ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor3274876236 <...> Warning: Permanently added '10.128.0.33' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor3274876236", ["ci2-android-6-1/syz-executor3274876236"], 0x7fffaba6a4d0 /* 10 vars */) = 0 brk(NULL) = 0x55558e12c000 brk(0x55558e12cd40) = 0x55558e12cd40 arch_prctl(ARCH_SET_FS, 0x55558e12c3c0) = 0 set_tid_address(0x55558e12c690) = 305 set_robust_list(0x55558e12c6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor3274876236", 4096) = 44 getrandom("\xf1\x25\x68\x77\xd6\xe2\x08\x24", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558e12cd40 brk(0x55558e14dd40) = 0x55558e14dd40 brk(0x55558e14e000) = 0x55558e14e000 mprotect(0x7fa2d83ef000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 [ 26.338246][ T28] audit: type=1400 audit(1789902465.463:64): avc: denied { execmem } for pid=305 comm="syz-executor327" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 26.357729][ T28] audit: type=1400 audit(1789902465.463:65): avc: denied { mounton } for pid=305 comm="syz-executor327" path="/syzcgroup/unified" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.358171][ T305] cgroup: Unknown subsys name 'net' mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) [ 26.380645][ T28] audit: type=1400 audit(1789902465.473:66): avc: denied { mount } for pid=305 comm="syz-executor327" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.409526][ T28] audit: type=1400 audit(1789902465.533:67): avc: denied { unmount } for pid=305 comm="syz-executor327" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.411606][ T305] cgroup: Unknown subsys name 'devices' mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) [ 26.560559][ T305] cgroup: Unknown subsys name 'hugetlb' [ 26.566396][ T305] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558e12c690) = 306 ci2-android-6-1/strace-static-x86_64: Process 306 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 306] set_robust_list(0x55558e12c6a0, 24ci2-android-6-1/strace-static-x86_64: Process 307 attached ) = 0 [pid 305] <... clone resumed>, child_tidptr=0x55558e12c690) = 307 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 307] set_robust_list(0x55558e12c6a0, 24 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] <... set_robust_list resumed>) = 0 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] getrandom( [pid 305] rt_sigprocmask(SIG_BLOCK, ~[] [pid 306] <... getrandom resumed>"\xe4\x60\xfd\x98\x92\x34\x0a\x08", 8, GRND_NONBLOCK) = 8 [pid 305] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [] [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 306] mkdir("./syzkaller.q6qPRT", 0700ci2-android-6-1/strace-static-x86_64: Process 308 attached [pid 307] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] <... clone resumed>, child_tidptr=0x55558e12c690) = 308 [pid 308] set_robust_list(0x55558e12c6a0, 24 [pid 306] <... mkdir resumed>) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 307] getrandom( [pid 308] <... set_robust_list resumed>) = 0 [pid 306] chmod("./syzkaller.q6qPRT", 0777 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... getrandom resumed>"\xdb\xb2\xce\xe9\x26\xb5\x41\xf4", 8, GRND_NONBLOCK) = 8 [pid 306] <... chmod resumed>) = 0 ci2-android-6-1/strace-static-x86_64: Process 309 attached [pid 305] <... clone resumed>, child_tidptr=0x55558e12c690) = 309 [pid 308] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] chdir("./syzkaller.q6qPRT") = 0 [pid 306] unshare(CLONE_NEWPID [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 309] set_robust_list(0x55558e12c6a0, 24 [pid 308] getrandom( [pid 307] mkdir("./syzkaller.zxe08I", 0700 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] <... set_robust_list resumed>) = 0 [pid 308] <... getrandom resumed>"\x9c\x26\xc6\xb2\x43\x55\x2e\x89", 8, GRND_NONBLOCK) = 8 [pid 306] <... unshare resumed>) = 0 [pid 305] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 307] <... mkdir resumed>) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 308] mkdir("./syzkaller.svxJbZ", 0700 [pid 307] chmod("./syzkaller.zxe08I", 0777 [pid 306] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 306] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 310 attached [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 306] <... clone resumed>, child_tidptr=0x55558e12c690) = 311 [pid 306] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... chmod resumed>) = 0 [pid 306] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] <... clone resumed>, child_tidptr=0x55558e12c690) = 310 [pid 310] set_robust_list(0x55558e12c6a0, 24 [pid 309] getrandom( [pid 307] chdir("./syzkaller.zxe08I") = 0 [pid 307] unshare(CLONE_NEWPID [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 307] <... unshare resumed>) = 0 [pid 307] rt_sigprocmask(SIG_BLOCK, ~[] [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] <... set_robust_list resumed>) = 0 [pid 309] <... getrandom resumed>"\x20\x55\x01\xe3\xc6\x7e\x04\xb9", 8, GRND_NONBLOCK) = 8 [pid 307] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 307] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 311 attached [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 309] mkdir("./syzkaller.yqsCSo", 0700 [pid 308] <... mkdir resumed>) = 0 ci2-android-6-1/strace-static-x86_64: Process 312 attached [pid 311] set_robust_list(0x55558e12c6a0, 24 [pid 307] <... clone resumed>, child_tidptr=0x55558e12c690) = 312 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [] [pid 310] getrandom( [pid 307] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] <... getrandom resumed>"\x92\xec\x2b\x84\xad\xe0\xcf\xba", 8, GRND_NONBLOCK) = 8 [pid 310] mkdir("./syzkaller.UAetip", 0700 [pid 309] <... mkdir resumed>) = 0 [pid 308] chmod("./syzkaller.svxJbZ", 0777) = 0 [pid 308] chdir("./syzkaller.svxJbZ" [pid 310] <... mkdir resumed>) = 0 [pid 311] <... set_robust_list resumed>) = 0 [pid 309] chmod("./syzkaller.yqsCSo", 0777 [pid 310] chmod("./syzkaller.UAetip", 0777 [pid 309] <... chmod resumed>) = 0 [pid 310] <... chmod resumed>) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [] [pid 312] set_robust_list(0x55558e12c6a0, 24 [pid 311] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 310] chdir("./syzkaller.UAetip" [pid 309] chdir("./syzkaller.yqsCSo" [pid 308] <... chdir resumed>) = 0 [pid 312] <... set_robust_list resumed>) = 0 [pid 312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 312] getppid() = 0 [pid 312] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 312] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} [pid 310] <... chdir resumed>) = 0 [pid 312] <... prlimit64 resumed>, NULL) = 0 [pid 312] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 312] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 312] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 312] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 312] unshare(CLONE_NEWNS) = 0 [pid 310] unshare(CLONE_NEWPID [pid 309] <... chdir resumed>) = 0 [pid 311] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 308] unshare(CLONE_NEWPID [pid 312] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] <... prctl resumed>) = 0 [pid 310] <... unshare resumed>) = 0 [pid 309] unshare(CLONE_NEWPID [pid 308] <... unshare resumed>) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[] [pid 309] <... unshare resumed>) = 0 [pid 310] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[] [pid 312] unshare(CLONE_NEWIPC [pid 311] getppid( [pid 310] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] rt_sigprocmask(SIG_BLOCK, ~[] [pid 311] <... getppid resumed>) = 0 [pid 311] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 311] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 311] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 311] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 311] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 311] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 311] unshare(CLONE_NEWNS [pid 309] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 308] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 311] <... unshare resumed>) = 0 ci2-android-6-1/strace-static-x86_64: Process 313 attached [pid 312] <... unshare resumed>) = -1 EINVAL (Invalid argument) [pid 311] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 309] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] <... clone resumed>, child_tidptr=0x55558e12c690) = 314 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 314 attached [pid 314] set_robust_list(0x55558e12c6a0, 24) = 0 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 313] set_robust_list(0x55558e12c6a0, 24 [pid 310] <... clone resumed>, child_tidptr=0x55558e12c690) = 313 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 314] getppid() = 0 [pid 314] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 314] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 314] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 314] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 314] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} [pid 313] <... set_robust_list resumed>) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [] [pid 314] <... prlimit64 resumed>, NULL) = 0 [pid 314] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 314] unshare(CLONE_NEWNS) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 312] unshare(CLONE_NEWCGROUP [pid 311] <... mount resumed>) = 0 [pid 310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 309] <... clone resumed>, child_tidptr=0x55558e12c690) = 315 ci2-android-6-1/strace-static-x86_64: Process 315 attached [pid 314] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 314] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 314] unshare(CLONE_NEWCGROUP) = 0 [pid 314] unshare(CLONE_NEWUTS) = 0 [pid 314] unshare(CLONE_SYSVSEM) = 0 [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 309] rt_sigprocmask(SIG_SETMASK, [] [pid 314] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 313] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 309] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 314] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 314] getpid() = 1 [pid 314] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 315] set_robust_list(0x55558e12c6a0, 24 [pid 313] <... prctl resumed>) = 0 [pid 312] <... unshare resumed>) = 0 [pid 311] unshare(CLONE_NEWIPC [pid 315] <... set_robust_list resumed>) = 0 [pid 313] getppid( [pid 312] unshare(CLONE_NEWUTS [pid 311] <... unshare resumed>) = -1 EINVAL (Invalid argument) [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... getppid resumed>) = 0 [pid 312] <... unshare resumed>) = 0 [pid 311] unshare(CLONE_NEWCGROUP [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024} [pid 312] unshare(CLONE_SYSVSEM [pid 311] <... unshare resumed>) = 0 [pid 315] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] <... prlimit64 resumed>, NULL) = 0 [pid 312] <... unshare resumed>) = 0 [pid 311] unshare(CLONE_NEWUTS [pid 315] <... prctl resumed>) = 0 [pid 313] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 311] <... unshare resumed>) = 0 [pid 315] getppid( [pid 313] <... prlimit64 resumed>, NULL) = 0 [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] unshare(CLONE_SYSVSEM [pid 315] <... getppid resumed>) = 0 [pid 313] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 311] <... unshare resumed>) = 0 [pid 315] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024} [pid 313] <... prlimit64 resumed>, NULL) = 0 [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 315] <... prlimit64 resumed>, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 315] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024} [pid 313] <... prlimit64 resumed>, NULL) = 0 [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 315] <... prlimit64 resumed>, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 315] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024} [pid 313] <... prlimit64 resumed>, NULL) = 0 [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 315] <... prlimit64 resumed>, NULL) = 0 [pid 313] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 315] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024} [pid 313] <... prlimit64 resumed>, NULL) = 0 [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 315] <... prlimit64 resumed>, NULL) = 0 [pid 313] unshare(CLONE_NEWNS [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 315] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024} [pid 313] <... unshare resumed>) = 0 [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 315] <... prlimit64 resumed>, NULL) = 0 [pid 313] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 312] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 315] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256} [pid 314] <... unshare resumed>) = 0 [pid 313] <... mount resumed>) = 0 [pid 315] <... prlimit64 resumed>, NULL) = 0 [pid 313] unshare(CLONE_NEWIPC [pid 312] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 315] unshare(CLONE_NEWNS [pid 313] <... unshare resumed>) = -1 EINVAL (Invalid argument) [pid 312] getpid( [pid 314] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 313] unshare(CLONE_NEWCGROUP [pid 312] <... getpid resumed>) = 1 [pid 311] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 313] <... unshare resumed>) = 0 [pid 312] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} [pid 314] <... openat resumed>) = 3 [ 26.673976][ T28] audit: type=1400 audit(1789902465.793:68): avc: denied { mounton } for pid=312 comm="syz-executor327" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 313] unshare(CLONE_NEWUTS [pid 312] <... capget resumed>, {effective=1<) = -1 ENOENT (No such file or directory) [pid 315] <... unshare resumed>) = 0 [pid 313] <... unshare resumed>) = 0 [pid 312] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 315] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL [pid 313] unshare(CLONE_SYSVSEM [pid 312] <... capset resumed>) = 0 [pid 311] getpid( [pid 315] <... mount resumed>) = 0 [pid 313] <... unshare resumed>) = 0 [pid 312] unshare(CLONE_NEWNET [pid 311] <... getpid resumed>) = 1 [pid 315] unshare(CLONE_NEWIPC [pid 314] write(3, "0 65535", 7 [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 314] <... write resumed>) = 7 [pid 314] close(3) = 0 [pid 314] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "100000", 6) = 6 [pid 314] close(3) = 0 [pid 314] mkdir("./syz-tmp", 0777) = 0 [pid 314] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 315] <... unshare resumed>) = -1 EINVAL (Invalid argument) [pid 314] <... mount resumed>) = 0 [pid 313] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} [pid 314] mkdir("./syz-tmp/newroot", 0777 [pid 315] unshare(CLONE_NEWCGROUP [pid 314] <... mkdir resumed>) = 0 [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 311] <... capget resumed>, {effective=1<) = 0 [pid 314] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 314] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 315] unshare(CLONE_NEWUTS [pid 313] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 314] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 314] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 315] <... unshare resumed>) = 0 [pid 314] <... mount resumed>) = 0 [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 311] <... capset resumed>) = 0 [pid 314] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 314] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 314] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 315] unshare(CLONE_SYSVSEM [pid 314] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 315] <... unshare resumed>) = 0 [pid 313] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 311] unshare(CLONE_NEWNET [pid 314] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 314] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC [pid 314] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 314] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 314] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0 [pid 314] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 314] mkdir("./syz-tmp/newroot/syzcgroup", 0700) = 0 [pid 314] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700) = 0 [pid 314] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0 [pid 314] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700) = 0 [pid 314] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 314] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 314] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 314] mkdir("./syz-tmp/pivot", 0777) = 0 [pid 314] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0 [pid 314] chdir("/") = 0 [pid 314] umount2("./pivot", MNT_DETACH [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [ 26.722329][ T28] audit: type=1400 audit(1789902465.843:69): avc: denied { mounton } for pid=314 comm="syz-executor327" path="/root/syzkaller.svxJbZ/syz-tmp" dev="sda1" ino=2033 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC [pid 313] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 314] <... umount2 resumed>) = 0 [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 314] chroot("./newroot") = 0 [pid 314] chdir("/") = 0 [pid 314] mkdir("/dev/gadgetfs", 0777) = 0 [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC [pid 314] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 314] <... mount resumed>) = -1 ENODEV (No such device) [pid 313] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 314] mkdir("/dev/binderfs", 0777) = 0 [pid 314] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 314] <... mount resumed>) = 0 [pid 313] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 314] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 313] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC [pid 314] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 314] getpid() = 1 [pid 314] mkdir("/syzcgroup/unified/syz2", 0777 [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 313] getpid() = 1 [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC [pid 313] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 313] <... capget resumed>, {effective=1<) = 0 [pid 314] openat(AT_FDCWD, "/syzcgroup/unified/syz2/pids.max", O_WRONLY|O_CLOEXEC) = 3 [pid 313] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 315] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC [pid 313] <... capset resumed>) = 0 [pid 314] write(3, "32", 2 [pid 313] unshare(CLONE_NEWNET [pid 315] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 314] <... write resumed>) = 2 [pid 314] close(3) = 0 [pid 314] openat(AT_FDCWD, "/syzcgroup/unified/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1", 1) = 1 [pid 314] close(3) = 0 [pid 314] mkdir("/syzcgroup/cpu/syz2", 0777) = 0 [pid 314] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1", 1) = 1 [pid 314] close(3) = 0 [pid 314] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 315] getpid( [pid 314] write(3, "313524224", 9) = 9 [pid 314] close(3) = 0 [pid 314] openat(AT_FDCWD, "/syzcgroup/cpu/syz2/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "314572800", 9) = 9 [pid 314] close(3) = 0 [pid 314] mkdir("/syzcgroup/net/syz2", 0777 [pid 315] <... getpid resumed>) = 1 [pid 314] <... mkdir resumed>) = 0 [pid 314] openat(AT_FDCWD, "/syzcgroup/net/syz2/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 314] write(3, "1", 1) = 1 [pid 314] close(3) = 0 [pid 314] mkdir("./0", 0777) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 314] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558e12c690) = 2 [pid 314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-6-1/strace-static-x86_64: Process 316 attached [pid 316] set_robust_list(0x55558e12c6a0, 24) = 0 [pid 316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 316] chdir("./0") = 0 [pid 316] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 316] setpgid(0, 0) = 0 [pid 316] symlink("/syzcgroup/unified/syz2", "./cgroup") = 0 [pid 316] symlink("/syzcgroup/cpu/syz2", "./cgroup.cpu") = 0 [pid 316] symlink("/syzcgroup/net/syz2", "./cgroup.net") = 0 [pid 316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 312] <... unshare resumed>) = 0 [pid 315] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1} [pid 316] <... openat resumed>) = 3 [pid 316] write(3, "1000", 4) = 4 [pid 316] close(3) = 0 [pid 316] symlink("/dev/binderfs", "./binderfs") = 0 [pid 316] write(1, "executing program\n", 18) = 18 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] rt_sigaction(SIGRT_1, {sa_handler=0x7fa2d8358710, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa2d834a6c0}, NULL, 8) = 0 [pid 316] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 316] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fa2d8303000 [pid 316] mprotect(0x7fa2d8304000, 131072, PROT_READ|PROT_WRITE) = 0 executing program [pid 315] <... capget resumed>, {effective=1< [pid 315] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 316] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 316] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8323990, parent_tid=0x7fa2d8323990, exit_signal=0, stack=0x7fa2d8303000, stack_size=0x20300, tls=0x7fa2d83236c0} [pid 312] <... openat resumed>) = 3 [ 26.753415][ T28] audit: type=1400 audit(1789902465.873:70): avc: denied { mount } for pid=314 comm="syz-executor327" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 26.777356][ T314] request_module fs-gadgetfs succeeded, but still no fs? [pid 315] <... capset resumed>) = 0 [pid 315] unshare(CLONE_NEWNET [pid 312] write(3, "0 65535", 7 [pid 316] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3 [pid 316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x7fa2d83239a0, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] mkdirat(AT_FDCWD, "./dev", 0473) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] mount(NULL, "./dev", "devtmpfs", 0, NULL) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] mkdir("./config", 024) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 312] <... write resumed>) = 7 [pid 317] <... mkdirat resumed>) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [ 26.797888][ T28] audit: type=1400 audit(1789902465.873:71): avc: denied { mounton } for pid=314 comm="syz-executor327" path="/root/syzkaller.svxJbZ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 26.828863][ T28] audit: type=1400 audit(1789902465.873:72): avc: denied { mount } for pid=314 comm="syz-executor327" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [pid 317] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/acm.usb0", 0777 [pid 312] close(3 [pid 317] <... mkdirat resumed>) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] openat(AT_FDCWD, "./dev/ttyGS0", O_RDWR) = 3 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 316] <... futex resumed>) = 0 [pid 316] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 316] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] rmdir("./config/usb_gadget/g1/functions/acm.usb0" [pid 