./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3353759932 <...> Warning: Permanently added '10.128.0.85' (ED25519) to the list of known hosts. execve("./syz-executor3353759932", ["./syz-executor3353759932"], 0x7ffea9e3e7d0 /* 10 vars */) = 0 brk(NULL) = 0x55557d4ce000 brk(0x55557d4ced00) = 0x55557d4ced00 arch_prctl(ARCH_SET_FS, 0x55557d4ce380) = 0 set_tid_address(0x55557d4ce650) = 287 set_robust_list(0x55557d4ce660, 24) = 0 rseq(0x55557d4ceca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3353759932", 4096) = 28 getrandom("\xf1\x25\x05\x53\x84\xe8\x95\xd5", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557d4ced00 brk(0x55557d4efd00) = 0x55557d4efd00 brk(0x55557d4f0000) = 0x55557d4f0000 mprotect(0x7f81e7b21000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 write(1, "executing program\n", 18executing program ) = 18 socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 3 openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 4 ioctl(4, TUNSETIFF, 0x20000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 5 socket(AF_UNIX, SOCK_STREAM, 0) = 6 ioctl(6, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x38\x00\x00\x00\x24\x00\x41\x65\x2a\xbd\x70\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00", iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 20.715864][ T24] audit: type=1400 audit(1736030353.740:66): avc: denied { execmem } for pid=287 comm="syz-executor335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.722716][ T287] ================================================================== [ 20.724130][ T287] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xbb8/0x3630 [ 20.724963][ T24] audit: type=1400 audit(1736030353.750:67): avc: denied { read } for pid=133 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 20.725512][ T287] Read of size 8 at addr ffff88810c91cac0 by task syz-executor335/287 [ 20.729503][ T287] [ 20.729831][ T287] CPU: 0 PID: 287 Comm: syz-executor335 Not tainted 5.10.232-syzkaller-00746-g49e8ba0a684f #0 [ 20.731198][ T287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 20.732548][ T287] Call Trace: [ 20.732984][ T287] dump_stack_lvl+0x1e2/0x24b [ 20.733608][ T287] ? bfq_pos_tree_add_move+0x43b/0x43b [ 20.734326][ T287] ? panic+0x812/0x812 [ 20.734855][ T287] print_address_description+0x81/0x3b0 [ 20.735573][ T287] kasan_report+0x179/0x1c0 [ 20.737477][ T287] ? tc_setup_flow_action+0xbb8/0x3630 [ 20.742772][ T287] ? tc_setup_flow_action+0xbb8/0x3630 [ 20.748072][ T287] __asan_report_load8_noabort+0x14/0x20 [ 20.753543][ T287] tc_setup_flow_action+0xbb8/0x3630 [ 20.758655][ T287] ? __kmalloc+0x1aa/0x330 [ 20.762904][ T287] ? flow_rule_alloc+0x30/0x2b0 [ 20.767597][ T287] mall_replace_hw_filter+0x394/0xc10 [ 20.772798][ T287] ? mall_set_parms+0x440/0x440 [ 20.777487][ T287] ? tcf_exts_destroy+0xb0/0xb0 [ 20.782171][ T287] ? pcpu_memcg_post_alloc_hook+0x1c8/0x360 [ 20.787909][ T287] ? pcpu_alloc+0xfa0/0x1420 [ 20.792328][ T287] ? mall_set_parms+0x4b/0x440 [ 20.796926][ T287] ? mall_set_parms+0x1a2/0x440 [ 20.801613][ T287] mall_change+0x573/0x7a0 [ 20.805877][ T287] ? __kasan_check_write+0x14/0x20 [ 20.810816][ T287] ? mall_get+0xb0/0xb0 [ 20.814809][ T287] ? tcf_chain_tp_insert_unique+0xa90/0xbb0 [ 20.820538][ T287] tc_new_tfilter+0x168e/0x1dc0 [ 20.825230][ T287] ? mall_get+0xb0/0xb0 [ 20.829219][ T287] ? tcf_gate_entry_destructor+0x20/0x20 [ 20.834684][ T287] ? security_capable+0x87/0xb0 [ 20.839377][ T287] ? ns_capable+0x89/0xe0 [ 20.843534][ T287] ? netlink_net_capable+0x125/0x160 [ 20.848657][ T287] ? tcf_gate_entry_destructor+0x20/0x20 [ 20.854125][ T287] rtnetlink_rcv_msg+0x77a/0xc50 [ 20.858909][ T287] ? is_bpf_text_address+0x172/0x190 [ 20.864018][ T287] ? rtnetlink_bind+0x80/0x80 [ 20.868532][ T287] ? arch_stack_walk+0xf3/0x140 [ 20.873220][ T287] ? stack_trace_save+0x113/0x1c0 [ 20.878077][ T287] ? stack_trace_snprint+0xf0/0xf0 [ 20.883027][ T287] ? avc_has_perm+0x14d/0x400 [ 20.887552][ T287] ? memcpy+0x56/0x70 [ 20.891370][ T287] ? avc_has_perm+0x275/0x400 [ 20.895875][ T287] ? __kasan_slab_alloc+0xb1/0xe0 [ 20.900731][ T287] ? slab_post_alloc_hook+0x61/0x2f0 [ 20.905853][ T287] ? kmem_cache_alloc+0x168/0x2e0 [ 20.910716][ T287] ? avc_has_perm_noaudit+0x240/0x240 [ 20.915920][ T287] ? iov_iter_advance+0x258/0xb20 [ 20.920782][ T287] netlink_rcv_skb+0x1cf/0x410 [ 20.925386][ T287] ? rtnetlink_bind+0x80/0x80 [ 20.929895][ T287] ? netlink_ack+0xb30/0xb30 [ 20.934325][ T287] ? __netlink_lookup+0x37b/0x3a0 [ 20.939185][ T287] rtnetlink_rcv+0x1c/0x20 [ 20.943435][ T287] netlink_unicast+0x8df/0xac0 [ 20.948036][ T287] ? netlink_detachskb+0x90/0x90 [ 20.952809][ T287] ? security_netlink_send+0x7b/0xa0 [ 20.957929][ T287] netlink_sendmsg+0xa46/0xd00 [ 20.962529][ T287] ? netlink_getsockopt+0x5c0/0x5c0 [ 20.967565][ T287] ? security_socket_sendmsg+0x82/0xb0 [ 20.972857][ T287] ? netlink_getsockopt+0x5c0/0x5c0 [ 20.977893][ T287] ____sys_sendmsg+0x59e/0x8f0 [ 20.982491][ T287] ? __sys_sendmsg_sock+0x40/0x40 [ 20.987355][ T287] ? import_iovec+0xe5/0x120 [ 20.991778][ T287] ___sys_sendmsg+0x252/0x2e0 [ 20.996290][ T287] ? __sys_sendmsg+0x280/0x280 [ 21.000895][ T287] ? finish_task_switch+0x130/0x5a0 [ 21.005927][ T287] ? __schedule+0xbee/0x1330 [ 21.010355][ T287] ? __kasan_check_write+0x14/0x20 [ 21.015300][ T287] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 21.020254][ T287] ? __kasan_check_read+0x11/0x20 [ 21.025110][ T287] ? __fdget+0x179/0x240 [ 21.029186][ T287] __se_sys_sendmsg+0x1b1/0x280 [ 21.033874][ T287] ? _raw_spin_unlock_irq+0x4e/0x70 [ 21.038909][ T287] ? __x64_sys_sendmsg+0x90/0x90 [ 21.043684][ T287] ? fpu__clear_all+0x20/0x20 [ 21.048195][ T287] __x64_sys_sendmsg+0x7b/0x90 [ 21.052797][ T287] do_syscall_64+0x34/0x70 [ 21.057046][ T287] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.062777][ T287] RIP: 0033:0x7f81e7aae829 [ 21.067030][ T287] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 21.086471][ T287] RSP: 002b:00007ffe5e4decb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 21.094717][ T287] RAX: ffffffffffffffda RBX: 00007ffe5e4dee88 RCX: 00007f81e7aae829 [ 21.102526][ T287] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 [ 21.110345][ T287] RBP: 00007f81e7b21610 R08: 0000000000000001 R09: 00007ffe5e4dee88 [ 21.118149][ T287] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 21.125960][ T287] R13: 00007ffe5e4dee78 R14: 0000000000000001 R15: 0000000000000001 [ 21.133774][ T287] [ 21.135941][ T287] Allocated by task 287: [ 21.140030][ T287] ____kasan_kmalloc+0xdb/0x110 [ 21.144709][ T287] __kasan_kmalloc+0x9/0x10 [ 21.149051][ T287] __kmalloc+0x1aa/0x330 [ 21.153131][ T287] tcf_idr_create+0x5f/0x770 [ 21.157561][ T287] tcf_idr_create_from_flags+0x5f/0x70 [ 21.162850][ T287] tcf_gact_init+0x373/0x6e0 [ 21.167274][ T287] tcf_action_init_1+0x584/0x830 [ 21.172047][ T287] tcf_action_init+0x2b5/0x800 [ 21.176650][ T287] tcf_exts_validate+0x232/0x540 [ 21.181426][ T287] mall_set_parms+0x4b/0x440 [ 21.185847][ T287] mall_change+0x49e/0x7a0 [ 21.190101][ T287] tc_new_tfilter+0x168e/0x1dc0 [ 21.194791][ T287] rtnetlink_rcv_msg+0x77a/0xc50 [ 21.199566][ T287] netlink_rcv_skb+0x1cf/0x410 [ 21.204162][ T287] rtnetlink_rcv+0x1c/0x20 [ 21.208415][ T287] netlink_unicast+0x8df/0xac0 [ 21.213016][ T287] netlink_sendmsg+0xa46/0xd00 [ 21.217620][ T287] ____sys_sendmsg+0x59e/0x8f0 [ 21.222215][ T287] ___sys_sendmsg+0x252/0x2e0 [ 21.226728][ T287] __se_sys_sendmsg+0x1b1/0x280 [ 21.231417][ T287] __x64_sys_sendmsg+0x7b/0x90 [ 21.236022][ T287] do_syscall_64+0x34/0x70 [ 21.240270][ T287] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.246006][ T287] [ 21.248165][ T287] The buggy address belongs to the object at ffff88810c91ca00 [ 21.248165][ T287] which belongs to the cache kmalloc-192 of size 192 [ 21.262064][ T287] The buggy address is located 0 bytes to the right of [ 21.262064][ T287] 192-byte region [ffff88810c91ca00, ffff88810c91cac0) [ 21.275513][ T287] The buggy address belongs to the page: [ 21.281008][ T287] page:ffffea0004324700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c91c [ 21.291137][ T287] flags: 0x4000000000000200(slab) [ 21.296015][ T287] raw: 4000000000000200 ffffea0004324a00 0000000200000002 ffff888100043380 [ 21.304413][ T287] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 21.312828][ T287] page dumped because: kasan: bad access detected [ 21.319086][ T287] page_owner tracks the page as allocated [ 21.324642][ T287] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 65, ts 3184401735, free_ts 3179469715 [ 21.340176][ T287] prep_new_page+0x166/0x180 [ 21.344599][ T287] get_page_from_freelist+0x2d8c/0x2f30 [ 21.349998][ T287] __alloc_pages_nodemask+0x435/0xaf0 [ 21.355184][ T287] new_slab+0x80/0x400 [ 21.359094][ T287] ___slab_alloc+0x302/0x4b0 [ 21.363515][ T287] __slab_alloc+0x63/0xa0 [ 21.367682][ T287] kmem_cache_alloc_trace+0x1bd/0x2e0 [ 21.372890][ T287] shmem_fill_super+0x78/0xb50 [ 21.377497][ T287] get_tree_nodev+0xb2/0x160 [ 21.381920][ T287] shmem_get_tree+0x1c/0x20 [ 21.386258][ T287] vfs_get_tree+0x88/0x290 [ 21.390516][ T287] do_new_mount+0x2ba/0xb30 [ 21.394849][ T287] path_mount+0x56f/0xcb0 [ 21.399020][ T287] __se_sys_mount+0x2c4/0x3b0 [ 21.403530][ T287] __x64_sys_mount+0xbf/0xd0 [ 21.407957][ T287] do_syscall_64+0x34/0x70 [ 21.412206][ T287] page last free stack trace: [ 21.416722][ T287] free_unref_page_prepare+0x2ae/0x2d0 [ 21.422021][ T287] free_unref_page_list+0x122/0xb20 [ 21.427053][ T287] release_pages+0xea0/0xef0 [ 21.431476][ T287] free_pages_and_swap_cache+0x8a/0xa0 [ 21.436770][ T287] tlb_finish_mmu+0x177/0x320 [ 21.441287][ T287] exit_mmap+0x306/0x560 [ 21.445372][ T287] __mmput+0x95/0x2d0 [ 21.449189][ T287] mmput+0x59/0x170 [ 21.452828][ T287] do_exit+0xbda/0x2a50 [ 21.456825][ T287] do_group_exit+0x141/0x310 [ 21.461252][ T287] __x64_sys_exit_group+0x3f/0x40 [ 21.466110][ T287] do_syscall_64+0x34/0x70 [ 21.470364][ T287] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.476087][ T287] [ 21.478264][ T287] Memory state around the buggy address: [ 21.483726][ T287] ffff88810c91c980: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.491624][ T287] ffff88810c91ca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.499522][ T287] >ffff88810c91ca80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 21.507418][ T287] ^ sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x84\x00\x00\x00\x2c\x00\x27\x0d\x29\xbd\x30\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x07\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x50\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x02\x00\x00\x00\x40\x00\x00\x00\xff\xff\xff\xff\x70\xe6\x00\x00"..., iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 132 exit_group(0) = ? +++ exited with 0 +++ [ 21.513409][ T287] ffff88810c91cb00: 00 00 00 00 00 00 00 00 00 00 00