./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor850750733 <...> syzkaller login: [ 6.404913][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 12.631049][ T24] kauditd_printk_skb: 60 callbacks suppressed [ 12.631059][ T24] audit: type=1400 audit(1664729379.090:71): avc: denied { transition } for pid=289 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.635608][ T24] audit: type=1400 audit(1664729379.090:72): avc: denied { write } for pid=289 comm="sh" path="pipe:[11232]" dev="pipefs" ino=11232 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1 [ 13.434963][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 13.755426][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.375735][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! [ 14.644811][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 15.214802][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #82!!! [ 16.424822][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! Warning: Permanently added '10.128.0.79' (ECDSA) to the list of known hosts. execve("./syz-executor850750733", ["./syz-executor850750733"], 0x7ffc0166d4a0 /* 10 vars */) = 0 brk(NULL) = 0x555556dd4000 brk(0x555556dd4c40) = 0x555556dd4c40 arch_prctl(ARCH_SET_FS, 0x555556dd4300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor850750733", 4096) = 27 brk(0x555556df5c40) = 0x555556df5c40 brk(0x555556df6000) = 0x555556df6000 mprotect(0x7fd36d2b1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 ftruncate(3, 262144) = 0 pwrite64(3, "\x20\x00\x00\x00\x00\x01\x00\x00\x0c\xe2\xff\x8b\x06\x00\x00\x00\x0f\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x20\x00\x00\x00\x74\x1f\x17\x63\x74\x1f\x1f\x63\x01\x00\xff\xff\x53\xef\x01\x00\x01\x00\xee\xff\x73\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x00", 89, 1024) = 89 pwrite64(3, "\x03\x00\x00\x00\x13\x00\x00\x00\x23\x00\x00\x00\xce\x00\x0f", 15, 2048) = 15 pwrite64(3, "\xff\xff\xff\xff\xfc\xff\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"..., 1024, 3072) = 1024 pwrite64(3, "\xff\xff", 2, 19456) = 2 pwrite64(3, "\xed\x41\x00\x00\x00\x04\x00\x00\x73\x1f\x1f\x63\x74\x1f\x1f\x63\x74\x1f\x1f\x63\x00\x00\x00\x00\x00\x00\x04\x00\x02", 29, 35968) = 29 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 mkdir("./file0", 0777) = 0 mount("/dev/loop0", "./file0", "ext4", 0, ",errors=continue") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 5 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 close(3) = 0 [ 20.834775][ T24] audit: type=1400 audit(1664729387.290:73): avc: denied { execmem } for pid=371 comm="syz-executor850" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.849786][ T371] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [ 20.854254][ T24] audit: type=1400 audit(1664729387.300:74): avc: denied { read write } for pid=371 comm="syz-executor850" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 20.870302][ T371] EXT4-fs warning (device loop0): ext4_update_dynamic_rev:1066: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 20.887555][ T24] audit: type=1400 audit(1664729387.300:75): avc: denied { open } for pid=371 comm="syz-executor850" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 20.902566][ T371] ------------[ cut here ]------------ [ 20.925925][ T24] audit: type=1400 audit(1664729387.300:76): avc: denied { ioctl } for pid=371 comm="syz-executor850" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 20.931074][ T371] kernel BUG at fs/ext4/ext4.h:3248! [ 20.956932][ T24] audit: type=1400 audit(1664729387.300:77): avc: denied { mounton } for pid=371 comm="syz-executor850" path="/root/file0" dev="sda1" ino=1138 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 20.961976][ T371] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 20.985070][ T24] audit: type=1400 audit(1664729387.330:78): avc: denied { mount } for pid=371 comm="syz-executor850" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 20.990634][ T371] CPU: 1 PID: 371 Comm: syz-executor850 Not tainted 5.10.146-syzkaller-01235-g391716695e71 #0 [ 21.012683][ T24] audit: type=1400 audit(1664729387.330:79): avc: denied { write } for pid=371 comm="syz-executor850" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 21.022593][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 21.022611][ T371] RIP: 0010:ext4_mb_load_buddy_gfp+0xe54/0xec0 [ 21.022620][ T371] Code: ff e8 50 24 c8 ff e9 c8 f3 ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 14 f4 ff ff e8 56 24 c8 ff e9 0a f4 ff ff e8 9c 14 8e ff <0f> 0b e8 95 14 8e ff 4c 89 ef e8 fd 6b cd ff e9 34 fc ff ff e8 83 [ 21.022626][ T371] RSP: 0018:ffffc900002bf1f8 EFLAGS: 00010293 [ 21.044912][ T24] audit: type=1400 audit(1664729387.330:80): avc: denied { add_name } for pid=371 comm="syz-executor850" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 21.054588][ T371] RAX: ffffffff81ded684 RBX: 0000000000000001 RCX: ffff8881067c8000 [ 21.060879][ T24] audit: type=1400 audit(1664729387.330:81): avc: denied { create } for pid=371 comm="syz-executor850" name="cgroup.controllers" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 21.080277][ T371] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 21.080284][ T371] RBP: ffffc900002bf290 R08: ffffffff81dec90c R09: ffffc900002bf320 [ 21.080291][ T371] R10: fffff52000057e6b R11: 1ffff92000057e64 R12: 1ffff11020c74a79 [ 21.080297][ T371] R13: ffff8881063a7000 R14: 0000000000000001 R15: dffffc0000000000 [ 21.080305][ T371] FS: 0000555556dd4300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 21.080311][ T371] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.080324][ T371] CR2: 000055740845bac0 CR3: 00000001059ea000 CR4: 00000000003506a0 [ 21.086737][ T24] audit: type=1400 audit(1664729387.370:82): avc: denied { read append open } for pid=371 comm="syz-executor850" path="/root/file0/cgroup.controllers" dev="loop0" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 21.108284][ T371] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.108290][ T371] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 21.108293][ T371] Call Trace: [ 21.108311][ T371] ext4_mballoc_query_range+0xb8/0x7a0 [ 21.108329][ T371] ? ext4_getfsmap_dev_compare+0x80/0x80 [ 21.248157][ T371] ? ext4_trim_all_free+0xb80/0xb80 [ 21.253338][ T371] ? kmem_cache_alloc_trace+0x1dd/0x330 [ 21.258857][ T371] ext4_getfsmap_datadev+0x1b7f/0x2710 [ 21.264302][ T371] ? sort_r+0x1387/0x13a0 [ 21.268633][ T371] ? ext4_getfsmap+0x10c0/0x10c0 [ 21.273542][ T371] ? ext4_getfsmap+0x10c0/0x10c0 [ 21.278453][ T371] ? ext4_getfsmap+0xb97/0x10c0 [ 21.283278][ T371] ? ext4_getfsmap+0x10c0/0x10c0 [ 21.288187][ T371] ext4_getfsmap+0xd66/0x10c0 [ 21.292839][ T371] ? ext4_fsmap_to_internal+0x260/0x260 [ 21.298360][ T371] ? common_lsm_audit+0xd53/0x1ad0 [ 21.303443][ T371] ? ext4_getfsmap+0x10c0/0x10c0 [ 21.308353][ T371] ? avc_audit_pre_callback+0x2b0/0x2b0 [ 21.313871][ T371] ? ext4_shutdown+0x4d0/0x4d0 [ 21.318610][ T371] ? ext4_fsmap_to_internal+0x25/0x260 [ 21.324040][ T371] ext4_ioctl+0x35bd/0x6330 [ 21.328518][ T371] ? avc_denied+0x13b/0x1b0 [ 21.332997][ T371] ? ext4_has_metadata_csum+0x1f0/0x1f0 [ 21.338511][ T371] ? avc_has_extended_perms+0xb5f/0x1270 [ 21.344114][ T371] ? avc_ss_reset+0x290/0x290 [ 21.348765][ T371] ? __kasan_check_write+0x14/0x20 [ 21.353847][ T371] ? __switch_to+0x5e4/0x1220 [ 21.358502][ T371] ? ioctl_has_perm+0x3da/0x560 [ 21.363325][ T371] ? __x32_compat_sys_ioctl+0x90/0x90 [ 21.368668][ T371] ? has_cap_mac_admin+0xb0/0xb0 [ 21.373579][ T371] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 21.378665][ T371] ? __kasan_check_write+0x14/0x20 [ 21.383748][ T371] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 21.388833][ T371] ? cgroup_update_frozen+0x155/0x320 [ 21.394176][ T371] ? _raw_spin_unlock_irq+0x4e/0x70 [ 21.399349][ T371] ? selinux_file_ioctl+0x3c9/0x530 [ 21.404522][ T371] ? ptrace_stop+0x6ff/0x9f0 [ 21.409086][ T371] ? selinux_file_alloc_security+0x120/0x120 [ 21.415037][ T371] ? _raw_spin_unlock_irq+0x4e/0x70 [ 21.420219][ T371] ? ptrace_notify+0x248/0x340 [ 21.424953][ T371] ? do_notify_parent+0xa40/0xa40 [ 21.429958][ T371] ? __fpregs_load_activate+0x1e7/0x370 [ 21.435476][ T371] ? security_file_ioctl+0xb1/0xd0 [ 21.440559][ T371] ? ext4_has_metadata_csum+0x1f0/0x1f0 [ 21.446075][ T371] __se_sys_ioctl+0x115/0x190 [ 21.450725][ T371] __x64_sys_ioctl+0x7b/0x90 [ 21.455287][ T371] do_syscall_64+0x34/0x70 [ 21.459679][ T371] entry_SYSCALL_64_after_hwframe+0x61/0xc6 [ 21.465544][ T371] RIP: 0033:0x7fd36d244f99 [ 21.469934][ T371] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 21.489599][ T371] RSP: 002b:00007fff821c3d78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 21.497988][ T371] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd36d244f99 [ 21.505931][ T371] RDX: 0000000020000200 RSI: 00000000c0c0583b RDI: 0000000000000003 [ 21.513879][ T371] RBP: 00007fd36d204760 R08: 0000000000000000 R09: 0000000000000000 [ 21.521832][ T371] R10: 0000555556dd42c0 R11: 0000000000000246 R12: 00007fd36d2047f0 [ 21.529778][ T371] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 21.537723][ T371] Modules linked in: [ 21.541702][ T371] ---[ end trace 3fcc3082ba8fb880 ]--- [ 21.547516][ T371] RIP: 0010:ext4_mb_load_buddy_gfp+0xe54/0xec0 [ 21.553638][ T371] Code: ff e8 50 24 c8 ff e9 c8 f3 ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 14 f4 ff ff e8 56 24 c8 ff e9 0a f4 ff ff e8 9c 14 8e ff <0f> 0b e8 95 14 8e ff 4c 89 ef e8 fd 6b cd ff e9 34 fc ff ff e8 83 [ 21.573371][ T371] RSP: 0018:ffffc900002bf1f8 EFLAGS: 00010293 [ 21.579444][ T371] RAX: ffffffff81ded684 RBX: 0000000000000001 RCX: ffff8881067c8000 [ 21.587433][ T371] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 21.595399][ T371] RBP: ffffc900002bf290 R08: ffffffff81dec90c R09: ffffc900002bf320 [ 21.603340][ T371] R10: fffff52000057e6b R11: 1ffff92000057e64 R12: 1ffff11020c74a79 [ 21.611329][ T371] R13: ffff8881063a7000 R14: 0000000000000001 R15: dffffc0000000000 [ 21.619303][ T371] FS: 0000555556dd4300(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 21.628234][ T371] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.634808][ T371] CR2: 000055740845bac0 CR3: 00000001059ea000 CR4: 00000000003506a0 [ 21.642752][ T371] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 21.650805][ T371] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 21.658767][ T371] Kernel panic - not syncing: Fatal exception [ 21.664868][ T371] Kernel Offset: disabled [ 21.669168][ T371] Rebooting in 86400 seconds..