311] <... unshare resumed>) = 0 [pid 311] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "0 65535", 7) = 7 [pid 311] close(3) = 0 [pid 311] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "100000", 6) = 6 [pid 311] close(3) = 0 [pid 311] mkdir("./syz-tmp", 0777 [pid 312] <... close resumed>) = 0 [pid 313] <... unshare resumed>) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 311] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0 [pid 311] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 311] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 311] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 311] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0 [pid 311] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 311] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 311] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 311] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 311] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0 [pid 311] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 311] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 312] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 311] <... mkdir resumed>) = 0 [pid 311] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 312] <... openat resumed>) = 3 [pid 311] <... mkdir resumed>) = 0 [pid 311] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700) = 0 [pid 311] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 312] write(3, "100000", 6 [pid 311] <... mkdir resumed>) = 0 [pid 311] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 311] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 312] <... write resumed>) = 6 [pid 311] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 313] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 311] mkdir("./syz-tmp/pivot", 0777 [pid 312] close(3 [pid 311] <... mkdir resumed>) = 0 [pid 313] write(3, "0 65535", 7 [pid 311] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 313] <... write resumed>) = 7 [pid 311] <... pivot_root resumed>) = 0 [pid 313] close(3) = 0 [pid 313] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 311] chdir("/" [pid 313] write(3, "100000", 6 [pid 311] <... chdir resumed>) = 0 [pid 313] <... write resumed>) = 6 [pid 311] umount2("./pivot", MNT_DETACH [pid 313] close(3) = 0 [pid 313] mkdir("./syz-tmp", 0777) = 0 [pid 312] <... close resumed>) = 0 [pid 312] mkdir("./syz-tmp", 0777 [pid 311] <... umount2 resumed>) = 0 [pid 311] chroot("./newroot") = 0 [pid 311] chdir("/") = 0 [pid 311] mkdir("/dev/gadgetfs", 0777) = -1 EEXIST (File exists) [pid 312] <... mkdir resumed>) = 0 [pid 312] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 311] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL) = -1 ENODEV (No such device) [pid 312] <... mount resumed>) = 0 [pid 311] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists) [pid 313] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 312] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 312] mkdir("./syz-tmp/newroot/dev", 0700 [pid 311] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 312] <... mkdir resumed>) = 0 [pid 312] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 312] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 312] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 313] <... mount resumed>) = 0 [pid 312] <... mount resumed>) = 0 [pid 312] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 313] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 313] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 312] <... mkdir resumed>) = 0 [pid 312] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 313] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0 [pid 312] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 312] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 313] <... mount resumed>) = 0 [pid 313] mkdir("./syz-tmp/newroot/proc", 0700) = 0 [pid 312] <... mount resumed>) = 0 [pid 311] <... mount resumed>) = 0 [pid 311] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 313] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0 [pid 311] getpid( [pid 312] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] <... getpid resumed>) = 1 [pid 311] mkdir("/syzcgroup/unified/syz0", 0777 [pid 312] <... mount resumed>) = 0 [pid 312] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 312] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] <... mkdir resumed>) = 0 [pid 313] mkdir("./syz-tmp/newroot/selinux", 0700) = 0 [pid 313] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] <... mount resumed>) = 0 [pid 313] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 312] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0 [pid 312] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 313] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 313] <... mount resumed>) = 0 [pid 312] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 313] mkdir("./syz-tmp/newroot/sys", 0700) = 0 [pid 312] <... mkdir resumed>) = 0 [pid 313] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 313] <... mount resumed>) = 0 [pid 312] <... mkdir resumed>) = 0 [pid 311] openat(AT_FDCWD, "/syzcgroup/unified/syz0/pids.max", O_WRONLY|O_CLOEXEC [pid 312] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 311] <... openat resumed>) = 3 [pid 311] write(3, "32", 2) = 2 [pid 312] <... mkdir resumed>) = 0 [pid 312] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 311] close(3 [pid 313] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] <... mkdir resumed>) = 0 [pid 312] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] <... close resumed>) = 0 [pid 313] <... mount resumed>) = 0 [pid 312] <... mount resumed>) = 0 [pid 312] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] openat(AT_FDCWD, "/syzcgroup/unified/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 312] <... mount resumed>) = 0 [pid 311] <... openat resumed>) = 3 [pid 312] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 313] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory) [pid 313] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] write(3, "1", 1 [pid 313] <... mount resumed>) = 0 [pid 313] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0 [pid 313] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] <... mount resumed>) = 0 [pid 311] <... write resumed>) = 1 [pid 311] close(3) = 0 [pid 311] mkdir("/syzcgroup/cpu/syz0", 0777 [pid 312] mkdir("./syz-tmp/pivot", 0777 [pid 311] <... mkdir resumed>) = 0 [pid 311] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "1", 1 [pid 312] <... mkdir resumed>) = 0 [pid 311] <... write resumed>) = 1 [pid 311] close(3) = 0 [pid 311] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "313524224", 9) = 9 [pid 311] close(3) = 0 [pid 311] openat(AT_FDCWD, "/syzcgroup/cpu/syz0/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 311] write(3, "314572800", 9) = 9 [pid 311] close(3) = 0 [pid 311] mkdir("/syzcgroup/net/syz0", 0777 [pid 313] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 312] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 311] <... mkdir resumed>) = 0 [pid 313] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 311] openat(AT_FDCWD, "/syzcgroup/net/syz0/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 313] <... mkdir resumed>) = 0 [pid 311] <... openat resumed>) = 3 [pid 313] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 311] write(3, "1", 1 [pid 313] <... mkdir resumed>) = 0 [pid 311] <... write resumed>) = 1 [pid 313] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 311] close(3 [pid 313] <... mkdir resumed>) = 0 [pid 311] <... close resumed>) = 