./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor265172448 <...> Warning: Permanently added '10.128.1.246' (ED25519) to the list of known hosts. execve("./syz-executor265172448", ["./syz-executor265172448"], 0x7ffec99a91a0 /* 10 vars */) = 0 brk(NULL) = 0x555559db2000 brk(0x555559db2e00) = 0x555559db2e00 arch_prctl(ARCH_SET_FS, 0x555559db2480) = 0 set_tid_address(0x555559db2750) = 288 set_robust_list(0x555559db2760, 24) = 0 rseq(0x555559db2da0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor265172448", 4096) = 27 getrandom("\x8e\xbf\xd8\x1f\x12\xbf\xde\x97", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555559db2e00 brk(0x555559dd3e00) = 0x555559dd3e00 brk(0x555559dd4000) = 0x555559dd4000 mprotect(0x7f822ab94000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555559db2750) = 289 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "289", 3) = 3 close(3) = 0 kill(289, SIGKILL) = 0 ./strace-static-x86_64: Process 289 attached [pid 289] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=289, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 [ 25.435205][ T30] audit: type=1400 audit(1754785520.614:64): avc: denied { execmem } for pid=288 comm="syz-executor265" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.445257][ T288] cgroup: Unknown subsys name 'net' [ 25.454974][ T30] audit: type=1400 audit(1754785520.614:65): avc: denied { mounton } for pid=288 comm="syz-executor265" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) [ 25.482822][ T30] audit: type=1400 audit(1754785520.614:66): avc: denied { mount } for pid=288 comm="syz-executor265" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.483391][ T288] cgroup: Unknown subsys name 'devices' [ 25.505547][ T30] audit: type=1400 audit(1754785520.634:67): avc: denied { unmount } for pid=288 comm="syz-executor265" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) [ 25.650248][ T288] cgroup: Unknown subsys name 'hugetlb' [ 25.656413][ T288] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 chmod("/dev/raw-gadget", 0666) = 0 swapoff("./swap-file") = -1 ENOENT (No such file or directory) unlink("./swap-file") = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "./swap-file", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 3 fallocate(3, FALLOC_FL_ZERO_RANGE, 0, 128000000) = 0 close(3) = 0 rt_sigaction(SIGINT, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 rt_sigaction(SIGQUIT, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f822aacb000 rt_sigprocmask(SIG_BLOCK, ~[], [CHLD], 8) = 0 clone3({flags=CLONE_VM|CLONE_VFORK, exit_signal=SIGCHLD, stack=0x7f822aacb000, stack_size=0x9000}, 88./strace-static-x86_64: Process 290 attached [pid 290] rt_sigprocmask(SIG_BLOCK, NULL, ~[KILL STOP], 8) = 0 [pid 290] rt_sigaction(SIGHUP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGHUP, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGINT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGQUIT, NULL, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, 8) = 0 [pid 290] rt_sigaction(SIGILL, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGILL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGTRAP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGTRAP, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGABRT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGABRT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGBUS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGBUS, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGFPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGFPE, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGUSR1, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGUSR1, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGSEGV, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGSEGV, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGUSR2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGUSR2, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGPIPE, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGPIPE, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGALRM, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGTERM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGTERM, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGSTKFLT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGSTKFLT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGCHLD, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGCHLD, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGCONT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGCONT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGTSTP, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGTSTP, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGTTIN, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGTTIN, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGTTOU, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGTTOU, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGURG, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGURG, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGXCPU, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGXCPU, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGXFSZ, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGXFSZ, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGVTALRM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGVTALRM, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGPROF, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGPROF, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGWINCH, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGWINCH, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGIO, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGIO, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGPWR, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGPWR, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGSYS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGSYS, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_2, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_2, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_3, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_3, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_4, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_4, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_5, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_5, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_6, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_6, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_7, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_7, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_8, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_8, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_9, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_9, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_10, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_10, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_11, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_11, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_12, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_12, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_13, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_13, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_14, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_14, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_15, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_15, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_16, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_16, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_17, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_17, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_18, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_18, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_19, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_19, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_20, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_20, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_21, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_21, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_22, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_22, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_23, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_23, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_24, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_24, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_25, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_25, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_26, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_26, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_27, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_27, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_28, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_28, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_29, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_29, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_30, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_30, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_31, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_31, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGRT_32, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGRT_32, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 [pid 290] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 290] execve("/bin/sh", ["sh", "-c", "mkswap ./swap-file"], 0x7ffe2731ad78 /* 10 vars */ [pid 288] <... clone3 resumed>) = 290 [pid 288] munmap(0x7f822aacb000, 36864) = 0 [pid 288] rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0 [pid 290] <... execve resumed>) = 0 [pid 290] brk(NULL) = 0x564f231c2000 [pid 290] mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81f2b9f000 [ 25.750032][ T30] audit: type=1400 audit(1754785520.924:68): avc: denied { mounton } for pid=288 comm="syz-executor265" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.774999][ T30] audit: type=1400 audit(1754785520.924:69): avc: denied { mount } for pid=288 comm="syz-executor265" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [pid 290] access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v3/libbusybox.so.1.37.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v3/", 0x7fffbdac46d0, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v2/libbusybox.so.1.37.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v2/", 0x7fffbdac46d0, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/lib64/libbusybox.so.1.37.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x38\x13\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x09\x00\x40\x00\x19\x00\x18\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\xf4\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0644, st_size=792952, ...}) = 0 [pid 290] mmap(NULL, 792856, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f2add000 [pid 290] mmap(0x7f81f2aed000, 548864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10000) = 0x7f81f2aed000 [pid 290] mmap(0x7f81f2b73000, 163840, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x96000) = 0x7f81f2b73000 [pid 290] mmap(0x7f81f2b9b000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xbe000) = 0x7f81f2b9b000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\xf0\xab\x02\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x38\x22\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0e\x00\x40\x00\x3b\x00\x3a\x00\x06\x00\x00\x00\x04\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00"..., 832) = 832 [pid 290] pread64(3, "\x06\x00\x00\x00\x04\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00"..., 784, 64) = 784 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=1913080, ...