./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor180007843

<...>

syzkaller
syzkaller login: [    4.973076][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[   11.193000][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!!
[   11.248139][   T23] kauditd_printk_skb: 60 callbacks suppressed
[   11.248146][   T23] audit: type=1400 audit(1655828007.709:71): avc:  denied  { transition } for  pid=302 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   11.254376][   T23] audit: type=1400 audit(1655828007.719:72): avc:  denied  { write } for  pid=302 comm="sh" path="pipe:[245]" dev="pipefs" ino=245 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[   11.312943][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[   11.372949][    T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10!!!
Warning: Permanently added '10.128.0.181' (ECDSA) to the list of known hosts.
execve("./syz-executor180007843", ["./syz-executor180007843"], 0x7ffdb008d3b0 /* 10 vars */) = 0
brk(NULL)                               = 0x555556a8a000
brk(0x555556a8ac40)                     = 0x555556a8ac40
arch_prctl(ARCH_SET_FS, 0x555556a8a300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
set_tid_address(0x555556a8a5d0)         = 383
set_robust_list(0x555556a8a5e0, 24)     = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7fe41f1e9ab0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7fe41f1ea180}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7fe41f1e9b50, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe41f1ea180}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor180007843", 4096) = 27
brk(0x555556aabc40)                     = 0x555556aabc40
brk(0x555556aac000)                     = 0x555556aac000
mprotect(0x7fe41f2ab000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556a8a5d0) = 384
./strace-static-x86_64: Process 384 attached
[pid   384] set_robust_list(0x555556a8a5e0, 24) = 0
[pid   384] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid   384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   384] setsid()                    = 1
[pid   384] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   384] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   384] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   384] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   384] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0
[pid   384] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   384] unshare(CLONE_NEWNS)        = 0
[pid   384] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   384] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   384] unshare(CLONE_NEWCGROUP)    = 0
[pid   384] unshare(CLONE_NEWUTS)       = 0
[pid   384] unshare(CLONE_SYSVSEM)      = 0
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   384] getpid()                    = 1
[pid   384] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   384] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   384] unshare(CLONE_NEWNET)       = 0
[pid   384] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   384] write(3, "0 65535", 7)      = 7
[pid   384] close(3)                    = 0
[pid   384] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid   384] dup2(3, 200)                = 200
[pid   384] close(3)                    = 0
[pid   384] ioctl(200, TUNSETIFF, 0x7ffe614fe560) = 0
[pid   384] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   384] write(3, "0", 1)            = 1
[pid   384] close(3)                    = 0
[pid   384] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid   384] write(3, "0", 1)            = 1
[pid   384] close(3)                    = 0
[pid   384] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid   384] access("/proc/net", R_OK)   = 0
[pid   384] access("/proc/net/unix", R_OK) = 0
[pid   384] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   384] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   384] close(4)                    = 0
[pid   384] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid   384] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   384] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   384] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   384] close(4)                    = 0
[pid   384] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid   384] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   384] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   384] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   384] close(4)                    = 0
[pid   384] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid   384] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   384] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   384] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   384] close(4)                    = 0
[pid   384] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid   384] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   384] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   384] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   384] close(4)                    = 0
[pid   384] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
[pid   384] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   384] close(3)                    = 0
[pid   384] mkdir("/dev/binderfs", 0777) = 0
[pid   384] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   384] symlink("/dev/binderfs", "./binderfs") = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe41f1b9000
[pid   384] mprotect(0x7fe41f1ba000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   384] clone(child_stack=0x7fe41f1d93f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[2], tls=0x7fe41f1d9700, child_tidptr=0x7fe41f1d99d0) = 2