0 [pid 313] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 311] mkdir("./0", 0777 [pid 313] <... mkdir resumed>) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 313] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] rt_sigprocmask(SIG_BLOCK, ~[] [pid 313] <... mount resumed>) = 0 [pid 311] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 313] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 311] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-6-1/strace-static-x86_64: Process 320 attached [pid 313] <... mount resumed>) = 0 [pid 312] <... pivot_root resumed>) = 0 [pid 320] set_robust_list(0x55558e12c6a0, 24 [pid 313] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] chdir("/" [pid 311] <... clone resumed>, child_tidptr=0x55558e12c690) = 2 [pid 320] <... set_robust_list resumed>) = 0 [pid 313] <... mount resumed>) = 0 [pid 312] <... chdir resumed>) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [] [pid 320] rt_sigprocmask(SIG_SETMASK, [] [pid 313] mkdir("./syz-tmp/pivot", 0777 [pid 311] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] <... mkdir resumed>) = 0 [pid 312] umount2("./pivot", MNT_DETACH [pid 320] chdir("./0" [pid 313] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 320] <... chdir resumed>) = 0 [pid 320] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 313] <... pivot_root resumed>) = 0 [pid 312] <... umount2 resumed>) = 0 [pid 320] <... prctl resumed>) = 0 [pid 320] setpgid(0, 0 [pid 313] chdir("/" [pid 312] chroot("./newroot" [pid 320] <... setpgid resumed>) = 0 [pid 320] symlink("/syzcgroup/unified/syz0", "./cgroup" [pid 313] <... chdir resumed>) = 0 [pid 312] <... chroot resumed>) = 0 [pid 320] <... symlink resumed>) = 0 [pid 312] chdir("/" [pid 320] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu" [pid 313] umount2("./pivot", MNT_DETACH [pid 320] <... symlink resumed>) = 0 [pid 312] <... chdir resumed>) = 0 [pid 320] symlink("/syzcgroup/net/syz0", "./cgroup.net" [pid 313] <... umount2 resumed>) = 0 [pid 312] mkdir("/dev/gadgetfs", 0777 [pid 320] <... symlink resumed>) = 0 [pid 320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 313] chroot("./newroot" [pid 312] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 320] <... openat resumed>) = 3 [pid 312] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 320] write(3, "1000", 4 [pid 313] <... chroot resumed>) = 0 [pid 320] <... write resumed>) = 4 [pid 320] close(3 [pid 313] chdir("/" [pid 312] <... mount resumed>) = -1 ENODEV (No such device) [pid 320] <... close resumed>) = 0 [pid 320] symlink("/dev/binderfs", "./binderfs" [pid 313] <... chdir resumed>) = 0 [pid 320] <... symlink resumed>) = 0 [pid 312] mkdir("/dev/binderfs", 0777 [pid 320] write(1, "executing program\n", 18 executing program [pid 313] mkdir("/dev/gadgetfs", 0777 [pid 320] <... write resumed>) = 18 [pid 312] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 312] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 320] <... futex resumed>) = 0 [pid 313] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 320] rt_sigaction(SIGRT_1, {sa_handler=0x7fa2d8358710, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa2d834a6c0} [pid 313] <... mount resumed>) = -1 ENODEV (No such device) [pid 320] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 313] mkdir("/dev/binderfs", 0777 [pid 320] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 313] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 320] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] mount("binder", "/dev/binderfs", "binder", 0, NULL [pid 312] <... mount resumed>) = 0 [pid 320] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 313] <... mount resumed>) = 0 [pid 312] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 320] <... mmap resumed>) = 0x7fa2d8303000 [pid 313] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL [pid 312] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 320] mprotect(0x7fa2d8304000, 131072, PROT_READ|PROT_WRITE [pid 313] <... mount resumed>) = -1 EBUSY (Device or resource busy) [pid 312] getpid( [pid 320] <... mprotect resumed>) = 0 [pid 313] getpid( [pid 312] <... getpid resumed>) = 1 [pid 320] rt_sigprocmask(SIG_BLOCK, ~[] [pid 313] <... getpid resumed>) = 1 [pid 312] mkdir("/syzcgroup/unified/syz1", 0777 [pid 320] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 313] mkdir("/syzcgroup/unified/syz4", 0777 [pid 320] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8323990, parent_tid=0x7fa2d8323990, exit_signal=0, stack=0x7fa2d8303000, stack_size=0x20300, tls=0x7fa2d83236c0} [pid 316] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 313] <... mkdir resumed>) = 0 [pid 312] <... mkdir resumed>) = 0 ci2-android-6-1/strace-static-x86_64: Process 321 attached [pid 312] openat(AT_FDCWD, "/syzcgroup/unified/syz1/pids.max", O_WRONLY|O_CLOEXEC [pid 321] set_robust_list(0x7fa2d83239a0, 24 [pid 320] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3 [pid 321] <... set_robust_list resumed>) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [] [pid 313] openat(AT_FDCWD, "/syzcgroup/unified/syz4/pids.max", O_WRONLY|O_CLOEXEC [pid 312] <... openat resumed>) = 3 [pid 321] rt_sigprocmask(SIG_SETMASK, [] [pid 320] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] <... openat resumed>) = 3 [pid 312] write(3, "32", 2 [pid 321] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] write(3, "32", 2 [pid 312] <... write resumed>) = 2 [pid 321] mkdirat(AT_FDCWD, "./dev", 0473 [pid 320] <... futex resumed>) = 0 [pid 313] <... write resumed>) = 2 [pid 312] close(3 [pid 321] <... mkdirat resumed>) = 0 [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] close(3 [pid 312] <... close resumed>) = 0 [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... close resumed>) = 0 [pid 312] openat(AT_FDCWD, "/syzcgroup/unified/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 321] <... futex resumed>) = 1 [pid 320] <... futex resumed>) = 0 [pid 321] mount(NULL, "./dev", "devtmpfs", 0, NULL [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] openat(AT_FDCWD, "/syzcgroup/unified/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 312] <... openat resumed>) = 3 [pid 321] <... mount resumed>) = 0 [pid 320] <... futex resumed>) = 0 [pid 313] <... openat resumed>) = 3 [pid 312] write(3, "1", 1 [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] write(3, "1", 1 [pid 321] <... futex resumed>) = 0 [pid 320] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 312] <... write resumed>) = 1 [pid 321] mkdir("./config", 024 [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... write resumed>) = 1 [pid 312] close(3 [pid 321] <... mkdir resumed>) = 0 [pid 320] <... futex resumed>) = 0 [pid 313] close(3 [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... close resumed>) = 0 [pid 312] <... close resumed>) = 0 [pid 321] <... futex resumed>) = 0 [pid 320] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 313] mkdir("/syzcgroup/cpu/syz4", 0777 [pid 312] mkdir("/syzcgroup/cpu/syz1", 0777 [pid 321] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... unshare resumed>) = 0 [pid 313] <... mkdir resumed>) = 0 [pid 321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 320] <... futex resumed>) = 0 [pid 313] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 321] mount(NULL, "./config", "configfs", 0, NULL [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 321] <... mount resumed>) = 0 [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 320] <... futex resumed>) = 0 [pid 321] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 320] <... futex resumed>) = 0 [pid 321] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... openat