ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor999173195 <...> Warning: Permanently added '10.128.1.143' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor999173195", ["ci2-android-5-10/syz-executor999173195"], 0x7ffea7024c70 /* 10 vars */) = 0 brk(NULL) = 0x55555f881000 brk(0x55555f881e00) = 0x55555f881e00 arch_prctl(ARCH_SET_FS, 0x55555f881480) = 0 set_tid_address(0x55555f881750) = 297 set_robust_list(0x55555f881760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor999173195", 4096) = 44 getrandom("\xa6\x38\x60\x29\x98\xe8\xbc\x4d", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555f881e00 brk(0x55555f8a2e00) = 0x55555f8a2e00 brk(0x55555f8a3000) = 0x55555f8a3000 mprotect(0x7f8df27f4000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f8df274fd80, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f8df2753a90}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f8df274fd80, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f8df2753a90}, NULL, 8) = 0 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8dea348000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576 munmap(0x7f8dea348000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 26.460366][ T24] audit: type=1400 audit(1788969174.450:64): avc: denied { execmem } for pid=297 comm="syz-executor999" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 26.484307][ T24] audit: type=1400 audit(1788969174.480:65): avc: denied { read write } for pid=297 comm="syz-executor999" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 close(4) = 0 mkdir("./file1", 0777) = 0 [ 26.508720][ T24] audit: type=1400 audit(1788969174.480:66): avc: denied { open } for pid=297 comm="syz-executor999" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.532869][ T24] audit: type=1400 audit(1788969174.490:67): avc: denied { ioctl } for pid=297 comm="syz-executor999" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.575923][ T24] audit: type=1400 audit(1788969174.570:68): avc: denied { mounton } for pid=297 comm="syz-executor999" path="/root/file1" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 mount("/dev/loop0", "./file1", "ext4", MS_SYNCHRONOUS, ",errors=continue") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 newfstatat(AT_FDCWD, "./file1", NULL, AT_SYMLINK_NOFOLLOW|AT_EMPTY_PATH|0x2000) = -1 EFAULT (Bad address) quotactl(QCMD(Q_QUOTAON, USRQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) mprotect(0x200000000000, 12288, PROT_READ|PROT_SEM) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [ 26.636037][ T297] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 26.645134][ T24] audit: type=1400 audit(1788969174.640:69): avc: denied { mount } for pid=297 comm="syz-executor999" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 mmap(0x200000000000, 11755520, PROT_READ|PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 read(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 8224) = 8224 openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_SYNC|O_CLOEXEC|FASYNC, 042) = 5 [ 26.669790][ T24] audit: type=1400 audit(1788969174.670:70): avc: denied { append } for pid=297 comm="syz-executor999" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.693818][ T24] audit: type=1400 audit(1788969174.670:71): avc: denied { map } for pid=297 comm="syz-executor999" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.700118][ T297] ================================================================== [ 26.717972][ T24] audit: type=1400 audit(1788969174.690:72): avc: denied { read write } for pid=297 comm="syz-executor999" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.725896][ T297] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1159/0x3860 [ 26.725933][ T297] Read of size 18446744073709551600 at addr ffff88812105beb8 by task syz-executor999/297 [ 26.748887][ T24] audit: type=1400 audit(1788969174.690:73): avc: denied { open } for pid=297 comm="syz-executor999" path="/root/file1/file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.756663][ T297] [ 26.756719][ T297] CPU: 1 PID: 297 Comm: syz-executor999 Not tainted syzkaller #0 [ 26.799842][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.809889][ T297] Call Trace: [ 26.813182][ T297] __dump_stack+0x21/0x24 [ 26.817511][ T297] dump_stack_lvl+0x1a7/0x208 [ 26.822190][ T297] ? show_regs_print_info+0x18/0x18 [ 26.827394][ T297] ? thaw_kernel_threads+0x220/0x220 [ 26.832719][ T297] print_address_description+0x7f/0x2c0 [ 26.838292][ T297] ? ext4_xattr_set_entry+0x1159/0x3860 [ 26.843969][ T297] kasan_report+0x100/0x140 [ 26.848481][ T297] ? ext4_xattr_set_entry+0x1159/0x3860 [ 26.854031][ T297] ? ext4_xattr_set_entry+0x1159/0x3860 [ 26.859582][ T297] kasan_check_range+0x249/0x2a0 [ 26.864519][ T297] ? ext4_xattr_set_entry+0x1159/0x3860 [ 26.870066][ T297] memmove+0x2d/0x70 [ 26.873964][ T297] ext4_xattr_set_entry+0x1159/0x3860 [ 26.879337][ T297] ? ext4_get_group_desc+0x25f/0x2b0 [ 26.884620][ T297] ? __ext4_get_inode_loc+0x53b/0xbf0 [ 26.890000][ T297] ? ext4_xattr_ibody_set+0x330/0x330 [ 26.895377][ T297] ? ext4_get_inode_loc+0x130/0x130 [ 26.900574][ T297] ? __kmalloc+0x19f/0x330 [ 26.904991][ T297] ? errseq_check+0x41/0x80 [ 26.909493][ T297] ? __ext4_journal_get_write_access+0x21b/0x4a0 [ 26.915819][ T297] ext4_xattr_ibody_set+0x114/0x330 [ 26.921014][ T297] ext4_destroy_inline_data_nolock+0x20f/0x5e0 [ 26.927187][ T297] ? ext4_destroy_inline_data+0xe0/0xe0 [ 26.932736][ T297] ? memcpy+0x56/0x70 [ 26.936725][ T297] ext4_convert_inline_data_nolock+0x3df/0xcc0 [ 26.942892][ T297] ? ext4_get_inode_loc+0x130/0x130 [ 26.948096][ T297] ? ext4_add_dirent_to_inline+0x460/0x460 [ 26.953907][ T297] ? down_write+0xb2/0x120 [ 26.958328][ T297] ? __kasan_check_read+0x11/0x20 [ 26.963357][ T297] ext4_convert_inline_data+0x470/0x5b0 [ 26.968904][ T297] ? ext4_inline_data_truncate+0xb40/0xb40 [ 26.974710][ T297] ? down_write+0xb2/0x120 [ 26.979127][ T297] ? down_read_killable+0xe0/0xe0 [ 26.984151][ T297] ext4_fallocate+0xfb/0x1a60 [ 26.988831][ T297] ? fsnotify_perm+0x66/0x4a0 [ 26.993532][ T297] ? preempt_count_add+0x90/0x1b0 [ 26.998586][ T297] vfs_fallocate+0x4b9/0x590 [ 27.003180][ T297] __x64_sys_fallocate+0xc0/0x110 [ 27.008203][ T297] do_syscall_64+0x31/0x40 [ 27.012658][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.018555][ T297] RIP: 0033:0x7f8df276c3d9 [ 27.022981][ T297] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 27.042591][ T297] RSP: 002b:00007ffda59ad588 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 27.051017][ T297] RAX: ffffffffffffffda RBX: 6f6f6c2f7665642f RCX: 00007f8df276c3d9 [ 27.058994][ T297] RDX: 0000000000020000 RSI: 0000000000000020 RDI: 0000000000000005 [ 27.066970][ T297] RBP: 00007ffda59ad598 R08: 00007f8df274fd80 R09: 00007f8df274fd80 [ 27.074948][ T297] R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 [ 27.082923][ T297] R13: 0000000000000002 R14: 00007f8df27f4c80 R15: 0000000000000002 [ 27.090900][ T297] [ 27.093236][ T297] The buggy address belongs to the page: [ 27.098911][ T297] page:ffffea00048416c0 refcount:3 mapcount:1 mapping:ffff88810044ad10 index:0x2 pfn:0x12105b [ 27.109148][ T297] aops:def_blk_aops ino:0 [ 27.113499][ T297] flags: 0x400000000002203e(referenced|uptodate|dirty|lru|active|private|mappedtodisk) [ 27.123132][ T297] raw: 400000000002203e ffffea00042c9f08 ffffea00042c42c8 ffff88810044ad10 [ 27.131728][ T297] raw: 0000000000000002 ffff8881214b8930 0000000300000000 ffff888100146000 [ 27.140305][ T297] page dumped because: kasan: bad access detected [ 27.146722][ T297] page->mem_cgroup:ffff888100146000 [ 27.151927][ T297] page_owner tracks the page as allocated [ 27.157657][ T297] page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 297, ts 26635227423, free_ts 26634053123 [ 27.174682][ T297] prep_new_page+0x176/0x190 [ 27.179287][ T297] get_page_from_freelist+0x225f/0x23f0 [ 27.184844][ T297] __alloc_pages_nodemask+0x29a/0x640 [ 27.190225][ T297] pagecache_get_page+0x63e/0x930 [ 27.195252][ T297] __getblk_gfp+0x212/0x780 [ 27.199761][ T297] __ext4_get_inode_loc+0x45e/0xbf0 [ 27.204970][ T297] __ext4_iget+0x491/0x44e0 [ 27.209490][ T297] ext4_fill_super+0x6f35/0x8d90 [ 27.214459][ T297] mount_bdev+0x26a/0x380 [ 27.218785][ T297] ext4_mount+0x34/0x40 [ 27.222947][ T297] legacy_get_tree+0xed/0x190 [ 27.227631][ T297] vfs_get_tree+0x89/0x260 [ 27.232235][ T297] do_new_mount+0x25a/0xa30 [ 27.236746][ T297] path_mount+0x581/0xca0 [ 27.241081][ T297] __se_sys_mount+0x320/0x390 [ 27.245763][ T297] __x64_sys_mount+0xbf/0xd0 [ 27.250363][ T297] page last free stack trace: [ 27.255055][ T297] free_unref_page_prepare+0x2b7/0x2d0 [ 27.260532][ T297] free_unref_page_list+0x129/0x9c0 [ 27.265744][ T297] release_pages+0xe41/0xe90 [ 27.270344][ T297] __pagevec_release+0x71/0xe0 [ 27.275117][ T297] shmem_undo_range+0x741/0x1740 [ 27.280053][ T297] shmem_evict_inode+0x1dc/0x970 [ 27.284996][ T297] evict+0x4a9/0x940 [ 27.288901][ T297] iput+0x654/0x7e0 [ 27.292707][ T297] dentry_unlink_inode+0x2d5/0x390 [ 27.297811][ T297] __dentry_kill+0x45b/0x660 [ 27.302401][ T297] dentry_kill+0xc0/0x2a0 [ 27.306730][ T297] dput+0x42/0x80 [ 27.310374][ T297] do_renameat2+0x7f2/0xe50 [ 27.314881][ T297] __x64_sys_rename+0x86/0x90 [ 27.319564][ T297] do_syscall_64+0x31/0x40 [ 27.323988][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.329878][ T297] [ 27.332233][ T297] Memory state around the buggy address: [ 27.337874][ T297] ffff88812105bd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.345947][ T297] ffff88812105be00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.354015][ T297] >ffff88812105be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.362081][ T297] ^ [ 27.367979][ T297] ffff88812105bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.376050][ T297] ffff88812105bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fallocate(5, FALLOC_FL_INSERT_RANGE, 131072, 32768) = -1 ENOSPC (No space left on device) exit_group(0) = ? +++ exited with 0 +++ [ 27.384121][ T297] =====================================