ci2-android-6-12-rust/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-12-rust/syz-executor2082181291
<...>
syzkaller
syzkaller login: [ 14.343462][ T36] kauditd_printk_skb: 48 callbacks suppressed
[ 14.343477][ T36] audit: type=1400 audit(1794183529.659:59): avc: denied { transition } for pid=233 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.347708][ T36] audit: type=1400 audit(1794183529.659:60): avc: denied { noatsecure } for pid=233 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.350465][ T36] audit: type=1400 audit(1794183529.659:61): avc: denied { write } for pid=233 comm="sh" path="pipe:[2868]" dev="pipefs" ino=2868 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 14.354004][ T36] audit: type=1400 audit(1794183529.659:62): avc: denied { rlimitinh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 14.356758][ T36] audit: type=1400 audit(1794183529.659:63): avc: denied { siginh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
Warning: Permanently added '10.128.1.170' (ED25519) to the list of known hosts.
execve("ci2-android-6-12-rust/syz-executor2082181291", ["ci2-android-6-12-rust/syz-executor2082181291"], 0x7ffe191e1810 /* 10 vars */) = 0
brk(NULL) = 0x5555921b1000
brk(0x5555921b1d40) = 0x5555921b1d40
arch_prctl(ARCH_SET_FS, 0x5555921b13c0) = 0
set_tid_address(0x5555921b1690) = 313
set_robust_list(0x5555921b16a0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-12-rust/syz-executor2082181291", 4096) = 50
getrandom("\xa7\xdf\xb7\x31\xd8\xe5\x5c\xa5", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555921b1d40
brk(0x5555921d2d40) = 0x5555921d2d40
brk(0x5555921d3000) = 0x5555921d3000
mprotect(0x7f69cb152000, 20480, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18) = 18
executing program
openat(AT_FDCWD, "/dev/mapper/control", O_RDWR) = 3
ioctl(3, DM_DEV_CREATE, [{version=[4, 0, 0], data_size=312, name="syza0", flags=DM_SKIP_LOCKFS_FLAG|DM_SECURE_DATA_FLAG|DM_IMA_MEASUREMENT_FLAG}] => [{version=[4, 48, 0], data_size=305, dev=makedev(0xfc, 0), name="syza0", target_count=0, open_count=0, event_nr=0, flags=DM_SKIP_LOCKFS_FLAG|DM_IMA_MEASUREMENT_FLAG}]) = 0
openat(AT_FDCWD, "/dev/mapper/control", O_WRONLY|O_CREAT|O_NONBLOCK|O_LARGEFILE|O_CLOEXEC, 000) = 4
[ 23.285351][ T36] audit: type=1400 audit(1794183538.599:64): avc: denied { execmem } for pid=313 comm="syz-executor208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 23.302612][ T313] device-mapper: verity: sha512 using shash "sha512-avx2"
[ 23.304794][ T36] audit: type=1400 audit(1794183538.619:65): avc: denied { read write } for pid=313 comm="syz-executor208" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[ 23.311945][ T313] ------------[ cut here ]------------
[ 23.336242][ T36] audit: type=1400 audit(1794183538.619:66): avc: denied { open } for pid=313 comm="syz-executor208" path="/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[ 23.341159][ T313] UBSAN: shift-out-of-bounds in drivers/md/dm-verity-target.c:1758:38