resumed>) = 3 [pid 312] <... mkdir resumed>) = 0 [pid 321] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 315] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC [pid 313] write(3, "1", 1 [pid 312] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... write resumed>) = 1 [pid 313] close(3) = 0 [pid 313] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 313] write(3, "313524224", 9) = 9 [pid 313] close(3) = 0 [pid 313] openat(AT_FDCWD, "/syzcgroup/cpu/syz4/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 313] write(3, "314572800", 9) = 9 [pid 313] close(3) = 0 [pid 313] mkdir("/syzcgroup/net/syz4", 0777 [pid 321] <... futex resumed>) = 1 [pid 320] <... futex resumed>) = 0 [pid 315] <... openat resumed>) = 3 [pid 313] <... mkdir resumed>) = 0 [pid 312] <... openat resumed>) = 3 [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] openat(AT_FDCWD, "/syzcgroup/net/syz4/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 312] write(3, "1", 1 [pid 321] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/acm.usb0", 0777 [pid 320] <... futex resumed>) = 0 [pid 315] write(3, "0 65535", 7 [pid 313] <... openat resumed>) = 3 [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] write(3, "1", 1 [pid 312] <... write resumed>) = 1 [pid 315] <... write resumed>) = 7 [pid 313] <... write resumed>) = 1 [pid 312] close(3 [pid 313] close(3) = 0 [pid 313] mkdir("./0", 0777 [pid 315] close(3 [pid 312] <... close resumed>) = 0 [pid 313] <... mkdir resumed>) = 0 [pid 312] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 315] <... close resumed>) = 0 [pid 313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 313] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 315] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC [pid 312] <... openat resumed>) = 3 ci2-android-6-1/strace-static-x86_64: Process 322 attached [pid 315] <... openat resumed>) = 3 [pid 312] write(3, "313524224", 9 [pid 322] set_robust_list(0x55558e12c6a0, 24 [pid 313] <... clone resumed>, child_tidptr=0x55558e12c690) = 2 [pid 322] <... set_robust_list resumed>) = 0 [pid 315] write(3, "100000", 6 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 312] <... write resumed>) = 9 [pid 322] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 312] close(3 [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 315] <... write resumed>) = 6 [pid 322] chdir("./0" [pid 312] <... close resumed>) = 0 [pid 322] <... chdir resumed>) = 0 [pid 322] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 315] close(3 [pid 312] openat(AT_FDCWD, "/syzcgroup/cpu/syz1/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC [pid 322] <... prctl resumed>) = 0 [pid 322] setpgid(0, 0) = 0 [pid 322] symlink("/syzcgroup/unified/syz4", "./cgroup" [pid 315] <... close resumed>) = 0 [pid 312] <... openat resumed>) = 3 [pid 322] <... symlink resumed>) = 0 [pid 322] symlink("/syzcgroup/cpu/syz4", "./cgroup.cpu" [pid 315] mkdir("./syz-tmp", 0777 [pid 312] write(3, "314572800", 9 [pid 322] <... symlink resumed>) = 0 [pid 322] symlink("/syzcgroup/net/syz4", "./cgroup.net") = 0 [pid 322] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 315] <... mkdir resumed>) = 0 [pid 312] <... write resumed>) = 9 [ 26.853174][ T28] audit: type=1400 audit(1789902465.873:73): avc: denied { mounton } for pid=314 comm="syz-executor327" path="/root/syzkaller.svxJbZ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [pid 322] <... openat resumed>) = 3 [pid 312] close(3 [pid 322] write(3, "1000", 4 [pid 315] mount("", "./syz-tmp", "tmpfs", 0, NULL [pid 312] <... close resumed>) = 0 [pid 322] <... write resumed>) = 4 [pid 312] mkdir("/syzcgroup/net/syz1", 0777 [pid 315] <... mount resumed>) = 0 [pid 315] mkdir("./syz-tmp/newroot", 0777) = 0 [pid 315] mkdir("./syz-tmp/newroot/dev", 0700) = 0 [pid 322] close(3 [pid 312] <... mkdir resumed>) = 0 [pid 315] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 322] <... close resumed>) = 0 [pid 312] openat(AT_FDCWD, "/syzcgroup/net/syz1/cgroup.procs", O_WRONLY|O_CLOEXEC [pid 322] symlink("/dev/binderfs", "./binderfs" [pid 315] <... mount resumed>) = 0 executing program [pid 312] <... openat resumed>) = 3 [pid 322] <... symlink resumed>) = 0 [pid 315] mkdir("./syz-tmp/newroot/proc", 0700 [pid 312] write(3, "1", 1 [pid 322] write(1, "executing program\n", 18) = 18 [pid 315] <... mkdir resumed>) = 0 [pid 312] <... write resumed>) = 1 [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL [pid 312] close(3 [pid 322] <... futex resumed>) = 0 [pid 312] <... close resumed>) = 0 [pid 312] mkdir("./0", 0777) = 0 [pid 322] rt_sigaction(SIGRT_1, {sa_handler=0x7fa2d8358710, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa2d834a6c0} [pid 315] <... mount resumed>) = 0 [pid 312] rt_sigprocmask(SIG_BLOCK, ~[] [pid 322] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 315] mkdir("./syz-tmp/newroot/selinux", 0700 [pid 312] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 322] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 312] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 315] <... mkdir resumed>) = 0 [pid 322] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 315] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULLci2-android-6-1/strace-static-x86_64: Process 323 attached [pid 322] <... mmap resumed>) = 0x7fa2d8303000 [pid 323] set_robust_list(0x55558e12c6a0, 24 [pid 312] <... clone resumed>, child_tidptr=0x55558e12c690) = 2 [pid 323] <... set_robust_list resumed>) = 0 [pid 322] mprotect(0x7fa2d8304000, 131072, PROT_READ|PROT_WRITE [pid 315] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 312] rt_sigprocmask(SIG_SETMASK, [] [pid 323] rt_sigprocmask(SIG_SETMASK, [] [pid 322] <... mprotect resumed>) = 0 [pid 315] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 312] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 323] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] rt_sigprocmask(SIG_BLOCK, ~[] [pid 323] chdir("./0" [pid 322] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 315] <... mount resumed>) = 0 [pid 323] <... chdir resumed>) = 0 [pid 322] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8323990, parent_tid=0x7fa2d8323990, exit_signal=0, stack=0x7fa2d8303000, stack_size=0x20300, tls=0x7fa2d83236c0} [pid 323] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 315] mkdir("./syz-tmp/newroot/sys", 0700 [pid 323] <... prctl resumed>) = 0 [pid 323] setpgid(0, 0) = 0 ci2-android-6-1/strace-static-x86_64: Process 324 attached [pid 323] symlink("/syzcgroup/unified/syz1", "./cgroup" [pid 324] set_robust_list(0x7fa2d83239a0, 24 [pid 323] <... symlink resumed>) = 0 [pid 322] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3 [pid 315] <... mkdir resumed>) = 0 [pid 324] <... set_robust_list resumed>) = 0 [pid 323] symlink("/syzcgroup/cpu/syz1", "./cgroup.cpu" [pid 322] rt_sigprocmask(SIG_SETMASK, [] [pid 315] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 324] rt_sigprocmask(SIG_SETMASK, [] [pid 323] <... symlink resumed>) = 0 [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 324] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 323] symlink("/syzcgroup/net/syz1", "./cgroup.net" [pid 324] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... symlink resumed>) = 0 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... mount resumed>) = 0 [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 322] <... futex resumed>) = 0 [pid 315] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 324] mkdirat(AT_FDCWD, "./dev", 0473 [pid 323] <... openat resumed>) = 3 [pid 324] <... mkdirat resumed>) = 0 [pid 323] write(3, "1000", 4 [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... mount