./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor499125312

<...>
Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts.
execve("./syz-executor499125312", ["./syz-executor499125312"], 0x7ffffaaf2ec0 /* 10 vars */) = 0
brk(NULL)                               = 0x55555aefc000
brk(0x55555aefcd40)                     = 0x55555aefcd40
arch_prctl(ARCH_SET_FS, 0x55555aefc3c0) = 0
set_tid_address(0x55555aefc690)         = 300
set_robust_list(0x55555aefc6a0, 24)     = 0
rseq(0x55555aefcce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor499125312", 4096) = 27
getrandom("\x26\x49\xd4\x51\x00\x9d\xd4\x5e", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55555aefcd40
brk(0x55555af1dd40)                     = 0x55555af1dd40
brk(0x55555af1e000)                     = 0x55555af1e000
mprotect(0x7fd05798f000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0executing program
) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18)     = 18
futex(0x7fd0579953cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7fd05792b7b0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd05791ce30}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd0578a4000
mprotect(0x7fd0578a5000, 131072, PROT_READ|PROT_WRITE) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd0578c4990, parent_tid=0x7fd0578c4990, exit_signal=0, stack=0x7fd0578a4000, stack_size=0x20300, tls=0x7fd0578c46c0} => {parent_tid=[301]}, 88) = 301
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
futex(0x7fd0579953c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
futex(0x7fd0579953cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 301 attached
 <unfinished ...>
[pid   301] set_robust_list(0x7fd0578c49a0, 24) = 0
[pid   301] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   301] openat(AT_FDCWD, "/dev/fuse", O_RDWR) = 3
[pid   301] futex(0x7fd0579953cc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   300] <... futex resumed>)        = 0
[pid   300] futex(0x7fd0579953c8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   300] futex(0x7fd0579953cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   301] <... futex resumed>)        = 1
[pid   301] mkdir("./file0", 0777)      = 0
[pid   301] mount(NULL, "./file0", "fuse", 0, "fd=0x0000000000000003,rootmode=00000000000000000040000,user_id=00000000000000000000,group_id=0000000"...) = 0
[   28.095461][   T28] audit: type=1400 audit(1745813369.451:66): avc:  denied  { execmem } for  pid=300 comm="syz-executor499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   28.115003][   T28] audit: type=1400 audit(1745813369.451:67): avc:  denied  { read write } for  pid=300 comm="syz-executor499" name="fuse" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[pid   301] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY <unfinished ...>
[pid   300] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   300] futex(0x7fd0579953dc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd057883000
[pid   300] mprotect(0x7fd057884000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid   300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd0578a3990, parent_tid=0x7fd0578a3990, exit_signal=0, stack=0x7fd057883000, stack_size=0x20300, tls=0x7fd0578a36c0} => {parent_tid=[303]}, 88) = 303
[pid   300] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   300] futex(0x7fd0579953d8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   300] futex(0x7fd0579953dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 303 attached
 <unfinished ...>
[pid   303] set_robust_list(0x7fd0578a39a0, 24) = 0
[pid   303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   303] read(3, "\x68\x00\x00\x00\x1a\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x26\x00\x00\x00\x00\x00\x02\x00\xfb\xff\xff\x73\x09\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 8192) = 104
[pid   303] write(3, "\x50\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x2b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 80) = 80
[pid   303] futex(0x7fd0579953dc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   300] <... futex resumed>)        = 0
