Warning: Permanently added '10.128.0.201' (ED25519) to the list of known hosts. 2024/04/05 16:49:02 ignoring optional flag "sandboxArg"="0" 2024/04/05 16:49:02 parsed 1 programs 2024/04/05 16:49:02 executed programs: 0 [ 42.031330][ T23] kauditd_printk_skb: 67 callbacks suppressed [ 42.031337][ T23] audit: type=1400 audit(1712335742.350:143): avc: denied { mounton } for pid=403 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 42.064854][ T23] audit: type=1400 audit(1712335742.360:144): avc: denied { mount } for pid=403 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 42.085933][ T408] cgroup1: Unknown subsys name 'perf_event' [ 42.106671][ T408] cgroup1: Unknown subsys name 'net_cls' [ 42.108265][ T23] audit: type=1400 audit(1712335742.390:145): avc: denied { mounton } for pid=408 comm="syz-executor.0" path="/syzcgroup/unified" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 42.141744][ T412] cgroup1: Unknown subsys name 'perf_event' [ 42.149201][ T415] cgroup1: Unknown subsys name 'perf_event' [ 42.149635][ T413] cgroup1: Unknown subsys name 'perf_event' [ 42.172293][ T415] cgroup1: Unknown subsys name 'net_cls' [ 42.178184][ T412] cgroup1: Unknown subsys name 'net_cls' [ 42.186664][ T417] cgroup1: Unknown subsys name 'perf_event' [ 42.193337][ T413] cgroup1: Unknown subsys name 'net_cls' [ 42.201928][ T23] audit: type=1400 audit(1712335742.390:146): avc: denied { mounton } for pid=408 comm="syz-executor.0" path="/syzcgroup/cpu" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 42.213128][ T418] cgroup1: Unknown subsys name 'perf_event' [ 42.225025][ T417] cgroup1: Unknown subsys name 'net_cls' [ 42.233705][ T418] cgroup1: Unknown subsys name 'net_cls' [ 42.333203][ T408] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.340256][ T408] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.347876][ T408] device bridge_slave_0 entered promiscuous mode [ 42.372331][ T408] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.379294][ T408] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.386793][ T408] device bridge_slave_1 entered promiscuous mode [ 42.488106][ T413] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.495441][ T413] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.502995][ T413] device bridge_slave_0 entered promiscuous mode [ 42.509954][ T413] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.517129][ T413] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.524706][ T413] device bridge_slave_1 entered promiscuous mode [ 42.535773][ T415] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.543127][ T415] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.550819][ T415] device bridge_slave_0 entered promiscuous mode [ 42.579515][ T415] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.586628][ T415] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.593998][ T415] device bridge_slave_1 entered promiscuous mode [ 42.600665][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.607950][ T418] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.615260][ T418] device bridge_slave_0 entered promiscuous mode [ 42.622212][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.629195][ T418] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.636668][ T418] device bridge_slave_1 entered promiscuous mode [ 42.668162][ T417] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.675063][ T417] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.682730][ T417] device bridge_slave_0 entered promiscuous mode [ 42.693815][ T417] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.700826][ T417] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.709129][ T417] device bridge_slave_1 entered promiscuous mode [ 42.785252][ T412] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.792299][ T412] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.800146][ T412] device bridge_slave_0 entered promiscuous mode [ 42.809722][ T408] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.816598][ T408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.823803][ T408] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.830897][ T408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.865406][ T412] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.872903][ T412] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.880253][ T412] device bridge_slave_1 entered promiscuous mode [ 42.982633][ T418] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.989590][ T418] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.996706][ T418] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.003776][ T418] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.035219][ T413] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.042436][ T413] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.049494][ T413] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.056500][ T413] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.077294][ T417] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.084398][ T417] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.091768][ T417] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.098698][ T417] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.116888][ T415] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.123926][ T415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.131024][ T415] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.137860][ T415] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.165263][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.173019][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.180347][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.187941][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.195084][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.202009][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.209346][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.216533][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.223913][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.230873][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.238896][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.246512][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.303194][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.311157][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.318000][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.326032][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.334178][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.341084][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.348393][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.356262][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.364440][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.371636][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.379217][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.387530][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.395971][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