ci2-android-6-12-rust/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-12-rust/syz-executor2233873802 <...> Warning: Permanently added '10.128.1.83' (ED25519) to the list of known hosts. execve("ci2-android-6-12-rust/syz-executor2233873802", ["ci2-android-6-12-rust/syz-executor2233873802"], 0x7ffc9bb81d90 /* 10 vars */) = 0 brk(NULL) = 0x555572f1e000 brk(0x555572f1ed40) = 0x555572f1ed40 arch_prctl(ARCH_SET_FS, 0x555572f1e3c0) = 0 set_tid_address(0x555572f1e690) = 312 set_robust_list(0x555572f1e6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-12-rust/syz-executor2233873802", 4096) = 50 getrandom("\xc7\x38\xcd\x91\x7d\x74\x4d\xc9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555572f1ed40 brk(0x555572f3fd40) = 0x555572f3fd40 brk(0x555572f40000) = 0x555572f40000 mprotect(0x7fa71b9af000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 313 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 314 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 315 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 316 attached , child_tidptr=0x555572f1e690) = 316 [pid 312] rt_sigprocmask(SIG_SETMASK, [] [pid 316] set_robust_list(0x555572f1e6a0, 24 [pid 312] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 316] <... set_robust_list resumed>) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 316] <... clone resumed>, child_tidptr=0x555572f1e690) = 317 [pid 317] <... prctl resumed>) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 317] setpgid(0, 0 [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 317] <... setpgid resumed>) = 0 [pid 317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 317] write(3, "1000", 4) = 4 [pid 317] close(3) = 0 [pid 317] write(1, "executing program\n", 18) = 18 [pid 317] mkdirat(AT_FDCWD, "./config", 0777) = 0 [pid 317] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 317] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 317] rmdir(NULL) = -1 EFAULT (Bad address) [pid 317] rmdir("./config/usb_gadget/g1") = 0 [pid 317] exit_group(0) = ? [pid 317] +++ exited with 0 +++ [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=317, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...>ci2-android-6-12-rust/strace-static-x86_64: Process 313 attached [pid 313] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 319 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 316] <... restart_syscall resumed>) = 0 [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 320 attached [pid 320] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, []ci2-android-6-12-rust/strace-static-x86_64: Process 314 attached ci2-android-6-12-rust/strace-static-x86_64: Process 315 attached , NULL, 8) = 0 [pid 316] <... clone resumed>, child_tidptr=0x555572f1e690) = 320 [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 320] <... prctl resumed>) = 0 [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] setpgid(0, 0) = 0 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 320] write(3, "1000", 4) = 4 [pid 320] close(3) = 0 [pid 320] write(1, "executing program\n", 18 [pid 315] set_robust_list(0x555572f1e6a0, 24 [pid 314] set_robust_list(0x555572f1e6a0, 24ci2-android-6-12-rust/strace-static-x86_64: Process 319 attached [pid 315] <... set_robust_list resumed>) = 0 [pid 320] <... write resumed>) = 18 [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 314] <... set_robust_list resumed>) = 0 [pid 320] mkdirat(AT_FDCWD, "./config", 0777 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] <... mkdirat resumed>) = -1 EEXIST (File exists) executing program executing program [pid 319] set_robust_list(0x555572f1e6a0, 24 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[] [pid 314] rt_sigprocmask(SIG_SETMASK, [] [pid 320] mount(NULL, "./config", "configfs", 0, NULL [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 315] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 320] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 314] rt_sigprocmask(SIG_BLOCK, ~[] [pid 320] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777ci2-android-6-12-rust/strace-static-x86_64: Process 321 attached ) = 0 [pid 319] <... set_robust_list resumed>) = 0 [pid 314] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 319] rt_sigprocmask(SIG_SETMASK, [] [pid 315] <... clone resumed>, child_tidptr=0x555572f1e690) = 321 [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 320] rmdir(NULL) = -1 EFAULT (Bad address) [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 319] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] <... clone resumed>, child_tidptr=0x555572f1e690) = 322 ci2-android-6-12-rust/strace-static-x86_64: Process 322 attached [pid 322] set_robust_list(0x555572f1e6a0, 24 [pid 321] set_robust_list(0x555572f1e6a0, 24 [pid 320] rmdir("./config/usb_gadget/g1" [pid 314] rt_sigprocmask(SIG_SETMASK, [] [pid 322] <... set_robust_list resumed>) = 0 [pid 321] <... set_robust_list resumed>) = 0 [pid 320] <... rmdir resumed>) = 0 [pid 322] rt_sigprocmask(SIG_SETMASK, [] [pid 321] rt_sigprocmask(SIG_SETMASK, [] [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 321] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 321] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 322] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 321] <... prctl resumed>) = 0 [pid 319] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 322] setpgid(0, 0) = 0 [pid 321] setpgid(0, 0 [pid 320] exit_group(0 [pid 319] <... prctl resumed>) = 0 [pid 322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 320] <... exit_group resumed>) = ? [pid 322] write(3, "1000", 4 [pid 320] +++ exited with 0 +++ [pid 322] <... write resumed>) = 4 [pid 322] close(3 [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=320, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 322] <... close resumed>) = 0 [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 322] write(1, "executing program\n", 18) = 18 [pid 322] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 316] <... restart_syscall resumed>) = 0 [pid 322] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) executing program [pid 322] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 323 attached [pid 323] set_robust_list(0x555572f1e6a0, 24 [pid 322] rmdir(NULL [pid 316] <... clone resumed>, child_tidptr=0x555572f1e690) = 323 [pid 323] <... set_robust_list resumed>) = 0 [pid 322] <... rmdir resumed>) = -1 EFAULT (Bad address) [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 323] rt_sigprocmask(SIG_SETMASK, [] [pid 322] rmdir("./config/usb_gadget/g1" [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 323] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] <... rmdir resumed>) = 0 [pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 323] setpgid(0, 0) = 0 [pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 323] write(3, "1000", 4) = 4 [pid 323] close(3 [pid 322] exit_group(0 [pid 323] <... close resumed>) = 0 [pid 322] <... exit_group resumed>) = ? [pid 323] write(1, "executing program\n", 18 [pid 322] +++ exited with 0 +++ [pid 323] <... write resumed>) = 18 [pid 323] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 323] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 323] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 323] rmdir(NULL) = -1 EFAULT (Bad address) executing program [pid 323] rmdir("./config/usb_gadget/g1") = 0 [pid 323] exit_group(0) = ? [pid 323] +++ exited with 0 +++ [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=323, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 321] <... setpgid resumed>) = 0 [pid 321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 321] write(3, "1000", 4) = 4 [pid 321] close(3) = 0 [pid 321] write(1, "executing program\n", 18) = 18 [pid 321] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 321] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 321] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 321] rmdir(NULL) = -1 EFAULT (Bad address) [pid 321] rmdir("./config/usb_gadget/g1") = 0 [pid 321] exit_group(0) = ? executing program [pid 321] +++ exited with 0 +++ [pid 316] <... restart_syscall resumed>) = 0 [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 324 attached [pid 324] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 324] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 324] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 316] <... clone resumed>, child_tidptr=0x555572f1e690) = 324 [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 324] <... prctl resumed>) = 0 [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 324] setpgid(0, 0) = 0 [pid 324] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 324] write(3, "1000", 4) = 4 [pid 324] close(3) = 0 [pid 324] write(1, "executing program\n", 18) = 18 [pid 324] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 324] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) executing program [pid 324] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 324] rmdir(NULL) = -1 EFAULT (Bad address) [pid 324] rmdir("./config/usb_gadget/g1") = 0 [pid 324] exit_group(0) = ? [pid 324] +++ exited with 0 +++ [ 23.614909][ T36] audit: type=1400 audit(1787107356.560:64): avc: denied { execmem } for pid=312 comm="syz-executor223" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=324, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 319] setpgid(0, 0) = 0 [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=321, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 314] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=322, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 319] write(3, "1000", 4 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[] [pid 314] rt_sigprocmask(SIG_BLOCK, ~[] [pid 319] <... write resumed>) = 4 [pid 315] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 314] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 319] close(3 [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 319] <... close resumed>) = 0 [pid 319] write(1, "executing program\n", 18 [pid 315] <... clone resumed>, child_tidptr=0x555572f1e690) = 325 [pid 314] <... clone resumed>, child_tidptr=0x555572f1e690) = 326 [pid 319] <... write resumed>) = 18 [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 314] rt_sigprocmask(SIG_SETMASK, [] [pid 319] mkdirat(AT_FDCWD, "./config", 0777 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 319] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 319] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 319] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 319] rmdir(NULL) = -1 EFAULT (Bad address) [pid 319] rmdir("./config/usb_gadget/g1") = 0 [pid 319] exit_group(0) = ? [pid 319] +++ exited with 0 +++ executing program ci2-android-6-12-rust/strace-static-x86_64: Process 325 attached [pid 325] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 326 attached [pid 325] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 316] <... restart_syscall resumed>) = 0 [pid 325] <... prctl resumed>) = 0 [pid 325] setpgid(0, 0) = 0 [pid 325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 325] write(3, "1000", 4) = 4 [pid 325] close(3) = 0 executing program [pid 325] write(1, "executing program\n", 18) = 18 [pid 325] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 325] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 325] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 325] rmdir(NULL) = -1 EFAULT (Bad address) [pid 325] rmdir("./config/usb_gadget/g1") = 0 [pid 325] exit_group(0) = ? [pid 325] +++ exited with 0 +++ [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=325, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 315] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 327 attached [pid 327] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 327] setpgid(0, 0) = 0 [pid 327] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 327] write(3, "1000", 4) = 4 [pid 327] close(3) = 0 executing program [pid 327] write(1, "executing program\n", 18) = 18 [pid 327] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 327] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 327] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 315] <... clone resumed>, child_tidptr=0x555572f1e690) = 327 [pid 327] <... mkdirat resumed>) = 0 [pid 315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] rmdir(NULL) = -1 EFAULT (Bad address) [pid 327] rmdir("./config/usb_gadget/g1" [pid 326] set_robust_list(0x555572f1e6a0, 24 [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=319, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 327] <... rmdir resumed>) = 0 [pid 327] exit_group(0) = ? [pid 327] +++ exited with 0 +++ [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=327, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [ 23.642602][ T36] audit: type=1400 audit(1787107356.560:65): avc: denied { mounton } for pid=317 comm="syz-executor223" path="/root/config" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 23.666435][ T36] audit: type=1400 audit(1787107356.560:66): avc: denied { mount } for pid=317 comm="syz-executor223" name="/" dev="configfs" ino=2425 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 23.689531][ T36] audit: type=1400 audit(1787107356.560:67): avc: denied { search } for pid=317 comm="syz-executor223" name="/" dev="configfs" ino=2425 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [pid 315] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 326] <... set_robust_list resumed>) = 0 [pid 326] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 326] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 326] setpgid(0, 0) = 0 [pid 326] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 326] write(3, "1000", 4) = 4 [pid 326] close(3) = 0 [pid 326] write(1, "executing program\n", 18) = 18 [pid 326] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 326] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 326] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 326] rmdir(NULL) = -1 EFAULT (Bad address) [pid 326] rmdir("./config/usb_gadget/g1") = 0 [pid 326] exit_group(0) = ? [pid 326] +++ exited with 0 +++ [pid 314] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=326, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- executing program [pid 314] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 315] <... restart_syscall resumed>) = 0 [pid 314] <... restart_syscall resumed>) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 328 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 329 [pid 315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 330 attached , child_tidptr=0x555572f1e690) = 330 [pid 330] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 330] rt_sigprocmask(SIG_SETMASK, [] [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 330] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 330] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 330] setpgid(0, 0) = 0 [pid 330] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 330] write(3, "1000", 4) = 4 [pid 330] close(3) = 0 [pid 330] write(1, "executing program\n", 18) = 18 executing program [pid 330] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 330] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 330] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 330] rmdir(NULL) = -1 EFAULT (Bad address) [pid 330] rmdir("./config/usb_gadget/g1") = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 329 attached ci2-android-6-12-rust/strace-static-x86_64: Process 328 attached [pid 330] exit_group(0) = ? [pid 330] +++ exited with 0 +++ [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=330, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 329] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 329] setpgid(0, 0) = 0 [pid 329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 329] write(3, "1000", 4) = 4 [pid 329] close(3) = 0 [pid 329] write(1, "executing program\n", 18) = 18 [pid 329] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 329] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 329] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 329] rmdir(NULL) = -1 EFAULT (Bad address) [pid 329] rmdir("./config/usb_gadget/g1") = 0 [pid 329] exit_group(0) = ? executing program [pid 328] set_robust_list(0x555572f1e6a0, 24 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[] [pid 316] <... restart_syscall resumed>) = 0 [ 23.712093][ T36] audit: type=1400 audit(1787107356.560:68): avc: denied { write } for pid=317 comm="syz-executor223" name="usb_gadget" dev="configfs" ino=2426 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.735342][ T36] audit: type=1400 audit(1787107356.560:69): avc: denied { add_name } for pid=317 comm="syz-executor223" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [pid 328] <... set_robust_list resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 331 [pid 316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] +++ exited with 0 +++ [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=329, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 315] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 328] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... clone resumed>, child_tidptr=0x555572f1e690) = 332 ci2-android-6-12-rust/strace-static-x86_64: Process 331 attached [pid 328] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 332 attached [pid 332] set_robust_list(0x555572f1e6a0, 24 [pid 331] set_robust_list(0x555572f1e6a0, 24 [pid 328] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 332] <... set_robust_list resumed>) = 0 [pid 332] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 332] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 332] setpgid(0, 0) = 0 [pid 332] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 332] write(3, "1000", 4) = 4 [pid 332] close(3) = 0 [pid 332] write(1, "executing program\n", 18) = 18 [pid 332] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 332] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 332] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 332] rmdir(NULL) = -1 EFAULT (Bad address) [pid 332] rmdir("./config/usb_gadget/g1") = 0 [pid 332] exit_group(0) = ? [pid 332] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=332, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-12-rust/strace-static-x86_64: Process 333 attached , child_tidptr=0x555572f1e690) = 333 [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 333] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 333] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 333] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 333] setpgid(0, 0) = 0 [pid 333] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 333] write(3, "1000", 4) = 4 [pid 333] close(3) = 0 [pid 333] write(1, "executing program\n", 18) = 18 [pid 333] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 333] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 333] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 333] rmdir(NULL) = -1 EFAULT (Bad address) [pid 333] rmdir("./config/usb_gadget/g1" [pid 313] <... restart_syscall resumed>) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 334 [pid 313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 334 attached [pid 334] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 334] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 334] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 334] setpgid(0, 0) = 0 [pid 334] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 334] write(3, "1000", 4) = 4 [pid 334] close(3) = 0 [pid 334] write(1, "executing program\n", 18) = 18 [pid 334] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 334] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 334] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 334] rmdir(NULL) = -1 EFAULT (Bad address) [pid 334] rmdir("./config/usb_gadget/g1") = 0 [pid 334] exit_group(0) = ? [pid 334] +++ exited with 0 +++ [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=334, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 333] <... rmdir resumed>) = 0 [pid 333] exit_group(0) = ? [pid 333] +++ exited with 0 +++ [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=333, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- executing program executing program executing program [pid 315] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 331] <... set_robust_list resumed>) = 0 [pid 313] <... restart_syscall resumed>) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 335 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 328] <... prctl resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 328] setpgid(0, 0) = 0 [pid 328] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 328] write(3, "1000", 4) = 4 [pid 328] close(3) = 0 executing program [pid 328] write(1, "executing program\n", 18) = 18 [pid 328] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 328] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 328] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 331] rt_sigprocmask(SIG_SETMASK, [] [pid 328] <... mkdirat resumed>) = 0 [pid 328] rmdir(NULL) = -1 EFAULT (Bad address) [ 23.756347][ T36] audit: type=1400 audit(1787107356.560:70): avc: denied { create } for pid=317 comm="syz-executor223" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 23.777468][ T36] audit: type=1400 audit(1787107356.560:71): avc: denied { remove_name } for pid=317 comm="syz-executor223" name="g1" dev="configfs" ino=3015 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.803264][ T328] BUG: scheduling while atomic: syz-executor223/328/0x00000002 [pid 328] rmdir("./config/usb_gadget/g1"ci2-android-6-12-rust/strace-static-x86_64: Process 335 attached [pid 331] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 315] <... restart_syscall resumed>) = 0 [ 23.808166][ T36] audit: type=1400 audit(1787107356.560:72): avc: denied { rmdir } for pid=317 comm="syz-executor223" name="g1" dev="configfs" ino=3015 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.810856][ T328] Modules linked in: [ 23.833302][ T36] audit: type=1400 audit(1787107356.590:73): avc: denied { mounton } for pid=320 comm="syz-executor223" path="/root/config" dev="configfs" ino=2425 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.837180][ T328] CPU: 0 UID: 0 PID: 328 Comm: syz-executor223 Not tainted syzkaller #0 851f5cb62ab9f9c24538876695daf6a72142c571 [ 23.837206][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.837217][ T328] Call Trace: [ 23.837223][ T328] [ 23.837230][ T328] __dump_stack+0x21/0x30 [ 23.837258][ T328] dump_stack_lvl+0x140/0x1c0 [ 23.837282][ T328] ? __cfi_dump_stack_lvl+0x10/0x10 [ 23.837307][ T328] dump_stack+0x19/0x20 [ 23.837329][ T328] __schedule_bug+0x12b/0x200 [ 23.837349][ T328] ? find_proxy_task+0x2460/0x2460 [ 23.837368][ T328] ? kernel_text_address+0xa9/0xe0 [ 23.837391][ T328] ? __kernel_text_address+0x11/0x40 [ 23.837414][ T328] ? unwind_get_return_address+0x51/0x90 [ 23.837435][ T328] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 23.837457][ T328] __schedule+0xb85/0x20b0 [ 23.837480][ T328] ? stack_trace_save+0xaa/0x100 [ 23.837500][ T328] ? __sched_text_start+0x10/0x10 [ 23.837522][ T328] ? __kasan_check_read+0x15/0x20 [ 23.837539][ T328] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 23.837565][ T328] ? __kasan_check_write+0x18/0x20 [ 23.837582][ T328] ? _raw_spin_lock_irq+0x93/0x120 [ 23.837602][ T328] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 23.837622][ T328] schedule+0xc5/0x240 [ 23.837643][ T328] schedule_preempt_disabled+0x14/0x30 [ 23.837666][ T328] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 23.837686][ T328] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 23.837704][ T328] ? try_to_wake_up+0x111a/0x1fd0 [ 23.837724][ T328] ? __kasan_check_write+0x18/0x20 [ 23.837741][ T328] ? wake_q_add_safe+0x29/0x100 [ 23.837757][ T328] ? cpus_share_resources+0xa0/0x130 [ 23.837777][ T328] ? rwsem_mark_wake+0x507/0x770 [ 23.837802][ T328] ? __kasan_check_write+0x18/0x20 [ 23.837819][ T328] ? rwsem_read_trylock+0x275/0x5a0 [ 23.837843][ T328] ? downgrade_write+0x470/0x470 [ 23.837869][ T328] down_write+0x163/0x2b0 [ 23.837886][ T328] ? __cfi_down_write+0x10/0x10 [ 23.837903][ T328] ? __kasan_check_write+0x18/0x20 [ 23.837927][ T328] kernfs_remove_by_name_ns+0x8c/0x180 [ 23.837952][ T328] sysfs_remove_group+0x108/0x250 [ 23.837972][ T328] dpm_sysfs_remove+0x99/0xd0 [ 23.837994][ T328] device_del+0x241/0xcf0 [ 23.838018][ T328] ? __cfi_class_find_device+0x10/0x10 [ 23.838036][ T328] ? __cfi_device_del+0x10/0x10 [ 23.838064][ T328] ? __kasan_check_write+0x18/0x20 [ 23.838081][ T328] ? kobject_put+0x1cc/0x2a0 [ 23.838101][ T328] device_destroy+0xb0/0x100 [ 23.838116][ T328] ? __cfi_device_destroy+0x10/0x10 [ 23.838141][ T328] ? __kasan_check_write+0x18/0x20 [ 23.838159][ T328] android_device_destroy+0x118/0x180 [ 23.838183][ T328] gadgets_drop+0x1d/0x30 [ 23.838199][ T328] ? __cfi_gadgets_drop+0x10/0x10 [ 23.838215][ T328] configfs_rmdir+0x8b7/0x9b0 [ 23.838239][ T328] vfs_rmdir+0x3de/0x560 [ 23.838263][ T328] do_rmdir+0x29a/0x590 [ 23.838285][ T328] ? __cfi_do_rmdir+0x10/0x10 [ 23.838309][ T328] ? __kasan_check_write+0x18/0x20 [ 23.838327][ T328] __x64_sys_rmdir+0x4b/0x60 [ 23.838349][ T328] x64_sys_call+0xaf7/0x2ee0 [ 23.838366][ T328] do_syscall_64+0x57/0xf0 [ 23.838385][ T328] ? clear_bhb_loop+0x50/0xa0 [ 23.838409][ T328] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.838432][ T328] RIP: 0033:0x7fa71b91c5f9 [ 23.838447][ T328] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 23.838461][ T328] RSP: 002b:00007fff09794c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 23.838481][ T328] RAX: ffffffffffffffda RBX: 0031672f74656764 RCX: 00007fa71b91c5f9 [pid 328] <... rmdir resumed>) = 0 [pid 335] set_robust_list(0x555572f1e6a0, 24 [pid 331] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 335] <... set_robust_list resumed>) = 0 [pid 331] <... prctl resumed>) = 0 [pid 328] exit_group(0 [pid 335] rt_sigprocmask(SIG_SETMASK, [] [pid 331] setpgid(0, 0 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[] [pid 335] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 331] <... setpgid resumed>) = 0 [pid 315] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 328] <... exit_group resumed>) = ? ci2-android-6-12-rust/strace-static-x86_64: Process 336 attached [pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 331] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 328] +++ exited with 0 +++ [pid 336] set_robust_list(0x555572f1e6a0, 24 [pid 335] <... prctl resumed>) = 0 [pid 336] <... set_robust_list resumed>) = 0 [pid 335] setpgid(0, 0 [pid 315] <... clone resumed>, child_tidptr=0x555572f1e690) = 336 [pid 314] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=328, si_uid=0, si_status=0, si_utime=0, si_stime=42 /* 0.42 s */} --- [pid 331] <... openat resumed>) = 3 [pid 335] <... setpgid resumed>) = 0 [pid 314] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 336] rt_sigprocmask(SIG_SETMASK, [] [pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 331] write(3, "1000", 