0x34/0x60 [ 24.525451][ T384] ? __kasan_check_write+0x14/0x20 [ 24.530559][ T384] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 24.535707][ T384] ? security_socket_sendmsg+0xb0/0xd0 [ 24.541162][ T384] ? packet_getsockopt+0xea0/0xea0 [ 24.546263][ T384] __sys_sendto+0x541/0x700 [ 24.550751][ T384] ? cgroup_leave_frozen+0x15c/0x2b0 [ 24.556033][ T384] ? __ia32_sys_getpeername+0x90/0x90 [ 24.561479][ T384] ? _raw_spin_unlock_irq+0x4e/0x70 [ 24.566658][ T384] ? ptrace_notify+0x248/0x340 [ 24.571406][ T384] ? switch_fpu_return+0x10/0x10 [ 24.576325][ T384] ? sock_poll+0x310/0x310 [ 24.580723][ T384] __x64_sys_sendto+0xe5/0x100 [ 24.585662][ T384] do_syscall_64+0x34/0x70 [ 24.590077][ T384] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 24.595957][ T384] RIP: 0033:0x7f870df56569 [ 24.600358][ T384] Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 24.619953][ T384] RSP: 002b:00007fff8935f0a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 24.628355][ T384] RAX: ffffffffffffffda RBX: 00007fff8935f0c8 RCX: 00007f870df56569 [ 24.636308][ T384] RDX: 000000000000fceb RSI: 0000000020000080 RDI: 0000000000000003 [ 24.644272][ T384] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 24.652242][ T384] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8935f0d0 [ 24.660291][ T384] R13: 00007fff8935f0f0 R14: 0000000000000000 R15: 0000000000000000 [ 24.668254][ T384] Modules linked in: [ 24.672187][ T384] ---[ end trace 02963efa2cd58fa2 ]--- [ 24.677667][ T384] RIP: 0010:skb_mac_gso_segment+0x498/0x4a0 [ 24.683568][ T384] Code: 4c 24 10 80 e1 07 80 c1 03 38 c1 0f 8c c6 fe ff ff 48 8b 7c 24 10 e8 87 29 e2 fd e9 b7 fe ff ff e8 3d 42 ce 00 e8 68 28 a8 fd <0f> 0b 66 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 [ 24.703183][ T384] RSP: 0018:ffffc900009bf520 EFLAGS: 00010293 [ 24.709268][ T384] RAX: ffffffff83c4f928 RBX: 000000000000fcd3 RCX: ffff8881067f62c0 [ 24.717362][ T384] RDX: 0000000000000000 RSI: 000000000000fcd3 RDI: 000000000000fccf [ 24.725349][ T384] RBP: ffffc900009bf5e8 R08: ffffffff83c4f5d8 R09: ffffffff83c4f215 [ 24.733323][ T384] R10: 0000000000000002 R11: ffff8881067f62c0 R12: ffff88810c3d96b4 [ 24.741282][ T384] R13: 000000000000b9c6 R14: 0000000000000012 R15: 000000000000fccf [ 24.749257][ T384] FS: 0000555555d96300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 24.758179][ T384] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.764760][ T384] CR2: 000000002000f000 CR3: 00000001047bc000 CR4: 00000000003506a0 [ 24.772764][ T384] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.780713][ T384] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.788695][ T384] Kernel panic - not syncing: Fatal exception in interrupt [ 24.796093][ T384] Kernel Offset: disabled [ 24.800404][ T384] Rebooting in 86400 seconds..