ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor861181076 <...> permissive=1 [ 14.005450][ T30] audit: type=1400 audit(1793550728.834:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.331973][ T230] sshd-session (230) used greatest stack depth: 21440 bytes left Warning: Permanently added '10.128.1.27' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor861181076", ["ci2-android-5-15/syz-executor861181076"], 0x7ffc9461fcb0 /* 10 vars */) = 0 brk(NULL) = 0x55558ffec000 brk(0x55558ffecd40) = 0x55558ffecd40 arch_prctl(ARCH_SET_FS, 0x55558ffec3c0) = 0 set_tid_address(0x55558ffec690) = 304 set_robust_list(0x55558ffec6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor861181076", 4096) = 44 getrandom("\x8a\x7d\x92\x85\x45\xd5\x7b\x97", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558ffecd40 brk(0x55559000dd40) = 0x55559000dd40 brk(0x55559000e000) = 0x55559000e000 mprotect(0x7f5389711000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [ 22.923077][ T30] audit: type=1400 audit(1793550737.814:64): avc: denied { execmem } for pid=304 comm="syz-executor861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.943378][ T30] audit: type=1400 audit(1793550737.814:65): avc: denied { map_create } for pid=304 comm="syz-executor861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 22.963155][ T30] audit: type=1400 audit(1793550737.814:66): avc: denied { map_read map_write } for pid=304 comm="syz-executor861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 22.984594][ T30] audit: type=1400 audit(1793550737.814:67): avc: denied { prog_load } for pid=304 comm="syz-executor861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.006151][ T30] audit: type=1400 audit(1793550737.814:68): avc: denied { bpf } for pid=304 comm="syz-executor861" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=6, insns=0x200000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_SK_SKB_STREAM_VERDICT, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 6 bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=6, attach_type=BPF_SK_SKB_STREAM_VERDICT, attach_flags=0, replace_bpf_fd=0, relative_fd=0, expected_revision=0}, 32) = 0 bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x200000000640, value=0x200000000680, flags=BPF_ANY}, 32) = 0 [ 23.070707][ T30] audit: type=1400 audit(1793550737.964:69): avc: denied { perfmon } for pid=304 comm="syz-executor861" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 23.092463][ T30] audit: type=1400 audit(1793550737.984:70): avc: denied { prog_run } for pid=304 comm="syz-executor861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.094570][ T304] ================================================================== [ 23.119975][ T304] BUG: KASAN: slab-out-of-bounds in sk_skb_adjust_room+0x389/0x5c0 [ 23.128306][ T304] Read of size 8 at addr ffff888121af9f68 by task syz-executor861/304 [ 23.136478][ T304] [ 23.138822][ T304] CPU: 0 PID: 304 Comm: syz-executor861 Not tainted syzkaller #0 [ 23.146542][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 23.156594][ T304] Call Trace: [ 23.159872][ T304] [ 23.162808][ T304] __dump_stack+0x21/0x30 [ 23.167129][ T304] dump_stack_lvl+0x110/0x170 [ 23.172076][ T304] ? show_regs_print_info+0x20/0x20 [ 23.177715][ T304] ? load_image+0x3f0/0x3f0 [ 23.182218][ T304] ? skb_release_data+0x1b5/0xa20 [ 23.187499][ T304] print_address_description+0x7f/0x2c0 [ 23.193186][ T304] ? sk_skb_adjust_room+0x389/0x5c0 [ 23.198481][ T304] kasan_report+0x10f/0x150 [ 23.203675][ T304] ? sk_skb_adjust_room+0x389/0x5c0 [ 23.209214][ T304] __asan_report_load8_noabort+0x14/0x20 [ 23.220748][ T304] sk_skb_adjust_room+0x389/0x5c0 [ 23.225847][ T304] bpf_prog_e15ab8bd9cea3c06+0x19/0x744 [ 23.231501][ T304] sk_psock_verdict_recv+0x245/0x7f0 [ 23.237107][ T304] unix_read_sock+0x108/0x2d0 [ 23.243099][ T304] ? sk_psock_skb_redirect+0x440/0x440 [ 23.249617][ T304] ? unix_stream_splice_actor+0x120/0x120 [ 23.255661][ T304] ? copy_mc_pipe_to_iter+0x7e0/0x7e0 [ 23.261473][ T304] ? sk_psock_skb_redirect+0x440/0x440 [ 23.266943][ T304] unix_stream_read_sock+0x61/0x90 [ 23.272061][ T304] sk_psock_verdict_data_ready+0x167/0x1d0 [ 23.277886][ T304] ? sk_psock_start_verdict+0xc0/0xc0 [ 23.283273][ T304] ? _raw_spin_lock+0x94/0xf0 [ 23.288320][ T304] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 23.294152][ T304] ? skb_queue_tail+0xcb/0xf0 [ 23.298853][ T304] unix_stream_sendmsg+0x7d1/0xc90 [ 23.304020][ T304] ? unix_show_fdinfo+0xa0/0xa0 [ 23.308916][ T304] ? __schedule+0xbd7/0x14a0 [ 23.313517][ T304] ? security_socket_sendmsg+0x82/0xa0 [ 23.319721][ T304] __sys_sendto+0x46d/0x620 [ 23.324244][ T304] ? __ia32_sys_getpeername+0x90/0x90 [ 23.329731][ T304] ? __kasan_check_write+0x14/0x20 [ 23.334850][ T304] __x64_sys_sendto+0xe5/0x100 [ 23.339625][ T304] x64_sys_call+0x178/0x9a0 [ 23.344123][ T304] do_syscall_64+0x4c/0xa0 [ 23.348770][ T304] ? clear_bhb_loop+0x50/0xa0 [ 23.353461][ T304] ? clear_bhb_loop+0x50/0xa0 [ 23.358154][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.364065][ T304] RIP: 0033:0x7f5389680e79 [ 23.368788][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 23.393825][ T304] RSP: 002b:00007ffc5b45e5a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 23.402390][ T304] RAX: ffffffffffffffda RBX: 00007ffc5b45e6e8 RCX: 00007f5389680e79 [ 23.410733][ T304] RDX: 0000000000000001 RSI: 0000200000000800 RDI: 0000000000000004 [ 23.422801][ T304] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 23.430796][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5b45e6d8 [ 23.438884][ T304] R13: 0000000000000002 R14: 00007f5389711ca0 R15: 0000000000000002 [ 23.447123][ T304] [ 23.451416][ T304] [ 23.453750][ T304] Allocated by task 304: [ 23.457991][ T304] __kasan_slab_alloc+0xb7/0xe0 [ 23.462834][ T304] slab_post_alloc_hook+0x4f/0x2b0 [ 23.467946][ T304] kmem_cache_alloc+0xf7/0x260 [ 23.472735][ T304] sk_prot_alloc+0x5f/0x320 [ 23.477342][ T304] sk_alloc+0x38/0x430 [ 23.481441][ T304] unix_create1+0xb4/0x610 [ 23.485993][ T304] unix_create+0x149/0x200 [ 23.490500][ T304] __sock_create+0x38d/0x7a0 [ 23.495102][ T304] __sys_socketpair+0x1a1/0x590 [ 23.499940][ T304] __x64_sys_socketpair+0x9b/0xb0 [ 23.504957][ T304] x64_sys_call+0x36/0x9a0 [ 23.509363][ T304] do_syscall_64+0x4c/0xa0 [ 23.513768][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.519834][ T304] [ 23.522170][ T304] The buggy address belongs to the object at ffff888121af9a40 [ 23.522170][ T304] which belongs to the cache UNIX-STREAM of size 1216 [ 23.536356][ T304] The buggy address is located 104 bytes to the right of [ 23.536356][ T304] 1216-byte region [ffff888121af9a40, ffff888121af9f00) [ 23.550852][ T304] The buggy address belongs to the page: [ 23.557260][ T304] page:ffffea000486be00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121af8 [ 23.567501][ T304] head:ffffea000486be00 order:2 compound_mapcount:0 compound_pincount:0 [ 23.576364][ T304] flags: 0x4000000000010200(slab|head|zone=1) [ 23.582665][ T304] raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881003e6780 [ 23.591409][ T304] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 23.600252][ T304] page dumped because: kasan: bad access detected [ 23.608636][ T304] page_owner tracks the page as allocated [ 23.615097][ T304] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 299, ts 22780808678, free_ts 0 [ 23.634047][ T304] post_alloc_hook+0x192/0x1b0 [ 23.640123][ T304] prep_new_page+0x1c/0x110 [ 23.644724][ T304] get_page_from_freelist+0x2d42/0x2dd0 [ 23.650538][ T304] __alloc_pages+0x1a2/0x460 [ 23.655159][ T304] new_slab+0xa0/0x4d0 [ 23.659419][ T304] ___slab_alloc+0x3ac/0x840 [ 23.664019][ T304] __slab_alloc+0x49/0x90 [ 23.668377][ T304] kmem_cache_alloc+0x138/0x260 [ 23.675914][ T304] sk_prot_alloc+0x5f/0x320 [ 23.680431][ T304] sk_alloc+0x38/0x430 [ 23.684519][ T304] unix_create1+0xb4/0x610 [ 23.688959][ T304] unix_create+0x149/0x200 [ 23.693539][ T304] __sock_create+0x38d/0x7a0 [ 23.698774][ T304] __sys_socketpair+0x218/0x590 [ 23.704240][ T304] __x64_sys_socketpair+0x9b/0xb0 [ 23.709949][ T304] x64_sys_call+0x36/0x9a0 [ 23.714386][ T304] page_owner free stack trace missing [ 23.720085][ T304] [ 23.722445][ T304] Memory state around the buggy address: [ 23.728083][ T304] ffff888121af9e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.738295][ T304] ffff888121af9e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.746882][ T304] >ffff888121af9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.755441][ T304] ^ [ 23.763291][ T304] ffff888121af9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc sendto(4, "\x01", 1, 0, NULL, 0) = 1 exit_group(0) = ? +++ exited with 0 +++ [ 23.771620][ T304] ffff8881