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 385 attached
 <unfinished ...>
[pid   385] set_robust_list(0x7fe41f1d99e0, 24) = 0
[pid   385] openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 3
[pid   385] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   384] <... futex resumed>)        = 0
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   385] <... futex resumed>)        = 1
[   18.958491][   T23] audit: type=1400 audit(1655828015.419:73): avc:  denied  { execmem } for  pid=383 comm="syz-executor180" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   18.963861][   T23] audit: type=1400 audit(1655828015.419:74): avc:  denied  { mounton } for  pid=384 comm="syz-executor180" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[   18.970461][   T23] audit: type=1400 audit(1655828015.419:75): avc:  denied  { mount } for  pid=384 comm="syz-executor180" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[   18.976683][   T23] audit: type=1400 audit(1655828015.429:76): avc:  denied  { mounton } for  pid=384 comm="syz-executor180" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[pid   385] ioctl(3, TUNSETIFF, 0x20000200) = 0
[pid   385] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   384] <... futex resumed>)        = 0
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   385] <... futex resumed>)        = 1
[pid   385] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4
[pid   385] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   384] <... futex resumed>)        = 0
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   385] <... futex resumed>)        = 1
[pid   385] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) = 5
[pid   385] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   384] <... futex resumed>)        = 0
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   385] <... futex resumed>)        = 1
[pid   385] ioctl(5, SIOCGIFINDEX, {ifr_name="rose0", ifr_ifindex=12}) = 0
[pid   385] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   384] <... futex resumed>)        = 0
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   385] <... futex resumed>)        = 1
[pid   385] ioctl(3, TUNSETQUEUE, 0x20000340) = 0
[pid   385] futex(0x7fe41f2b14ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   384] <... futex resumed>)        = 0
[pid   384] futex(0x7fe41f2b14e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   385] <... futex resumed>)        = 1
[   18.994097][   T23] audit: type=1400 audit(1655828015.449:77): avc:  denied  { create } for  pid=380 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   19.014837][   T23] audit: type=1400 audit(1655828015.449:78): avc:  denied  { write } for  pid=380 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   19.015739][  T385] netlink: 20 bytes leftover after parsing attributes in process `syz-executor180'.
[pid   385] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x34\x00\x00\x00\x11\x00\x01\xe9\x0d\x7d\x1f\xc7\x4e\x1b\xed\x42\xec\x45\xb2\xfc\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=52}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0 <unfinished ...>
[pid   384] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   384] futex(0x7fe41f2b14ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   384] futex(0x7fe41f2b14fc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe41f198000
[pid   384] mprotect(0x7fe41f199000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   384] clone(child_stack=0x7fe41f1b83f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[3], tls=0x7fe41f1b8700, child_tidptr=0x7fe41f1b89d0) = 3
[pid   384] futex(0x7fe41f2b14f8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   384] futex(0x7fe41f2b14fc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 386 attached
 <unfinished ...>
[pid   386] set_robust_list(0x7fe41f1b89e0, 24) = 0
[   19.035527][   T23] audit: type=1400 audit(1655828015.449:79): avc:  denied  { nlmsg_read } for  pid=380 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   19.065845][   T23] audit: type=1400 audit(1655828015.449:80): avc:  denied  { module_request } for  pid=380 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[pid   386] ioctl(3, TUNSETIFF, 0x20000200 <unfinished ...>
[pid   384] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[   19.089035][   T23] audit: type=1400 audit(1655828015.449:81): avc:  denied  { read } for  pid=380 comm="strace-static-x" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1
[   19.109555][   T23] audit: type=1400 audit(1655828015.459:82): avc:  denied  { mounton } for  pid=384 comm="syz-executor180" path="/dev/binderfs" dev="devtmpfs" ino=363 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[   19.133062][  T386] ------------[ cut here ]------------
[   19.138592][  T386] WARNING: CPU: 0 PID: 386 at net/core/dev.c:6742 netif_napi_add+0x8f2/0xa20
[   19.147600][  T386] Modules linked in:
[   19.151523][  T386] CPU: 0 PID: 386 Comm: syz-executor180 Not tainted 5.10.117-syzkaller-00814-gfdd06dc6b0f8 #0
[   19.161864][  T386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   19.171978][  T386] RIP: 0010:netif_napi_add+0x8f2/0xa20
[   19.177459][  T386] Code: c2 e0 25 79 85 48 c7 c1 90 f0 c1 85 45 89 e8 31 c0 e8 66 97 cc 00 e9 12 fc ff ff e8 b8 d7 a8 fd e9 d5 fe ff ff e8 ae d7 a8 fd <0f> 0b eb a0 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 2e f8 ff ff e8 75
[   19.197071][  T386] RSP: 0018:ffffc9000096faf0 EFLAGS: 00010293
[pid   384] exit_group(1)               = ?
