./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3513039045
<...>
Warning: Permanently added '10.128.0.28' (ED25519) to the list of known hosts.
execve("./syz-executor3513039045", ["./syz-executor3513039045"], 0x7ffc761ff0b0 /* 10 vars */) = 0
brk(NULL) = 0x555555e92000
brk(0x555555e92d00) = 0x555555e92d00
arch_prctl(ARCH_SET_FS, 0x555555e92380) = 0
set_tid_address(0x555555e92650) = 5063
set_robust_list(0x555555e92660, 24) = 0
rseq(0x555555e92ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3513039045", 4096) = 28
getrandom("\x68\x9e\x46\x45\xae\xfc\x1d\x48", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555e92d00
brk(0x555555eb3d00) = 0x555555eb3d00
brk(0x555555eb4000) = 0x555555eb4000
mprotect(0x7f2078e08000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.1NjMXr", 0700) = 0
chmod("./syzkaller.1NjMXr", 0777) = 0
chdir("./syzkaller.1NjMXr") = 0
mkdir("./0", 0777) = 0
[ 104.117855][ T27] audit: type=1400 audit(1702577250.362:86): avc: denied { execmem } for pid=5063 comm="syz-executor351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555e92650) = 5064
./strace-static-x86_64: Process 5064 attached
[ 104.171273][ T27] audit: type=1400 audit(1702577250.412:87): avc: denied { read write } for pid=5063 comm="syz-executor351" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 104.195916][ T27] audit: type=1400 audit(1702577250.422:88): avc: denied { open } for pid=5063 comm="syz-executor351" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5064] set_robust_list(0x555555e92660, 24) = 0
[pid 5064] chdir("./0") = 0
[pid 5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5064] setpgid(0, 0) = 0
[pid 5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5064] write(3, "1000", 4) = 4
[pid 5064] close(3) = 0
[pid 5064] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5064] memfd_create("syzkaller", 0) = 3
[pid 5064] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2070935000
[ 104.221669][ T27] audit: type=1400 audit(1702577250.442:89): avc: denied { ioctl } for pid=5063 comm="syz-executor351" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5064] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 5064] munmap(0x7f2070935000, 138412032) = 0
[pid 5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5064] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5064] close(3) = 0
[pid 5064] mkdir("./file0", 0777) = 0
[ 104.328013][ T5064] loop0: detected capacity change from 0 to 2048
[ 104.352348][ T5064] =======================================================
[ 104.352348][ T5064] WARNING: The mand mount option has been deprecated and
[ 104.352348][ T5064] and is ignored by this kernel. Remove the mand
[ 104.352348][ T5064] option from the mount to silence this warning.
[ 104.352348][ T5064] =======================================================
[ 104.352522][ T27] audit: type=1400 audit(1702577250.602:90): avc: denied { mounton } for pid=5064 comm="syz-executor351" path="/root/syzkaller.1NjMXr/0/file0" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 104.400578][ T5064] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[pid 5064] mount("/dev/loop0", "./file0", "udf", MS_NODEV|MS_MANDLOCK|MS_POSIXACL, "uid=ignore,noadinicb,novrs,iocharset=iso8859-4,gid=ignore,") = 0
[pid 5064] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5064] chdir("./file0") = 0
[pid 5064] ioctl(4, LOOP_CLR_FD) = 0
[pid 5064] close(4) = 0
[pid 5064] creat("./bus", 000) = 4
[ 104.426074][ T5064] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[ 104.438824][ T27] audit: type=1400 audit(1702577250.682:91): avc: denied { mount } for pid=5064 comm="syz-executor351" name="/" dev="loop0" ino=1376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1
[pid 5064] mount("/dev/loop0", "./bus", NULL, MS_BIND|MS_UNBINDABLE|MS_SHARED, NULL) = 0
[pid 5064] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5
[pid 5064] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000
[ 104.481417][ T27] audit: type=1400 audit(1702577250.722:92): avc: denied { mounton } for pid=5064 comm="syz-executor351" path="/root/syzkaller.1NjMXr/0/file0/bus" dev="loop0" ino=1367 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=file permissive=1
[pid 5064] memfd_create("syzkaller", 0) = 6
[pid 5064] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2070935000
[ 104.508792][ T27] audit: type=1400 audit(1702577250.762:93): avc: denied { map } for pid=5064 comm="syz-executor351" path="/root/syzkaller.1NjMXr/0/file0/bus" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 5064] write(6, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x10\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x01\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x78\x5f\xaa\x3b\xd7\x0e\xce\x68\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 5064] munmap(0x7f2070935000, 138412032) = 0
[pid 5064] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7
[pid 5064] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 5064] ioctl(7, LOOP_CLR_FD) = 0
[pid 5064] ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy)
[pid 5064] close(7) = 0
[pid 5064] close(6) = 0
[pid 5064] exit_group(0) = ?