}) = 0 [pid 290] pread64(3, "\x06\x00\x00\x00\x04\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00"..., 784, 64) = 784 [pid 290] mmap(NULL, 1965720, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f28fd000 [pid 290] mmap(0x7f81f2925000, 1368064, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7f81f2925000 [pid 290] mmap(0x7f81f2a73000, 356352, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x176000) = 0x7f81f2a73000 [pid 290] mmap(0x7f81f2aca000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1cc000) = 0x7f81f2aca000 [pid 290] mmap(0x7f81f2ad0000, 52888, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81f2ad0000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libpam.so.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xf8\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1b\x00\x1a\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x29\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=63416, ...}) = 0 [pid 290] mmap(NULL, 65552, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f28ec000 [pid 290] mmap(0x7f81f28ef000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f81f28ef000 [pid 290] mmap(0x7f81f28f7000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f81f28f7000 [pid 290] mmap(0x7f81f28fb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe000) = 0x7f81f28fb000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libpam_misc.so.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x51\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1a\x00\x19\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x12\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=22400, ...}) = 0 [pid 290] mmap(NULL, 24656, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f28e5000 [pid 290] mmap(0x7f81f28e7000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f81f28e7000 [pid 290] mmap(0x7f81f28e9000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f81f28e9000 [pid 290] mmap(0x7f81f28ea000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f81f28ea000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xa8\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0b\x00\x40\x00\x1d\x00\x1c\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x27\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=59624, ...}) = 0 [pid 290] mmap(NULL, 67720, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f28d4000 [pid 290] mmap(0x7f81f28d7000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f81f28d7000 [pid 290] mmap(0x7f81f28df000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f81f28df000 [pid 290] mmap(0x7f81f28e1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd000) = 0x7f81f28e1000 [pid 290] mmap(0x7f81f28e3000, 6280, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81f28e3000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v3/libselinux.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v3/", 0x7fffbdac4630, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v2/libselinux.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v2/", 0x7fffbdac4630, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x60\xd1\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0b\x00\x40\x00\x1d\x00\x1c\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x28\x74\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=186528, ...}) = 0 [pid 290] mmap(NULL, 194256, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f28a4000 [pid 290] mmap(0x7f81f28ac000, 114688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7f81f28ac000 [pid 290] mmap(0x7f81f28c8000, 32768, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7f81f28c8000 [pid 290] mmap(0x7f81f28d0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2c000) = 0x7f81f28d0000 [pid 290] mmap(0x7f81f28d2000, 5840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81f28d2000 [pid 290] close(3) = 0 [pid 290] mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81f28a2000 [pid 290] openat(AT_FDCWD, "/lib64/libatomic.so.1", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x30\x71\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1b\x00\x1a\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x78\x1f\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=30704, ...}) = 0 [pid 290] mmap(NULL, 37000, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f2898000 [pid 290] mmap(0x7f81f289a000, 12288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f81f289a000 [pid 290] mmap(0x7f81f289d000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f81f289d000 [pid 290] mmap(0x7f81f289f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f81f289f000 [pid 290] mmap(0x7f81f28a1000, 136, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f81f28a1000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1a\x00\x19\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\x20\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=395120, ...}) = 0 [pid 290] mmap(NULL, 397336, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f81f2836000 [pid 290] mmap(0x7f81f2839000, 225280, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f81f2839000 [pid 290] mmap(0x7f81f2870000, 155648, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3a000) = 0x7f81f2870000 [pid 290] mmap(0x7f81f2896000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5f000) = 0x7f81f2896000 [pid 290] close(3) = 0 [pid 290] mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81f2834000 [pid 290] arch_prctl(ARCH_SET_FS, 0x7f81f2834c80) = 0 [pid 290] set_tid_address(0x7f81f2834f50) = 290 [pid 290] set_robust_list(0x7f81f2834f60, 24) = 0 [pid 290] rseq(0x7f81f2834ae0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) [pid 290] mprotect(0x7f81f2aca000, 16384, PROT_READ) = 0 [pid 290] mprotect(0x7f81f2896000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f289f000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f28d0000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f28e1000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f28fb000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f28ea000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f2b9b000, 