[ 23.365619][ T36] audit: type=1400 audit(1794183538.619:67): avc: denied { ioctl } for pid=313 comm="syz-executor208" path="/dev/mapper/control" dev="devtmpfs" ino=198 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[ 23.373697][ T313] shift exponent 66 is too large for 64-bit type 'sector_t' (aka 'unsigned long long')
[ 23.409119][ T313] CPU: 1 UID: 0 PID: 313 Comm: syz-executor208 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9
[ 23.409137][ T313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[ 23.409150][ T313] Call Trace:
[ 23.409154][ T313]
[ 23.409158][ T313] __dump_stack+0x21/0x30
[ 23.409176][ T313] dump_stack_lvl+0x140/0x1c0
[ 23.409185][ T313] ? __cfi_dump_stack_lvl+0x10/0x10
[ 23.409196][ T313] dump_stack+0x19/0x20
[ 23.409205][ T313] ubsan_epilogue+0xe/0x40
[ 23.409215][ T313] __ubsan_handle_shift_out_of_bounds+0x36d/0x400
[ 23.409230][ T313] verity_ctr+0x124c/0x1d00
[ 23.409241][ T313] ? __cfi_verity_ctr+0x10/0x10
[ 23.409250][ T313] ? skip_spaces+0x8e/0xa0
[ 23.409266][ T313] ? dm_split_args+0x5d0/0x740
[ 23.409290][ T313] dm_table_add_target+0x59f/0xcb0
[ 23.409304][ T313] table_load+0x2eb/0x7d0
[ 23.409317][ T313] ? __check_object_size+0x99/0x870
[ 23.409333][ T313] ? __cfi_table_load+0x10/0x10
[ 23.409346][ T313] ? __kasan_check_write+0x18/0x20
[ 23.409361][ T313] ? __cfi_table_load+0x10/0x10
[ 23.409374][ T313] dm_ctl_ioctl+0x8f3/0xde0
[ 23.409387][ T313] ? __cfi_dm_ctl_ioctl+0x10/0x10
[ 23.409402][ T313] ? ptrace_notify+0x20d/0x290
[ 23.409412][ T313] ? bpf_lsm_file_ioctl+0xd/0x20
[ 23.409424][ T313] ? security_file_ioctl+0x3e/0x110
[ 23.409439][ T313] ? __cfi_dm_ctl_ioctl+0x10/0x10
[ 23.409451][ T313] __se_sys_ioctl+0x123/0x1b0
[ 23.409462][ T313] __x64_sys_ioctl+0x7f/0xa0
[ 23.409473][ T313] x64_sys_call+0x1878/0x2ee0
[ 23.409483][ T313] do_syscall_64+0x57/0xf0
[ 23.409494][ T313] ? clear_bhb_loop+0x50/0xa0
[ 23.409508][ T313] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 23.409521][ T313] RIP: 0033:0x7f69cb0c2179
[ 23.409536][ T313] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[ 23.409544][ T313] RSP: 002b:00007ffd5baf5b78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 23.409559][ T313] RAX: ffffffffffffffda RBX: 00007f69cb128023 RCX: 00007f69cb0c2179
[ 23.409567][ T313] RDX: 0000200000000900 RSI: 00000000c138fd09 RDI: 0000000000000004
[ 23.409573][ T313] RBP: 0000000000000001 R08: 0000000000000011 R09: 00007ffd5baf5ca8
[ 23.409580][ T313] R10: 0000000000000003 R11: 0000000000000246 R12: 00007ffd5baf5c98
[ 23.409587][ T313] R13: 0000000000000002 R14: 00007f69cb152ca0 R15: 0000000000000002
[ 23.409594][ T313]
[ 23.409598][ T313] ---[ end trace ]---
[ 23.652386][ T313] ------------[ cut here ]------------
[ 23.657834][ T313] UBSAN: shift-out-of-bounds in drivers/md/dm-verity-target.c:1759:6
