./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2706296441 <...> syzkaller syzkaller login: [ 69.144396][ T26] kauditd_printk_skb: 42 callbacks suppressed [ 69.144419][ T26] audit: type=1400 audit(1688039809.053:77): avc: denied { transition } for pid=4973 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 69.173183][ T26] audit: type=1400 audit(1688039809.053:78): avc: denied { noatsecure } for pid=4973 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 69.193251][ T26] audit: type=1400 audit(1688039809.063:79): avc: denied { write } for pid=4973 comm="sh" path="pipe:[28581]" dev="pipefs" ino=28581 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 69.222736][ T26] audit: type=1400 audit(1688039809.063:80): avc: denied { rlimitinh } for pid=4973 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 69.252085][ T26] audit: type=1400 audit(1688039809.063:81): avc: denied { siginh } for pid=4973 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 70.243128][ T26] audit: type=1400 audit(1688039810.153:82): avc: denied { read } for pid=4429 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.0.130' (ECDSA) to the list of known hosts. execve("./syz-executor2706296441", ["./syz-executor2706296441"], 0x7ffcd889e000 /* 10 vars */) = 0 brk(NULL) = 0x5555568ae000 brk(0x5555568aec40) = 0x5555568aec40 arch_prctl(ARCH_SET_FS, 0x5555568ae300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2706296441", 4096) = 28 brk(0x5555568cfc40) = 0x5555568cfc40 brk(0x5555568d0000) = 0x5555568d0000 mprotect(0x7f123bbf1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 [ 86.557263][ T26] audit: type=1400 audit(1688039826.473:83): avc: denied { write } for pid=4992 comm="strace-static-x" path="pipe:[29982]" dev="pipefs" ino=29982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 86.585220][ T26] audit: type=1400 audit(1688039826.503:84): avc: denied { execmem } for pid=4995 comm="syz-executor270" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1233737000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f1233737000, 4194304) = 0 [ 86.586414][ T4995] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4995 'syz-executor270' openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 86.661722][ T26] audit: type=1400 audit(1688039826.573:85): avc: denied { read write } for pid=4995 comm="syz-executor270" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 86.664995][ T4995] loop0: detected capacity change from 0 to 8192 [ 86.686620][ T26] audit: type=1400 audit(1688039826.573:86): avc: denied { open } for pid=4995 comm="syz-executor270" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 86.707508][ T4995] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 86.717071][ T26] audit: type=1400 audit(1688039826.573:87): avc: denied { ioctl } for pid=4995 comm="syz-executor270" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 86.755494][ T4995] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 86.756032][ T26] audit: type=1400 audit(1688039826.613:88): avc: denied { mounton } for pid=4995 comm="syz-executor270" path="/root/file1" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 86.765117][ T4995] REISERFS (device loop0): using ordered data mode [ 86.794079][ T4995] reiserfs: using flush barriers [ 86.800383][ T4995] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 86.817199][ T4995] REISERFS (device loop0): checking transaction log (loop0) [ 86.911506][ T4995] REISERFS (device loop0): Using r5 hash to sort names [ 86.918895][ T4995] REISERFS (device loop0): using 3.5.x disk format [ 86.992330][ T4995] BUG: unable to handle page fault for address: ffff888074200000 [ 