4 [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 336] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 335] <... openat resumed>) = 3 [pid 331] <... write resumed>) = 4 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 335] write(3, "1000", 4 [ 23.838494][ T328] RDX: ffffffffffffffd8 RSI: 00007fa71b91c5f9 RDI: 0000200000000600 [ 23.838508][ T328] RBP: 00000000000f4240 R08: 0000000000000009 R09: 0000000000000009 [ 23.838519][ T328] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000005c64 [ 23.838530][ T328] R13: 00007fff09794c3c R14: 00007fff09794c50 R15: 00007fff09794c40 [ 23.838546][ T328] [ 23.839653][ T328] BUG: scheduling while atomic: syz-executor223/328/0x00000000 [ 24.254604][ T328] Modules linked in: [pid 331] close(3 [pid 336] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 335] <... write resumed>) = 4 [pid 331] <... close resumed>) = 0 [pid 336] <... prctl resumed>) = 0 [pid 335] close(3 executing program [ 24.258536][ T328] CPU: 0 UID: 0 PID: 328 Comm: syz-executor223 Tainted: G W syzkaller #0 851f5cb62ab9f9c24538876695daf6a72142c571 [ 24.258568][ T328] Tainted: [W]=WARN [ 24.258574][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.258584][ T328] Call Trace: [ 24.258590][ T328] [ 24.258597][ T328] __dump_stack+0x21/0x30 [ 24.258627][ T328] dump_stack_lvl+0x140/0x1c0 [ 24.258651][ T328] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.258675][ T328] dump_stack+0x19/0x20 [ 24.258697][ T328] __schedule_bug+0x12b/0x200 [ 24.258720][ T328] ? find_proxy_task+0x2460/0x2460 [ 24.258745][ T328] __schedule+0xb85/0x20b0 [ 24.258771][ T328] ? preempt_schedule+0xc5/0xe0 [ 24.258797][ T328] ? __cfi_preempt_schedule+0x10/0x10 [ 24.258823][ T328] ? __cfi___wake_up_sync_key+0x10/0x10 [ 24.258844][ T328] ? preempt_schedule_thunk+0x1a/0x40 [ 24.258865][ T328] ? __sched_text_start+0x10/0x10 [ 24.258889][ T328] ? __kasan_check_write+0x18/0x20 [ 24.258909][ T328] ? _raw_spin_lock_irq+0x93/0x120 [ 24.258931][ T328] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.258955][ T328] ? __kasan_check_read+0x15/0x20 [ 24.258973][ T328] ? cgroup_update_frozen+0x160/0x980 [ 24.258997][ T328] schedule+0xc5/0x240 [ 24.259021][ T328] ptrace_stop+0x528/0x8f0 [ 24.259042][ T328] ptrace_notify+0x1de/0x290 [ 24.259067][ T328] ? __cfi_ptrace_notify+0x10/0x10 [ 24.259091][ T328] ? __cfi_do_rmdir+0x10/0x10 [ 24.259118][ T328] ? __kasan_check_write+0x18/0x20 [ 24.259137][ T328] syscall_exit_work+0x84/0x150 [ 24.259156][ T328] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 24.259174][ T328] syscall_exit_to_user_mode+0x15/0xb0 [ 24.259194][ T328] do_syscall_64+0x63/0xf0 [ 24.259216][ T328] ? clear_bhb_loop+0x50/0xa0 [ 24.259243][ T328] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.259268][ T328] RIP: 0033:0x7fa71b91c5f9 [ 24.259285][ T328] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.259301][ T328] RSP: 002b:00007fff09794c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 24.259331][ T328] RAX: 0000000000000000 RBX: 0031672f74656764 RCX: 00007fa71b91c5f9 [ 24.259345][ T328] RDX: ffffffffffffffd8 RSI: 00007fa71b91c5f9 RDI: 0000200000000600 [ 24.259359][ T328] RBP: 00000000000f4240 R08: 0000000000000009 R09: 0000000000000009 [ 24.259371][ T328] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000005c64 [ 24.259383][ T328] R13: 00007fff09794c3c R14: 00007fff09794c50 R15: 00007fff09794c40 [pid 331] write(1, "executing program\n", 18 [pid 336] setpgid(0, 0 executing program [pid 335] <... close resumed>) = 0 [pid 331] <... write resumed>) = 18 [pid 314] <... restart_syscall resumed>) = 0 [pid 336] <... setpgid resumed>) = 0 [pid 335] write(1, "executing program\n", 18 [pid 331] mkdirat(AT_FDCWD, "./config", 0777 [pid 335] <... write resumed>) = 18 [pid 335] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 335] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 331] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 335] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 331] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 331] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 337 ci2-android-6-12-rust/strace-static-x86_64: Process 337 attached [pid 314] rt_sigprocmask(SIG_SETMASK, [] [pid 337] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 337] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 337] <... prctl resumed>) = 0 [pid 335] <... mkdirat resumed>) = 0 [pid 337] setpgid(0, 0 [pid 335] rmdir(NULL [pid 337] <... setpgid resumed>) = 0 [pid 336] <... openat resumed>) = 3 [pid 335] <... rmdir resumed>) = -1 EFAULT (Bad address) [pid 331] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 336] write(3, "1000", 4 [pid 335] rmdir("./config/usb_gadget/g1" [pid 331] rmdir(NULL [pid 337] <... openat resumed>) = 3 [pid 336] <... write resumed>) = 4 [pid 336] close(3) = 0 executing program [pid 336] write(1, "executing program\n", 18) = 18 [pid 336] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 336] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 336] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 335] <... rmdir resumed>) = 0 [pid 337] write(3, "1000", 4 [pid 331] <... rmdir resumed>) = -1 EFAULT (Bad address) [pid 337] <... write resumed>) = 4 [pid 336] <... mkdirat resumed>) = 0 [pid 335] exit_group(0 [pid 331] rmdir("./config/usb_gadget/g1" [pid 336] rmdir(NULL) = -1 EFAULT (Bad address) [pid 336] rmdir("./config/usb_gadget/g1") = 0 [pid 336] exit_group(0) = ? [pid 337] close(3 [pid 336] +++ exited with 0 +++ [pid 335] <... exit_group resumed>) = ? [pid 331] <... rmdir resumed>) = -1 ENOENT (No such file or directory) [pid 337] <... close resumed>) = 0 [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=336, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 315] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 331] exit_group(0 [pid 337] write(1, "executing program\n", 18 [pid 335] +++ exited with 0 +++ [pid 331] <... exit_group resumed>) = ? executing program [pid 337] <... write resumed>) = 18 [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=335, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 337] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 331] +++ exited with 0 +++ [pid 337] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 337] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=331, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 337] <... mkdirat resumed>) = 0 [pid 316] <... restart_syscall resumed>) = 0 [pid 315] <... restart_syscall resumed>) = 0 [pid 313] <... restart_syscall resumed>) = 0 [pid 337] rmdir(NULL) = -1 EFAULT (Bad address) [pid 337] rmdir("./config/usb_gadget/g1" [pid 315] rt_sigprocmask(SIG_BLOCK, ~[] [pid 313] rt_sigprocmask(SIG_BLOCK, ~[] [pid 337] <... rmdir resumed>) = 0 [pid 313] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 337] exit_group(0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 337] <... exit_group resumed>) = ? ci2-android-6-12-rust/strace-static-x86_64: Process 338 attached [pid 316] rt_sigprocmask(SIG_BLOCK, ~[] [pid 315] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 313] <... clone resumed>, child_tidptr=0x555572f1e690) = 338 [pid 338] set_robust_list(0x555572f1e6a0, 24 [pid 337] +++ exited with 0 +++ [pid 316] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 338] <... set_robust_list resumed>) = 0 [pid 316] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 338] rt_sigprocmask(SIG_SETMASK, []ci2-android-6-12-rust/strace-static-x86_64: Process 339 attached , NULL, 8) = 0 [pid 314] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 339] set_robust_list(0x555572f1e6a0, 24 [pid 338] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 316] <... clone resumed>, child_tidptr=0x555572f1e690) = 339 [pid 314] restart_syscall(<... resuming interrupted rt_sigprocmask ...>ci2-android-6-12-rust/strace-static-x86_64: Process 340 attached [pid 339] <... set_robust_list resumed>) = 0 [pid 338] <... prctl resumed>) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [] [pid 315] <... clone resumed>, child_tidptr=0x555572f1e690) = 340 [pid 314] <... restart_syscall resumed>) = 0 [pid 339] rt_sigprocmask(SIG_SETMASK, [] [pid 338] setpgid(0, 0 [pid 316] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 340] set_robust_list(0x555572f1e6a0, 24 [pid 339] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 338] <... setpgid resumed>) = 0 [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 339] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 338] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 340] <... set_robust_list resumed>) = 0 [pid 339] <... prctl resumed>) = 0 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 339] setpgid(0, 0 [pid 338] <... openat resumed>) = 3 [pid 340] rt_sigprocmask(SIG_SETMASK, [] [pid 314] rt_sigprocmask(SIG_BLOCK, ~[] [pid 340] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 339] <... setpgid resumed>) = 0 [pid 338] write(3, "1000", 4 [pid 314] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 338] <... write resumed>) = 4 [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 339] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 338] close(3 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0ci2-android-6-12-rust/strace-static-x86_64: Process 341 attached [pid 338] <... close resumed>) = 0 [pid 341] set_robust_list(0x555572f1e6a0, 24 [pid 338] write(1, "executing program\n", 18 [pid 314] <... clone resumed>, child_tidptr=0x555572f1e690) = 341 executing program [pid 341] <... set_robust_list resumed>) = 0 [pid 340] <... setpgid resumed>) = 0 [pid 339] <... openat resumed>) = 3 [pid 338] <... write resumed>) = 18 [pid 341] rt_sigprocmask(SIG_SETMASK, [] [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 339] write(3, "1000", 4 [pid 338] mkdirat(AT_FDCWD, "./config", 0777 [pid 314] rt_sigprocmask(SIG_SETMASK, [] [pid 341] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 339] <... write resumed>) = 4 [pid 314] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 339] close(3 [pid 341] <... prctl resumed>) = 0 [pid 340] <... openat resumed>) = 3 [pid 338] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 341] setpgid(0, 0 [pid 340] write(3, "1000", 4 [pid 339] <... close resumed>) = 0 [pid 338] mount(NULL, "./config", "configfs", 0, NULL [pid 341] <... setpgid resumed>) = 0 [pid 340] <... write resumed>) = 4 [pid 339] write(1, "executing program\n", 18 [pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 340] close(3 [pid 339] <... write resumed>) = 18 executing program [pid 341] <... openat resumed>) = 3 [pid 340] <... close resumed>) = 0 [pid 339] mkdirat(AT_FDCWD, "./config", 0777 [pid 338] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 341] write(3, "1000", 4 [pid 340] write(1, "executing program\n", 18 [pid 339] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 338] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 341] <... write resumed>) = 4 [pid 341] close(3) = 0 executing program [pid 341] write(1, "executing program\n", 18 [pid 340] <... write resumed>) = 18 [pid 341] <... write resumed>) = 18 executing program [pid 341] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 341] mount(NULL, "./config", "configfs", 0, NULL [pid 339] mount(NULL, "./config", "configfs", 0, NULL [pid 341] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 341] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [pid 340] mkdirat(AT_FDCWD, "./config", 0777 [pid 339] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 338] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 341] rmdir(NULL [pid 340] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 339] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 338] rmdir(NULL [pid 341] <... rmdir resumed>) = -1 EFAULT (Bad address) [pid 341] rmdir("./config/usb_gadget/g1") = 0 [pid 340] mount(NULL, "./config", "configfs", 0, NULL [pid 341] exit_group(0) = ? [pid 341] +++ exited with 0 +++ [pid 339] <... mkdirat resumed>) = 0 [pid 338] <... rmdir resumed>) = -1 EFAULT (Bad address) [pid 340] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 338] rmdir("./config/usb_gadget/g1" [pid 314] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=341, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 339] rmdir(NULL) = -1 EFAULT (Bad address) [pid 339] rmdir("./config/usb_gadget/g1" [pid 338] <... rmdir resumed>) = 0 [pid 314] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 339] <... rmdir resumed>) = -1 ENOENT (No such file or directory) [pid 339] exit_group(0) = ? [pid 339] +++ exited with 0 +++ [pid 340] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 316] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=339, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 316] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 338] exit_group(0) = ? [pid 340] <... mkdirat resumed>) = 0 [pid 338] +++ exited with 0 +++ [pid 340] rmdir(NULL) = -1 EFAULT (Bad address) [pid 314] <... restart_syscall resumed>) = 0 [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=338, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 340] rmdir("./config/usb_gadget/g1" [pid 313] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 24.259400][ T328] [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555572f1e690) = 342 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-12-rust/strace-static-x86_64: Process 342 attached [pid 342] set_robust_list(0x555572f1e6a0, 24) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 342] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 342] setpgid(0, 0) = 0 [pid 342] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 342] write(3, "1000", 4) = 4 [pid 342] close(3) = 0 executing program [pid 342] write(1, "executing program\n", 18) = 18 [pid 342] mkdirat(AT_FDCWD, "./config", 0777) = -1 EEXIST (File exists) [pid 342] mount(NULL, "./config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 342] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 316] <... restart_syscall resumed>) = 0 [pid 313] <... restart_syscall resumed>) = 0 [ 24.551341][ T340] BUG: scheduling while atomic: syz-executor223/340/0x00000002 [ 24.558975][ T340] Modules linked in: [ 24.563450][ T340] CPU: 1 UID: 0 PID: 340 Comm: syz-executor223 Tainted: G W syzkaller #0 851f5cb62ab9f9c24538876695daf6a72142c571 [ 24.563478][ T340] Tainted: [W]=WARN [ 24.563484][ T340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.563493][ T340] Call Trace: [ 24.563498][ T340] [ 24.563505][ T340] __dump_stack+0x21/0x30 [ 24.563531][ T340] dump_stack_lvl+0x140/0x1c0 [ 24.563553][ T340] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.563576][ T340] dump_stack+0x19/0x20 [ 24.563597][ T340] __schedule_bug+0x12b/0x200 [ 24.563614][ T340] ? find_proxy_task+0x2460/0x2460 [ 24.563632][ T340] ? __kasan_check_read+0x15/0x20 [ 24.563649][ T340] ? psi_group_change+0xab6/0x10a0 [ 24.563670][ T340] __schedule+0xb85/0x20b0 [ 24.563692][ T340] ? update_curr+0xf1/0x9c0 [ 24.563708][ T340] ? __sched_text_start+0x10/0x10 [ 24.563729][ T340] ? __kasan_check_read+0x15/0x20 [ 24.563745][ T340] ? irqentry_exit+0x4a/0x60 [ 24.563760][ T340] ? common_interrupt+0x5c/0xb0 [ 24.563782][ T340] ? asm_common_interrupt+0x2b/0x40 [ 24.563806][ T340] schedule+0xc5/0x240 [ 24.563825][ T340] schedule_preempt_disabled+0x14/0x30 [ 24.563846][ T340] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 24.563863][ T340] ? activate_task+0x43b/0x480 [ 24.563880][ T340] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 24.563896][ T340] ? try_to_wake_up+0x111a/0x1fd0 [ 24.563916][ T340] ? __kasan_check_write+0x18/0x20 [ 24.563931][ T340] ? wake_q_add_safe+0x29/0x100 [ 24.563946][ T340] ? cpus_share_resources+0xa0/0x130 [ 24.563963][ T340] ? rwsem_mark_wake+0x507/0x770 [ 24.563988][ T340] ? __kasan_check_write+0x18/0x20 [ 24.564003][ T340] ? rwsem_read_trylock+0x275/0x5a0 [ 24.564028][ T340] ? downgrade_write+0x470/0x470 [ 24.564060][ T340] down_write+0x163/0x2b0 [ 24.564074][ T340] ? __cfi_down_write+0x10/0x10 [ 24.564089][ T340] ? kernfs_name_hash+0x1c7/0x220 [ 24.564110][ T340] ? __kasan_check_write+0x18/0x20 [ 24.564127][ T340] kernfs_remove_by_name_ns+0x8c/0x180 [ 24.564149][ T340] sysfs_remove_group+0x108/0x250 [ 24.564168][ T340] dpm_sysfs_remove+0x99/0xd0 [ 24.564188][ T340] device_del+0x241/0xcf0 [ 24.564210][ T340] ? __cfi_class_find_device+0x10/0x10 [ 24.564227][ T340] ? __cfi_device_del+0x10/0x10 [ 24.564249][ T340] ? __kasan_check_write+0x18/0x20 [ 24.564264][ T340] ? kobject_put+0x1cc/0x2a0 [ 24.564283][ T340] device_destroy+0xb0/0x100 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 24.564297][ T340] ? __cfi_device_destroy+0x10/0x10 [ 24.564320][ T340] ? __kasan_check_write+0x18/0x20 [ 24.564336][ T340] android_device_destroy+0x118/0x180 [ 24.564359][ T340] gadgets_drop+0x1d/0x30 [ 24.564373][ T340] ? __cfi_gadgets_drop+0x10/0x10 [ 24.564388][ T340] configfs_rmdir+0x8b7/0x9b0 [ 24.564410][ T340] vfs_rmdir+0x3de/0x560 [ 24.564432][ T340] do_rmdir+0x29a/0x590 [ 24.564453][ T340] ? __cfi_do_rmdir+0x10/0x10 [ 24.564475][ T340] ? __kasan_check_write+0x18/0x20 [ 24.564491][ T340] __x64_sys_rmdir+0x4b/0x60 [ 24.564513][ T340] x64_sys_call+0xaf7/0x2ee0 [ 24.564528][ T340] do_syscall_64+0x57/0xf0 [ 24.564546][ T340] ? clear_bhb_loop+0x50/0xa0 [ 24.564569][ T340] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.564591][ T340] RIP: 0033:0x7fa71b91c5f9 [ 24.564605][ T340] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.564618][ T340] RSP: 002b:00007fff09794c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 24.564637][ T340] RAX: ffffffffffffffda RBX: 0031672f74656764 RCX: 00007fa71b91c5f9 [ 24.564649][ T340] RDX: ffffffffffffffd8 RSI: 00007fa71b91c5f9 RDI: 0000200000000600 [ 24.564661][ T340] RBP: 00000000000f4240 R08: 0000000000000009 R09: 0000000000000009 [ 24.564672][ T340] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000005eaf [ 24.564683][ T340] R13: 00007fff09794c3c R14: 00007fff09794c50 R15: 00007fff09794c40 [ 24.564697][ T340] [ 24.565348][ T340] BUG: scheduling while atomic: syz-executor223/340/0x00000000 [ 24.956338][ T340] Modules linked in: [ 24.960299][ T340] CPU: 0 UID: 0 PID: 340 Comm: syz-executor223 Tainted: G W syzkaller #0 851f5cb62ab9f9c24538876695daf6a72142c571 [ 24.960332][ T340] Tainted: [W]=WARN [ 24.960338][ T340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.960348][ T340] Call Trace: [ 24.960355][ T340] [ 24.960362][ T340] __dump_stack+0x21/0x30 [ 24.960392][ T340] dump_stack_lvl+0x140/0x1c0 [ 24.960415][ T340] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.960443][ T340] dump_stack+0x19/0x20 [ 24.960469][ T340] __schedule_bug+0x12b/0x200 [ 24.960492][ T340] ? find_proxy_task+0x2460/0x2460 [ 24.960513][ T340] ? prepare_signal+0x13da/0x16b0 [ 24.960539][ T340] __schedule+0xb85/0x20b0 [ 24.960564][ T340] ? __wake_up_sync_key+0x1be/0x2c0 [ 24.960587][ T340] ? __cfi___wake_up_sync_key+0x10/0x10 [ 24.960608][ T340] ? __sched_text_start+0x10/0x10 [ 24.960633][ T340] ? __kasan_check_write+0x18/0x20 [ 24.960652][ T340] ? _raw_spin_lock_irq+0x93/0x120 [ 24.960675][ T340] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.960697][ T340] ? __kasan_check_read+0x15/0x20 [ 24.960716][ T340] ? cgroup_update_frozen+0x160/0x980 [ 24.960741][ T340] schedule+0xc5/0x240 [ 24.960764][ T340] ptrace_stop+0x528/0x8f0 [ 24.960785][ T340] ptrace_notify+0x1de/0x290 [ 24.960809][ T340] ? __cfi_ptrace_notify+0x10/0x10 [ 24.960834][ T340] ? __cfi_do_rmdir+0x10/0x10 [ 24.960861][ T340] ? __kasan_check_write+0x18/0x20 [ 24.960880][ T340] syscall_exit_work+0x84/0x150 [ 24.960898][ T340] syscall_exit_to_user_mode_prepare+0x21/0x40 [ 24.960918][ T340] syscall_exit_to_user_mode+0x15/0xb0 [ 24.960936][ T340] do_syscall_64+0x63/0xf0 [ 24.960958][ T340] ? clear_bhb_loop+0x50/0xa0 [ 24.960985][ T340] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.961031][ T340] RIP: 0033:0x7fa71b91c5f9 [ 24.961049][ T340] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.961065][ T340] RSP: 002b:00007fff09794c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 24.961086][ T340] RAX: 0000000000000000 RBX: 0031672f74656764 RCX: 00007fa71b91c5f9 [ 24.961101][ T340] RDX: ffffffffffffffd8 RSI: 00007fa71b91c5f9 RDI: 0000200000000600 [ 24.961117][ T340] RBP: 00000000000f4240 R08: 0000000000000009 R09: 0000000000000009 [ 24.961130][ T340] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000005eaf [ 24.961153][ T340] R13: 00007fff09794c3c R14: 00007fff09794c50 R15: 00007fff09794c40 [ 24.961170][ T340] [ 24.961183][ T340] psi: inconsistent task state! task=99:klogd cpu=1 psi_flags=14 clear=0 set=10 [ 24.961281][ T99] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) [ 25.225875][ T99] BUG: unable to handle page fault for address: ffffc90000e3ed70 [ 25.233586][ T99] #PF: supervisor instruction fetch in kernel mode [ 25.240080][ T99] #PF: error_code(0x0011) - permissions violation [ 25.246488][ T99] PGD 100000067 P4D 100000067 PUD 101657067 PMD 10b7a0067 PTE 800000010cf8d063 [ 25.255449][ T99] Oops: Oops: 0011 [#2] PREEMPT SMP KASAN PTI [ 25.261518][ T99] CPU: 0 UID: 0 PID: 99 Comm: klogd Tainted: G D W syzkaller #0 851f5cb62ab9f9c24538876695daf6a72142c571 [ 25.273932][ T99] Tainted: [D]=DIE, [W]=WARN [ 25.278518][ T99] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.288587][ T99] RIP: 0010:0xffffc90000e3ed70 [ 25.293357][ T99] Code: ff ff a2 4f 99 85 ff ff ff ff 21 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 5c 80 38 87 ff ff ff ff b0 ed e3 00 00 c9 ff ff <8b> f7 ad 82 ff ff ff ff 80 4f 99 85 ff ff ff ff e0 ed e3 00 00 c9 [ 25.312963][ T99] RSP: 0018:ffffc90000e3ed30 EFLAGS: 00010046 [ 25.319034][ T99] RAX: ffffffff88bb7462 RBX: dffffc0000000000 RCX: 47995d6eaaaa5200 [ 25.327006][ T99] RDX: 0000000000000000 RSI: 0000000000000000 RDI: fffff520001c7d78 [ 25.334984][ T99] RBP: ffffffff8738805c R08: 0000000000000004 R09: 0000000000000000 [ 25.342963][ T99] R10: fffff520001c7d10 R11: fffff520001c7c9f R12: ffffc90000e3ed28 [ 25.350955][ T99] R13: ffffffff85994fa2 R14: 0000000000000021 R15: 000000000000000c [ 25.358926][ T99] FS: 00007f7214323c80(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 25.367856][ T99] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.374442][ T99] CR2: ffffc90000e3ed70 CR3: 000000010cb7a000 CR4: 00000000003526b0 [ 25.382420][ T99] Call Trace: [ 25.385708][ T99] [ 25.388670][ T99] ? bsearch+0xab/0xd0 [ 25.392740][ T99] ? __cfi_cmp_ex_search+0x10/0x10 [ 25.397855][ T99] ? cmp_ex_search+0x22/0x80 [ 25.402473][ T99] ? bsearch+0xab/0xd0 [ 25.406543][ T99] ? __cfi_cmp_ex_search+0x10/0x10 [ 25.411665][ T99] ? copy_from_kernel_nofault+0x8a/0x340 [ 25.417480][ T99] ? search_extable+0x90/0xd0 [ 25.422167][ T99] ? __cfi_search_extable+0x10/0x10 [ 25.427372][ T99] ? copy_from_kernel_nofault+0x8a/0x340 [ 25.433012][ T99] ? copy_from_kernel_nofault+0x8a/0x340 [ 25.438648][ T99] ? copy_from_kernel_nofault+0x8a/0x340 [ 25.444286][ T99] ? fixup_exception+0x136a/0x1e20 [ 25.449398][ T99] ? __cfi_fixup_exception+0x10/0x10 [ 25.454682][ T99] ? __stack_chk_fail+0x28/0x30 [ 25.459532][ T99] ? pointer+0xcf5/0xe10 [ 25.463792][ T99] ? __kasan_check_read+0x15/0x20 [ 25.468824][ T99] ? vprintk_emit+0x3ea/0x650 [ 25.473515][ T99] ? __cfi_vprintk_emit+0x10/0x10 [ 25.478547][ T99] ? __bad_area_nosemaphore+0xb3/0x680 [ 25.484008][ T99] ? __kasan_check_read+0x15/0x20 [ 25.489032][ T99] ? vprintk_emit+0x3ea/0x650 [ 25.494582][ T99] ? __cfi_vprintk_emit+0x10/0x10 [ 25.499611][ T99] ? _printk+0xde/0x140 [ 25.503774][ T99] ? vprintk_default+0x2a/0x40 [ 25.508541][ T99] ? vprintk+0x93/0xa0 [ 25.512626][ T99] ? _printk+0xde/0x140 [ 25.516813][ T99] ? panic_smp_self_stop+0xd/0x50 [ 25.521844][ T99] ? panic+0x6ec/0x710 [ 25.525917][ T99] ? __cfi_panic+0x10/0x10 [ 25.530334][ T99] ? __show_regs+0x4d1/0x5f0 [ 25.534934][ T99] ? oops_end+0xd5/0xf0 [ 25.539093][ T99] ? page_fault_oops+0x8b5/0x9d0 [ 25.544035][ T99] ? kernelmode_fixup_or_oops+0x100/0x100 [ 25.549763][ T99] ? gp_try_fixup_and_notify+0x88/0x1e0 [ 25.555313][ T99] ? is_errata93+0xca/0x290 [ 25.559813][ T99] ? gp_user_force_sig_segv+0x240/0x240 [ 25.565376][ T99] ? do_user_addr_fault+0xf53/0x1230 [ 25.570667][ T99] ? save_fpregs_to_fpstate+0x19d/0x230 [ 25.576233][ T99] ? exc_general_protection+0xcf/0x1e0 [ 25.581701][ T99] ? exc_page_fault+0x58/0xc0 [ 25.586379][ T99] ? asm_exc_page_fault+0x2b/0x30 [ 25.591410][ T99] ? number+0xe2d/0xf00 [ 25.595572][ T99] ? pointer+0xe10/0xe10 [ 25.599833][ T99] ? format_decode+0xc93/0x1610 [ 25.604686][ T99] ? vsnprintf+0x1392/0x1ad0 [ 25.609281][ T99] ? sprintf+0xe8/0x140 [ 25.613440][ T99] ? kasan_save_track+0x4f/0x80 [ 25.618296][ T99] ? __cfi_sprintf+0x10/0x10 [ 25.622890][ T99] ? x64_sys_call+0x19e6/0x2ee0 [ 25.627746][ T99] ? desc_read+0x1b4/0x3e0 [ 25.632177][ T99] ? info_print_prefix+0x183/0x4a0 [ 25.637290][ T99] ? trace_raw_output_console+0xf0/0xf0 [ 25.642836][ T99] ? _prb_read_valid+0xa3d/0xa50 [ 25.647779][ T99] ? record_print_text+0x182/0x4b0 [ 25.652899][ T99] ? prb_read_valid+0x80/0x80 [ 25.657575][ T99] ? printk_get_next_message+0x9e0/0x9e0 [ 25.663212][ T99] ? __cfi_mutex_lock+0x10/0x10 [ 25.668099][ T99] ? prb_read_valid+0x41/0x80 [ 25.672798][ T99] ? syslog_print+0x3c0/0x6f0 [ 25.677570][ T99] ? do_syslog+0x7f0/0x7f0 [ 25.681998][ T99] ? __cfi_avc_has_perm+0x10/0x10 [ 25.687029][ T99] ? selinux_capable+0x38/0x50 [ 25.691802][ T99] ? selinux_syslog+0x10d/0x140 [ 25.696659][ T99] ? bpf_lsm_syslog+0xd/0x20 [ 25.701257][ T99] ? do_syslog+0x584/0x7f0 [ 25.705679][ T99] ? __cfi_do_syslog+0x10/0x10 [ 25.710465][ T99] ? __cfi___sys_connect+0x10/0x10 [ 25.715578][ T99] ? __kasan_check_write+0x18/0x20 [ 25.720691][ T99] ? fpregs_restore_userregs+0x11c/0x260 [ 25.726326][ T99] ? __x64_sys_syslog+0x80/0x90 [ 25.731179][ T99] ? x64_sys_call+0x19e6/0x2ee0 [ 25.736043][ T99] ? do_syscall_64+0x57/0xf0 [ 25.740692][ T99] ? clear_bhb_loop+0x50/0xa0 [ 25.745475][ T99] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.751558][ T99] [ 25.754669][ T99] Modules linked in: [ 25.758656][ T99] CR2: ffffc90000e3ed70 [ 25.762807][ T99] ---[ end trace 0000000000000000 ]--- [ 25.768256][ T99] RIP: 0010:0x18 [ 25.771812][ T99] Code: Unable to access opcode bytes at 0xffffffffffffffee. [ 25.779169][ T99] RSP: 0018:ffffc90000e3f6c0 EFLAGS: 00010282 [ 25.785237][ T99] RAX: ffffc90000e3f746 RBX: 0000000000000000 RCX: 0000000000000000 [ 25.793213][ T99] RDX: ffff88810c775f00 RSI: 0000000000000060 RDI: 000000000000000a [ 25.801184][ T99] RBP: ffffc90000e3f6c0 R08: ffffc90000e3f757 R09: 0000000000000000 [ 25.809154][ T99] R10: ffffc90000e3f740 R11: fffff520001c7eeb R12: ffffffff85a1022d [ 25.817125][ T99] R13: 00000000000ea942 R14: 0000000000000010 R15: 0000000000010046 [ 25.825188][ T99] FS: 00007f7214323c80(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 25.834128][ T99] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.840711][ T99] CR2: ffffffffffffffee CR3: 000000010cb7a000 CR4: 00000000003526b0 [ 25.848709][ T99] Kernel panic - not syncing: Fatal exception [ 26.925165][ T99] Shutting down cpus with NMI [ 26.930028][ T99] Kernel Offset: disabled [ 26.934365][ T99] Rebooting in 86400 seconds..