12288, PROT_READ) = 0 [pid 290] mprotect(0x564ee65e3000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7f81f2bd4000, 8192, PROT_READ) = 0 [pid 290] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 [pid 290] statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0 [pid 290] statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0 [pid 290] getrandom("\xc8\x10\xbf\xa4\xa6\xcd\x48\xe1", 8, GRND_NONBLOCK) = 8 [pid 290] brk(NULL) = 0x564f231c2000 [pid 290] brk(0x564f231e3000) = 0x564f231e3000 [pid 290] access("/etc/selinux/config", F_OK) = 0 [pid 290] getpid() = 290 [pid 290] rt_sigaction(SIGCHLD, {sa_handler=0x7f81f2b20287, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f81f293c180}, NULL, 8) = 0 [pid 290] getppid() = 288 [pid 290] uname({sysname="Linux", nodename="syzkaller", ...}) = 0 [pid 290] newfstatat(AT_FDCWD, "/root", {st_mode=S_IFDIR|0700, st_size=4096, ...}, 0) = 0 [pid 290] newfstatat(AT_FDCWD, ".", {st_mode=S_IFDIR|0700, st_size=4096, ...}, 0) = 0 [pid 290] rt_sigaction(SIGINT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGINT, {sa_handler=0x7f81f2b20287, sa_mask=~[RTMIN RT_1], sa_flags=SA_RESTORER, sa_restorer=0x7f81f293c180}, NULL, 8) = 0 [pid 290] rt_sigaction(SIGQUIT, NULL, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] rt_sigaction(SIGTERM, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0 [pid 290] newfstatat(AT_FDCWD, "/bin/mkswap", 0x7fffbdac4fc8, 0) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/sbin/mkswap", {st_mode=S_IFREG|0755, st_size=14256, ...}, 0) = 0 [pid 290] execve("/sbin/mkswap", ["mkswap", "./swap-file"], 0x564f231c26f0 /* 10 vars */) = 0 [pid 290] brk(NULL) = 0x5652ba999000 [pid 290] mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efc075ce000 [pid 290] access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v3/libbusybox.so.1.37.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v3/", 0x7fffd63145c0, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v2/libbusybox.so.1.37.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/lib64/glibc-hwcaps/x86-64-v2/", 0x7fffd63145c0, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/lib64/libbusybox.so.1.37.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x38\x13\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x09\x00\x40\x00\x19\x00\x18\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\xf4\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0644, st_size=792952, ...}) = 0 [pid 290] mmap(NULL, 792856, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc0750c000 [pid 290] mmap(0x7efc0751c000, 548864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10000) = 0x7efc0751c000 [pid 290] mmap(0x7efc075a2000, 163840, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x96000) = 0x7efc075a2000 [pid 290] mmap(0x7efc075ca000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xbe000) = 0x7efc075ca000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\xf0\xab\x02\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x38\x22\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0e\x00\x40\x00\x3b\x00\x3a\x00\x06\x00\x00\x00\x04\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00"..., 832) = 832 [pid 290] pread64(3, "\x06\x00\x00\x00\x04\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00"..., 784, 64) = 784 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=1913080, ...}) = 0 [pid 290] pread64(3, "\x06\x00\x00\x00\x04\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x10\x03\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x60\xc1\x19\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00"..., 784, 64) = 784 [pid 290] mmap(NULL, 1965720, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc0732c000 [pid 290] mmap(0x7efc07354000, 1368064, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7efc07354000 [pid 290] mmap(0x7efc074a2000, 356352, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x176000) = 0x7efc074a2000 [pid 290] mmap(0x7efc074f9000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1cc000) = 0x7efc074f9000 [pid 290] mmap(0x7efc074ff000, 52888, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efc074ff000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libpam.so.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xf8\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1b\x00\x1a\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x29\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=63416, ...}) = 0 [pid 290] mmap(NULL, 65552, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc0731b000 [pid 290] mmap(0x7efc0731e000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7efc0731e000 [pid 290] mmap(0x7efc07326000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7efc07326000 [pid 290] mmap(0x7efc0732a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe000) = 0x7efc0732a000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libpam_misc.so.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x51\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1a\x00\x19\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x12\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=22400, ...}) = 0 [pid 290] mmap(NULL, 24656, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc07314000 [pid 290] mmap(0x7efc07316000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7efc07316000 [pid 290] mmap(0x7efc07318000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7efc07318000 [pid 290] mmap(0x7efc07319000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7efc07319000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xa8\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0b\x00\x40\x00\x1d\x00\x1c\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x27\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=59624, ...