87.000111][ T4995] #PF: supervisor write access in kernel mode [ 87.006200][ T4995] #PF: error_code(0x0002) - not-present page [ 87.012204][ T4995] PGD 12201067 P4D 12201067 PUD 2a8a4063 PMD 740f9063 PTE 100040020 [ 87.020264][ T4995] Oops: 0002 [#1] PREEMPT SMP KASAN [ 87.025487][ T4995] CPU: 0 PID: 4995 Comm: syz-executor270 Not tainted 6.4.0-syzkaller-01406-ge8f75c0270d9 #0 [ 87.035584][ T4995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 87.045659][ T4995] RIP: 0010:memmove+0x28/0x1b0 [ 87.050483][ T4995] Code: c3 90 f3 0f 1e fa 48 89 f8 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f b5 00 00 00 48 83 fa 20 0f 82 01 01 00 00 48 89 d1 a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48 [ 87.070136][ T4995] RSP: 0018:ffffc9000369efb8 EFLAGS: 00010286 [ 87.076240][ T4995] RAX: ffff88806ef9cfb4 RBX: 0000000000000002 RCX: fffffffffad9cf94 [ 87.084242][ T4995] RDX: ffffffffffffffe0 RSI: ffff8880741ffff0 RDI: ffff888074200000 [ 87.092246][ T4995] RBP: 0000000000000020 R08: ffff88806ef9cf84 R09: 0000766972705f73 [ 87.100253][ T4995] R10: 667265736965722e R11: 0000766972705f73 R12: 0000000000000001 [ 87.108261][ T4995] R13: 0000000000000000 R14: ffff88806ef9cfa4 R15: 0000000000000010 [ 87.116265][ T4995] FS: 00005555568ae300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 87.125225][ T4995] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.131815][ T4995] CR2: ffff888074200000 CR3: 0000000077014000 CR4: 00000000003506f0 [ 87.139795][ T4995] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.147772][ T4995] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.155750][ T4995] Call Trace: [ 87.159031][ T4995] [ 87.161965][ T4995] ? __die+0x1f/0x60 [ 87.165889][ T4995] ? page_fault_oops+0x34f/0xa50 [ 87.170843][ T4995] ? cmp_ex_sort+0xd0/0xd0 [ 87.175275][ T4995] ? dump_pagetable+0x500/0x500 [ 87.180137][ T4995] ? search_extable+0x83/0xb0 [ 87.184828][ T4995] ? is_prefetch.constprop.0+0xb7/0x540 [ 87.190395][ T4995] ? trim_init_extable+0x3d0/0x3d0 [ 87.195523][ T4995] ? memmove+0x28/0x1b0 [ 87.199685][ T4995] ? pgtable_bad+0x90/0x90 [ 87.204115][ T4995] ? preempt_count_add+0x78/0x140 [ 87.209147][ T4995] ? search_module_extables+0x80/0x150 [ 87.214619][ T4995] ? memmove+0x28/0x1b0 [ 87.218782][ T4995] ? fixup_exception+0x115/0xcc0 [ 87.223737][ T4995] ? kernelmode_fixup_or_oops+0x23f/0x2b0 [ 87.229561][ T4995] ? __bad_area_nosemaphore+0x3a4/0x6c0 [ 87.235124][ T4995] ? kasan_save_stack+0x32/0x40 [ 87.239979][ T4995] ? spurious_kernel_fault+0x38d/0x5b0 [ 87.245451][ T4995] ? do_kern_addr_fault+0x5b/0x70 [ 87.250486][ T4995] ? exc_page_fault+0x14f/0x170 [ 87.255356][ T4995] ? asm_exc_page_fault+0x26/0x30 [ 87.260397][ T4995] ? memmove+0x28/0x1b0 [ 87.264559][ T4995] leaf_paste_entries+0x44d/0x910 [ 87.269610][ T4995] balance_leaf+0x9853/0xddc0 [ 87.274303][ T4995] ? reiserfs_prepare_for_journal+0x162/0x2b0 [ 87.280382][ T4995] ? fix_nodes+0x14cf/0x8660 [ 87.284988][ T4995] ? replace_key+0x170/0x170 [ 87.289589][ T4995] do_balance+0x319/0x810 [ 87.293927][ T4995] ? get_right_neighbor_position+0x170/0x170 [ 87.299921][ T4995] ? wait_for_completion_io_timeout+0x20/0x20 [ 87.306013][ T4995] reiserfs_paste_into_item+0x74b/0x8d0 [ 87.311569][ T4995] ? reiserfs_delete_object+0x210/0x210 [ 87.317149][ T4995] ? search_by_entry_key+0x960/0x960 [ 87.322456][ T4995] ? reiserfs_new_inode+0x3c3/0x2110 [ 87.327758][ T4995] ? r5_hash+0xaf/0xd0 [ 87.331838][ T4995] ? make_cpu_key+0x26/0x2a0 [ 87.336446][ T4995] reiserfs_add_entry+0x8cb/0xcf0 [ 87.341484][ T4995] ? reiserfs_lookup+0x610/0x610 [ 87.346448][ T4995] ? wait_for_completion_io_timeout+0x20/0x20 [ 87.352546][ T4995] ? do_journal_begin_r+0xd4d/0x10e0 [ 87.357846][ T4995] ? dquot_get_next_dqblk+0x180/0x180 [ 87.363242][ T4995] ? make_vfsgid+0x170/0x170 [ 87.367842][ T4995] reiserfs_mkdir+0x683/0x990 [ 87.372533][ T4995] ? reiserfs_mknod+0x710/0x710 [ 87.377398][ T4995] ? rwsem_down_write_slowpath+0x1220/0x1220 [ 87.383388][ T4995] reiserfs_xattr_init+0x57e/0xbc0 [ 87.388519][ T4995] reiserfs_fill_super+0x2129/0x2eb0 [ 87.393825][ T4995] ? reiserfs_remount+0x1650/0x1650 [ 87.399129][ T4995] ? sget+0x483/0x5d0 [ 87.403135][ T4995] ? snprintf+0xbf/0x100 [ 87.407396][ T4995] mount_bdev+0x315/0x3e0 [ 87.411744][ T4995] ? reiserfs_remount+0x1650/0x1650 [ 87.416980][ T4995] ? reiserfs_kill_sb+0x1e0/0x1e0 [ 87.422050][ T4995] legacy_get_tree+0x109/0x220 [ 87.426851][ T4995] vfs_get_tree+0x8d/0x350 [ 87.431292][ T4995] path_mount+0x136e/0x1e70 [ 87.435818][ T4995] ? putname+0x102/0x140 [ 87.440080][ T4995] ? lockdep_hardirqs_on+0x7d/0x100 [ 87.445303][ T4995] ? finish_automount+0xa30/0xa30 [ 87.450357][ T4995] ? putname+0x102/0x140 [ 87.454616][ T4995] __x64_sys_mount+0x283/0x300 [ 87.459401][ T4995] ? copy_mnt_ns+0xb30/0xb30 [ 87.464008][ T4995] ? lockdep_hardirqs_on+0x7d/0x100 [ 87.469229][ T4995] ? _raw_spin_unlock_irq+0x2e/0x50 [ 87.474525][ T4995] ? ptrace_notify+0xfe/0x140 [ 87.479231][ T4995] do_syscall_64+0x39/0xb0 [ 87.483671][ T4995] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 87.489593][ T4995] RIP: 0033:0x7f123bb84afa [ 87.494025][ T4995] Code: 20 00 04 00 01 00 00 00 01 ff 00 00 00 00 00 00 20 00 04 00 01 00 00 00 01 ff 00 00 00 00 00 00 20 00 04 00 01 00 00 00 01 ff <00> 00 00 00 00 00 20 00 04 00 01 00 00 00 01 ff 00 00 00 00 00 00 [ 87.513640][ T4995] RSP: 002b:00007ffe94ab4c08 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 87.522058][ T4995] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f123bb84afa [ 87.530035][ T4995] RDX: 0000000020001100 RSI: 0000000020000040 RDI: 00007ffe94ab4c20 [ 87.538010][ T4995] RBP: 00007ffe94ab4c20 R08: 00007ffe94ab4c60 R09: 00000000000010f4 [ 87.545986][ T4995] R10: 0000000000000080 R11: 0000000000000286 R12: 0000000000000004 [ 87.553966][ T4995] R13: 00005555568ae2c0 R14: 0000000000000080 R15: 00007ffe94ab4c60 [ 87.561943][ T4995] [ 87.564962][ T4995] Modules linked in: [ 87.568858][ T4995] CR2: ffff888074200000 [ 87.573014][ T4995] ---[ end trace 0000000000000000 ]--- [ 87.578467][ T4995] RIP: 0010:memmove+0x28/0x1b0 [ 87.583246][ T4995] Code: c3 90 f3 0f 1e fa 48 89 f8 48 39 fe 7d 0f 49 89 f0 49 01 d0 49 39 f8 0f 8f b5 00 00 00 48 83 fa 20 0f 82 01 01 00 00 48 89 d1 a4 c3 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48 [ 87.602952][ T4995] RSP: 0018:ffffc9000369efb8 EFLAGS: 00010286 [ 87.609022][ T4995] RAX: ffff88806ef9cfb4 RBX: 0000000000000002 RCX: fffffffffad9cf94 [ 87.617013][ T4995] RDX: ffffffffffffffe0 RSI: ffff8880741ffff0 RDI: ffff888074200000 [ 87.624993][ T4995] RBP: 0000000000000020 R08: ffff88806ef9cf84 R09: 0000766972705f73 [ 87.632972][ T4995] R10: 667265736965722e R11: 0000766972705f73 R12: 0000000000000001 [ 87.640948][ T4995] R13: 0000000000000000 R14: ffff88806ef9cfa4 R15: 0000000000000010 [ 87.648926][ T4995] FS: 00005555568ae300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 87.657864][ T4995] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.664454][ T4995] CR2: ffff888074200000 CR3: 0000000077014000 CR4: 00000000003506f0 [ 87.672430][ T4995] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.680407][ T4995] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.688381][ T4995] Kernel panic - not syncing: Fatal exception [ 87.694823][ T4995] Kernel Offset: disabled [ 87.699161][ T4995] Rebooting in 86400 seconds..