./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1496590576 <...> Warning: Permanently added '10.128.1.42' (ED25519) to the list of known hosts. execve("./syz-executor1496590576", ["./syz-executor1496590576"], 0x7ffd55a16690 /* 10 vars */) = 0 brk(NULL) = 0x5555574c4000 brk(0x5555574c4d00) = 0x5555574c4d00 arch_prctl(ARCH_SET_FS, 0x5555574c4380) = 0 set_tid_address(0x5555574c4650) = 295 set_robust_list(0x5555574c4660, 24) = 0 rseq(0x5555574c4ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1496590576", 4096) = 28 getrandom("\x2a\x61\x7c\x4d\x1a\x1c\x82\xdb", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555574c4d00 brk(0x5555574e5d00) = 0x5555574e5d00 brk(0x5555574e6000) = 0x5555574e6000 mprotect(0x7faf2fd6c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_BLOOM_FILTER, key_size=0, value_size=2147483649, max_entries=255, map_flags=0, inner_map_fd=1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 3 [ 22.279927][ T28] audit: type=1400 audit(1710796571.707:66): avc: denied { execmem } for pid=295 comm="syz-executor149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.283671][ T295] ================================================================================ [ 22.285657][ T28] audit: type=1400 audit(1710796571.717:67): avc: denied { bpf } for pid=295 comm="syz-executor149" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 22.288000][ T295] UBSAN: array-index-out-of-bounds in kernel/bpf/verifier.c:5393:12 [ 22.297856][ T295] index -1 is out of range for type 'u8[8]' (aka 'unsigned char[8]') [ 22.298237][ T28] audit: type=1400 audit(1710796571.717:68): avc: denied { map_create } for pid=295 comm="syz-executor149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 22.303212][ T295] CPU: 0 PID: 295 Comm: syz-executor149 Not tainted 6.1.68-syzkaller-00062-g4292d259032a #0 [ 22.332174][ T295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 22.342052][ T295] Call Trace: [ 22.345172][ T295] [ 22.348038][ T295] dump_stack_lvl+0x151/0x1b7 [ 22.352815][ T295] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 22.358126][ T295] dump_stack+0x15/0x1b [ 22.362104][ T295] __ubsan_handle_out_of_bounds+0x13a/0x160 [ 22.368089][ T295] check_stack_range_initialized+0x1349/0x1770 [ 22.374077][ T295] ? check_buffer_access+0x300/0x300 [ 22.379448][ T295] ? check_reg_sane_offset+0x240/0x240 [ 22.384691][ T295] ? sanitize_check_bounds+0xd4/0x370 [ 22.390404][ T295] check_helper_mem_access+0x4c3/0xf80 [ 22.396269][ T295] ? __check_ptr_off_reg+0x2fb/0x3d0 [ 22.401687][ T295] ? check_mem_reg+0x650/0x650 [ 22.406375][ T295] ? check_ptr_off_reg+0x30/0x30 [ 22.412266][ T295] ? mark_reg_read+0x1fe/0x390 [ 22.417227][ T295] ? check_reg_arg+0x5ef/0x840 [ 22.421825][ T295] ? check_func_arg_reg_off+0x1f8/0x270 [ 22.427292][ T295] check_helper_call+0x2fcf/0x6cd0 [ 22.432352][ T295] ? check_kfunc_call+0x1630/0x1630 [ 22.437556][ T295] ? memset+0x35/0x40 [ 22.441369][ T295] ? tnum_const+0xd/0x20 [ 22.445488][ T295] do_check+0x78b7/0xe040 [ 22.449781][ T295] ? kasan_set_track+0x4b/0x70 [ 22.454554][ T295] ? kasan_save_alloc_info+0x1f/0x30 [ 22.459996][ T295] ? __x64_sys_bpf+0x7c/0x90 [ 22.464668][ T295] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 22.471013][ T295] ? init_func_state+0x3c0/0x3c0 [ 22.477377][ T295] ? memset+0x35/0x40 [ 22.481879][ T295] ? btf_check_subprog_arg_match+0x182/0x300 [ 22.488280][ T295] do_check_common+0x6ce/0xed0 [ 22.493807][ T295] bpf_check+0x673b/0x16560 [ 22.498413][ T295] ? stack_depot_save+0x13/0x20 [ 22.503331][ T295] ? __kasan_check_write+0x14/0x20 [ 22.508801][ T295] ? __set_page_owner_handle+0x38a/0x3d0 [ 22.514523][ T295] ? page_ext_put+0x1c/0x30 [ 22.518856][ T295] ? __set_page_owner+0x53/0x70 [ 22.523548][ T295] ? post_alloc_hook+0x213/0x220 [ 22.528587][ T295] ? prep_new_page+0x1b/0x110 [ 22.533100][ T295] ? get_page_from_freelist+0x27ea/0x2870 [ 22.538696][ T295] ? unwind_get_return_address+0x4d/0x90 [ 22.544122][ T295] ? __kasan_check_write+0x14/0x20 [ 22.550121][ T295] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 22.555402][ T295] ? bpf_get_btf_vmlinux+0x60/0x60 [ 22.560363][ T295] ? is_bpf_text_address+0x172/0x190 [ 22.565865][ T295] ? is_module_text_address+0x290/0x360 [ 22.571826][ T295] ? stack_trace_save+0x1c0/0x1c0 [ 22.577459][ T295] ? kernel_text_address+0xa9/0xe0 [ 22.582490][ T295] ? __kernel_text_address+0xd/0x40 [ 22.587535][ T295] ? unwind_get_return_address+0x4d/0x90 [ 22.593131][ T295] ? __kasan_check_write+0x14/0x20 [ 22.598028][ T295] ? _raw_spin_lock_irqsave+0xf9/0x210 [ 22.603424][ T295] ? _raw_spin_lock+0x1b0/0x1b0 [ 22.608282][ T295] ? stack_trace_save+0x113/0x1c0 [ 22.613640][ T295] ? stack_trace_snprint+0xf0/0xf0 [ 22.619368][ T295] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 22.625615][ T295] ? __stack_depot_save+0x419/0x480 [ 22.631979][ T295] ? selinux_bpf_prog_alloc+0x51/0x140 [ 22.637867][ T295] ? kasan_set_track+0x60/0x70 [ 22.642803][ T295] ? kasan_set_track+0x4b/0x70 [ 22.648182][ T295] ? kasan_save_alloc_info+0x1f/0x30 [ 22.653491][ T295] ? __kasan_kmalloc+0x9c/0xb0 [ 22.658106][ T295] ? kmalloc_trace+0x44/0xa0 [ 22.662766][ T295] ? selinux_bpf_prog_alloc+0x51/0x140 [ 22.668667][ T295] ? security_bpf_prog_alloc+0x62/0x90 [ 22.674151][ T295] ? bpf_prog_load+0xa6a/0x1bf0 [ 22.681725][ T295] ? __sys_bpf+0x52c/0x7f0 [ 22.688213][ T295] ? __x64_sys_bpf+0x7c/0x90 [ 22.694248][ T295] ? do_syscall_64+0x3d/0xb0 [ 22.699057][ T295] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 22.706112][ T295] ? __kasan_check_write+0x14/0x20 [ 22.711778][ T295] ? _raw_spin_lock+0xa4/0x1b0 [ 22.716898][ T295] ? _raw_spin_trylock_bh+0x190/0x190 [ 22.723598][ T295] ? _raw_spin_unlock+0x4c/0x70 [ 22.728621][ T295] ? memset+0x35/0x40 [ 22.732620][ T295] ? bpf_obj_name_cpy+0x196/0x1e0 [ 22.737808][ T295] bpf_prog_load+0x1304/0x1bf0 [ 22.742578][ T295] ? map_freeze+0x3a0/0x3a0 [ 22.747004][ T295] ? selinux_bpf+0xcb/0x100 [ 22.751333][ T295] ? security_bpf+0x82/0xb0 [ 22.755672][ T295] __sys_bpf+0x52c/0x7f0 [ 22.760335][ T295] ? bpf_link_show_fdinfo+0x2d0/0x2d0 [ 22.765619][ T295] ? __kasan_check_write+0x14/0x20 [ 22.770769][ T295] ? fpregs_restore_userregs+0x130/0x290 [ 22.776319][ T295] __x64_sys_bpf+0x7c/0x90 [ 22.781004][ T295] do_syscall_64+0x3d/0xb0 [ 22.785333][ T295] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 22.791279][ T295] RIP: 0033:0x7faf2fcf9629 [ 22.796446][ T295] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 22.817485][ T295] RSP: 002b:00007ffe1bf61ca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 22.827695][ T295] RAX: ffffffffffffffda RBX: 00007ffe1bf61e78 RCX: 00007faf2fcf9629 [ 22.836919][ T295] RDX: 0000000000000090 RSI: 00000000200000c0 RDI: 0000000000000005 [ 22.844827][ T295] RBP: 00007faf2fd6c610 R08: 0000000000000000 R09: 00007ffe1bf61e78 [ 22.852633][ T295] R10: 00000000fffffff8 R11: 0000000000000246 R12: 0000000000000001 [ 22.861124][ T295] R13: 00007ffe1bf61e68 R14: 0000000000000001 R15: 0000000000000001 [ 22.869030][ T295] [ 22.872310][ T295] ================================================================================ bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_KPROBE, insn_cnt=12, insns=0x20000040, license="syzkaller", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_XDP, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 144) = -1 EACCES (Permission denied) exit_group(0) = ? +++ exited with 0 +++ [ 22.877762