resumed>) = 0 [pid 324] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... write resumed>) = 4 [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 324] <... futex resumed>) = 0 [pid 323] close(3 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] mount(NULL, "./dev", "devtmpfs", 0, NULL [pid 323] <... close resumed>) = 0 [pid 322] <... futex resumed>) = 0 [pid 315] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 324] <... mount resumed>) = 0 [pid 323] symlink("/dev/binderfs", "./binderfs" [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 324] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... symlink resumed>) = 0 [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 324] <... futex resumed>) = 0 [pid 323] write(1, "executing program\n", 18 executing program [pid 324] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... write resumed>) = 18 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... mount resumed>) = 0 [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = 0 [pid 315] mkdir("./syz-tmp/newroot/syz-inputs", 0700 [pid 324] mkdir("./config", 024 [pid 323] <... futex resumed>) = 0 [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 324] <... mkdir resumed>) = 0 [pid 323] rt_sigaction(SIGRT_1, {sa_handler=0x7fa2d8358710, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa2d834a6c0} [pid 315] <... mkdir resumed>) = 0 [pid 324] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... rt_sigaction resumed>, NULL, 8) = 0 [pid 315] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 324] <... futex resumed>) = 1 [pid 323] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1] [pid 322] <... futex resumed>) = 0 [pid 324] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 322] <... futex resumed>) = 0 [pid 315] mkdir("./syz-tmp/newroot/syzcgroup", 0700 [pid 324] mount(NULL, "./config", "configfs", 0, NULL [pid 323] <... mmap resumed>) = 0x7fa2d8303000 [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 324] <... mount resumed>) = 0 [pid 323] mprotect(0x7fa2d8304000, 131072, PROT_READ|PROT_WRITE [pid 315] <... mkdir resumed>) = 0 [pid 324] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... mprotect resumed>) = 0 [pid 324] <... futex resumed>) = 1 [pid 323] rt_sigprocmask(SIG_BLOCK, ~[] [pid 322] <... futex resumed>) = 0 [pid 315] mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700 [pid 324] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8323990, parent_tid=0x7fa2d8323990, exit_signal=0, stack=0x7fa2d8303000, stack_size=0x20300, tls=0x7fa2d83236c0} [pid 322] <... futex resumed>) = 0 ci2-android-6-1/strace-static-x86_64: Process 325 attached [pid 324] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... mkdir resumed>) = 0 [pid 325] set_robust_list(0x7fa2d83239a0, 24 [pid 324] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 323] <... clone3 resumed> => {parent_tid=[3]}, 88) = 3 [pid 315] mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700 [pid 325] <... set_robust_list resumed>) = 0 [pid 324] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] rt_sigprocmask(SIG_SETMASK, [] [pid 325] rt_sigprocmask(SIG_SETMASK, [] [pid 324] <... futex resumed>) = 1 [pid 323] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] <... futex resumed>) = 0 [pid 315] <... mkdir resumed>) = 0 [pid 325] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 324] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] mkdir("./syz-tmp/newroot/syzcgroup/net", 0700 [pid 325] mkdirat(AT_FDCWD, "./dev", 0473 [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] <... futex resumed>) = 0 [pid 322] <... futex resumed>) = 0 [pid 325] <... mkdirat resumed>) = 0 [pid 324] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/acm.usb0", 0777 [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... mkdir resumed>) = 0 [pid 325] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 325] <... futex resumed>) = 0 [pid 323] <... futex resumed>) = 0 [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] mount(NULL, "./dev", "devtmpfs", 0, NULL [pid 315] <... mount resumed>) = 0 [pid 325] <... mount resumed>) = 0 [pid 325] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 325] <... futex resumed>) = 1 [pid 323] <... futex resumed>) = 0 [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] mkdir("./config", 024 [pid 323] <... futex resumed>) = 0 [pid 315] <... mount resumed>) = 0 [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... mkdir resumed>) = 0 [pid 315] mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL [pid 325] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 323] <... futex resumed>) = 0 [pid 315] <... mount resumed>) = 0 [pid 325] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] mkdir("./syz-tmp/pivot", 0777 [pid 325] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] <... futex resumed>) = 0 [pid 315] <... mkdir resumed>) = 0 [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] pivot_root("./syz-tmp", "./syz-tmp/pivot" [pid 325] mount(NULL, "./config", "configfs", 0, NULL [pid 315] <... pivot_root resumed>) = 0 [pid 315] chdir("/" [pid 325] <... mount resumed>) = 0 [pid 315] <... chdir resumed>) = 0 [pid 325] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] umount2("./pivot", MNT_DETACH [pid 325] <... futex resumed>) = 1 [pid 323] <... futex resumed>) = 0 [pid 325] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... umount2 resumed>) = 0 [pid 325] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] <... futex resumed>) = 0 [pid 315] chroot("./newroot" [pid 325] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... chroot resumed>) = 0 [pid 325] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 315] chdir("/" [pid 325] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... chdir resumed>) = 0 [pid 325] <... futex resumed>) = 1 [pid 323] <... futex resumed>) = 0 [pid 315] mkdir("/dev/gadgetfs", 0777 [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 325] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/acm.usb0", 0777 [pid 323] <... futex resumed>) = 0 [pid 315] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... mount resumed>) = -1 ENODEV (No such device) [pid 315] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists) [pid 315] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0 [pid 315] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 315] getpid() = 1 [pid 315] mkdir("/syzcgroup/unified/syz3", 0777) = 0 [pid 315] openat(AT_FDCWD, "/syzcgroup/unified/syz3/pids.max", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "32", 2) = 2 [pid 315] close(3) = 0 [pid 315] openat(AT_FDCWD, "/syzcgroup/unified/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "1", 1) = 1 [pid 315] close(3) = 0 [pid 315] mkdir("/syzcgroup/cpu/syz3", 0777) = 0 [pid 315] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "1", 1) = 1 [pid 315] close(3) = 0 [pid 315] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.soft_limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "313524224", 9) = 9 [pid 315] close(3) = 0 [pid 315] openat(AT_FDCWD, "/syzcgroup/cpu/syz3/memory.limit_in_bytes", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "314572800", 9) = 9 [pid 315] close(3) = 0 [pid 315] mkdir("/syzcgroup/net/syz3", 0777) = 0 [pid 315] openat(AT_FDCWD, "/syzcgroup/net/syz3/cgroup.procs", O_WRONLY|O_CLOEXEC) = 3 [pid 315] write(3, "1", 1) = 1 [pid 315] close(3) = 0 [pid 315] mkdir("./0", 0777) = 0 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 315] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558e12c690) = 2 ci2-android-6-1/strace-static-x86_64: Process 326 attached [pid 315] rt_sigprocmask(SIG_SETMASK, [] [pid 