./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1850665199 <...> Warning: Permanently added '10.128.1.147' (ED25519) to the list of known hosts. execve("./syz-executor1850665199", ["./syz-executor1850665199"], 0x7ffee1c6ad10 /* 10 vars */) = 0 brk(NULL) = 0x555574f25000 brk(0x555574f25d00) = 0x555574f25d00 arch_prctl(ARCH_SET_FS, 0x555574f25380) = 0 set_tid_address(0x555574f25650) = 293 set_robust_list(0x555574f25660, 24) = 0 rseq(0x555574f25ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1850665199", 4096) = 28 getrandom("\x5e\x0f\xa6\xc1\x2d\x58\x2c\xde", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555574f25d00 brk(0x555574f46d00) = 0x555574f46d00 brk(0x555574f47000) = 0x555574f47000 mprotect(0x7f00bd387000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 executing program write(1, "executing program\n", 18) = 18 socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 3 openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 4 ioctl(4, TUNSETIFF, 0x20000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 5 socket(AF_UNIX, SOCK_STREAM, 0) = 6 ioctl(6, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x38\x00\x00\x00\x24\x00\x41\x65\x2a\xbd\x70\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00", iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 22.552294][ T30] audit: type=1400 audit(1736030172.723:66): avc: denied { execmem } for pid=293 comm="syz-executor185" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.578068][ T293] ================================================================== [ 22.585945][ T293] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xb9d/0x3430 [ 22.588863][ T30] audit: type=1400 audit(1736030172.763:67): avc: denied { read } for pid=139 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 22.593932][ T293] Read of size 8 at addr ffff88810cca5ac0 by task syz-executor185/293 [ 22.622574][ T293] [ 22.624742][ T293] CPU: 0 PID: 293 Comm: syz-executor185 Not tainted 5.15.173-syzkaller-00213-gaf461d0249a8 #0 [ 22.634981][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 22.644882][ T293] Call Trace: [ 22.648003][ T293] [ 22.650868][ T293] dump_stack_lvl+0x151/0x1c0 [ 22.655380][ T293] ? io_uring_drop_tctx_refs+0x190/0x190 [ 22.660845][ T293] ? panic+0x760/0x760 [ 22.664751][ T293] print_address_description+0x87/0x3b0 [ 22.670133][ T293] kasan_report+0x179/0x1c0 [ 22.674471][ T293] ? tc_setup_flow_action+0xb9d/0x3430 [ 22.679769][ T293] ? tc_setup_flow_action+0xb9d/0x3430 [ 22.685059][ T293] __asan_report_load8_noabort+0x14/0x20 [ 22.690529][ T293] tc_setup_flow_action+0xb9d/0x3430 [ 22.695679][ T293] mall_replace_hw_filter+0x394/0xc20 [ 22.700864][ T293] ? mall_set_parms+0x4b0/0x4b0 [ 22.705543][ T293] ? tcf_exts_destroy+0xb0/0xb0 [ 22.710228][ T293] ? pcpu_memcg_post_alloc_hook+0x1b1/0x260 [ 22.715959][ T293] ? pcpu_alloc+0xda0/0x13e0 [ 22.720383][ T293] ? mall_set_parms+0x1c3/0x4b0 [ 22.725072][ T293] mall_change+0x56e/0x780 [ 22.729327][ T293] ? mall_get+0xb0/0xb0 [ 22.733317][ T293] ? tcf_chain_tp_insert_unique+0xa90/0xbb0 [ 22.739046][ T293] ? nla_strcmp+0xed/0x120 [ 22.743298][ T293] ? mall_get+0xb0/0xb0 [ 22.747289][ T293] tc_new_tfilter+0x151a/0x1c00 [ 22.751981][ T293] ? tcf_gate_entry_destructor+0x20/0x20 [ 22.757454][ T293] ? security_capable+0x87/0xb0 [ 22.762137][ T293] ? ns_capable+0x89/0xe0 [ 22.766299][ T293] ? netlink_net_capable+0x125/0x160 [ 22.771418][ T293] ? tcf_gate_entry_destructor+0x20/0x20 [ 22.776888][ T293] rtnetlink_rcv_msg+0x776/0xc40 [ 22.781665][ T293] ? rtnetlink_bind+0x80/0x80 [ 22.786172][ T293] ? stack_trace_save+0x1c0/0x1c0 [ 22.791034][ T293] ? __kernel_text_address+0x9b/0x110 [ 22.796238][ T293] ? unwind_get_return_address+0x4d/0x90 [ 22.801716][ T293] ? avc_has_perm_noaudit+0x348/0x430 [ 22.806915][ T293] ? memcpy+0x56/0x70 [ 22.810734][ T293] ? avc_has_perm_noaudit+0x2dd/0x430 [ 22.816052][ T293] ? avc_denied+0x1b0/0x1b0 [ 22.820392][ T293] ? avc_has_perm+0x16f/0x260 [ 22.825066][ T293] ? ____kasan_kmalloc+0xed/0x110 [ 22.830010][ T293] ? avc_has_perm_noaudit+0x430/0x430 [ 22.835212][ T293] ? x64_sys_call+0x16a/0x9a0 [ 22.839732][ T293] netlink_rcv_skb+0x1cf/0x410 [ 22.844329][ T293] ? rtnetlink_bind+0x80/0x80 [ 22.848859][ T293] ? netlink_ack+0xb10/0xb10 [ 22.853284][ T293] ? __netlink_lookup+0x37b/0x3a0 [ 22.858127][ T293] rtnetlink_rcv+0x1c/0x20 [ 22.862378][ T293] netlink_unicast+0x8df/0xac0 [ 22.866978][ T293] ? netlink_detachskb+0x90/0x90 [ 22.871752][ T293] ? security_netlink_send+0x7b/0xa0 [ 22.876874][ T293] netlink_sendmsg+0xa0a/0xd20 [ 22.881906][ T293] ? netlink_getsockopt+0x560/0x560 [ 22.886941][ T293] ? security_socket_sendmsg+0x82/0xb0 [ 22.892235][ T293] ? netlink_getsockopt+0x560/0x560 [ 22.897274][ T293] ____sys_sendmsg+0x59e/0x8f0 [ 22.901879][ T293] ? __sys_sendmsg_sock+0x40/0x40 [ 22.906737][ T293] ? import_iovec+0xe5/0x120 [ 22.911171][ T293] ___sys_sendmsg+0x252/0x2e0 [ 22.915669][ T293] ? __sys_sendmsg+0x260/0x260 [ 22.920368][ T293] ? cgroup_leave_frozen+0x164/0x2c0 [ 22.925478][ T293] ? __kasan_check_read+0x11/0x20 [ 22.930337][ T293] ? __fdget+0x179/0x240 [ 22.934424][ T293] __se_sys_sendmsg+0x19a/0x260 [ 22.939203][ T293] ? __x64_sys_sendmsg+0x90/0x90 [ 22.944005][ T293] ? ptrace_notify+0x24c/0x350 [ 22.948579][ T293] ? __kasan_check_write+0x14/0x20 [ 22.953524][ T293] __x64_sys_sendmsg+0x7b/0x90 [ 22.958210][ T293] x64_sys_call+0x16a/0x9a0 [ 22.962551][ T293] do_syscall_64+0x3b/0xb0 [ 22.966802][ T293] ? clear_bhb_loop+0x35/0x90 [ 22.971317][ T293] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.977140][ T293] RIP: 0033:0x7f00bd314829 [ 22.981385][ T293] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 23.000841][ T293] RSP: 002b:00007ffd1935a378 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 23.009069][ T293] RAX: ffffffffffffffda RBX: 00007ffd1935a548 RCX: 00007f00bd314829 [ 23.016879][ T293] RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 [ 23.024689][ T293] RBP: 00007f00bd387610 R08: 0000000000000001 R09: 00007ffd1935a548 [ 23.032501][ T293] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 23.040310][ T293] R13: 00007ffd1935a538 R14: 0000000000000001 R15: 0000000000000001 [ 23.048244][ T293] [ 23.051099][ T293] [ 23.053271][ T293] Allocated by task 293: [ 23.057347][ T293] ____kasan_kmalloc+0xdb/0x110 [ 23.062035][ T293] __kasan_kmalloc+0x9/0x10 [ 23.066550][ T293] __kmalloc+0x13f/0x2c0 [ 23.070627][ T293] tcf_idr_create+0x5f/0x780 [ 23.075052][ T293] tcf_idr_create_from_flags+0x5f/0x70 [ 23.080347][ T293] tcf_gact_init+0x3cd/0x6e0 [ 23.084774][ T293] tcf_action_init_1+0x50f/0x7f0 [ 23.089547][ T293] tcf_action_init+0x306/0x840 [ 23.094320][ T293] tcf_exts_validate+0x236/0x520 [ 23.099094][ T293] mall_set_parms+0x44/0x4b0 [ 23.103519][ T293] mall_change+0x495/0x780 [ 23.107773][ T293] tc_new_tfilter+0x151a/0x1c00 [ 23.112462][ T293] rtnetlink_rcv_msg+0x776/0xc40 [ 23.117233][ T293] netlink_rcv_skb+0x1cf/0x410 [ 23.121832][ T293] rtnetlink_rcv+0x1c/0x20 [ 23.126083][ T293] netlink_unicast+0x8df/0xac0 [ 23.130684][ T293] netlink_sendmsg+0xa0a/0xd20 [ 23.135284][ T293] ____sys_sendmsg+0x59e/0x8f0 [ 23.139884][ T293] ___sys_sendmsg+0x252/0x2e0 [ 23.144921][ T293] __se_sys_sendmsg+0x19a/0x260 [ 23.149608][ T293] __x64_sys_sendmsg+0x7b/0x90 [ 23.154212][ T293] x64_sys_call+0x16a/0x9a0 [ 23.158545][ T293] do_syscall_64+0x3b/0xb0 [ 23.162799][ T293] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.168535][ T293] [ 23.170697][ T293] The buggy address belongs to the object at ffff88810cca5a00 [ 23.170697][ T293] which belongs to the cache kmalloc-192 of size 192 [ 23.184586][ T293] The buggy address is located 0 bytes to the right of [ 23.184586][ T293] 192-byte region [ffff88810cca5a00, ffff88810cca5ac0) [ 23.198038][ T293] The buggy address belongs to the page: [ 23.203515][ T293] page:ffffea0004332940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10cca5 [ 23.213583][ T293] flags: 0x4000000000000200(slab|zone=1) [ 23.219042][ T293] raw: 4000000000000200 ffffea000431b180 0000000c0000000c ffff888100042c00 [ 23.227461][ T293] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.235875][ T293] page dumped because: kasan: bad access detected [ 23.242130][ T293] page_owner tracks the page as allocated [ 23.247676][ T293] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 71, ts 3972592918, free_ts 3972420148 [ 23.263213][ T293] post_alloc_hook+0x1a3/0x1b0 [ 23.267824][ T293] prep_new_page+0x1b/0x110 [ 23.272153][ T293] get_page_from_freelist+0x3550/0x35d0 [ 23.277532][ T293] __alloc_pages+0x27e/0x8f0 [ 23.281961][ T293] new_slab+0x9a/0x4e0 [ 23.285864][ T293] ___slab_alloc+0x39e/0x830 [ 23.290298][ T293] __slab_alloc+0x4a/0x90 [ 23.294459][ T293] kmem_cache_alloc_trace+0x147/0x270 [ 23.299666][ T293] alloc_fs_context+0x65/0x830 [ 23.304264][ T293] fs_context_for_mount+0x24/0x30 [ 23.309124][ T293] do_new_mount+0x15c/0xb30 [ 23.313473][ T293] path_mount+0x671/0x1070 [ 23.317719][ T293] __se_sys_mount+0x2c4/0x3b0 [ 23.322234][ T293] __x64_sys_mount+0xbf/0xd0 [ 23.326660][ T293] x64_sys_call+0x49d/0x9a0 [ 23.330997][ T293] do_syscall_64+0x3b/0xb0 [ 23.335252][ T293] page last free stack trace: [ 23.339763][ T293] free_unref_page_prepare+0x7c8/0x7d0 [ 23.345066][ T293] free_unref_page+0xe8/0x750 [ 23.349573][ T293] __free_pages+0x61/0xf0 [ 23.353832][ T293] free_pages+0x7c/0x90 [ 23.357818][ T293] selinux_genfs_get_sid+0x24d/0x2a0 [ 23.362938][ T293] inode_doinit_with_dentry+0x8d2/0x1070 [ 23.368404][ T293] selinux_d_instantiate+0x27/0x40 [ 23.373353][ T293] security_d_instantiate+0x9f/0x100 [ 23.378476][ T293] d_splice_alias+0x6d/0x390 [ 23.382903][ T293] kernfs_iop_lookup+0x29e/0x2f0 [ 23.387675][ T293] __lookup_slow+0x2b9/0x400 [ 23.392101][ T293] lookup_slow+0x5a/0x80 [ 23.396179][ T293] walk_component+0x48c/0x610 [ 23.400811][ T293] path_lookupat+0x16d/0x450 [ 23.405233][ T293] filename_lookup+0x230/0x5c0 [ 23.409830][ T293] user_path_at_empty+0x43/0x1a0 [ 23.414604][ T293] [ 23.416769][ T293] Memory state around the buggy address: [ 23.422243][ T293] ffff88810cca5980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 23.430141][ T293] ffff88810cca5a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.438035][ T293] >ffff88810cca5a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 23.445943][ T293] ^ sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x84\x00\x00\x00\x2c\x00\x27\x0d\x29\xbd\x30\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x07\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x50\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x40\x00\x00\x00\x00\x04\x00\x00\x05\x00\x00\x00\x80\x00\x00\x00"..., iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 132 exit_group(0) = ? [ 23.451926][ T293] ffff88810cca5b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.459824][ T293] ffff88810cca5b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 23.467750][ T293] ================================================================== [ 23.475624][ T293] Disabling lock debugging due to kernel taint +++ exited with 0 +++