./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3062495454 <...> [ 3.394270][ T100] udevd[100]: starting eudev-3.2.11 [ 3.396099][ T99] udevd (99) used greatest stack depth: 23120 bytes left [ 7.009140][ T113] udevd (113) used greatest stack depth: 22544 bytes left [ 12.076087][ T223] sshd (223) used greatest stack depth: 22176 bytes left [ 12.150444][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 12.150460][ T30] audit: type=1400 audit(1724842131.235:61): avc: denied { transition } for pid=224 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.154424][ T30] audit: type=1400 audit(1724842131.235:62): avc: denied { noatsecure } for pid=224 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.157392][ T30] audit: type=1400 audit(1724842131.235:63): avc: denied { write } for pid=224 comm="sh" path="pipe:[13263]" dev="pipefs" ino=13263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.160399][ T30] audit: type=1400 audit(1724842131.235:64): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.163302][ T30] audit: type=1400 audit(1724842131.235:65): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.252' (ED25519) to the list of known hosts. execve("./syz-executor3062495454", ["./syz-executor3062495454"], 0x7fff5f79b1b0 /* 10 vars */) = 0 brk(NULL) = 0x555555afe000 brk(0x555555afed00) = 0x555555afed00 arch_prctl(ARCH_SET_FS, 0x555555afe380) = 0 set_tid_address(0x555555afe650) = 293 set_robust_list(0x555555afe660, 24) = 0 rseq(0x555555afeca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3062495454", 4096) = 28 getrandom("\x81\x0f\x47\x5e\x4d\xc4\x09\x51", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555afed00 brk(0x555555b1fd00) = 0x555555b1fd00 brk(0x555555b20000) = 0x555555b20000 mprotect(0x7f893683f000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555afe650) = 294 ./strace-static-x86_64: Process 294 attached [pid 294] set_robust_list(0x555555afe660, 24) = 0 [pid 294] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 294] setpgid(0, 0) = 0 [pid 294] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 294] write(3, "1000", 4) = 4 [pid 294] close(3) = 0 [pid 294] write(1, "executing program\n", 18executing program ) = 18 [pid 294] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [ 20.909479][ T30] audit: type=1400 audit(1724842139.995:66): avc: denied { execmem } for pid=293 comm="syz-executor306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 294] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\xf0\x00\x00\x00\x30\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdc\x00\x01\x00\x6c\x00\x01\x00\x0b\x00\x01\x00\x70\x6f\x6c\x69\x63\x65\x00\x00\x40\x00\x02\x80\x3c\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=240}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0 [pid 293] kill(-294, SIGKILL) = 0 [pid 293] kill(294, SIGKILL) = 0 [pid 293] openat(AT_FDCWD, "/sys/fs/fuse/connections", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 293] newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0 [pid 293] getdents64(3, 0x555555aff6f0 /* 2 entries */, 32768) = 48 [pid 293] getdents64(3, 0x555555aff6f0 /* 0 entries */, 32768) = 0 [pid 293] close(3) = 0 [ 