[   19.203145][  T386] RAX: ffffffff83c3daa2 RBX: ffff888105ded000 RCX: ffff8881065ecf00
[   19.211106][  T386] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[   19.219104][  T386] RBP: ffffc9000096fb40 R08: ffffffff83c3d1fc R09: ffffed1020bbda86
[   19.227098][  T386] R10: ffffed1020bbda86 R11: 1ffff11020bbda85 R12: ffff888105ded428
[   19.235072][  T386] R13: 0000000000000040 R14: ffff888105ded418 R15: ffffffff82eee9a0
[   19.243049][  T386] FS:  00007fe41f1b8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   19.252082][  T386] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   19.258708][  T386] CR2: 0000563e33faf0f8 CR3: 000000011e169000 CR4: 00000000003506a0
[   19.266711][  T386] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   19.274685][  T386] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   19.282638][  T386] Call Trace:
[   19.285935][  T386]  ? xdp_rxq_info_reg+0x194/0x2f0
[   19.290951][  T386]  tun_attach+0x877/0x14c0
[   19.295372][  T386]  tun_set_iff+0xadf/0x1100
[   19.299860][  T386]  __tun_chr_ioctl+0x8ab/0x2130
[   19.304710][  T386]  ? tun_flow_create+0x320/0x320
[   19.309629][  T386]  ? __fget_files+0x310/0x370
[   19.314311][  T386]  tun_chr_ioctl+0x2a/0x40
[   19.318715][  T386]  ? tun_chr_poll+0x650/0x650
[   19.323483][  T386]  __se_sys_ioctl+0x115/0x190
[   19.328152][  T386]  __x64_sys_ioctl+0x7b/0x90
[   19.332715][  T386]  do_syscall_64+0x34/0x70
[   19.337141][  T386]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   19.343038][  T386] RIP: 0033:0x7fe41f2282d9
[   19.347436][  T386] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   19.367132][  T386] RSP: 002b:00007fe41f1b8308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   19.375560][  T386] RAX: ffffffffffffffda RBX: 00007fe41f2b14f8 RCX: 00007fe41f2282d9
[   19.383631][  T386] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003
[   19.391617][  T386] RBP: 00007fe41f2b14f0 R08: 00007fe41f1b8700 R09: 0000000000000000
[   19.399593][  T386] R10: 00007fe41f1b8700 R11: 0000000000000246 R12: 00007fe41f2b14fc
[   19.407579][  T386] R13: 00007fe41f27e004 R14: 74656e2f7665642f R15: 0000000000022000
[   19.415547][  T386] ---[ end trace 66ad7f172d5f9b9a ]---
[   19.421049][  T386] ------------[ cut here ]------------
[   19.426511][  T386] kernel BUG at include/linux/netdevice.h:518!
