ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor2903471882 <...> Warning: Permanently added '10.128.0.128' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor2903471882", ["ci2-android-5-15/syz-executor2903471882"], 0x7ffe0b469010 /* 10 vars */) = 0 brk(NULL) = 0x555583bf1000 brk(0x555583bf1d40) = 0x555583bf1d40 arch_prctl(ARCH_SET_FS, 0x555583bf13c0) = 0 set_tid_address(0x555583bf1690) = 303 set_robust_list(0x555583bf16a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor2903471882", 4096) = 45 getrandom("\x78\x23\x90\x6b\xf5\x61\x4e\xd7", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555583bf1d40 brk(0x555583c12d40) = 0x555583c12d40 brk(0x555583c13000) = 0x555583c13000 mprotect(0x7fa0a7e36000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555583bf1690) = 304 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x555583bf16a0, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] getppid() = 0 [pid 304] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 304] unshare(CLONE_NEWNS) = 0 [pid 304] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 304] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 304] unshare(CLONE_NEWCGROUP) = 0 [pid 304] unshare(CLONE_NEWUTS) = 0 [pid 304] unshare(CLONE_SYSVSEM) = 0 [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] getpid() = 1 [pid 304] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 12]) = 0 [pid 309] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=88, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_MULTI|NLM_F_ECHO|0xe00, nlmsg_seq=0, nlmsg_pid=-4}, "\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x01\x00\x00\x00\x0a\x00\x01\x00\x6e\x65\x74\x65\x6d\x00\x00\x00\x28\x00\x02\x00\x01\x00\x00\x00\x06\x00\x00\x00\x00\x0a\x00\x00\x03\x00\x00\x00\xff\xff\xff\xff\x02\x01\x02\x00\x0c\x00\x04\x00\xff\xff\xff\x7f\x55\x01\x00\x00"], iov_len=88}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, MSG_EOR|MSG_ZEROCOPY) = 88 [pid 309] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) = 5 [pid 309] bind(5, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[00, 0x11, 0x22, 0x33, 0x44, 0x55]}, 20) = 0 [pid 309] setsockopt(5, SOL_PACKET, PACKET_TX_RING, {tp_block_size=4096, tp_block_nr=4, tp_frame_size=2048, tp_frame_nr=8}, 16) = 0 [pid 309] mmap(0x200000000000, 16384, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 5, 0) = 0x200000000000 [pid 309] write(5, "\x01", 1) = 0 [pid 309] close(3) = 0 [pid 309] close(4) = 0 [pid 309] close(5) = 0 [pid 309] close(6) = -1 EBADF (Bad file descriptor) [pid 309] close(7) = -1 EBADF (Bad file descriptor) [pid 309] close(8) = -1 EBADF (Bad file descriptor) [pid 309] close(9) = -1 EBADF (Bad file descriptor) [pid 309] close(10) = -1 EBADF (Bad file descriptor) [pid 309] close(11) = -1 EBADF (Bad file descriptor) [pid 309] close(12) = -1 EBADF (Bad file descriptor) [pid 309] close(13) = -1 EBADF (Bad file descriptor) [pid 309] close(14) = -1 EBADF (Bad file descriptor) [pid 309] close(15) = -1 EBADF (Bad file descriptor) [pid 309] close(16) = -1 EBADF (Bad file descriptor) [pid 309] close(17) = -1 EBADF (Bad file descriptor) [pid 309] close(18) = -1 EBADF (Bad file descriptor) [pid 309] close(19) = -1 EBADF (Bad file descriptor) [pid 309] close(20) = -1 EBADF (Bad file descriptor) [pid 309] close(21) = -1 EBADF (Bad file descriptor) [pid 309] close(22) = -1 EBADF (Bad file descriptor) [pid 309] close(23) = -1 EBADF (Bad file descriptor) [pid 309] close(24) = -1 EBADF (Bad file descriptor) [pid 309] close(25) = -1 EBADF (Bad file descriptor) [pid 309] close(26) = -1 EBADF (Bad file descriptor) [pid 309] close(27) = -1 EBADF (Bad file descriptor) [pid 309] close(28) = -1 EBADF (Bad file descriptor) [pid 309] close(29) = -1 EBADF (Bad file descriptor) [pid 309] exit_group(0) = ? [pid 