./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor197624104 <...> Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts. execve("./syz-executor197624104", ["./syz-executor197624104"], 0x7fffcef6f5e0 /* 10 vars */) = 0 brk(NULL) = 0x555586fb8000 brk(0x555586fb8d00) = 0x555586fb8d00 arch_prctl(ARCH_SET_FS, 0x555586fb8380) = 0 set_tid_address(0x555586fb8650) = 356 set_robust_list(0x555586fb8660, 24) = 0 rseq(0x555586fb8ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor197624104", 4096) = 27 getrandom("\xdc\xe8\xf3\x55\x4a\x11\xe6\xc0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555586fb8d00 brk(0x555586fd9d00) = 0x555586fd9d00 brk(0x555586fda000) = 0x555586fda000 mprotect(0x7f1cab9ce000, 16384, PROT_READ) = 0 mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000 mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000 mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000 write(1, "executing program\n", 18executing program ) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1ca351e000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f1ca351e000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 25.380370][ T23] audit: type=1400 audit(1741964628.330:66): avc: denied { execmem } for pid=356 comm="syz-executor197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 close(4) = 0 [ 25.406829][ T23] audit: type=1400 audit(1741964628.360:67): avc: denied { read write } for pid=356 comm="syz-executor197" name="loop0" dev="devtmpfs" ino=9407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.433409][ T23] audit: type=1400 audit(1741964628.360:68): avc: denied { open } for pid=356 comm="syz-executor197" path="/dev/loop0" dev="devtmpfs" ino=9407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 mkdir("./file0", 0777) = 0 [ 25.459514][ T23] audit: type=1400 audit(1741964628.380:69): avc: denied { ioctl } for pid=356 comm="syz-executor197" path="/dev/loop0" dev="devtmpfs" ino=9407 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.487633][ T356] ====================================================== [ 25.487633][ T356] WARNING: the mand mount option is being deprecated and [ 25.487633][ T356] will be removed in v5.15! [ 25.487633][ T356] ====================================================== [ 25.487666][ T23] audit: type=1400 audit(1741964628.440:70): avc: denied { mounton } for pid=356 comm="syz-executor197" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 mount("/dev/loop0", "./file0", "ext4", MS_MANDLOCK, ",errors=continue") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, "./bus", O_RDWR|O_CREAT|O_NONBLOCK|O_SYNC|O_NOATIME, 000) = 4 mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [ 25.605384][ T356] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 25.614672][ T23] audit: type=1400 audit(1741964628.570:71): avc: denied { mount } for pid=356 comm="syz-executor197" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 25.614695][ T356] ext4 filesystem being mounted at /root/file0 supports timestamps until (%ptR?) (0x7fffffff) open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_DIRECT|O_CLOEXEC|FASYNC) = 5 mmap(0x400000000000, 8388608, PROT_WRITE, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x400000000000 chdir(0x400000000240) = 0 bind(-1, 0x400000000400, 110) = -1 EBADF (Bad file descriptor) [ 25.654870][ T23] audit: type=1400 audit(1741964628.610:72): avc: denied { mounton } for pid=356 comm="syz-executor197" path="/root/bus" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=file permissive=1 [ 25.677598][ T356] EXT4-fs warning (device loop0): ext4_update_dynamic_rev:864: updating to rev 1 because of new feature flag, running e2fsck is recommended openat(AT_FDCWD, 0x4000000001c0, O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [ 25.680207][ T23] audit: type=1400 audit(1741964628.630:73): avc: denied { map } for pid=356 comm="syz-executor197" path="/root/bus" dev="devtmpfs" ino=9407 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.721031][ T23] audit: type=1400 audit(1741964628.630:74): avc: denied { write } for pid=356 comm="syz-executor197" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.721840][ T356] ------------[ cut here ]------------ [ 25.744976][ T23] audit: type=1400 audit(1741964628.630:75): avc: denied { add_name } for pid=356 comm="syz-executor197" name="blkio.bfq.avg_queue_size" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.750476][ T356] kernel BUG at fs/ext4/ext4.h:2985! [ 25.779293][ T356] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 25.785605][ T356] CPU: 1 PID: 356 Comm: syz-executor197 Not tainted 5.4.290-syzkaller-00017-g6b07fcd94a6a #0 [ 25.796913][ T356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 25.807619][ T356] RIP: 0010:ext4_mb_find_by_goal+0xc36/0xc70 [ 25.813609][ T356] Code: fb ff ff 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c f6 fb ff ff 48 89 d7 e8 29 63 c8 ff 48 8b 54 24 20 e9 e4 fb ff ff e8 fa 78 98 ff <0f> 0b e8 03 1c 6f ff e8 ee 78 98 ff 0f 0b e8 e7 78 98 ff 0f 0b e8 [ 25.836534][ T356] RSP: 0018:ffff8881eee5e900 EFLAGS: 00010293 [ 25.844432][ T356] RAX: ffffffff81cbd206 RBX: 0000000000000001 RCX: ffff8881f30f3f00 [ 25.855045][ T356] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 25.863379][ T356] RBP: ffff8881eee5ea10 R08: ffffffff81cbc6f1 R09: ffffed103d3eedd8 [ 25.873348][ T356] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 25.882045][ T356] R13: ffff8881f36fa3f0 R14: 0000000000000001 R15: 1ffff1103e6df47e [ 25.892036][ T356] FS: 0000555586fb8380(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 25.901680][ T356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.909013][ T356] CR2: 000000000045b630 CR3: 00000001deab8000 CR4: 00000000003406a0 [ 25.917100][ T356] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.925198][ T356] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.933654][ T356] Call Trace: [ 25.937721][ T356] ? __die+0xb4/0x100 [ 25.944581][ T356] ? die+0x26/0x50 [ 25.949220][ T356] ? do_trap+0x1e7/0x340 [ 25.953498][ T356] ? ext4_mb_find_by_goal+0xc36/0xc70 [ 25.959583][ T356] ? ext4_mb_find_by_goal+0xc36/0xc70 [ 25.965556][ T356] ? do_invalid_op+0xfb/0x110 [ 25.970621][ T356] ? ext4_mb_find_by_goal+0xc36/0xc70 [ 25.976080][ T356] ? invalid_op+0x1e/0x30 [ 25.981046][ T356] ? ext4_mb_find_by_goal+0x121/0xc70 [ 25.986414][ T356] ? ext4_mb_find_by_goal+0xc36/0xc70 [ 25.992693][ T356] ? ext4_mb_find_by_goal+0xc36/0xc70 [ 25.998507][ T356] ? ext4_mb_new_blocks+0x29f/0x2d10 [ 26.004010][ T356] ? ext4_ind_map_blocks+0x124d/0x2e90 [ 26.011678][ T356] ? _ext4_get_block+0x21b/0x610 [ 26.016833][ T356] ? ext4_mb_use_inode_pa+0x4b0/0x4b0 [ 26.022424][ T356] ? ext4_file_write_iter+0x499/0x10e0 [ 26.027835][ T356] ? __vfs_write+0x5d3/0x750 [ 26.033181][ T356] ? vfs_write+0x206/0x4e0 [ 26.037531][ T356] ? ksys_write+0x199/0x2c0 [ 26.042336][ T356] ? do_syscall_64+0xca/0x1c0 [ 26.048386][ T356] ext4_mb_regular_allocator+0x229/0x10d0 [ 26.054965][ T356] ? ext4_mb_initialize_context+0x7bf/0xb80 [ 26.061281][ T356] ? ext4_mb_normalize_request+0x27a/0x1250 [ 26.066993][ T356] ? ext4_mb_normalize_request+0x1250/0x1250 [ 26.073470][ T356] ext4_mb_new_blocks+0x59a/0x2d10 [ 26.079020][ T356] ? stack_trace_save+0x118/0x1c0 [ 26.085030][ T356] ext4_ind_map_blocks+0x124d/0x2e90 [ 26.090518][ T356] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 26.096917][ T356] ? asan.module_dtor+0x20/0x20 [ 26.102035][ T356] ? is_bpf_text_address+0x24c/0x260 [ 26.107442][ T356] ? check_preemption_disabled+0x9f/0x320 [ 26.113762][ T356] ? _raw_read_unlock+0x21/0x40 [ 26.119472][ T356] ? ext4_es_lookup_extent+0x559/0x9d0 [ 26.126364][ T356] ext4_map_blocks+0x9d6/0x1ba0 [ 26.132227][ T356] ? ext4_issue_zeroout+0x150/0x150 [ 26.138748][ T356] ? ext4_write_begin+0x419/0x1900 [ 26.144685][ T356] ? vfs_write+0x206/0x4e0 [ 26.149938][ T356] ? ksys_write+0x199/0x2c0 [ 26.154320][ T356] ? do_syscall_64+0xca/0x1c0 [ 26.159148][ T356] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 26.165137][ T356] _ext4_get_block+0x21b/0x610 [ 26.169814][ T356] ? ext4_get_block+0x40/0x40 [ 26.174597][ T356] ? check_preemption_disabled+0x9f/0x320 [ 26.180269][ T356] ? debug_smp_processor_id+0x20/0x20 [ 26.186300][ T356] ext4_block_write_begin+0x68a/0x1390 [ 26.193027][ T356] ? _raw_spin_trylock_bh+0x190/0x190 [ 26.198419][ T356] ? ext4_es_is_delayed+0x40/0x40 [ 26.203418][ T356] ? trace_android_fs_datawrite_start+0x200/0x200 [ 26.209836][ T356] ? ext4_should_dioread_nolock+0x94/0x500 [ 26.215491][ T356] ext4_write_begin+0x5ba/0x1900 [ 26.220705][ T356] ? __generic_file_write_iter+0x159/0x530 [ 26.226659][ T356] ? ext4_readpages+0x110/0x110 [ 26.232182][ T356] ? kmem_cache_free+0x10b/0x2c0 [ 26.237035][ T356] ext4_da_write_begin+0x4a3/0xfe0 [ 26.244304][ T356] ? down_write_trylock+0x130/0x130 [ 26.249726][ T356] ? ext4_set_page_dirty+0x190/0x190 [ 26.254921][ T356] ? ext4_initxattrs+0x110/0x110 [ 26.260268][ T356] ? __vfs_getxattr+0x600/0x6d0 [ 26.265385][ T356] ? iov_iter_fault_in_readable+0x313/0x4c0 [ 26.274134][ T356] ? asan.module_dtor+0x20/0x20 [ 26.279564][ T356] ? ktime_get_coarse_real_ts64+0xcc/0xe0 [ 26.285457][ T356] generic_perform_write+0x2c7/0x560 [ 26.291436][ T356] ? grab_cache_page_write_begin+0x90/0x90 [ 26.298753][ T356] ? file_remove_privs+0x640/0x640 [ 26.305381][ T356] ? debug_smp_processor_id+0x20/0x20 [ 26.313299][ T356] ? down_write_trylock+0xd7/0x130 [ 26.320767][ T356] __generic_file_write_iter+0x224/0x530 [ 26.328492][ T356] ext4_file_write_iter+0x499/0x10e0 [ 26.335257][ T356] ? ext4_file_read_iter+0x140/0x140 [ 26.345579][ T356] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 26.352014][ T356] ? _raw_spin_lock_irqsave+0x210/0x210 [ 26.358919][ T356] ? cgroup_update_frozen+0x157/0xab0 [ 26.367574][ T356] ? cgroup_update_frozen+0x157/0xab0 [ 26.373354][ T356] ? cgroup_leave_frozen+0x13c/0x290 [ 26.379394][ T356] ? iov_iter_init+0x82/0x160 [ 26.384510][ T356] __vfs_write+0x5d3/0x750 [ 26.389516][ T356] ? __kernel_write+0x350/0x350 [ 26.395340][ T356] ? check_preemption_disabled+0x9f/0x320 [ 26.405097][ T356] ? debug_smp_processor_id+0x20/0x20 [ 26.411147][ T356] ? selinux_file_permission+0x2be/0x530 [ 26.417656][ T356] vfs_write+0x206/0x4e0 [ 26.422635][ T356] ksys_write+0x199/0x2c0 [ 26.426928][ T356] ? do_syscall_64+0x1c0/0x1c0 [ 26.431928][ T356] ? __ia32_sys_read+0x80/0x80 [ 26.437798][ T356] do_syscall_64+0xca/0x1c0 [ 26.443425][ T356] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 26.450528][ T356] RIP: 0033:0x7f1cab95b849 [ 26.455030][ T356] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 26.476318][ T356] RSP: 002b:00007fffc51d7878 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 26.487016][ T356] RAX: ffffffffffffffda RBX: 00007f1cab996bf3 RCX: 00007f1cab95b849 [ 26.497300][ T356] RDX: 000000000208e24b RSI: 0000400000000000 RDI: 0000000000000006 [ 26.509899][ T356] RBP: 00007f1cab9ce610 R08: 0000000000000000 R09: 00007fffc51d7a48 [ 26.518435][ T356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 26.528513][ T356] R13: 00007fffc51d7a38 R14: 0000000000000001 R15: 0000000000000001 [ 26.538758][ T356] Modules linked in: [ 26.544807][ T356] ---[ end trace 8022c7ce8ad8e627 ]--- [ 26.550979][ T356] RIP: 0010:ext4_mb_find_by_goal+0xc36/0xc70 [ 26.557472][ T356] Code: fb ff ff 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c f6 fb ff ff 48 89 d7 e8 29 63 c8 ff 48 8b 54 24 20 e9 e4 fb ff ff e8 fa 78 98 ff <0f> 0b e8 03 1c 6f ff e8 ee 78 98 ff 0f 0b e8 e7 78 98 ff 0f 0b e8 [ 26.578506][ T356] RSP: 0018:ffff8881eee5e900 EFLAGS: 00010293 [ 26.584486][ T356] RAX: ffffffff81cbd206 RBX: 0000000000000001 RCX: ffff8881f30f3f00 [ 26.592712][ T356] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 26.600578][ T356] RBP: ffff8881eee5ea10 R08: ffffffff81cbc6f1 R09: ffffed103d3eedd8 [ 26.608995][ T356] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 26.617528][ T356] R13: ffff8881f36fa3f0 R14: 0000000000000001 R15: 1ffff1103e6df47e [ 26.627722][ T356] FS: 0000555586fb8380(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 26.637160][ T356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.643667][ T356] CR2: 000000000045b630 CR3: 00000001deab8000 CR4: 00000000003406a0 [ 26.651455][ T356] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.659858][ T356] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.667702][ T356] Kernel panic - not syncing: Fatal exception [ 26.673783][ T356] Kernel Offset: disabled [ 26.678251][ T356] Rebooting in 86400 seconds..