244.446919][ T31] INFO: task kworker/1:1:39 blocked for more than 122 seconds. [ 244.454324][ T31] Not tainted 5.15.156-syzkaller-00821-g29d153aabd54 #0 [ 244.461869][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.470451][ T31] task:kworker/1:1 state:D stack:25632 pid: 39 ppid: 2 flags:0x00004000 [ 244.479735][ T31] Workqueue: events_power_efficient reg_check_chans_work [ 244.486590][ T31] Call Trace: [ 244.490039][ T31] [ 244.492780][ T31] __schedule+0xccc/0x1590 [ 244.497183][ T31] ? release_firmware_map_entry+0x190/0x190 [ 244.502884][ T31] ? wq_worker_sleeping+0x19c/0x200 [ 244.508135][ T31] schedule+0x11f/0x1e0 [ 244.512103][ T31] schedule_preempt_disabled+0x13/0x20 [ 244.517537][ T31] __mutex_lock+0x90e/0x1870 [ 244.521933][ T31] ? __kasan_check_write+0x14/0x20 [ 244.527016][ T31] ? __ww_mutex_lock_interruptible_slowpath+0x20/0x20 [ 244.533582][ T31] ? _raw_spin_unlock_irqrestore+0x5c/0x80 [ 244.539535][ T31] ? __mod_timer+0x903/0xcf0 [ 244.543940][ T31] ? __update_load_avg_cfs_rq+0xb1/0x2f0 [ 244.549554][ T31] __mutex_lock_slowpath+0xe/0x10 [ 244.554386][ T31] mutex_lock+0x135/0x1e0 [ 244.558685][ T31] ? wait_for_completion_killable_timeout+0x10/0x10 [ 244.565077][ T31] ? queue_delayed_work_on+0x13f/0x180 [ 244.571901][ T31] ? delayed_work_timer_fn+0x80/0x80 [ 244.577106][ T31] rtnl_lock+0x15/0x20 [ 244.580910][ T31] reg_check_chans_work+0x83/0xb80 [ 244.585860][ T31] ? gc_worker+0x1059/0x1300 [ 244.590459][ T31] ? reg_process_ht_flags+0xc40/0xc40 [ 244.595635][ T31] ? __kasan_check_write+0x14/0x20 [ 244.600720][ T31] ? __kasan_check_read+0x11/0x20 [ 244.605548][ T31] ? read_word_at_a_time+0x12/0x20 [ 244.610655][ T31] ? strscpy+0x9c/0x260 [ 244.614613][ T31] process_one_work+0x6bb/0xc10 [ 244.619444][ T31] worker_thread+0xad5/0x12a0 [ 244.623926][ T31] ? _raw_spin_lock+0x1b0/0x1b0 [ 244.628768][ T31] kthread+0x421/0x510 [ 244.632641][ T31] ? worker_clr_flags+0x180/0x180 [ 244.637644][ T31] ? kthread_blkcg+0xd0/0xd0 [ 244.642038][ T31] ret_from_fork+0x1f/0x30 [ 244.646294][ T31] [ 244.649392][ T31] NMI backtrace for cpu 1 [ 244.653524][ T31] CPU: 1 PID: 31 Comm: khungtaskd Not tainted 5.15.156-syzkaller-00821-g29d153aabd54 #0 [ 244.663069][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 244.672957][ T31] Call Trace: [ 244.676080][ T31] [ 244.678861][ T31] dump_stack_lvl+0x151/0x1c0 [ 244.683370][ T31] ? io_uring_drop_tctx_refs+0x190/0x190 [ 244.688845][ T31] dump_stack+0x15/0x20 [ 244.692832][ T31] nmi_cpu_backtrace+0x2f7/0x300 [ 244.697605][ T31] ? nmi_trigger_cpumask_backtrace+0x270/0x270 [ 244.703596][ T31] ? sched_show_task+0x3d8/0x620 [ 244.708366][ T31] ? __rcu_read_unlock+0xd0/0xd0 [ 244.713141][ T31] ? arch_trigger_cpumask_backtrace+0x20/0x20 [ 244.719041][ T31] nmi_trigger_cpumask_backtrace+0x15d/0x270 [ 244.724858][ T31] ? arch_trigger_cpumask_backtrace+0x20/0x20 [ 244.730759][ T31] arch_trigger_cpumask_backtrace+0x10/0x20 [ 244.736486][ T31] watchdog+0xdd7/0xf50 [ 244.740479][ T31] ? __kasan_check_write+0x14/0x20 [ 244.745430][ T31] ? hungtask_pm_notify+0x50/0x50 [ 244.750286][ T31] ? __kasan_check_read+0x11/0x20 [ 244.755146][ T31] ? __kthread_parkme+0xb2/0x200 [ 244.759924][ T31] kthread+0x421/0x510 [ 244.763827][ T31] ? hungtask_pm_notify+0x50/0x50 [ 244.768689][ T31] ? kthread_blkcg+0xd0/0xd0 [ 244.773115][ T31] ret_from_fork+0x1f/0x30 [ 244.777370][ T31] [ 244.780268][ T31] Sending NMI from CPU 1 to CPUs 0: [ 244.785273][ C0] NMI backtrace for cpu 0 [ 244.785281][ C0] CPU: 0 PID: 294 Comm: syz-executor306 Not tainted 5.15.156-syzkaller-00821-g29d153aabd54 #0 [ 244.785297][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 244.785305][ C0] RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785327][ C0] Code: 8d 42 28 4c 39 d0 77 22 89 f8 89 f6 48 c7 44 0a 08 01 00 00 00 48 89 44 0a 10 48 89 74 0a 18 4c 89 44 0a 20 49 ff c1 4c 89 09 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 48 89 e5 4c 8b [ 244.785340][ C0] RSP: 0018:ffffc90000986750 EFLAGS: 00000293 [ 244.785353][ C0] RAX: 0000000000000000 RBX: ffff888124c1d340 RCX: ffff88811bbc62c0 [ 244.785364][ C0] RDX: ffff88811bbc62c0 RSI: 0000000000000000 RDI: 0000000000000040 [ 244.785374][ C0] RBP: ffffc90000986750 R08: ffffffff82874bc6 R09: fffff52000130ce9 [ 244.785385][ C0] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88810ad11c38 [ 244.785395][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888124c1d342 [ 244.785405][ C0] FS: 0000555555afe380(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 244.785419][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 244.785429][ C0] CR2: 0000555555afe338 CR3: 00000001180ca000 CR4: 00000000003506b0 [ 244.785442][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 244.785450][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 244.785460][ C0] Call Trace: [ 244.785464][ C0] [ 244.785469][ C0] ? show_regs+0x58/0x60 [ 244.785484][ C0] ? nmi_cpu_backtrace+0x29f/0x300 [ 244.785501][ C0] ? nmi_trigger_cpumask_backtrace+0x270/0x270 [ 244.785519][ C0] ? __sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785536][ C0] ? __sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785552][ C0] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 244.785568][ C0] ? nmi_handle+0xa8/0x280 [ 244.785582][ C0] ? __sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785604][ C0] ? default_do_nmi+0x69/0x160 [ 244.785618][ C0] ? exc_nmi+0xad/0x100 [ 244.785629][ C0] ? end_repeat_nmi+0x16/0x31 [ 244.785643][ C0] ? radix_tree_lookup+0x96/0x290 [ 244.785659][ C0] ? __sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785676][ C0] ? __sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785693][ C0] ? __sanitizer_cov_trace_const_cmp1+0x80/0x90 [ 244.785710][ C0] [ 244.785714][ C0] [ 244.785718][ C0] radix_tree_lookup+0x96/0x290 [ 244.785734][ C0] idr_find+0x40/0x60 [ 244.785748][ C0] tcf_idr_check_alloc+0x89/0x3b0 [ 244.785763][ C0] tcf_police_init+0x318/0x1880 [ 244.785776][ C0] ? rtnetlink_rcv+0x1c/0x20 [ 244.785790][ C0] ? netlink_unicast+0x8df/0xac0 [ 244.785806][ C0] ? x64_sys_call+0x16a/0x9a0 [ 244.785820][ C0] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 244.785838][ C0] ? tcf_police_search+0x90/0x90 [ 244.785854][ C0] ? nla_memcpy+0x5e/0xc0 [ 244.785868][ C0] ? nla_memcpy+0x8e/0xc0 [ 244.785881][ C0] ? tcf_police_search+0x90/0x90 [ 244.785895][ C0] tcf_action_init_1+0x50f/0x7f0 [ 244.785909][ C0] ? tc_action_load_ops+0x550/0x550 [ 244.785923][ C0] ? tc_action_load_ops+0x2a6/0x550 [ 244.785940][ C0] tcf_action_init+0x306/0x840 [ 244.785954][ C0] ? tcf_action_init_1+0x7f0/0x7f0 [ 244.785975][ C0] ? security_capable+0x87/0xb0 [ 244.785992][ C0] tc_ctl_action+0x49b/0xd00 [ 244.786005][ C0] ? memcpy+0x56/0x70 [ 244.786019][ C0] ? tcf_free_cookie_rcu+0x50/0x50 [ 244.786033][ C0] ? avc_denied+0x1b0/0x1b0 [ 244.786052][ C0] ? __kasan_check_write+0x14/0x20 [ 244.786067][ C0] ? mutex_lock+0xb6/0x1e0 [ 244.786080][ C0] ? wait_for_completion_killable_timeout+0x10/0x10 [ 244.786096][ C0] ? ns_capable+0x89/0xe0 [ 244.786108][ C0] ? netlink_net_capable+0x125/0x160 [ 244.786124][ C0] ? tcf_free_cookie_rcu+0x50/0x50 [ 244.786138][ C0] rtnetlink_rcv_msg+0x951/0xc40 [ 244.786153][ C0] ? rtnetlink_bind+0x80/0x80 [ 244.786167][ C0] ? avc_denied+0x13f/0x1b0 [ 244.786182][ C0] ? avc_has_perm_noaudit+0x2dd/0x430 [ 244.786198][ C0] ? avc_denied+0x1b0/0x1b0 [ 244.786214][ C0] ? avc_has_perm+0x16f/0x260 [ 244.786228][ C0] ? ____kasan_kmalloc+0xed/0x110 [ 244.786242][ C0] ? avc_has_perm_noaudit+0x430/0x430 [ 244.786257][ C0] ? x64_sys_call+0x16a/0x9a0 [ 244.786271][ C0] netlink_rcv_skb+0x1cf/0x410 [ 244.786283][ C0] ? rtnetlink_bind+0x80/0x80 [ 244.786297][ C0] ? netlink_ack+0xb10/0xb10 [ 244.786311][ C0] ? __netlink_lookup+0x37b/0x3a0 [ 244.786324][ C0] rtnetlink_rcv+0x1c/0x20 [ 244.786338][ C0] netlink_unicast+0x8df/0xac0 [ 244.786354][ C0] ? netlink_detachskb+0x90/0x90 [ 244.786370][ C0] ? security_netlink_send+0x7b/0xa0 [ 244.786384][ C0] netlink_sendmsg+0xa0a/0xd20 [ 244.786398][ C0] ? netlink_getsockopt+0x560/0x560 [ 244.786412][ C0] ? security_socket_sendmsg+0x82/0xb0 [ 244.786426][ C0] ? netlink_getsockopt+0x560/0x560 [ 244.786439][ C0] ____sys_sendmsg+0x59e/0x8f0 [ 244.786455][ C0] ? __sys_sendmsg_sock+0x40/0x40 [ 244.786470][ C0] ? import_iovec+0xe5/0x120 [ 244.786486][ C0] ___sys_sendmsg+0x252/0x2e0 [ 244.786501][ C0] ? __sys_sendmsg+0x260/0x260 [ 244.786520][ C0] ? cgroup_leave_frozen+0x164/0x2c0 [ 244.786536][ C0] ? __kasan_check_read+0x11/0x20 [ 244.786550][ C0] ? __fdget+0x179/0x240 [ 244.786563][ C0] __se_sys_sendmsg+0x19a/0x260 [ 244.786578][ C0] ? __x64_sys_sendmsg+0x90/0x90 [ 244.786597][ C0] ? ptrace_notify+0x24c/0x350 [ 244.786614][ C0] __x64_sys_sendmsg+0x7b/0x90 [ 244.786628][ C0] x64_sys_call+0x16a/0x9a0 [ 244.786641][ C0] do_syscall_64+0x3b/0xb0 [ 244.786657][ C0] ? clear_bhb_loop+0x35/0x90 [ 244.786669][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 244.786686][ C0] RIP: 0033:0x7f89367cbdf9 [ 244.786699][ C0] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 244.786710][ C0] RSP: 002b:00007ffc6d24d938 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 244.786724][ C0] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f89367cbdf9 [ 244.786734][ C0] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 244.786743][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006 [ 244.786751][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 244.786760][ C0] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 244.786770][ C0] [ 244.786780][ C0] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.504 msecs