ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor3940096666 <...> Warning: Permanently added '10.128.0.252' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor3940096666", ["ci2-android-6-1/syz-executor3940096666"], 0x7ffc9921e590 /* 10 vars */) = 0 brk(NULL) = 0x55557de6f000 brk(0x55557de6fd40) = 0x55557de6fd40 arch_prctl(ARCH_SET_FS, 0x55557de6f3c0) = 0 set_tid_address(0x55557de6f690) = 305 set_robust_list(0x55557de6f6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor3940096666", 4096) = 44 getrandom("\x2f\x25\x22\xbf\x68\x3e\xce\xf1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557de6fd40 brk(0x55557de90d40) = 0x55557de90d40 brk(0x55557de91000) = 0x55557de91000 mprotect(0x7f30283c5000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 executing program socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP) = 3 socket(AF_PPPOX, SOCK_STREAM, 1) = 4 connect(4, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x02\x00\x11\x5c\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00"}, 38) = 0 ioctl(4, F2FS_IOC_RELEASE_VOLATILE_WRITE, 0) = -1 ENOTTY (Inappropriate ioctl for device) exit_group(0) = ? [ 22.737244][ T28] audit: type=1400 audit(1789198016.431:64): avc: denied { execmem } for pid=305 comm="syz-executor394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.757267][ T28] audit: type=1400 audit(1789198016.431:65): avc: denied { create } for pid=305 comm="syz-executor394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 22.777357][ T305] ================================================================== [ 22.777768][ T28] audit: type=1400 audit(1789198016.431:66): avc: denied { connect } for pid=305 comm="syz-executor394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 22.785425][ T305] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 22.785467][ T305] Write of size 8 at addr ffff888110477d50 by task syz-executor394/305 [ 22.805423][ T28] audit: type=1400 audit(1789198016.451:67): avc: denied { ioctl } for pid=305 comm="syz-executor394" path="socket:[7820]" dev="sockfs" ino=7820 ioctlcmd=0xf504 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 22.811963][ T305] [ 22.811969][ T305] CPU: 0 PID: 305 Comm: syz-executor394 Not tainted syzkaller #0 [ 22.811984][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 22.812009][ T305] Call Trace: [ 22.868212][ T305] [ 22.871127][ T305] __dump_stack+0x21/0x24 [ 22.875446][ T305] dump_stack_lvl+0x110/0x170 [ 22.880103][ T305] ? __cfi_dump_stack_lvl+0x8/0x8 [ 22.885133][ T305] ? mutex_lock+0x86/0x1b0 [ 22.889528][ T305] print_address_description+0x71/0x200 [ 22.895069][ T305] print_report+0x4a/0x60 [ 22.899381][ T305] kasan_report+0x122/0x150 [ 22.903882][ T305] ? mutex_lock+0x86/0x1b0 [ 22.908306][ T305] kasan_check_range+0x249/0x2a0 [ 22.913222][ T305] __kasan_check_write+0x14/0x20 [ 22.918156][ T305] mutex_lock+0x86/0x1b0 [ 22.922387][ T305] ? __cfi_mutex_lock+0x10/0x10 [ 22.927214][ T305] ? kfree+0x6f/0xf0 [ 22.931089][ T305] ? l2tp_session_put+0xaf/0x1a0 [ 22.936001][ T305] ? l2tp_session_delete+0x3df/0x4d0 [ 22.941264][ T305] pppol2tp_release+0x178/0x2b0 [ 22.946099][ T305] sock_close+0xc9/0x220 [ 22.950333][ T305] ? __cfi_sock_close+0x10/0x10 [ 22.955168][ T305] __fput+0x1fd/0x8f0 [ 22.959144][ T305] ____fput+0x15/0x20 [ 22.963108][ T305] task_work_run+0x1e1/0x250 [ 22.967687][ T305] ? __cfi_task_work_run+0x10/0x10 [ 22.972806][ T305] ? __kasan_check_write+0x14/0x20 [ 22.977894][ T305] do_exit+0xb03/0x2970 [ 22.982037][ T305] ? ptrace_stop+0x6dc/0x8e0 [ 22.986708][ T305] ? __cfi_do_exit+0x10/0x10 [ 22.991276][ T305] ? __kasan_check_write+0x14/0x20 [ 22.996390][ T305] ? _raw_spin_lock_irq+0x95/0xf0 [ 23.001395][ T305] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 23.006919][ T305] ? zap_other_threads+0x321/0x3a0 [ 23.012033][ T305] do_group_exit+0x21b/0x2e0 [ 23.016699][ T305] __x64_sys_exit_group+0x3f/0x40 [ 23.021712][ T305] x64_sys_call+0x7b4/0x9a0 [ 23.026196][ T305] do_syscall_64+0x4c/0xa0 [ 23.030712][ T305] ? clear_bhb_loop+0x30/0x80 [ 23.035373][ T305] ? clear_bhb_loop+0x30/0x80 [ 23.040134][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.046037][ T305] RIP: 0033:0x7f3028334305 [ 23.050452][ T305] Code: Unable to access opcode bytes at 0x7f30283342db. [ 23.057469][ T305] RSP: 002b:00007ffd72a5e6e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 23.065860][ T305] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f3028334305 [ 23.073812][ T305] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 23.081793][ T305] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffd72a5e878 [ 23.089765][ T305] R10: 0000000000000001 R11: 0000000000000206 R12: 0000000000000000 [ 23.097724][ T305] R13: 00007f30283ca110 R14: 00007f30283cc3a8 R15: 00007f30283cc3c0 [ 23.105684][ T305] [ 23.108711][ T305] [ 23.111012][ T305] Allocated by task 305: [ 23.115226][ T305] kasan_set_track+0x4b/0x70 [ 23.119795][ T305] kasan_save_alloc_info+0x1f/0x30 [ 23.124882][ T305] __kasan_kmalloc+0x95/0xb0 [ 23.129450][ T305] __kmalloc+0xb4/0x1e0 [ 23.133579][ T305] l2tp_session_create+0x38/0xbd0 [ 23.138584][ T305] pppol2tp_connect+0xbf5/0x1640 [ 23.143505][ T305] __sys_connect+0x3da/0x460 [ 23.148083][ T305] __x64_sys_connect+0x7a/0x90 [ 23.152828][ T305] x64_sys_call+0x88d/0x9a0 [ 23.157309][ T305] do_syscall_64+0x4c/0xa0 [ 23.161709][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.167601][ T305] [ 23.169903][ T305] Freed by task 305: [ 23.173768][ T305] kasan_set_track+0x4b/0x70 [ 23.178398][ T305] kasan_save_free_info+0x2b/0x40 [ 23.183415][ T305] ____kasan_slab_free+0x132/0x180 [ 23.188519][ T305] __kasan_slab_free+0x11/0x20 [ 23.193283][ T305] slab_free_freelist_hook+0xc2/0x190 [ 23.198631][ T305] __kmem_cache_free+0xb7/0x1b0 [ 23.203461][ T305] kfree+0x6f/0xf0 [ 23.207177][ T305] l2tp_session_put+0xaf/0x1a0 [ 23.211936][ T305] l2tp_session_delete+0x3df/0x4d0 [ 23.217041][ T305] pppol2tp_release+0x169/0x2b0 [ 23.221887][ T305] sock_close+0xc9/0x220 [ 23.226103][ T305] __fput+0x1fd/0x8f0 [ 23.230076][ T305] ____fput+0x15/0x20 [ 23.234035][ T305] task_work_run+0x1e1/0x250 [ 23.238608][ T305] do_exit+0xb03/0x2970 [ 23.242744][ T305] do_group_exit+0x21b/0x2e0 [ 23.247318][ T305] __x64_sys_exit_group+0x3f/0x40 [ 23.252353][ T305] x64_sys_call+0x7b4/0x9a0 [ 23.256836][ T305] do_syscall_64+0x4c/0xa0 [ 23.261246][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.267118][ T305] [ 23.269422][ T305] The buggy address belongs to the object at ffff888110477c00 [ 23.269422][ T305] which belongs to the cache kmalloc-512 of size 512 [ 23.283444][ T305] The buggy address is located 336 bytes inside of [ 23.283444][ T305] 512-byte region [ffff888110477c00, ffff888110477e00) [ 23.296693][ T305] [ 23.298997][ T305] The buggy address belongs to the physical page: [ 23.305379][ T305] page:ffffea0004411d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110474 [ 23.315604][ T305] head:ffffea0004411d00 order:2 compound_mapcount:0 compound_pincount:0 [ 23.323907][ T305] flags: 0x4000000000010200(slab|head|zone=1) [ 23.329978][ T305] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 23.338535][ T305] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.347093][ T305] page dumped because: kasan: bad access detected [ 23.353495][ T305] page_owner tracks the page as allocated [ 23.359206][ T305] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 92, tgid 92 (klogd), ts 3842819787, free_ts 0 [ 23.378800][ T305] post_alloc_hook+0x1f5/0x210 [ 23.383551][ T305] prep_new_page+0x1c/0x110 [ 23.388052][ T305] get_page_from_freelist+0x2ca9/0x2d20 [ 23.393576][ T305] __alloc_pages+0x1fa/0x610 [ 23.398143][ T305] alloc_slab_page+0x6e/0xf0 [ 23.402733][ T305] new_slab+0x98/0x3e0 [ 23.406799][ T305] ___slab_alloc+0x70f/0xb70 [ 23.411368][ T305] __slab_alloc+0x5e/0xa0 [ 23.415691][ T305] __kmem_cache_alloc_node+0x204/0x2d0 [ 23.421130][ T305] __kmalloc_node_track_caller+0xa1/0x1e0 [ 23.426832][ T305] __alloc_skb+0x226/0x4a0 [ 23.431239][ T305] alloc_skb_with_frags+0xa8/0x620 [ 23.436332][ T305] sock_alloc_send_pskb+0x87f/0x9a0 [ 23.441514][ T305] unix_dgram_sendmsg+0x5c1/0x1710 [ 23.446605][ T305] __sys_sendto+0x4ac/0x660 [ 23.451103][ T305] __x64_sys_sendto+0xe5/0x100 [ 23.455860][ T305] page_owner free stack trace missing [ 23.461230][ T305] [ 23.463549][ T305] Memory state around the buggy address: [ 23.469154][ T305] ffff888110477c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.477212][ T305] ffff888110477c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.485252][ T305] >ffff888110477d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.493288][ T305] ^ [ 23.499972][ T305] ffff888110477d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.508009][ T305] ffff888110477e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.516045][ T305] ================================================================== [ 23.524401][ T305] Disabling lock debugging due to kernel taint +++ exited with 0 +++ [ 23.529422][ T28] audit: type=1400 audit(1789198017.221:68): avc: denied { read } for pid=85 comm="syslogd" n