}) = 0 [pid 290] mmap(NULL, 67720, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc07303000 [pid 290] mmap(0x7efc07306000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7efc07306000 [pid 290] mmap(0x7efc0730e000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7efc0730e000 [pid 290] mmap(0x7efc07310000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd000) = 0x7efc07310000 [ 25.798556][ T30] audit: type=1400 audit(1754785520.944:70): avc: denied { setattr } for pid=288 comm="syz-executor265" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 290] mmap(0x7efc07312000, 6280, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efc07312000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v3/libselinux.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v3/", 0x7fffd6314520, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v2/libselinux.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] newfstatat(AT_FDCWD, "/usr/lib64/glibc-hwcaps/x86-64-v2/", 0x7fffd6314520, 0) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x60\xd1\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0b\x00\x40\x00\x1d\x00\x1c\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x28\x74\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=186528, ...}) = 0 [pid 290] mmap(NULL, 194256, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc072d3000 [pid 290] mmap(0x7efc072db000, 114688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7efc072db000 [pid 290] mmap(0x7efc072f7000, 32768, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7efc072f7000 [pid 290] mmap(0x7efc072ff000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2c000) = 0x7efc072ff000 [pid 290] mmap(0x7efc07301000, 5840, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efc07301000 [pid 290] close(3) = 0 [pid 290] mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efc072d1000 [pid 290] openat(AT_FDCWD, "/lib64/libatomic.so.1", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x30\x71\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1b\x00\x1a\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x78\x1f\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=30704, ...}) = 0 [pid 290] mmap(NULL, 37000, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc072c7000 [pid 290] mmap(0x7efc072c9000, 12288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7efc072c9000 [pid 290] mmap(0x7efc072cc000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7efc072cc000 [pid 290] mmap(0x7efc072ce000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7efc072ce000 [pid 290] mmap(0x7efc072d0000, 136, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7efc072d0000 [pid 290] close(3) = 0 [pid 290] openat(AT_FDCWD, "/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 290] openat(AT_FDCWD, "/usr/lib64/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3 [pid 290] read(3, "\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x3e\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x38\x00\x0a\x00\x40\x00\x1a\x00\x19\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc8\x20\x00\x00"..., 832) = 832 [pid 290] fstat(3, {st_mode=S_IFREG|0755, st_size=395120, ...}) = 0 [pid 290] mmap(NULL, 397336, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7efc07265000 [pid 290] mmap(0x7efc07268000, 225280, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7efc07268000 [pid 290] mmap(0x7efc0729f000, 155648, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3a000) = 0x7efc0729f000 [pid 290] mmap(0x7efc072c5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5f000) = 0x7efc072c5000 [pid 290] close(3) = 0 [pid 290] mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efc07263000 [pid 290] arch_prctl(ARCH_SET_FS, 0x7efc07263c80) = 0 [pid 290] set_tid_address(0x7efc07263f50) = 290 [pid 290] set_robust_list(0x7efc07263f60, 24) = 0 [pid 290] rseq(0x7efc07263ae0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) [pid 290] mprotect(0x7efc074f9000, 16384, PROT_READ) = 0 [pid 290] mprotect(0x7efc072c5000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc072ce000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc072ff000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc07310000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc0732a000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc07319000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc075ca000, 12288, PROT_READ) = 0 [pid 290] mprotect(0x5652a9fa5000, 4096, PROT_READ) = 0 [pid 290] mprotect(0x7efc07603000, 8192, PROT_READ) = 0 [pid 290] prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 [pid 290] statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0 [pid 290] statfs("/sys/fs/selinux", {f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0, 0]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_NOSUID|ST_NOEXEC|ST_RELATIME}) = 0 [pid 290] getrandom("\x9d\xae\x31\xc6\x36\x62\x69\x0b", 8, GRND_NONBLOCK) = 8 [pid 290] brk(NULL) = 0x5652ba999000 [pid 290] brk(0x5652ba9ba000) = 0x5652ba9ba000 [pid 290] access("/etc/selinux/config", F_OK) = 0 [pid 290] openat(AT_FDCWD, "./swap-file", O_WRONLY) = 3 [pid 290] lseek(3, 0, SEEK_END) = 128000000 [pid 290] lseek(3, 0, SEEK_SET) = 0 [pid 290] fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0 [pid 290] fstat(3, {st_mode=S_IFREG|0600, st_size=128000000, ...