[pid   300] futex(0x7fd0579953d8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   300] futex(0x7fd0579953dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   303] <... futex resumed>)        = 1
[pid   303] read(3, "\x30\x00\x00\x00\x1b\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2d\x01\x00\x00\x00\x00\x00\x00\x00\x80\x01\x00\x00\x00\x00\x00", 8192) = 48
[pid   303] write(3, "\x20\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 32 <unfinished ...>
[pid   301] <... openat resumed>)       = 4
[pid   301] chdir("./file0" <unfinished ...>
[pid   303] <... write resumed>)        = 32
[pid   303] futex(0x7fd0579953dc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   300] <... futex resumed>)        = 0
[pid   300] futex(0x7fd0579953d8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   300] futex(0x7fd0579953dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   303] <... futex resumed>)        = 1
[pid   303] read(3, "\x30\x00\x00\x00\x22\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2d\x01\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00", 8192) = 48
[pid   303] write(3, "\x10\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00", 16 <unfinished ...>
[pid   301] <... chdir resumed>)        = 0
[pid   301] futex(0x7fd0579953cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   301] futex(0x7fd0579953c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   303] <... write resumed>)        = 16
[pid   303] futex(0x7fd0579953dc, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   300] <... futex resumed>)        = 0
[pid   300] futex(0x7fd0579953c8, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid   301] <... futex resumed>)        = 0
[pid   300] futex(0x7fd0579953cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   301] read(3,  <unfinished ...>
[pid   303] <... futex resumed>)        = 1
[   28.138348][   T28] audit: type=1400 audit(1745813369.451:68): avc:  denied  { open } for  pid=300 comm="syz-executor499" path="/dev/fuse" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[   28.161798][   T28] audit: type=1400 audit(1745813369.451:69): avc:  denied  { mounton } for  pid=300 comm="syz-executor499" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[pid   303] futex(0x7fd0579953d8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   300] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   300] futex(0x7fd0579953d8, FUTEX_WAKE_PRIVATE, 1000000) = 1
[pid   300] futex(0x7fd0579953dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   303] <... futex resumed>)        = 0
[pid   303] newfstatat(AT_FDCWD, "./file1",  <unfinished ...>
[pid   301] <... read resumed>"\x2e\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2f\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x31\x00", 8192) = 46
[pid   301] write(3, "\xae\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00"..., 174) = 174
[pid   301] futex(0x7fd0579953cc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[   28.184408][   T28] audit: type=1400 audit(1745813369.451:70): avc:  denied  { mount } for  pid=300 comm="syz-executor499" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[   28.208432][  T303] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
[   28.220088][  T303] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
[   28.228878][  T303] CPU: 1 PID: 303 Comm: syz-executor499 Not tainted 6.1.134-syzkaller-00029-ga4fc1bef0501 #0
[   28.238945][  T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   28.248836][  T303] RIP: 0010:step_into+0x11d/0xf30
[   28.253699][  T303] Code: 74 24 08 c6 44 24 7f 00 43 0f b6 04 3c 84 c0 4d 89 fd 0f 85 08 0c 00 00 45 8b 36 4c 8b bc 24 a8 00 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 07 0c 00 00 45 8b 3f 44 89 fe 81 e6 00
[   28.273227][  T303] RSP: 0018:ffffc90000ee77a0 EFLAGS: 00010207
[   28.279127][  T303] RAX: 0000000000000003 RBX: ffffc90000ee79e0 RCX: ffff8881106a3cc0
[   28.287024][  T303] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   28.294935][  T303] RBP: ffffc90000ee78b8 R08: dffffc0000000000 R09: ffffed1023097125
[   28.302747][  T303] R10: ffffed1023097125 R11: 1ffff11023097124 R12: 1ffff920001dcf43
[   28.310661][  T303] R13: dffffc0000000000 R14: 0000000000000001 R15: 000000000000001e