[   19.432646][  T386] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   19.438682][  T386] CPU: 1 PID: 386 Comm: syz-executor180 Tainted: G        W         5.10.117-syzkaller-00814-gfdd06dc6b0f8 #0
[   19.450290][  T386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   19.460323][  T386] RIP: 0010:tun_attach+0x14b3/0x14c0
[   19.465578][  T386] Code: 89 df e8 e0 ba b7 fe e9 cf fa ff ff e8 f6 e4 7d fe 48 c7 c7 a0 12 68 86 48 89 de e8 67 7c 7b ff e9 e0 fb ff ff e8 dd e4 7d fe <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41
[   19.485158][  T386] RSP: 0018:ffffc9000096fb50 EFLAGS: 00010293
[   19.491198][  T386] RAX: ffffffff82eecd73 RBX: 0000000000000000 RCX: ffff8881065ecf00
[   19.499142][  T386] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   19.507107][  T386] RBP: ffffc9000096fc70 R08: ffffffff82eec175 R09: ffffed1020bbda86
[   19.515063][  T386] R10: ffffed1020bbda86 R11: 1ffff11020bbda85 R12: ffff888105ded428
[   19.523011][  T386] R13: ffff888101fe0980 R14: ffff888101fe0000 R15: dffffc0000000000
[   19.530956][  T386] FS:  00007fe41f1b8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   19.539863][  T386] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   19.546427][  T386] CR2: 0000563e33faf0f8 CR3: 000000011e169000 CR4: 00000000003506a0
[   19.554382][  T386] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   19.562342][  T386] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   19.570287][  T386] Call Trace:
[   19.573580][  T386]  tun_set_iff+0xadf/0x1100
[   19.578054][  T386]  __tun_chr_ioctl+0x8ab/0x2130
[   19.582872][  T386]  ? tun_flow_create+0x320/0x320
[   19.587814][  T386]  ? __fget_files+0x310/0x370
[   19.592475][  T386]  tun_chr_ioctl+0x2a/0x40
[   19.596876][  T386]  ? tun_chr_poll+0x650/0x650
[   19.601539][  T386]  __se_sys_ioctl+0x115/0x190
[   19.606183][  T386]  __x64_sys_ioctl+0x7b/0x90
[   19.610742][  T386]  do_syscall_64+0x34/0x70
[   19.615128][  T386]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   19.620992][  T386] RIP: 0033:0x7fe41f2282d9
[   19.625402][  T386] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   19.645118][  T386] RSP: 002b:00007fe41f1b8308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   19.653522][  T386] RAX: ffffffffffffffda RBX: 00007fe41f2b14f8 RCX: 00007fe41f2282d9
[   19.661484][  T386] RDX: 0000000020000200 RSI: 00000000400454ca RDI: 0000000000000003
[   19.669435][  T386] RBP: 00007fe41f2b14f0 R08: 00007fe41f1b8700 R09: 0000000000000000
[   19.677395][  T386] R10: 00007fe41f1b8700 R11: 0000000000000246 R12: 00007fe41f2b14fc
[   19.685339][  T386] R13: 00007fe41f27e004 R14: 74656e2f7665642f R15: 0000000000022000
[   19.693280][  T386] Modules linked in:
[   19.697227][  T386] ---[ end trace 66ad7f172d5f9b9b ]---
[   19.702673][  T386] RIP: 0010:tun_attach+0x14b3/0x14c0
[   19.707983][  T386] Code: 89 df e8 e0 ba b7 fe e9 cf fa ff ff e8 f6 e4 7d fe 48 c7 c7 a0 12 68 86 48 89 de e8 67 7c 7b ff e9 e0 fb ff ff e8 dd e4 7d fe <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41
[   19.727583][  T386] RSP: 0018:ffffc9000096fb50 EFLAGS: 00010293
[   19.733680][  T386] RAX: ffffffff82eecd73 RBX: 0000000000000000 RCX: ffff8881065ecf00
[   19.741633][  T386] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   19.749611][  T386] RBP: ffffc9000096fc70 R08: ffffffff82eec175 R09: ffffed1020bbda86
[   19.757776][  T386] R10: ffffed1020bbda86 R11: 1ffff11020bbda85 R12: ffff888105ded428
[   19.765751][  T386] R13: ffff888101fe0980 R14: ffff888101fe0000 R15: dffffc0000000000
[   19.773735][  T386] FS:  00007fe41f1b8700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   19.782638][  T386] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   19.789216][  T386] CR2: 0000563e33faf0f8 CR3: 000000011e169000 CR4: 00000000003506a0
[   19.797184][  T386] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   19.805158][  T386] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   19.813125][  T386] Kernel panic - not syncing: Fatal exception
[   19.819341][  T386] Kernel Offset: disabled
[   19.823664][  T386] Rebooting in 86400 seconds..