}) = 0 [pid 290] fgetxattr(3, "security.selinux", "\x72\x6f\x6f\x74\x3a\x6f\x62\x6a\x65\x63\x74\x5f\x72\x3a\x75\x73\x65\x72\x5f\x68\x6f\x6d\x65\x5f\x74\x00", 255) = 26 [pid 290] access("/var/run/setrans/.setrans-unix", F_OK) = -1 ENOENT (No such file or directory) [pid 290] futex(0x7efc073026b8, FUTEX_WAKE_PRIVATE, 2147483647) = 0 [pid 290] fsetxattr(3, "security.selinux", "\x72\x6f\x6f\x74\x3a\x6f\x62\x6a\x65\x63\x74\x5f\x72\x3a\x73\x77\x61\x70\x66\x69\x6c\x65\x5f\x74\x00", 25, 0) = 0 [pid 290] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1024) = 1024 [pid 290] write(3, "\x01\x00\x00\x00\x11\x7a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 516) = 516 [pid 290] lseek(3, 4086, SEEK_SET) = 4086 [pid 290] write(3, "SWAPSPACE2", 10) = 10 [ 25.874102][ T290] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.883196][ T30] audit: type=1400 audit(1754785521.054:71): avc: denied { relabelto } for pid=290 comm="mkswap" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [pid 290] fsync(3) = 0 [pid 290] write(1, "Setting up swapspace version 1, size = 127995904 bytes\n", 55Setting up swapspace version 1, size = 127995904 bytes ) = 55 [pid 290] exit_group(0) = ? [pid 290] +++ exited with 0 +++ rt_sigaction(SIGINT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 rt_sigaction(SIGQUIT, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=290, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- swapon("./swap-file", SWAP_FLAG_PREFER|0) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f822aadeab0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f822aadeab0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f822aaeb9e0}, NULL, 8) = 0 mkdir("./syzkaller.a87dRm", 0700) = 0 chmod("./syzkaller.a87dRm", 0777) = 0 chdir("./syzkaller.a87dRm") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555559db2750) = 291 ./strace-static-x86_64: Process 291 attached [pid 291] set_robust_list(0x555559db2760, 24) = 0 [pid 291] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 291] getppid() = 0 [pid 291] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 291] unshare(CLONE_NEWNS) = 0 [pid 291] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 291] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 291] unshare(CLONE_NEWCGROUP) = 0 [pid 291] unshare(CLONE_NEWUTS) = 0 [pid 291] unshare(CLONE_SYSVSEM) = 0 [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] getpid() = 1 [pid 291] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 303] set_robust_list(0x555559db2760, 24) = 0 [pid 303] chdir("./0" [pid 291] <... clone resumed>, child_tidptr=0x555559db2750) = 2 [pid 303] <... chdir resumed>) = 0 [pid 303] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 303] setpgid(0, 0) = 0 [pid 303] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 303] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 303] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 303] write(3, "1000", 4) = 4 [pid 303] close(3) = 0 [pid 303] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 303] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110 [pid 303] read(200, 0x7ffe2731a3a0, 1000) = -1 EAGAIN (Resource temporarily unavailable) [pid 303] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 303] write(1, "executing program\n", 18) = 18 [pid 303] memfd_create("syzkaller", 0) = 3 [pid 303] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f82226d4000 [pid 303] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 303] munmap(0x7f82226d4000, 138412032) = 0 [pid 303] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 26.742290][ T291] request_module fs-gadgetfs succeeded, but still no fs? [pid 303] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 303] close(3) = 0 [pid 303] close(4) = 0 [pid 303] mkdir("./bus", 0777) = 0 [ 26.785627][ T303] loop0: detected capacity change from 0 to 512 [ 26.794339][ T303] ======================================================= [ 26.794339][ T303] WARNING: The mand mount option has been deprecated and [ 26.794339][ T303] and is ignored by this kernel. Remove the mand [ 26.794339][ T303] option from the mount to silence this warning. [ 26.794339][ T303] ======================================================= [ 26.835540][ T303] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 26.844990][ T303] EXT4-fs (loop0): feature flags set on rev 0 fs, running e2fsck is recommended [ 26.856053][ T303] EXT4-fs (loop0): warning: checktime reached, running e2fsck is recommended [ 26.865899][ T303] EXT4-fs error (device loop0): ext4_orphan_get:1401: inode #16: comm syz-executor265: iget: bogus i_mode (5) [pid 303] mount("/dev/loop0", "./bus", "ext4", MS_MANDLOCK|MS_LAZYTIME, "auto_da_alloc,jqfmt=vfsold,noquota,init_itable,stripe=0x0000000000000079,resgid=0x0000000000000000,d"...) = 0 [pid 303] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 303] chdir("./bus") = 0 [pid 303] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 303] ioctl(4, LOOP_CLR_FD) = 0 [pid 303] close(4) = 0 [pid 303] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 303] fallocate(4, 0, 0, 1048820) = -1 ENOSPC (No space left on device) [pid 303] open("./bus", O_RDWR|O_CREAT|O_SYNC|O_DIRECT|O_NOATIME|0x3c, 000) = 5 [pid 303] mmap(0x200000000000, 6291456, PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSDOWN|0x90e976db900956f0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<) = 0 [pid 291] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 291] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 291] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=140, ...}, AT_EMPTY_PATH) = 0 [pid 291] getdents64(3, 0x555559db37f0 /* 7 entries */, 32768) = 200 [pid 291] umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 291] newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 291] umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 291] openat(AT_FDCWD, "./0/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 291] newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 26.877730][ T303] EXT4-fs error (device loop0): ext4_orphan_get:1406: comm syz-executor265: couldn't read orphan inode 16 (err -117) [ 26.890202][ T303] EXT4-fs (loop0): mounted filesystem without journal. Opts: auto_da_alloc,jqfmt=vfsold,noquota,init_itable,stripe=0x0000000000000079,resgid=0x0000000000000000,data_err=ignore,init_itable,errors=continue,,errors=continue. Quota mode: writeback. [pid 291] getdents64(4, 0x555559dbb830 /* 0 entries */, 32768) = 0 [pid 291] close(4) = 0 [pid 291] rmdir("./0/bus") = -1 EBUSY (Device or resource busy) [pid 291] umount2("./0/bus", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 