309] +++ exited with 0 +++ [pid 304] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 304] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 310 attached , child_tidptr=0x555583bf1690) = 3 [pid 310] set_robust_list(0x555583bf16a0, 24 [pid 304] rt_sigprocmask(SIG_SETMASK, [] [pid 310] <... set_robust_list resumed>) = 0 [pid 304] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 310] setpgid(0, 0) = 0 [pid 310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 310] write(3, "1000", 4) = 4 [pid 310] close(3) = 0 executing program [ 26.997391][ T30] audit: type=1400 audit(1787132687.375:72): avc: denied { mounton } for pid=304 comm="syz-executor290" path="/root/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 27.002638][ T304] request_module fs-gadgetfs succeeded, but still no fs? [ 27.021934][ T30] audit: type=1400 audit(1787132687.375:73): avc: denied { mount } for pid=304 comm="syz-executor290" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [pid 310] write(1, "executing program\n", 18) = 18 [pid 310] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [pid 310] socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 4 [pid 310] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=NULL, iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = -1 EFAULT (Bad address) [pid 310] getsockname(4, {sa_family=AF_NETLINK, nl_pid=3, nl_groups=00000000}, [20 => 12]) = 0 [pid 310] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=88, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_MULTI|NLM_F_ECHO|0xe00, nlmsg_seq=0, nlmsg_pid=-4}, "\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x01\x00\x00\x00\x0a\x00\x01\x00\x6e\x65\x74\x65\x6d\x00\x00\x00\x28\x00\x02\x00\x01\x00\x00\x00\x06\x00\x00\x00\x00\x0a\x00\x00\x03\x00\x00\x00\xff\xff\xff\xff\x02\x01\x02\x00\x0c\x00\x04\x00\xff\xff\xff\x7f\x55\x01\x00\x00"], iov_len=88}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, MSG_EOR|MSG_ZEROCOPY) = 88 [pid 310] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) = 5 [pid 310] bind(5, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[00, 0x11, 0x22, 0x33, 0x44, 0x55]}, 20) = 0 [pid 310] setsockopt(5, SOL_PACKET, PACKET_TX_RING, {tp_block_size=4096, tp_block_nr=4, tp_frame_size=2048, tp_frame_nr=8}, 16) = 0 [pid 310] mmap(0x200000000000, 16384, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 5, 0) = 0x200000000000 [ 27.086185][ T310] divide error: 0000 [#1] PREEMPT SMP KASAN [ 27.092145][ T310] CPU: 1 PID: 310 Comm: syz-executor290 Not tainted syzkaller #0 [ 27.099877][ T310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.109968][ T310] RIP: 0010:netem_enqueue+0x17f8/0x3750 [ 27.115563][ T310] Code: 00 4c 89 e9 45 8b 6d 70 48 89 4c 24 28 4c 8d 61 74 4c 89 e1 48 c1 e9 03 0f b6 0c 31 84 c9 0f 85 34 19 00 00 45 2b 2c 24 31 d2 <41> f7 f5 48 01 d3 48 89 d8 48 c1 e8 03 0f b6 04 30 84 c0 0f 85 45 [ 27.135349][ T310] RSP: 0018:ffffc90000a67520 EFLAGS: 00010246 [ 27.141447][ T310] RAX: 00000000bc224c5d RBX: ffff88810fdce080 RCX: 0000000000000000 [ 27.149600][ T310] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff88810f2027f0 [ 27.157589][ T310] RBP: ffffc90000a67650 R08: 0000000000000003 R09: 0000000000000004 [ 27.166737][ T310] R10: dffffc0000000000 R11: fffff5200014ce0c R12: ffff88810f2027f4 [ 27.174719][ T310] R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000000 [ 27.182690][ T310] FS: 0000555583bf13c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 27.191617][ T310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.198228][ T310] CR2: 0000000000000000 CR3: 00000001211f1000 CR4: 00000000003506a0 [ 27.206224][ T310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.214197][ T310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.222174][ T310] Call Trace: [ 27.225585][ T310] [ 27.228517][ T310] ? __kasan_check_write+0x14/0x20 [ 27.233631][ T310] ? _raw_spin_lock+0x94/0xf0 [ 27.238305][ T310] ? qdisc_purge_queue+0x3d0/0x3d0 [ 27.243421][ T310] __dev_queue_xmit+0xc35/0x2d60 [ 27.248361][ T310] ? dev_queue_xmit+0x20/0x20 [ 27.253049][ T310] ? packet_parse_headers+0x845/0xab0 [ 27.258512][ T310] ? sock_kzfree_s+0x60/0x60 [ 27.263102][ T310] ? skb_setup_tx_timestamp+0x200/0x200 [ 27.268652][ T310] ? mutex_lock+0x9b/0x1c0 [ 27.273084][ T310] ? wait_for_completion_killable_timeout+0x10/0x10 [ 27.279694][ T310] dev_queue_xmit+0x17/0x20 [ 27.284220][ T310] packet_sendmsg+0x224d/0x5060 [ 27.289078][ T310] ? packet_getsockopt+0x900/0x900 [ 27.294203][ T310] ? security_socket_sendmsg+0x82/0xa0 [ 27.299668][ T310] sock_write_iter+0x2a6/0x3a0 [ 27.304431][ T310] ? sock_read_iter+0x380/0x380 [ 27.309279][ T310] ? memset+0x35/0x40 [ 27.313262][ T310] ? iov_iter_init+0xbc/0x180 [ 27.317941][ T310] vfs_write+0x831/0xfd0 [ 27.322178][ T310] ? file_end_write+0x1b0/0x1b0 [ 27.327036][ T310] ? _raw_spin_unlock_irq+0x4e/0x70 [ 27.332230][ T310] ? cgroup_leave_frozen+0x165/0x2a0 [ 27.337515][ T310] ? __kasan_check_read+0x11/0x20 [ 27.342536][ T310] ? __fdget_pos+0x1f7/0x380 [ 27.347124][ T310] ksys_write+0x14a/0x260 [ 27.351448][ T310] ? __ia32_sys_read+0x90/0x90 [ 27.356210][ T310] ? __kasan_check_write+0x14/0x20 [ 27.361336][ T310] ? switch_fpu_return+0x15d/0x2c0 [ 27.366446][ T310] __x64_sys_write+0x7b/0x90 [ 27.371030][ T310] x64_sys_call+0x8ef/0x9a0 [ 27.375532][ T310] do_syscall_64+0x4c/0xa0 [ 27.379942][ T310] ? clear_bhb_loop+0x50/0xa0 [ 27.384616][ T310] ? clear_bhb_loop+0x50/0xa0 [ 27.389287][ T310] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.395182][ T310] RIP: 0033:0x7fa0a7d9ea89 [ 27.399602][ T310] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 27.419203][ T310] RSP: 002b:00007ffddc833738 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 27.427618][ T310] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa0a7d9ea89 [ 27.435604][ T310] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000005 [ 27.443570][ T310] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 27.451540][ T310] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 27.459620][ T310] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffddc833780 [ 27.467613][ T310] [ 27.470743][ T310] Modules linked in: [ 27.474762][ T310] ---[ end trace 2ee40ca139cc5159 ]--- [ 27.480362][ T310] RIP: 0010:netem_enqueue+0x17f8/0x3750 [ 27.485948][ T310] Code: 00 4c 89 e9 45 8b 6d 70 48 89 4c 24 28 4c 8d 61 74 4c 89 e1 48 c1 e9 03 0f b6 0c 31 84 c9 0f 85 34 19 00 00 45 2b 2c 24 31 d2 <41> f7 f5 48 01 d3 48 89 d8 48 c1 e8 03 0f b6 04 30 84 c0 0f 85 45 [ 27.505633][ T310] RSP: 0018:ffffc90000a67520 EFLAGS: 00010246 [ 27.511764][ T310] RAX: 00000000bc224c5d RBX: ffff88810fdce080 RCX: 0000000000000000 [ 27.519749][ T310] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff88810f2027f0 [ 27.527851][ T310] RBP: ffffc90000a67650 R08: 0000000000000003 R09: 0000000000000004 [ 27.535930][ T310] R10: dffffc0000000000 R11: fffff5200014ce0c R12: ffff88810f2027f4 [ 27.543992][ T310] R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000000 [ 27.552042][ T310] FS: 0000555583bf13c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 27.561019][ T310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.567633][ T310] CR2: 0000000000000000 CR3: 00000001211f1000 CR4: 00000000003506a0 [ 27.575676][ T310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.583692][ T310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.591724][ T310] Kernel panic - not syncing: Fatal exception in interrupt [ 27.599101][ T310] Kernel Offset: disabled [ 27.606062][ T310] Rebooting in 86400 seconds..