.403028][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.410365][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.418707][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.426945][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.434301][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.461311][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.468810][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.476527][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.485207][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.493619][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.500522][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.508062][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.516214][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.524260][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.531354][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.539050][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.547054][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.554932][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.563071][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.570388][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.588876][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.597405][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.606016][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.612862][ T363] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.620218][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.642733][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.650551][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.658912][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.667130][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.674154][ T363] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.681391][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.688995][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.696370][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 43.705184][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.713496][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 43.721146][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.740087][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.748139][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.757991][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 43.766615][ T124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.775031][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.781933][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.815842][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.824425][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.832113][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.841375][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 43.849510][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.857521][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 43.865731][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.873635][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 43.881707][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.889775][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.896625][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.925399][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 43.933590][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.942120][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 43.948208][ T23] audit: type=1400 audit(1712335744.260:147): avc: denied { mounton } for pid=440 comm="syz-executor.5" path="/root/syzkaller-testdir338412601/syzkaller.7Ka6s8/0/file0" dev="sda1" ino=1962 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 43.952820][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.979422][ T23] audit: type=1400 audit(1712335744.300:148): avc: denied { mount } for pid=440 comm="syz-executor.5" name="/" dev="incremental-fs" ino=1962 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 43.986242][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 44.010795][ T23] audit: type=1400 audit(1712335744.300:149): avc: denied { unmount } for pid=440 comm="syz-executor.5" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 44.016802][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.044715][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 44.053115][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.061171][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.068036][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.109522][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.118555][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 44.127095][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.136719][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.145547][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.154011][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.162168][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 44.170865][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.179145][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.186187][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.193545][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.201527][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.209649][ T370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.223213][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.231767][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.240466][ T363] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.253013][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.261221][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.292397][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.300920][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.312446][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 44.320336][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.328315][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 44.336557][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.344474][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.353289][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.392261][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 44.405408][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.415601][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 44.426780][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.435462][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 44.443578][ T451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.472553][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 44.480663][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.489240][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.498211][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.507884][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.516450][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.525199][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.533764][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.542160][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.551098][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.576366][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 