291] exit_group(1) = ? [ 26.947546][ T291] EXT4-fs error (device loop0): ext4_map_blocks:630: inode #2: block 3: comm syz-executor265: lblock 0 mapped to illegal pblock 3 (length 1) [ 26.964655][ T291] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5867: Corrupt filesystem [ 26.974259][ T291] EXT4-fs error (device loop0): ext4_dirty_inode:6071: inode #2: comm syz-executor265: mark_inode_dirty error [ 26.986279][ T45] ================================================================== [ 26.994331][ T45] BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 [ 27.001712][ T45] Read of size 4 at addr ffff888124a05650 by task kworker/u4:2/45 [ 27.009586][ T45] [ 27.011903][ T45] CPU: 0 PID: 45 Comm: kworker/u4:2 Not tainted 5.15.189-syzkaller-android13-5.15.189_r00 #0 [ 27.022036][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 27.032072][ T45] Workqueue: writeback wb_workfn (flush-7:0) [ 27.038068][ T45] Call Trace: [ 27.041339][ T45] [ 27.044257][ T45] __dump_stack+0x21/0x30 [ 27.048573][ T45] dump_stack_lvl+0xee/0x150 [ 27.053169][ T45] ? show_regs_print_info+0x20/0x20 [ 27.058351][ T45] ? load_image+0x3a0/0x3a0 [ 27.062857][ T45] print_address_description+0x7f/0x2c0 [ 27.068403][ T45] ? ext4_find_extent+0xbeb/0xe20 [ 27.073415][ T45] kasan_report+0xf1/0x140 [ 27.077817][ T45] ? __read_extent_tree_block+0x1e8/0x790 [ 27.083615][ T45] ? ext4_find_extent+0xbeb/0xe20 [ 27.088629][ T45] __asan_report_load4_noabort+0x14/0x20 [ 27.094264][ T45] ext4_find_extent+0xbeb/0xe20 [ 27.099100][ T45] ext4_ext_map_blocks+0x1de/0x6280 [ 27.104283][ T45] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 27.110073][ T45] ? __stack_depot_save+0x442/0x480 [ 27.115260][ T45] ? __kasan_slab_alloc+0xcf/0xf0 [ 27.120267][ T45] ? __kasan_slab_alloc+0xbd/0xf0 [ 27.125296][ T45] ? slab_post_alloc_hook+0x4f/0x2b0 [ 27.130570][ T45] ? kmem_cache_alloc+0xf7/0x260 [ 27.135495][ T45] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 27.140856][ T45] ? ext4_writepages+0xec8/0x2f90 [ 27.145865][ T45] ? do_writepages+0x48a/0x6c0 [ 27.150614][ T45] ? wb_workfn+0x38f/0xe20 [ 27.155166][ T45] ? process_one_work+0x6be/0xba0 [ 27.160181][ T45] ? worker_thread+0xa59/0x1200 [ 27.165023][ T45] ? ext4_ext_release+0x10/0x10 [ 27.169885][ T45] ? ext4_es_lookup_extent+0x32d/0x8c0 [ 27.175331][ T45] ext4_map_blocks+0x97b/0x1b20 [ 27.180166][ T45] ? slab_post_alloc_hook+0x6d/0x2b0 [ 27.185469][ T45] ? should_failslab+0x9/0x20 [ 27.190134][ T45] ? ext4_issue_zeroout+0x250/0x250 [ 27.195341][ T45] ? ext4_inode_journal_mode+0x19a/0x480 [ 27.200958][ T45] ext4_writepages+0x11e7/0x2f90 [ 27.205883][ T45] ? __kasan_check_read+0x11/0x20 [ 27.210907][ T45] ? mark_page_accessed+0x3b6/0x8d0 [ 27.216093][ T45] ? __activate_page+0xd40/0xd40 [ 27.221016][ T45] ? ext4_readpage+0x220/0x220 [ 27.225773][ T45] ? memcpy+0x56/0x70 [ 27.229753][ T45] ? copy_page_from_iter_atomic+0x784/0x1350 [ 27.235737][ T45] ? __kasan_check_read+0x11/0x20 [ 27.240771][ T45] ? __set_page_dirty_no_writeback+0xff/0x130 [ 27.246829][ T45] ? ext4_readpage+0x220/0x220 [ 27.251583][ T45] do_writepages+0x48a/0x6c0 [ 27.256165][ T45] ? update_curr+0x2f3/0x5b0 [ 27.260753][ T45] ? __writepage+0x130/0x130 [ 27.265333][ T45] ? enqueue_task_fair+0xaa7/0x2120 [ 27.270521][ T45] ? __kasan_check_write+0x14/0x20 [ 27.275629][ T45] ? _raw_spin_lock+0x8e/0xe0 [ 27.280295][ T45] __writeback_single_inode+0xd5/0x9c0 [ 27.285751][ T45] ? wbc_attach_and_unlock_inode+0x194/0x5f0 [ 27.291885][ T45] writeback_sb_inodes+0x9c0/0x1590 [ 27.297101][ T45] ? psi_task_change+0x212/0x370 [ 27.302040][ T45] ? queue_io+0x4c0/0x4c0 [ 27.306387][ T45] ? __kasan_check_read+0x11/0x20 [ 27.311408][ T45] ? queue_io+0x382/0x4c0 [ 27.315745][ T45] wb_writeback+0x3f1/0x980 [ 27.320365][ T45] ? inode_cgwb_move_to_attached+0x3e0/0x3e0 [ 27.326341][ T45] ? set_worker_desc+0x155/0x1c0 [ 27.331274][ T45] ? __kasan_check_write+0x14/0x20 [ 27.336377][ T45] wb_workfn+0x38f/0xe20 [ 27.340612][ T45] ? inode_wait_for_writeback+0x200/0x200 [ 27.346317][ T45] ? compat_start_thread+0x20/0x20 [ 27.351422][ T45] ? _raw_spin_unlock+0x4d/0x70 [ 27.356266][ T45] ? finish_task_switch+0x16b/0x780 [ 27.361457][ T45] ? __switch_to_asm+0x3a/0x60 [ 27.366208][ T45] ? __schedule+0xb76/0x14c0 [ 27.370807][ T45] process_one_work+0x6be/0xba0 [ 27.375648][ T45] worker_thread+0xa59/0x1200 [ 27.380319][ T45] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 27.385765][ T45] kthread+0x411/0x500 [ 27.389816][ T45] ? worker_clr_flags+0x190/0x190 [ 27.394840][ T45] ? kthread_blkcg+0xd0/0xd0 [ 27.399415][ T45] ret_from_fork+0x1f/0x30 [ 27.403842][ T45] [ 27.406847][ T45] [ 27.409161][ T45] The buggy address belongs to the page: [ 27.414772][ T45] page:ffffea0004928140 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x124a05 [ 27.425000][ T45] flags: 0x4000000000000000(zone=1) [ 27.430196][ T45] raw: 4000000000000000 ffffea00044c46c8 ffffea0004928308 0000000000000000 [ 27.438757][ T45] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 27.447317][ T45] page dumped because: kasan: bad access detected [ 27.453713][ T45] page_owner tracks the page as freed [ 27.459059][ T45] page last allocated via order 0, migratetype Movable, gfp_mask 0x100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 302, ts 26929442296, free_ts 26929833241 [ 27.474405][ T45] post_alloc_hook+0x192/0x1b0 [ 27.479154][ T45] prep_new_page+0x1c/0x110 [ 27.483639][ T45] get_page_from_freelist+0x2cc5/0x2d50 [ 27.489168][ T45] __alloc_pages+0x18f/0x440 [ 27.493745][ T45] handle_pte_fault+0xe89/0x2680 [ 27.498664][ T45] do_handle_mm_fault+0x1a6d/0x1d50 [ 27.503847][ T45] do_user_addr_fault+0x841/0x1180 [ 27.508959][ T45] exc_page_fault+0x51/0xb0 [ 27.513454][ T45] asm_exc_page_fault+0x27/0x30 [ 27.518329][ T45] page last free stack trace: [ 27.522982][ T45] free_unref_page_prepare+0x542/0x550 [ 27.528429][ T45] free_unref_page_list+0x134/0x9d0 [ 27.533653][ T45] release_pages+0xfda/0x1030 [ 27.538352][ T45] free_pages_and_swap_cache+0x86/0xa0 [ 27.543793][ T45] tlb_finish_mmu+0x175/0x300 [ 27.548451][ T45] unmap_region+0x315/0x360 [ 27.552966][ T45] __do_munmap+0xa0e/0xfe0 [ 27.557388][ T45] __vm_munmap+0x15b/0x2a0 [ 27.561802][ T45] __x64_sys_munmap+0x6b/0x80 [ 27.566475][ T45] x64_sys_call+0xc9/0x9a0 [ 27.570882][ T45] do_syscall_64+0x4c/0xa0 [ 27.575289][ T45] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.581284][ T45] [ 27.583592][ T45] Memory state around the buggy address: [ 27.589205][ T45] ffff888124a05500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.597254][ T45] ffff888124a05580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.605323][ T45] >ffff888124a05600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.613364][ T45] ^ [ 27.620018][ T45] ffff888124a05680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.628071][ T45] ffff888124a05700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 27.636113][ T45] ================================================================== [ 27.644153][ T45] Disabling lock debugging due to kernel taint [ 27.652709][ T45] ------------[ cut here ]------------ [ 27.658203][ T45] kernel BUG at fs/ext4/inode.c:2433! [ 27.663575][ T45] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 27.669629][ T45] CPU: 0 PID: 45 Comm: kworker/u4:2 Tainted: G B 5.15.189-syzkaller-android13-5.15.189_r00 #0 [ 27.681154][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 27.691191][ T45] Workqueue: writeback wb_workfn (flush-7:0) [ 27.697168][ T45] RIP: 0010:ext4_writepages+0x2eed/0x2f90 [ 27.702890][ T45] Code: 00 74 08 48 89 df e8 22 01 ce ff 48 8b 3b 48 8b 74 24 28 48 8b 54 24 30 44 89 e9 45 89 f0 e8 6a 9b 07 00 eb 51 e8 23 86 8f ff <0f> 0b e8 1c 86 8f ff eb 2f e8 15 86 8f ff eb 5f e8 0e 86 8f ff 31 [ 27.722475][ T45] RSP: 0018:ffffc900002ef100 EFLAGS: 00010293 [ 27.728526][ T45] RAX: ffffffff81d929ad RBX: ffff8881124898b8 RCX: ffff8881055f13c0 [ 27.736507][ T45] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.744459][ T45] RBP: ffffc900002ef470 R08: dffffc0000000000 R09: ffffed1022491310 [ 27.752417][ T45] R10: ffffed1022491310 R11: 1ffff1102249130f R12: dffffc0000000000 [ 27.760377][ T45] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 27.768331][ T45] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.777253][ T45] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.783826][ T45] CR2: 00007f822aba3390 CR3: 000000010d2c2000 CR4: 00000000003506b0 [ 27.791797][ T45] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.799748][ T45] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.807707][ T45] Call Trace: [ 27.810972][ T45] [ 27.813890][ T45] ? __kasan_check_read+0x11/0x20 [ 27.818923][ T45] ? mark_page_accessed+0x3b6/0x8d0 [ 27.824140][ T45] ? __activate_page+0xd40/0xd40 [ 27.829066][ T45] ? ext4_readpage+0x220/0x220 [ 27.833825][ T45] ? memcpy+0x56/0x70 [ 27.837829][ T45] ? copy_page_from_iter_atomic+0x784/0x1350 [ 27.843805][ T45] ? __kasan_check_read+0x11/0x20 [ 27.848843][ T45] ? __set_page_dirty_no_writeback+0xff/0x130 [ 27.854914][ T45] ? ext4_readpage+0x220/0x220 [ 27.859705][ T45] do_writepages+0x48a/0x6c0 [ 27.864337][ T45] ? update_curr+0x2f3/0x5b0 [ 27.868934][ T45] ? __writepage+0x130/0x130 [ 27.873536][ T45] ? enqueue_task_fair+0xaa7/0x2120 [ 27.878732][ T45] ? __kasan_check_write+0x14/0x20 [ 27.883836][ T45] ? _raw_spin_lock+0x8e/0xe0 [ 27.888498][ T45] __writeback_single_inode+0xd5/0x9c0 [ 27.893977][ T45] ? wbc_attach_and_unlock_inode+0x194/0x5f0 [ 27.899950][ T45] writeback_sb_inodes+0x9c0/0x1590 [ 27.905138][ T45] ? psi_task_change+0x212/0x370 [ 27.910062][ T45] ? queue_io+0x4c0/0x4c0 [ 27.914377][ T45] ? __kasan_check_read+0x11/0x20 [ 27.919386][ T45] ? queue_io+0x382/0x4c0 [ 27.923699][ T45] wb_writeback+0x3f1/0x980 [ 27.928191][ T45] ? inode_cgwb_move_to_attached+0x3e0/0x3e0 [ 27.934163][ T45] ? set_worker_desc+0x155/0x1c0 [ 27.939102][ T45] ? __kasan_check_write+0x14/0x20 [ 27.944199][ T45] wb_workfn+0x38f/0xe20 [ 27.948431][ T45] ? inode_wait_for_writeback+0x200/0x200 [ 27.954136][ T45] ? compat_start_thread+0x20/0x20 [ 27.959231][ T45] ? _raw_spin_unlock+0x4d/0x70 [ 27.964067][ T45] ? finish_task_switch+0x16b/0x780 [ 27.969254][ T45] ? __switch_to_asm+0x3a/0x60 [ 27.974006][ T45] ? __schedule+0xb76/0x14c0 [ 27.978583][ T45] process_one_work+0x6be/0xba0 [ 27.983424][ T45] worker_thread+0xa59/0x1200 [ 27.988093][ T45] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 27.993553][ T45] kthread+0x411/0x500 [ 27.997609][ T45] ? worker_clr_flags+0x190/0x190 [ 28.002636][ T45] ? kthread_blkcg+0xd0/0xd0 [ 28.007232][ T45] ret_from_fork+0x1f/0x30 [ 28.011645][ T45] [ 28.014655][ T45] Modules linked in: [ 28.020624][ T45] ---[ end trace 1a60bbf55a37667c ]--- [ 28.026186][ T45] RIP: 0010:ext4_writepages+0x2eed/0x2f90 [ 28.031914][ T45] Code: 00 74 08 48 89 df e8 22 01 ce ff 48 8b 3b 48 8b 74 24 28 48 8b 54 24 30 44 89 e9 45 89 f0 e8 6a 9b 07 00 eb 51 e8 23 86 8f ff <0f> 0b e8 1c 86 8f ff eb 2f e8 15 86 8f ff eb 5f e8 0e 86 8f ff 31 [ 28.051530][ T45] RSP: 0018:ffffc900002ef100 EFLAGS: 00010293 [ 28.057629][ T45] RAX: ffffffff81d929ad RBX: ffff8881124898b8 RCX: ffff8881055f13c0 [ 28.065611][ T45] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.073581][ T45] RBP: ffffc900002ef470 R08: dffffc0000000000 R09: ffffed1022491310 [ 28.081562][ T45] R10: ffffed1022491310 R11: 1ffff1102249130f R12: dffffc0000000000 [ 28.089548][ T45] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 28.097551][ T45] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.106512][ T45] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.113099][ T45] CR2: 00007f822aba3390 CR3: 000000010d2c2000 CR4: 00000000003506b0 [ 28.121083][ T45] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.129074][ T45] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.137085][ T45] Kernel panic - not syncing: Fatal exception [ 28.143417][ T45] Kernel Offset: disabled [ 28.147751][ T45] Rebooting in 86400 seconds..