[ 27.811973][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.875434][ T305] syz-executor.0 (305) used greatest stack depth: 10832 bytes left [ 28.375415][ T10] device bridge_slave_1 left promiscuous mode [ 28.381414][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.388423][ T10] device bridge_slave_0 left promiscuous mode [ 28.394547][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.401639][ T10] device veth1_macvtap left promiscuous mode [ 28.407419][ T10] device veth0_vlan left promiscuous mode [ 38.484387][ T27] kauditd_printk_skb: 18 callbacks suppressed [ 38.484391][ T27] audit: type=1400 audit(1721767155.077:94): avc: denied { read } for pid=79 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.1.190' (ED25519) to the list of known hosts. 2024/07/23 20:39:21 ignoring optional flag "sandboxArg"="0" 2024/07/23 20:39:21 parsed 1 programs [ 45.025384][ T27] audit: type=1400 audit(1721767161.627:95): avc: denied { unlink } for pid=347 comm="syz-executor" name="swap-file" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" 2024/07/23 20:39:21 executed programs: 0 [ 45.085590][ T347] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.102944][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.109793][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.116726][ T353] device bridge_slave_0 entered promiscuous mode [ 45.122918][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.129662][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.136581][ T353] device bridge_slave_1 entered promiscuous mode [ 45.147739][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.154550][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.161609][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.168444][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.177169][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.184170][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.191039][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 45.198087][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.206909][ T353] device veth0_vlan entered promiscuous mode [ 45.213369][ T353] device veth1_macvtap entered promiscuous mode [ 45.219979][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.228156][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.235796][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.242981][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.250167][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.258110][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.266502][ T23] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.273259][ T23] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.280356][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.288167][ T23] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.294959][ T23] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.302054][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.309730][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.318170][ T36] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.326989][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.336279][ T27] audit: type=1400 audit(1721767161.937:96): avc: denied { mounton } for pid=353 comm="syz-executor.0" path="/dev/binderfs" dev="devtmpfs" ino=207 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 45.360779][ T27] audit: type=1400 audit(1721767161.957:97): avc: denied { read write } for pid=358 comm="syz-executor.0" name="fuse" dev="devtmpfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 45.384047][ T27] audit: type=1400 audit(1721767161.957:98): avc: denied { open } for pid=358 comm="syz-executor.0" path="/dev/fuse" dev="devtmpfs" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 45.407072][ T27] audit: type=1400 audit(1721767161.957:99): avc: denied { mounton } for pid=358 comm="syz-executor.0" path="/root/syzkaller-testdir3000380561/syzkaller.LgphfO/0/file0" dev="sda1" ino=1939 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 45.434052][ T363] BUG: kernel NULL pointer dereference, address: 0000000000000049 [ 45.441818][ T363] #PF: supervisor read access in kernel mode [ 45.447728][ T363] #PF: error_code(0x0000) - not-present page [ 45.453532][ T363] PGD 1109c7067 P4D 1109c7067 PUD 1109b4067 PMD 0 [ 45.459869][ T363] Oops: 0000 [#1] PREEMPT SMP [ 45.464382][ T363] CPU: 0 PID: 363 Comm: syz-executor.0 Not tainted 6.1.90-syzkaller #0 [ 45.473146][ T363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 45.483313][ T363] RIP: 0010:do_unlinkat+0x1a1/0x2d0 [ 45.488362][ T363] Code: a9 00 00 70 00 74 53 25 00 00 60 00 31 c9 3d 00 00 20 00 0f 94 c1 41 be ec ff ff ff 41 29 ce 45 31 ed eb 47 41 bf a0 00 00 00 <4c> 8b 6b 30 f6 43 02 70 4c 8b 75 90 74 2d 4c 89 ef e8 e9 f8 00 00 [ 45.507866][ T363] RSP: 0018:ffffc900007a3e80 EFLAGS: 00010246 [ 45.513773][ T363] RAX: ffff88810024e028 RBX: 0000000000000019 RCX: 0000000000000005 [ 45.521665][ T363] RDX: 00000000ffffff9c RSI: 0000000300000000 RDI: ffff88810033cc00 [ 45.529477][ T363] RBP: ffffc900007a3f00 R08: ffff8881109d9be0 R09: ffffffff81549170 [ 45.537289][ T363] R10: ffff8881109d9be0 R11: ffff888100041400 R12: ffff88810c32c000 [ 45.545109][ T363] R13: ffffc900007a3eb0 R14: 00000000000000a0 R15: 00000000000000a0 [ 45.552911][ T363] FS: 00007f60ff7646c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 [ 45.561765][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.568195][ T363] CR2: 0000000000000049 CR3: 00000001109d3000 CR4: 00000000003506b0 [ 45.576001][ T363] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.583810][ T363] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.591802][ T363] Call Trace: [ 45.594919][ T363] [ 45.597698][ T363] ? __die_body+0x62/0xb0 [ 45.601864][ T363] ? __die+0x7e/0x90 [ 45.605596][ T363] ? page_fault_oops+0x369/0x3d0 [ 45.610379][ T363] ? exc_page_fault+0x4dc/0x670 [ 45.615148][ T363] ? asm_exc_page_fault+0x27/0x30 [ 45.620090][ T363] ? fuse_lookup_name+0x380/0x420 [ 45.624957][ T363] ? do_unlinkat+0x1a1/0x2d0 [ 45.629380][ T363] __x64_sys_unlink+0x1e/0x30 [ 45.633898][ T363] x64_sys_call+0x289/0x9a0 [ 45.638322][ T363] do_syscall_64+0x3b/0xb0 [ 45.642656][ T363] ? clear_bhb_loop+0x55/0xb0 [ 45.647169][ T363] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 45.652983][ T363] RIP: 0033:0x7f60fea7dda9 [ 45.657238][ T363] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 45.676767][ T363] RSP: 002b:00007f60ff7640c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 45.685010][ T363] RAX: ffffffffffffffda RBX: 00007f60febac050 RCX: 00007f60fea7dda9 [ 45.692908][ T363] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 45.700814][ T363] RBP: 00007f60feaca47a R08: 0000000000000000 R09: 0000000000000000 [ 45.710014][ T363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.717907][ T363] R13: 000000000000006e R14: 00007f60febac050 R15: 00007fff486e8718 [ 45.725721][ T363] [ 45.728582][ T363] Modules linked in: [ 45.732319][ T363] CR2: 0000000000000049 [ 45.736309][ T363] ---[ end trace 0000000000000000 ]--- [ 45.741690][ T363] RIP: 0010:do_unlinkat+0x1a1/0x2d0 [ 45.746722][ T363] Code: a9 00 00 70 00 74 53 25 00 00 60 00 31 c9 3d 00 00 20 00 0f 94 c1 41 be ec ff ff ff 41 29 ce 45 31 ed eb 47 41 bf a0 00 00 00 <4c> 8b 6b 30 f6 43 02 70 4c 8b 75 90 74 2d 4c 89 ef e8 e9 f8 00 00 [ 45.766251][ T363] RSP: 0018:ffffc900007a3e80 EFLAGS: 00010246 [ 45.772153][ T363] RAX: ffff88810024e028 RBX: 0000000000000019 RCX: 0000000000000005 [ 45.779973][ T363] RDX: 00000000ffffff9c RSI: 0000000300000000 RDI: ffff88810033cc00 [ 45.787780][ T363] RBP: ffffc900007a3f00 R08: ffff8881109d9be0 R09: ffffffff81549170 [ 45.795675][ T363] R10: ffff8881109d9be0 R11: ffff888100041400 R12: ffff88810c32c000 [ 45.803581][ T363] R13: ffffc900007a3eb0 R14: 00000000000000a0 R15: 00000000000000a0 [ 45.811730][ T363] FS: 00007f60ff7646c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 [ 45.820597][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.827006][ T363] CR2: 0000000000000049 CR3: 00000001109d3000 CR4: 00000000003506b0 [ 45.834813][ T363] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.842737][ T363] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.850548][ T363] Kernel panic - not syncing: Fatal exception [ 45.856671][ T363] Kernel Offset: disabled [ 45.860775][ T363] Rebooting in 86400 seconds..