./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1476160777 <...> [ 7.134640][ T36] audit: type=1400 audit(1750453738.060:58): avc: denied { read } for pid=201 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 syzkaller syzkaller login: [ 13.125606][ T36] audit: type=1400 audit(1750453744.060:59): avc: denied { transition } for pid=230 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.129260][ T36] audit: type=1400 audit(1750453744.060:60): avc: denied { noatsecure } for pid=230 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.132135][ T36] audit: type=1400 audit(1750453744.070:61): avc: denied { write } for pid=230 comm="sh" path="pipe:[1565]" dev="pipefs" ino=1565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.135168][ T36] audit: type=1400 audit(1750453744.070:62): avc: denied { rlimitinh } for pid=230 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.137742][ T36] audit: type=1400 audit(1750453744.070:63): avc: denied { siginh } for pid=230 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.55' (ED25519) to the list of known hosts. execve("./syz-executor1476160777", ["./syz-executor1476160777"], 0x7ffdcf8b4920 /* 10 vars */) = 0 brk(NULL) = 0x555583b2d000 brk(0x555583b2dd00) = 0x555583b2dd00 arch_prctl(ARCH_SET_FS, 0x555583b2d380) = 0 set_tid_address(0x555583b2d650) = 296 set_robust_list(0x555583b2d660, 24) = 0 rseq(0x555583b2dca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1476160777", 4096) = 28 getrandom("\x53\x04\xc7\x6d\x8a\x93\x7d\xc2", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555583b2dd00 brk(0x555583b4ed00) = 0x555583b4ed00 brk(0x555583b4f000) = 0x555583b4f000 mprotect(0x7f45a416d000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555583b2d650) = 297 ./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x555583b2d660, 24) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] getppid() = 0 [pid 297] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 297] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 297] unshare(CLONE_NEWNS) = 0 [pid 297] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 297] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 297] unshare(CLONE_NEWCGROUP) = 0 [pid 297] unshare(CLONE_NEWUTS) = 0 [pid 297] unshare(CLONE_SYSVSEM) = 0 [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 297] getpid() = 1 [pid 297] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 0b e9 3e ff ff ff e8 ba 98 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 22.346726][ T297] RSP: 0018:ffffc900011ef988 EFLAGS: 00010293 [ 22.352466][ T36] audit: type=1400 audit(1750453753.120:72): avc: denied { unmount } for pid=297 comm="syz-executor147" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.352503][ T36] audit: type=1400 audit(1750453753.120:73): avc: denied { mounton } for pid=297 comm="syz-executor147" path="/dev/gadgetfs" dev="devtmpfs" ino=434 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 22.378538][ T297] [ 22.378548][ T297] RAX: ffffffff8241e48a RBX: 0000000000000000 RCX: ffff88810be54c00 [ 22.378562][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.378571][ T297] RBP: ffffc900011ef9b0 R08: ffff88812d7900bf R09: 1ffff11025af2017 [ 22.378581][ T297] R10: dffffc0000000000 R11: ffffed1025af2018 R12: 0000000000000000 [ 22.378591][ T297] R13: dffffc0000000000 R14: ffff88812d790020 R15: ffff888111238bb0 [ 22.489385][ T297] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 22.498366][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.504950][ T297] CR2: 00007f45a41740f0 CR3: 000000010b32e000 CR4: 00000000003526b0 [ 22.512964][ T297] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.520964][ T297] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.529165][ T297] Call Trace: [ 22.532454][ T297] [ 22.535379][ T297] ovl_do_remove+0x7b8/0xcf0 [ 22.540124][ T297] ? ovl_set_redirect+0x780/0x780 [ 22.545149][ T297] ? down_write+0xe9/0x2a0 [ 22.549616][ T297] ? __cfi_down_write+0x10/0x10 [ 22.554471][ T297] ovl_rmdir+0x1e/0x30 [ 22.558562][ T297] vfs_rmdir+0x3dd/0x560 [ 22.562799][ T297] incfs_kill_sb+0x109/0x230 [ 22.567412][ T297] deactivate_locked_super+0xd5/0x2a0 [ 22.572778][ T297] deactivate_super+0xb8/0xe0 [ 22.577491][ T297] cleanup_mnt+0x3f1/0x480 [ 22.581907][ T297] __cleanup_mnt+0x1d/0x40 [ 22.586314][ T297] task_work_run+0x1e0/0x250 [ 22.590941][ T297] ? __cfi_task_work_run+0x10/0x10 [ 22.596134][ T297] ? free_nsproxy+0x223/0x290 [ 22.600851][ T297] do_exit+0x9b4/0x2630 [ 22.605003][ T297] ? __cfi_do_exit+0x10/0x10 [ 22.609621][ T297] ? __kasan_check_write+0x18/0x20 [ 22.614730][ T297] ? _raw_spin_lock_irq+0x8d/0x120 [ 22.619882][ T297] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 22.625425][ T297] ? zap_other_threads+0x334/0x370 [ 22.630584][ T297] do_group_exit+0x22a/0x300 [ 22.635164][ T297] __x64_sys_exit_group+0x43/0x50 [ 22.640205][ T297] x64_sys_call+0x2ed2/0x2ee0 [ 22.644878][ T297] do_syscall_64+0x58/0xf0 [ 22.649316][ T297] ? clear_bhb_loop+0x35/0x90 [ 22.654124][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.660055][ T297] RIP: 0033:0x7f45a40f7c49 [ 22.664488][ T297] Code: Unable to access opcode bytes at 0x7f45a40f7c1f. [ 22.671571][ T297] RSP: 002b:00007ffe19b880a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 22.680030][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f45a40f7c49 [ 22.688039][ T297] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 22.696006][ T297] RBP: 00007f45a4173290 R08: ffffffffffffffb8 R09: 0000000000000006 [ 22.704008][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f45a4173290 [ 22.712013][ T297] R13: 0000000000000000 R14: 00007f45a4173ce0 R15: 00007f45a40c9290 [ 22.720079][ T297] [ 22.723120][ T297] ---[ end trace 0000000000000000 ]--- [ 22.729197][ T297] ------------[ cut here ]------------ [ 22.734680][ T297] WARNING: CPU: 0 PID: 297 at fs/overlayfs/util.c:600 ovl_dir_modified+0x15a/0x190 [ 22.744557][ T297] Modules linked in: [ 22.748497][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor147 Tainted: G W 6.12.23-syzkaller-g6c1c18fcb8b7 #0 ba78288b1e32eb9f88d3f8d8da6b79a037cd8362 [ 22.763864][ T297] Tainted: [W]=WARN [ 22.767693][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 22.777772][ T297] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 22.783414][ T297] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 5e 83 99 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 c6 98 43 ff <0f> 0b e9 3e ff ff ff e8 ba 98 43 ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 22.803189][ T297] RSP: 0018:ffffc900011ef988 EFLAGS: 00010293 [ 22.809404][ T297] RAX: ffffffff8241e48a RBX: 0000000000000000 RCX: ffff88810be54c00 [ 22.817407][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.825373][ T297] RBP: ffffc900011ef9b0 R08: ffff88812d7900bf R09: 1ffff11025af2017 [ 22.833367][ T297] R10: dffffc0000000000 R11: ffffed1025af2018 R12: 0000000000000000 [ 22.841377][ T297] R13: dffffc0000000000 R14: ffff88812d790020 R15: ffff888111238bb0 [ 22.849480][ T297] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 22.858438][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.865031][ T297] CR2: 00007f45a41740f0 CR3: 000000010b32e000 CR4: 00000000003526b0 [ 22.873099][ T297] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.881104][ T297] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.889115][ T297] Call Trace: [ 22.892387][ T297] [ 22.895311][ T297] ovl_do_remove+0x7b8/0xcf0 [ 22.899937][ T297] ? ovl_set_redirect+0x780/0x780 [ 22.904953][ T297] ? down_write+0xe9/0x2a0 [ 22.909399][ T297] ? __cfi_down_write+0x10/0x10 [ 22.914253][ T297] ovl_rmdir+0x1e/0x30 [ 22.918396][ T297] vfs_rmdir+0x3dd/0x560 [ 22.922635][ T297] incfs_kill_sb+0x1a0/0x230 [ 22.927263][ T297] deactivate_locked_super+0xd5/0x2a0 [ 22.932661][ T297] deactivate_super+0xb8/0xe0 [ 22.937413][ T297] cleanup_mnt+0x3f1/0x480 [ 22.941852][ T297] __cleanup_mnt+0x1d/0x40 [ 22.946291][ T297] task_work_run+0x1e0/0x250 [ 22.950961][ T297] ? __cfi_task_work_run+0x10/0x10 [ 22.956073][ T297] ? free_nsproxy+0x223/0x290 [ 22.960795][ T297] do_exit+0x9b4/0x2630 [ 22.964966][ T297] ? __cfi_do_exit+0x10/0x10 [ 22.969650][ T297] ? __kasan_check_write+0x18/0x20 [ 22.974797][ T297] ? _raw_spin_lock_irq+0x8d/0x120 [ 22.979955][ T297] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 22.985602][ T297] ? zap_other_threads+0x334/0x370 [ 22.990807][ T297] do_group_exit+0x22a/0x300 [ 22.995397][ T297] __x64_sys_exit_group+0x43/0x50 [ 23.000458][ T297] x64_sys_call+0x2ed2/0x2ee0 [ 23.005138][ T297] do_syscall_64+0x58/0xf0 [ 23.009579][ T297] ? clear_bhb_loop+0x35/0x90 [ 23.014262][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.020189][ T297] RIP: 0033:0x7f45a40f7c49 [ 23.024595][ T297] Code: Unable to access opcode bytes at 0x7f45a40f7c1f. [ 23.031642][ T297] RSP: 002b:00007ffe19b880a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [pid 297] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=297, si_uid=0, si_status=1, si_utime=0, si_stime=80} --- exit_group(0) = ? +++ exited with 0 +++ [ 23.040200][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f45a40f7c4