[   28.318469][  T303] FS:  00007fd0578a36c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   28.327410][  T303] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   28.333998][  T303] CR2: 000000000045c780 CR3: 00000001244c5000 CR4: 00000000003506a0
[   28.341810][  T303] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   28.349616][  T303] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   28.357440][  T303] Call Trace:
[   28.360552][  T303]  <TASK>
[   28.363343][  T303]  ? __lookup_slow+0x376/0x3f0
[   28.367939][  T303]  ? lookup_one_len+0x2d0/0x2d0
[   28.372622][  T303]  ? down_read+0xa0/0xf0
[   28.376695][  T303]  ? set_root+0x400/0x400
[   28.380862][  T303]  ? up_read+0x56/0x1d0
[   28.384858][  T303]  walk_component+0x24c/0x420
[   28.389458][  T303]  path_lookupat+0x180/0x490
[   28.393971][  T303]  filename_lookup+0x1f0/0x500
[   28.398572][  T303]  ? __cfi_filename_lookup+0x10/0x10
[   28.403701][  T303]  vfs_statx+0x10b/0x660
[   28.407781][  T303]  ? __check_object_size+0x45a/0x600
[   28.413065][  T303]  ? strncpy_from_user+0x17a/0x2d0
[   28.418013][  T303]  ? vfs_fstatat+0x80/0x80
[   28.422269][  T303]  __se_sys_newfstatat+0xfd/0x380
[   28.427304][  T303]  ? __x64_sys_newfstatat+0xb0/0xb0
[   28.432347][  T303]  ? _raw_spin_lock_irq+0x8f/0xe0
[   28.437195][  T303]  ? __cfi__raw_spin_lock_irq+0x10/0x10
[   28.442736][  T303]  ? _raw_spin_unlock_irq+0x4d/0x70
[   28.447954][  T303]  ? memset+0x35/0x40
[   28.452100][  T303]  ? ptrace_stop+0x6ce/0x8b0
[   28.456659][  T303]  ? fpregs_restore_userregs+0x128/0x260
[   28.462283][  T303]  __x64_sys_newfstatat+0x9b/0xb0
[   28.467160][  T303]  x64_sys_call+0x77c/0x9a0
[   28.471575][  T303]  do_syscall_64+0x4c/0xa0
[   28.475918][  T303]  ? clear_bhb_loop+0x15/0x70
[   28.480421][  T303]  ? clear_bhb_loop+0x15/0x70
[   28.484951][  T303]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   28.490861][  T303] RIP: 0033:0x7fd0579058d9
[   28.495196][  T303] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   28.514712][  T303] RSP: 002b:00007fd0578a3218 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
[   28.522956][  T303] RAX: ffffffffffffffda RBX: 00007fd0579953d8 RCX: 00007fd0579058d9
[   28.530759][  T303] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: ffffffffffffff9c
[   28.538571][  T303] RBP: 00007fd0579953d0 R08: 0000000000000000 R09: 0000000000000000
[pid   301] futex(0x7fd0579953c8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   300] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[   28.546384][  T303] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd05796211c
[   28.554193][  T303] R13: 00002000000040c0 R14: 00002000000006c0 R15: 0000000000000000
[   28.562197][  T303]  </TASK>
[   28.565040][  T303] Modules linked in:
[   28.569342][  T303] ---[ end trace 0000000000000000 ]---
[   28.574868][  T303] RIP: 0010:step_into+0x11d/0xf30
[   28.579927][  T303] Code: 74 24 08 c6 44 24 7f 00 43 0f b6 04 3c 84 c0 4d 89 fd 0f 85 08 0c 00 00 45 8b 36 4c 8b bc 24 a8 00 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 07 0c 00 00 45 8b 3f 44 89 fe 81 e6 00
[   28.599436][  T303] RSP: 0018:ffffc90000ee77a0 EFLAGS: 00010207
[   28.605286][  T303] RAX: 0000000000000003 RBX: ffffc90000ee79e0 RCX: ffff8881106a3cc0
[   28.613217][  T303] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[   28.621307][  T303] RBP: ffffc90000ee78b8 R08: dffffc0000000000 R09: ffffed1023097125
[   28.629880][  T303] R10: ffffed1023097125 R11: 1ffff11023097124 R12: 1ffff920001dcf43
[   28.639754][  T303] R13: dffffc0000000000 R14: 0000000000000001 R15: 000000000000001e
[   28.651767][  T303] FS:  00007fd0578a36c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[   28.661291][  T303] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   28.669597][  T303] CR2: 00007ffc0afb3020 CR3: 00000001244c5000 CR4: 00000000003506b0
[   28.677810][  T303] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   28.685872][  T303] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   28.693675][  T303] Kernel panic - not syncing: Fatal exception
[   28.699659][  T303] Kernel Offset: disabled
[   28.703796][  T303] Rebooting in 86400 seconds..