ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor570268115 <...> syzkaller syzkaller login: [ 13.790153][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 13.790166][ T28] audit: type=1400 audit(1793037757.107:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.794348][ T28] audit: type=1400 audit(1793037757.107:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.797031][ T28] audit: type=1400 audit(1793037757.117:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[7008]" dev="pipefs" ino=7008 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.799985][ T28] audit: type=1400 audit(1793037757.117:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.802783][ T28] audit: type=1400 audit(1793037757.117:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor570268115", ["ci2-android-6-1/syz-executor570268115"], 0x7fff4a265f90 /* 10 vars */) = 0 brk(NULL) = 0x55559480d000 brk(0x55559480dd40) = 0x55559480dd40 arch_prctl(ARCH_SET_FS, 0x55559480d3c0) = 0 set_tid_address(0x55559480d690) = 305 set_robust_list(0x55559480d6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor570268115", 4096) = 43 getrandom("\x79\x35\xa1\x86\x34\xad\x0b\x4e", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55559480dd40 brk(0x55559482ed40) = 0x55559482ed40 brk(0x55559482f000) = 0x55559482f000 mprotect(0x7fcc6c4d5000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55559480d690) = 306 ci2-android-6-1/strace-static-x86_64: Process 306 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 306] set_robust_list(0x55559480d6a0, 24) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] <... openat resumed>) = 3 [pid 305] write(3, "10000000000", 11) = 11 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "20", 2) = 2 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "100", 3) = 3 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "7 4 1 3", 7) = 7 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/failslab/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_usercopy/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_make_request/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_io_timeout/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_iommufd/task-filter", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "306", 3) = 3 [pid 305] close(3) = 0 [pid 305] kill(306, SIGKILL) = 0 [pid 306] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=306, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55559480d690) = 307 ci2-android-6-1/strace-static-x86_64: Process 307 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 307] set_robust_list(0x55559480d6a0, 24) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 307] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 307] getppid() = 0 [pid 307] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 307] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 307] unshare(CLONE_NEWNS) = 0 [pid 307] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 307] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 307] unshare(CLONE_NEWCGROUP) = 0 [pid 307] unshare(CLONE_NEWUTS) = 0 [pid 307] unshare(CLONE_SYSVSEM) = 0 [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 307] getpid() = 1 [pid 307] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 80 3c 20 00 74 05 e8 94 aa c8 fc 49 8b 46 20 48 89 44 24 18 4c [ 25.559255][ T19] RSP: 0018:ffffc900001376a0 EFLAGS: 00010202 [ 25.565304][ T19] RAX: 0000000000000004 RBX: ffff88810d52a848 RCX: 0000000000000000 [ 25.573258][ T19] RDX: 0000000000000000 RSI: ffffffff878da8e0 RDI: 0000000000000020 [ 25.581208][ T19] RBP: ffffc90000137798 R08: 0000000000000003 R09: 0000000000000004 [ 25.589160][ T19] R10: dffffc0000000000 R11: fffff52000026ec4 R12: dffffc0000000000 [ 25.597111][ T19] R13: 1ffff92000026ed8 R14: 0000000000000000 R15: 1ffff11021aa5509 [ 25.605149][ T19] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 25.614056][ T19] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.620616][ T19] CR2: 00007fcc6c4a7d3c CR3: 000000010fd8d000 CR4: 00000000003506b0 [ 25.628570][ T19] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.636519][ T19] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.644472][ T19] Call Trace: [ 25.647732][ T19] [ 25.650647][ T19] ? __kasan_check_write+0x14/0x20 [ 25.655744][ T19] ? mutex_unlock+0x8f/0x230 [ 25.660323][ T19] ? __cfi_klist_remove+0x10/0x10 [ 25.665332][ T19] ? devres_release_all+0x14f/0x1b0 [ 25.670521][ T19] ? __cfi_devres_release_all+0x10/0x10 [ 25.676052][ T19] ? device_links_driver_cleanup+0x7f2/0x820 [ 25.682192][ T19] device_release_driver_internal+0x6a3/0x7e0 [ 25.688248][ T19] device_release_driver+0x19/0x20 [ 25.693344][ T19] bus_remove_device+0x2f0/0x350 [ 25.698263][ T19] device_del+0x63c/0xe50 [ 25.702579][ T19] ? __cfi_device_del+0x10/0x10 [ 25.707415][ T19] ? __kasan_check_write+0x14/0x20 [ 25.712510][ T19] usb_disable_device+0x3a8/0x750 [ 25.717521][ T19] usb_disconnect+0x32d/0x880 [ 25.722183][ T19] hub_event+0x1a66/0x4310 [ 25.726683][ T19] ? __cfi_hub_event+0x10/0x10 [ 25.731434][ T19] ? __kasan_check_write+0x14/0x20 [ 25.736533][ T19] ? _raw_spin_lock_irq+0x95/0xf0 [ 25.741539][ T19] ? __cfi__raw_spin_lock_irq+0x10/0x10 exit_group(0) = ? +++ exited with 0 +++ [ 25.747065][ T19] process