[pid 5064] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5064, si_uid=0, si_status=0, si_utime=0, si_stime=23 /* 0.23 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555555e936f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
[ 104.697908][ T27] audit: type=1400 audit(1702577250.942:94): avc: denied { unmount } for pid=5063 comm="syz-executor351" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:iso9660_t tclass=filesystem permissive=1
[ 104.759214][ T5063] ==================================================================
[ 104.767326][ T5063] BUG: KASAN: use-after-free in udf_close_lvid+0x508/0x5c0
[ 104.774551][ T5063] Write of size 1 at addr ffff8880a8639980 by task syz-executor351/5063
[ 104.782881][ T5063]
[ 104.785202][ T5063] CPU: 0 PID: 5063 Comm: syz-executor351 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
[ 104.795617][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
[ 104.805676][ T5063] Call Trace:
[ 104.808958][ T5063]
[ 104.811892][ T5063] dump_stack_lvl+0xd9/0x1b0
[ 104.816495][ T5063] print_report+0xc4/0x620
[ 104.820918][ T5063] ? __virt_addr_valid+0x5e/0x2d0
[ 104.825955][ T5063] ? __phys_addr+0xc6/0x140
[ 104.830471][ T5063] kasan_report+0xda/0x110
[ 104.834914][ T5063] ? udf_close_lvid+0x508/0x5c0
[ 104.839790][ T5063] ? udf_close_lvid+0x508/0x5c0
[ 104.844671][ T5063] udf_close_lvid+0x508/0x5c0
[ 104.849360][ T5063] ? fscrypt_destroy_keyring+0x1e/0x3d0
[ 104.854924][ T5063] udf_put_super+0x19c/0x200
[ 104.859527][ T5063] ? udf_close_lvid+0x5c0/0x5c0
[ 104.864390][ T5063] generic_shutdown_super+0x161/0x3d0
[ 104.869783][ T5063] kill_block_super+0x3b/0x90
[ 104.874481][ T5063] deactivate_locked_super+0xbc/0x1a0
[ 104.879874][ T5063] deactivate_super+0xde/0x100
[ 104.884668][ T5063] cleanup_mnt+0x222/0x450
[ 104.889097][ T5063] task_work_run+0x14d/0x240
[ 104.893709][ T5063] ? task_work_cancel+0x30/0x30
[ 104.898580][ T5063] ptrace_notify+0x10d/0x130
[ 104.903177][ T5063] syscall_exit_to_user_mode_prepare+0x126/0x230
[ 104.909516][ T5063] syscall_exit_to_user_mode+0xe/0x60
[ 104.914907][ T5063] do_syscall_64+0x4d/0x110
[ 104.919420][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 104.925339][ T5063] RIP: 0033:0x7f2078d75547
[ 104.929759][ T5063] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 104.949377][ T5063] RSP: 002b:00007ffd2cd5c9b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 104.957800][ T5063] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2078d75547
[ 104.965774][ T5063] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd2cd5ca70
[ 104.973757][ T5063] RBP: 00007ffd2cd5ca70 R08: 0000000000000000 R09: 0000000000000000
[ 104.981733][ T5063] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffd2cd5dae0
[ 104.989706][ T5063] R13: 0000555555e936c0 R14: 431bde82d7b634db R15: 00007ffd2cd5db00
[ 104.997704][ T5063]
[ 105.000723][ T5063]
[ 105.003042][ T5063] The buggy address belongs to the physical page:
[ 105.009463][ T5063] page:ffffea0002a18e40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa8639
[ 105.019705][ T5063] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 105.026812][ T5063] page_type: 0xffffffff()
[ 105.031143][ T5063] raw: 00fff00000000000 ffffea0002a18e48 ffffea0002a18e48 0000000000000000
[ 105.039743][ T5063] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 105.048320][ T5063] page dumped because: kasan: bad access detected
[ 105.054732][ T5063] page_owner info is not present (never set?)
