./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4131778084 <...> [ 4.398272][ T101] udevd[101]: starting eudev-3.2.11 [ 5.601295][ T132] ip (132) used greatest stack depth: 22816 bytes left [ 8.154776][ T106] udevd (106) used greatest stack depth: 22544 bytes left [ 14.576128][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 14.576141][ T30] audit: type=1400 audit(1729989173.117:61): avc: denied { transition } for pid=226 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.580227][ T30] audit: type=1400 audit(1729989173.117:62): avc: denied { noatsecure } for pid=226 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.583683][ T30] audit: type=1400 audit(1729989173.117:63): avc: denied { write } for pid=226 comm="sh" path="pipe:[14828]" dev="pipefs" ino=14828 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.587551][ T30] audit: type=1400 audit(1729989173.117:64): avc: denied { rlimitinh } for pid=226 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.590606][ T30] audit: type=1400 audit(1729989173.117:65): avc: denied { siginh } for pid=226 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.088520][ T227] sshd (227) used greatest stack depth: 22256 bytes left Warning: Permanently added '10.128.0.159' (ED25519) to the list of known hosts. execve("./syz-executor4131778084", ["./syz-executor4131778084"], 0x7ffe54037240 /* 10 vars */) = 0 brk(NULL) = 0x55555c181000 brk(0x55555c181e00) = 0x55555c181e00 arch_prctl(ARCH_SET_FS, 0x55555c181480) = 0 set_tid_address(0x55555c181750) = 295 set_robust_list(0x55555c181760, 24) = 0 rseq(0x55555c181da0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4131778084", 4096) = 28 getrandom("\x5f\x47\xc9\xca\x20\x26\xba\xf3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555c181e00 brk(0x55555c1a2e00) = 0x55555c1a2e00 brk(0x55555c1a3000) = 0x55555c1a3000 mprotect(0x7f25dc27a000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c181750) = 296 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "296", 3) = 3 close(3) = 0 kill(296, SIGKILL) = 0 ./strace-static-x86_64: Process 296 attached [pid 296] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=296, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- chmod("/dev/raw-gadget", 0666) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f25dc1c9600, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f25dc1d4930}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f25dc1c9600, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f25dc1d4930}, NULL, 8) = 0 mkdir("./syzkaller.l7ftoe", 0700) = 0 chmod("./syzkaller.l7ftoe", 0777) = 0 chdir("./syzkaller.l7ftoe") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c181750) = 297 ./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x55555c181760, 24) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] getppid() = 0 [pid 297] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 297] unshare(CLONE_NEWNS) = 0 [pid 297] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 297] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 297] unshare(CLONE_NEWCGROUP) = 0 [pid 297] unshare(CLONE_NEWUTS) = 0 [pid 297] unshare(CLONE_SYSVSEM) = 0 [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] getpid() = 1 [pid 297] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 24.783705][ T297] dump_stack_lvl+0x151/0x1c0 [ 24.788222][ T297] ? io_uring_drop_tctx_refs+0x190/0x190 [ 24.793692][ T297] ? panic+0x760/0x760 [ 24.797597][ T297] ? __ext4_handle_dirty_metadata+0x2fe/0x830 [ 24.803498][ T297] print_address_description+0x87/0x3b0 [ 24.808884][ T297] kasan_report+0x179/0x1c0 [ 24.813217][ T297] ? ext4_insert_dentry+0x392/0x710 [ 24.818251][ T297] ? ext4_insert_dentry+0x392/0x710 [ 24.823283][ T297] kasan_check_range+0x293/0x2a0 [ 24.828056][ T297] ? ext4_insert_dentry+0x392/0x710 [ 24.833090][ T297] memcpy+0x44/0x70 [ 24.836737][ T297] ext4_insert_dentry+0x392/0x710 [ 24.841598][ T297] add_dirent_to_buf+0x384/0x7d0 [ 24.846371][ T297] ? ext4_dx_add_entry+0x1620/0x1620 [ 24.851500][ T297] ? ext4_handle_dirty_dx_node+0x41c/0x580 [ 24.857220][ T297] make_indexed_dir+0xf34/0x15a0 [ 24.861996][ T297] ? add_dirent_to_buf+0x7d0/0x7d0 [ 24.866940][ T297] ? add_dirent_to_buf+0x54e/0x7d0 [ 24.871887][ T297] ? ext4_dx_add_entry+0x1620/0x1620 [ 24.877007][ T297] ? __kasan_check_read+0x11/0x20 [ 24.881870][ T297] ? __ext4_read_dirblock+0x56f/0x8e0 [ 24.887076][ T297] ext4_add_entry+0xde2/0x12b0 [ 24.891675][ T297] ? ext4_inc_count+0x190/0x190 [ 24.896455][ T297] ? dquot_initialize+0x20/0x20 [ 24.901134][ T297] ? selinux_determine_inode_label+0x29c/0x3b0 [ 24.907124][ T297] ext4_add_nondir+0x97/0x290 [ 24.911637][ T297] ? memcpy+0x56/0x70 [ 24.915456][ T297] ext4_symlink+0x913/0xed0 [ 24.919795][ T297] ? d_alloc+0x199/0x1d0 [ 24.923960][ T297] ? ext4_unlink+0x3f0/0x3f0 [ 24.928389][ T297] ? selinux_inode_symlink+0x22/0x30 [ 24.933511][ T297] ? security_inode_symlink+0xb8/0x100 [ 24.938892][ T297] vfs_symlink+0x29f/0x480 [ 24.943149][ T297] do_symlinkat+0x1ea/0x5a0 [ 24.947483][ T297] ? __check_object_size+0x2ec/0x3d0 [ 24.952605][ T297] ? vfs_symlink+0x480/0x480 [ 24.957030][ T297] ? getname_flags+0x1fd/0x520 [ 24.961630][ T297] __x64_sys_symlink+0x7e/0x90 [ 24.966232][ T297] x64_sys_call+0x290/0x9a0 [ 24.970659][ T297] do_syscall_64+0x3b/0xb0 [ 24.974909][ T297] ? clear_bhb_loop+0x35/0x90 [ 24.979424][ T297] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.985498][ T297] RIP: 0033:0x7f25dc209519 [ 24.989843][ T297] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 1c 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 25.009281][ T297] RSP: 002b:00007ffda46d5138 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 25.017528][ T297] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f25dc209519 [ 25.025336][ T297] RDX: 0000000000000000 RSI: 0000000020000cc0 RDI: 0000000020000dc0 [ 25.033148][ T297] RBP: 00007f25dc24d590 R08: 00007f25dc24d5b2 R09: 00007f25dc24d5b2 [ 25.041079][ T297] R10: 00007f25dc24d5b2 R11: 0000000000000246 R12: 00007f25dc24d515 [ 25.048886][ T297] R13: 00007ffda46d51a0 R14: 0000000000000003 R15: 00007ffda46d5178 [ 25.056694][ T297] [ 25.059553][ T297] [ 25.061724][ T297] The buggy address belongs to the page: [ 25.067207][ T297] page:ffffea0004717000 refcount:3 mapcount:0 mapping:ffff88810928b458 index:0x3f pfn:0x11c5c0 [ 25.077354][ T297] memcg:ffff888100214000 [ 25.081603][ T297] aops:def_blk_aops ino:700000 [ 25.086202][ T297] flags: 0x400000000000202a(referenced|dirty|active|private|zone=1) [ 25.094018][ T297] raw: 400000000000202a 0000000000000000 dead000000000122 ffff88810928b458 [ 25.102524][ T297] raw: 000000000000003f ffff88810981e5e8 00000003ffffffff ffff888100214000 [ 25.110936][ T297] page dumped because: kasan: bad access detected [ 25.117220][ T297] page_owner tracks the page as allocated [ 25.122831][ T297] page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 297, ts 24731691395, free_ts 18321272025 [ 25.139666][ T297] post_alloc_hook+0x1a3/0x1b0 [ 25.144266][ T297] prep_new_page+0x1b/0x110 [ 25.148605][ T297] get_page_from_freelist+0x3550/0x35d0 [ 25.153989][ T297] __alloc_pages+0x27e/0x8f0 [ 25.158415][ T297] pagecache_get_page+0xb18/0xeb0 [ 25.163276][ T297] __getblk_gfp+0x21e/0x7c0 [ 25.167612][ T297] ext4_getblk+0x259/0x700 [ 25.171952][ T297] ext4_bread+0x2f/0x180 [ 25.176033][ T297] ext4_append+0x31f/0x5b0 [ 25.180460][ T297] make_indexed_dir+0x515/0x15a0 [ 25.185232][ T297] ext4_add_entry+0xde2/0x12b0 [ 25.189831][ T297] ext4_add_nondir+0x97/0x290 [ 25.194353][ T297] ext4_symlink+0x913/0xed0 [ 25.198685][ T297] vfs_symlink+0x29f/0x480 [ 25.202936][ T297] do_symlinkat+0x1ea/0x5a0 [ 25.207277][ T297] __x64_sys_symlink+0x7e/0x90 [ 25.211879][ T297] page last free stack trace: [ 25.216391][ T297] free_unref_page_prepare+0x7c8/0x7d0 [ 25.221686][ T297] free_unref_page_list+0x14b/0xa60 [ 25.226721][ T297] release_pages+0x1310/0x1370 [ 25.231406][ T297] free_pages_and_swap_cache+0x8a/0xa0 [ 25.236787][ T297] tlb_finish_mmu+0x177/0x320 [ 25.241300][ T297] unmap_region+0x304/0x350 [ 25.245639][ T297] __do_munmap+0x1421/0x1a90 [ 25.250066][ T297] __vm_munmap+0x166/0x2a0 [ 25.254320][ T297] __x64_sys_munmap+0x6b/0x80 [ 25.259006][ T297] x64_sys_call+0x75/0x9a0 [ 25.263263][ T297] do_syscall_64+0x3b/0xb0 [ 25.267599][ T297] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.273328][ T297] [ 25.275498][ T297] Memory state around the buggy address: [ 25.280972][ T297] ffff88811c5c0f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [pid 297] symlink("./file0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [pid 297] close(3) = 0 [pid 297] close(4) = 0 [pid 297] close(5) = 0 [pid 297] close(6) = -1 EBADF (Bad file descriptor) [pid 297] close(7) = -1 EBADF (Bad file descriptor) [pid 297] close(8) = -1 EBADF (Bad file descriptor) [pid 297] close(9) = -1 EBADF (Bad file descriptor) [pid 297] close(10) = -1 EBADF (Bad file descriptor) [pid 297] close(11) = -1 EBADF (Bad file descriptor) [pid 297] close(12) = -1 EBADF (Bad file descriptor) [pid 297] close(13) = -1 EBADF (Bad file descriptor) [pid 297] close(14) = -1 EBADF (Bad file descriptor) [pid 297] close(15) = -1 EBADF (Bad file descriptor) [pid 297] close(16) = -1 EBADF (Bad file descriptor) [pid 297] close(17) = -1 EBADF (Bad file descriptor) [pid 297] close(18) = -1 EBADF (Bad file descriptor) [pid 297] close(19) = -1 EBADF (Bad file descriptor) [pid 297] close(20) = -1 EBADF (Bad file descriptor) [pid 297] close(21) = -1 EBADF (Bad file descriptor) [pid 297] close(22) = -1 EBADF (Bad file descriptor) [pid 297] close(23) = -1 EBADF (Bad file descriptor) [pid 297] close(24) = -1 EBADF (Bad file descriptor) [pid 297] close(25) = -1 EBADF (Bad file descriptor) [pid 297] close(26) = -1 EBADF (Bad file descriptor) [pid 297] close(27) = -1 EBADF (Bad file descriptor) [pid 297] close(28) = -1 EBADF (Bad file descriptor) [pid 297] close(29) = -1 EBADF (Bad file descriptor) [pid 297] exit_group(1) = ? [ 25.288868][ T297] ffff88811c5c0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.296765][ T297] >ffff88811c5c1000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.304663][ T297] ^ [ 25.308569][ T297] ffff88811c5c1080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.316469][ T297] ffff88811c5c1100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 25.324450][ T297] ================================================================== [ 25.332437][ T297] Disabling lock debugging due to kernel taint [pid 297] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=297, si_uid=0, si_status=1, si_utime=0, si_stime=32} --- exit_group(0) = ? +++ exited with 0 +++