44.585115][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.593395][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.601454][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.613910][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.622157][ T106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.652855][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 44.661108][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.670679][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 44.678975][ T362] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.784515][ T23] audit: type=1400 audit(1712335745.110:150): avc: denied { read } for pid=483 comm="syz-executor.4" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.830234][ T23] audit: type=1400 audit(1712335745.110:151): avc: denied { open } for pid=483 comm="syz-executor.4" path="/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 2024/04/05 16:49:07 executed programs: 170 2024/04/05 16:49:12 executed programs: 529 [ 52.614830][ T2446] ================================================================== [ 52.623343][ T2446] BUG: KASAN: use-after-free in path_openat+0x1c9e/0x3480 [ 52.630692][ T2446] Read of size 4 at addr ffff8881da87d81c by task syz-executor.5/2446 [ 52.639099][ T2446] [ 52.641323][ T2446] CPU: 0 PID: 2446 Comm: syz-executor.5 Not tainted 5.4.268-syzkaller-04870-gd0d34dcb02cc #0 [ 52.651878][ T2446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 52.661971][ T2446] Call Trace: [ 52.665085][ T2446] dump_stack+0x1d8/0x241 [ 52.669244][ T2446] ? nf_ct_l4proto_log_invalid+0x258/0x258 [ 52.674978][ T2446] ? printk+0xd1/0x111 [ 52.678887][ T2446] ? path_openat+0x1c9e/0x3480 [ 52.683492][ T2446] print_address_description+0x8c/0x600 [ 52.688861][ T2446] ? path_openat+0x1c9e/0x3480 [ 52.693629][ T2446] __kasan_report+0xf3/0x120 [ 52.698149][ T2446] ? path_openat+0x1c9e/0x3480 [ 52.702749][ T2446] kasan_report+0x30/0x60 [ 52.706997][ T2446] path_openat+0x1c9e/0x3480 [ 52.711427][ T2446] ? do_filp_open+0x450/0x450 [ 52.715933][ T2446] ? do_sys_open+0x357/0x810 [ 52.720363][ T2446] ? do_syscall_64+0xca/0x1c0 [ 52.724892][ T2446] ? entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 52.730778][ T2446] do_filp_open+0x20b/0x450 [ 52.735222][ T2446] ? vfs_tmpfile+0x280/0x280 [ 52.739651][ T2446] ? _raw_spin_unlock+0x49/0x60 [ 52.744512][ T2446] ? __alloc_fd+0x4c1/0x560 [ 52.748936][ T2446] do_sys_open+0x39c/0x810 [ 52.753365][ T2446] ? file_open_root+0x490/0x490 [ 52.758047][ T2446] ? switch_fpu_return+0x1d4/0x410 [ 52.762994][ T2446] ? ksys_mount+0xe0/0xf0 [ 52.767161][ T2446] do_syscall_64+0xca/0x1c0 [ 52.771592][ T2446] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 52.777410][ T2446] [ 52.779570][ T2446] Allocated by task 2446: [ 52.783741][ T2446] __kasan_kmalloc+0x171/0x210 [ 52.788352][ T2446] alloc_inode+0x43/0x70 [ 52.792449][ T2446] iget5_locked+0x9c/0x260 [ 52.796928][ T2446] fetch_regular_inode+0x256/0x320 [ 52.801877][ T2446] incfs_mount_fs+0x5c3/0xa00 [ 52.806395][ T2446] legacy_get_tree+0xdf/0x170 [ 52.811164][ T2446] vfs_get_tree+0x85/0x260 [ 52.815415][ T2446] do_new_mount+0x292/0x570 [ 52.819755][ T2446] do_mount+0x688/0xe10 [ 52.823759][ T2446] ksys_mount+0xc2/0xf0 [ 52.827844][ T2446] __x64_sys_mount+0xb1/0xc0 [ 52.832532][ T2446] do_syscall_64+0xca/0x1c0 [ 52.836960][ T2446] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 52.843077][ T2446] [ 52.845199][ T2446] Freed by task 2432: [ 52.849038][ T2446] __kasan_slab_free+0x1b5/0x270 [ 52.853978][ T2446] kfree+0x123/0x370 [ 52.857703][ T2446] evict+0x59d/0x6a0 [ 52.861443][ T2446] evict_inodes+0x5e1/0x660 [ 52.865803][ T2446] generic_shutdown_super+0x94/0x2a0 [ 52.870903][ T2446] kill_anon_super+0x37/0x60 [ 52.875324][ T2446] incfs_kill_sb+0x4c/0x200 [ 52.879663][ T2446] deactivate_locked_super+0xa8/0x110 [ 52.884867][ T2446] deactivate_super+0x1e2/0x2a0 [ 52.889554][ T2446] cleanup_mnt+0x44e/0x500 [ 52.893808][ T2446] task_work_run+0x140/0x170 [ 52.898320][ T2446] exit_to_usermode_loop+0x190/0x1a0 [ 52.903441][ T2446] prepare_exit_to_usermode+0x199/0x200 [ 52.908822][ T2446] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 [ 52.914545][ T2446] [ 52.916803][ T2446] The buggy address belongs to the object at ffff8881da87d800 [ 52.916803][ T2446] which belongs to the cache kmalloc-1k of size 1024 [ 52.931059][ T2446] The buggy address is located 28 bytes inside of [ 52.931059][ T2446] 1024-byte region [ffff8881da87d800, ffff8881da87dc00) [ 52.944417][ T2446] The buggy address belongs to the page: [ 52.949900][ T2446] page:ffffea00076a1e00 refcount:1 mapcount:0 mapping:ffff8881f5c02280 index:0xffff8881da87b000 compound_mapcount: 0 [ 52.962513][ T2446] flags: 0x8000000000010200(slab|head) [ 52.967806][ T2446] raw: 8000000000010200 0000000000000000 0000000100000001 ffff8881f5c02280 [ 52.976759][ T2446] raw: ffff8881da87b000 000000008010000d 00000001ffffffff 0000000000000000 [ 52.985156][ T2446] page dumped because: kasan: bad access detected [ 52.991516][ T2446] page_owner tracks the page as allocated [ 52.997069][ T2446] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC) [ 53.012207][ T2446] prep_new_page+0x18f/0x370 [ 53.016598][ T2446] get_page_from_freelist+0x2d13/0x2d90 [ 53.022065][ T2446] __alloc_pages_nodemask+0x393/0x840 [ 53.027531][ T2446] alloc_slab_page+0x39/0x3c0 [ 53.032308][ T2446] new_slab+0x97/0x440 [ 53.036424][ T2446] ___slab_alloc+0x2fe/0x490 [ 53.041304][ T2446] __slab_alloc+0x62/0xa0 [ 53.046005][ T2446] __kmalloc+0x19b/0x2e0 [ 53.050197][ T2446] veth_dev_init+0x1a9/0x340 [ 53.054823][ T2446] register_netdevice+0x1c0/0x12a0 [ 53.059987][ T2446] veth_newlink+0x667/0xb50 [ 53.064454][ T2446] rtnl_newlink+0x1567/0x2060 [ 53.069050][ T2446] rtnetlink_rcv_msg+0x983/0xc70 [ 53.073830][ T2446] netlink_rcv_skb+0x1d5/0x420 [ 53.078432][ T2446] netlink_unicast+0x936/0xb20 [ 53.083124][ T2446] netlink_sendmsg+0xa18/0xcf0 [ 53.087711][ T2446] page_owner free stack trace missing [ 53.092915][ T2446] [ 53.095178][ T2446] Memory state around the buggy address: [ 53.100642][ T2446] ffff8881da87d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.108712][ T2446] ffff8881da87d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 53.116872][ T2446] >ffff8881da87d800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.124854][ T2446] ^ [ 53.129627][ T2446] ffff8881da87d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.137533][ T2446] ffff8881da87d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 53.145490][ T2446] ================================================================== [ 53.153319][ T2446] Disabling lock debugging due to kernel taint 2024/04/05 16:49:17 executed programs: 863 2024/04/05 16:49:22 executed programs: 1223