[ 105.060799][ T5063]
[ 105.063120][ T5063] Memory state around the buggy address:
[ 105.068742][ T5063] ffff8880a8639880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 105.076819][ T5063] ffff8880a8639900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 105.084881][ T5063] >ffff8880a8639980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 105.092953][ T5063] ^
[ 105.097016][ T5063] ffff8880a8639a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 105.105073][ T5063] ffff8880a8639a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 105.113132][ T5063] ==================================================================
[ 105.121682][ T5063] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 105.128892][ T5063] CPU: 0 PID: 5063 Comm: syz-executor351 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0
[ 105.139314][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
[ 105.149374][ T5063] Call Trace:
[ 105.152665][ T5063]
[ 105.155603][ T5063] dump_stack_lvl+0xd9/0x1b0
[ 105.160219][ T5063] panic+0x6dc/0x790
[ 105.164137][ T5063] ? panic_smp_self_stop+0xa0/0xa0
[ 105.169317][ T5063] ? irqentry_exit+0x3b/0x80
[ 105.173955][ T5063] ? lockdep_hardirqs_on+0x7d/0x110
[ 105.179196][ T5063] ? preempt_schedule_thunk+0x1a/0x30
[ 105.184612][ T5063] ? preempt_schedule_common+0x45/0xc0
[ 105.190115][ T5063] ? check_panic_on_warn+0x1f/0xb0
[ 105.195256][ T5063] check_panic_on_warn+0xab/0xb0
[ 105.200227][ T5063] end_report+0x108/0x150
[ 105.204581][ T5063] kasan_report+0xea/0x110
[ 105.209014][ T5063] ? udf_close_lvid+0x508/0x5c0
[ 105.213885][ T5063] ? udf_close_lvid+0x508/0x5c0
[ 105.218761][ T5063] udf_close_lvid+0x508/0x5c0
[ 105.223465][ T5063] ? fscrypt_destroy_keyring+0x1e/0x3d0
[ 105.229041][ T5063] udf_put_super+0x19c/0x200
[ 105.233652][ T5063] ? udf_close_lvid+0x5c0/0x5c0
[ 105.238529][ T5063] generic_shutdown_super+0x161/0x3d0
[ 105.243932][ T5063] kill_block_super+0x3b/0x90
[ 105.248637][ T5063] deactivate_locked_super+0xbc/0x1a0
[ 105.254047][ T5063] deactivate_super+0xde/0x100
[ 105.258839][ T5063] cleanup_mnt+0x222/0x450
[ 105.263281][ T5063] task_work_run+0x14d/0x240
[ 105.267908][ T5063] ? task_work_cancel+0x30/0x30
[ 105.272791][ T5063] ptrace_notify+0x10d/0x130
[ 105.277401][ T5063] syscall_exit_to_user_mode_prepare+0x126/0x230
[ 105.283751][ T5063] syscall_exit_to_user_mode+0xe/0x60
[ 105.289156][ T5063] do_syscall_64+0x4d/0x110
[ 105.293683][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 105.299613][ T5063] RIP: 0033:0x7f2078d75547
[ 105.304057][ T5063] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 105.323851][ T5063] RSP: 002b:00007ffd2cd5c9b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 105.332295][ T5063] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f2078d75547
[ 105.340281][ T5063] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffd2cd5ca70
[ 105.348276][ T5063] RBP: 00007ffd2cd5ca70 R08: 0000000000000000 R09: 0000000000000000
[ 105.356258][ T5063] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007ffd2cd5dae0
[ 105.364252][ T5063] R13: 0000555555e936c0 R14: 431bde82d7b634db R15: 00007ffd2cd5db00
[ 105.372244][ T5063]
[ 105.375587][ T5063] Kernel Offset: disabled
[ 105.379912][ T5063] Rebooting in 86400 seconds..