[ 23.665974][ T313] shift exponent 66 is too large for 64-bit type 'sector_t' (aka 'unsigned long long')
[ 23.675628][ T313] CPU: 0 UID: 0 PID: 313 Comm: syz-executor208 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9
[ 23.675655][ T313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
[ 23.675662][ T313] Call Trace:
[ 23.675666][ T313]
[ 23.675677][ T313] __dump_stack+0x21/0x30
[ 23.675691][ T313] dump_stack_lvl+0x140/0x1c0
[ 23.675701][ T313] ? __cfi_dump_stack_lvl+0x10/0x10
[ 23.675711][ T313] dump_stack+0x19/0x20
[ 23.675720][ T313] ubsan_epilogue+0xe/0x40
[ 23.675730][ T313] __ubsan_handle_shift_out_of_bounds+0x36d/0x400
[ 23.675749][ T313] verity_ctr+0x128b/0x1d00
[ 23.675759][ T313] ? __cfi_verity_ctr+0x10/0x10
[ 23.675768][ T313] ? skip_spaces+0x8e/0xa0
[ 23.675782][ T313] ? dm_split_args+0x5d0/0x740
[ 23.675792][ T313] dm_table_add_target+0x59f/0xcb0
[ 23.675803][ T313] table_load+0x2eb/0x7d0
[ 23.675816][ T313] ? __check_object_size+0x99/0x870
[ 23.675831][ T313] ? __cfi_table_load+0x10/0x10
[ 23.675844][ T313] ? __kasan_check_write+0x18/0x20
[ 23.675859][ T313] ? __cfi_table_load+0x10/0x10
[ 23.675872][ T313] dm_ctl_ioctl+0x8f3/0xde0
[ 23.675885][ T313] ? __cfi_dm_ctl_ioctl+0x10/0x10
[ 23.675900][ T313] ? ptrace_notify+0x20d/0x290
[ 23.675910][ T313] ? bpf_lsm_file_ioctl+0xd/0x20
[ 23.675921][ T313] ? security_file_ioctl+0x3e/0x110
[ 23.675934][ T313] ? __cfi_dm_ctl_ioctl+0x10/0x10
[ 23.675947][ T313] __se_sys_ioctl+0x123/0x1b0
[ 23.675958][ T313] __x64_sys_ioctl+0x7f/0xa0
[ 23.675968][ T313] x64_sys_call+0x1878/0x2ee0
[ 23.675979][ T313] do_syscall_64+0x57/0xf0
[ 23.675990][ T313] ? clear_bhb_loop+0x50/0xa0
[ 23.676004][ T313] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 23.676017][ T313] RIP: 0033:0x7f69cb0c2179
[ 23.676028][ T313] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
[ 23.676036][ T313] RSP: 002b:00007ffd5baf5b78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 23.676048][ T313] RAX: ffffffffffffffda RBX: 00007f69cb128023 RCX: 00007f69cb0c2179
[ 23.676055][ T313] RDX: 0000200000000900 RSI: 00000000c138fd09 RDI: 0000000000000004
[ 23.676063][ T313] RBP: 0000000000000001 R08: 0000000000000011 R09: 00007ffd5baf5ca8
[ 23.676069][ T313] R10: 0000000000000003 R11: 0000000000000246 R12: 00007ffd5baf5c98
[ 23.676076][ T313] R13: 0000000000000002 R14: 00007f69cb152ca0 R15: 0000000000000002
[ 23.676083][ T313]
[ 23.676087][ T313] ---[ end trace ]---
ioctl(4, DM_TABLE_LOAD, [{version=[4, 0, 0], data_size=664, data_start=312, dev=makedev(0xfc, 0), target_count=1, flags=DM_READONLY_FLAG|DM_STATUS_TABLE_FLAG|DM_SKIP_LOCKFS_FLAG|DM_QUERY_INACTIVE_TABLE_FLAG|DM_UUID_FLAG|DM_DEFERRED_REMOVE}, ...] => [{version=[4, 48, 0], data_size=664, data_start=312, dev=makedev(0xfc, 0), flags=DM_READONLY_FLAG|DM_STATUS_TABLE_FLAG|DM_SKIP_LOCKFS_FLAG|DM_QUERY_INACTIVE_TABLE_FLAG|DM_UUID_FLAG|DM_DEFERRED_REMOVE}]) = -1 E2BIG (Argument list too long)
exit_group(0) = ?
+++ exited with 0 +++
[