326] set_robust_list(0x55558e12c6a0, 24 [pid 315] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 326] <... set_robust_list resumed>) = 0 [pid 326] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 326] chdir("./0") = 0 [pid 326] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 326] setpgid(0, 0) = 0 [pid 326] symlink("/syzcgroup/unified/syz3", "./cgroup") = 0 [pid 326] symlink("/syzcgroup/cpu/syz3", "./cgroup.cpu") = 0 [pid 326] symlink("/syzcgroup/net/syz3", "./cgroup.net") = 0 [pid 326] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 326] write(3, "1000", 4) = 4 [pid 326] close(3) = 0 [pid 326] symlink("/dev/binderfs", "./binderfs") = 0 [pid 326] write(1, "executing program\n", 18) = 18 [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 executing program [pid 326] rt_sigaction(SIGRT_1, {sa_handler=0x7fa2d8358710, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fa2d834a6c0}, NULL, 8) = 0 [pid 326] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 326] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fa2d8303000 [pid 326] mprotect(0x7fa2d8304000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 326] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 326] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8323990, parent_tid=0x7fa2d8323990, exit_signal=0, stack=0x7fa2d8303000, stack_size=0x20300, tls=0x7fa2d83236c0}ci2-android-6-1/strace-static-x86_64: Process 327 attached => {parent_tid=[3]}, 88) = 3 [pid 327] set_robust_list(0x7fa2d83239a0, 24 [pid 326] rt_sigprocmask(SIG_SETMASK, [] [pid 327] <... set_robust_list resumed>) = 0 [pid 326] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [] [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 326] <... futex resumed>) = 0 [pid 327] mkdirat(AT_FDCWD, "./dev", 0473 [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... mkdirat resumed>) = 0 [pid 327] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 326] <... futex resumed>) = 0 [pid 327] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 326] <... futex resumed>) = 0 [pid 327] mount(NULL, "./dev", "devtmpfs", 0, NULL [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... mount resumed>) = 0 [pid 327] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 326] <... futex resumed>) = 0 [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] mkdir("./config", 024) = 0 [pid 327] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 327] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 326] <... futex resumed>) = 0 [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = 0 [pid 326] <... futex resumed>) = 1 [pid 327] mount(NULL, "./config", "configfs", 0, NULL [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... mount resumed>) = 0 [pid 327] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 326] <... futex resumed>) = 0 [pid 327] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 326] <... futex resumed>) = 0 [pid 327] mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777 [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 327] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 326] <... futex resumed>) = 0 [pid 327] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 326] <... futex resumed>) = 0 [pid 327] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/acm.usb0", 0777 [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 320] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 320] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 320] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fa2d82e2000 [pid 320] mprotect(0x7fa2d82e3000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 320] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 320] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8302990, parent_tid=0x7fa2d8302990, exit_signal=0, stack=0x7fa2d82e2000, stack_size=0x20300, tls=0x7fa2d83026c0}ci2-android-6-1/strace-static-x86_64: Process 328 attached => {parent_tid=[4]}, 88) = 4 [pid 328] set_robust_list(0x7fa2d83029a0, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [] [pid 328] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 328] futex(0x7fa2d83f5b38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 320] futex(0x7fa2d83f5b38, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 328] <... futex resumed>) = 0 [pid 320] futex(0x7fa2d83f5b3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 328] openat(AT_FDCWD, "./dev/ttyGS0", O_RDWR) = -1 ENODEV (No such device) [pid 328] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 317] <... rmdir resumed>) = 0 [pid 328] futex(0x7fa2d83f5b38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] <... mkdirat resumed>) = 0 [pid 320] <... futex resumed>) = 0 [pid 317] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 327] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 325] <... mkdirat resumed>) = -1 EEXIST (File exists) [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 321] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 316] close(3 [pid 327] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 322] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 320] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] <... futex resumed>) = 0 [pid 327] <... futex resumed>) = 1 [pid 326] <... futex resumed>) = 0 [pid 325] <... futex resumed>) = 0 [pid 324] <... futex resumed>) = 0 [pid 323] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] <... futex resumed>) = 1 [pid 317] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 327] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 326] futex(0x7fa2d83f5b28, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] openat(AT_FDCWD, "./dev/ttyGS0", O_RDWR [ 26.985659][ T316] ================================================================== [ 26.993775][ T316] BUG: KASAN: use-after-free in check_tty_count+0x1a8/0x330 [ 27.001123][ T316] Read of size 8 at addr ffff88810e764110 by task syz-executor327/316 [ 27.009303][ T316] [ 27.011653][ T316] CPU: 1 PID: 316 Comm: syz-executor327 Not tainted syzkaller #0 [ 27.019414][ T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.029495][ T316] Call Trace: [ 27.032790][ T316] [pid 324] openat(AT_FDCWD, "./dev/ttyGS0", O_RDWR [pid 323] <... futex resumed>) = 0 [pid 322] <... futex resumed>) = 0 [ 27.035736][ T316] __dump_stack+0x21/0x24 [ 27.040101][ T316] dump_stack_lvl+0x110/0x170 [ 27.044807][ T316] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.049861][ T316] ? kernel_text_address+0xa0/0xd0 [ 27.055006][ T316] ? check_tty_count+0x1a8/0x330 [ 27.059988][ T316] print_address_description+0x71/0x200 [ 27.065577][ T316] print_report+0x4a/0x60 [ 27.069942][ T316] kasan_report+0x122/0x150 [ 27.074494][ T316] ? check_tty_count+0x1a8/0x330 [ 27.079460][ T316] kasan_check_range+0x249/0x2a0 [ 27.084425][ T316] __kasan_check_read+0x11/0x20 [ 27.089277][ T316] check_tty_count+0x1a8/0x330 [ 27.094046][ T316] tty_release+0x88/0x11d0 [ 27.098473][ T316] ? __cfi_tty_release+0x10/0x10 [ 27.103471][ T316] __fput+0x1fd/0x8f0 [ 27.107490][ T316] ____fput+0x15/0x20 [ 27.111541][ T316] task_work_run+0x1e1/0x250 [ 27.116189][ T316] ? __cfi_task_work_run+0x10/0x10 [ 27.121334][ T316] ptrace_notify+0x23f/0x270 [ 27.125957][ T316] ? __cfi_task_work_add+0x10/0x10 [ 27.131079][ T316] ? __cfi_ptrace_notify+0x10/0x10 [ 27.136225][ T316] ? fput+0x15b/0x1a0 [ 27.140217][ T316] ? filp_close+0x111/0x160 [ 27.144760][ T316] syscall_exit_work+0x84/0x140 [ 27.149662][ T316] syscall_exit_to_user_mode_prepare+0x1c/0x20 [ 27.155844][ T316] syscall_exit_to_user_mode+0xd/0x30 [ 27.161243][ T316] do_syscall_64+0x58/0xa0 [ 27.165677][ T316] ? clear_bhb_loop+0x30/0x80 [ 27.170388][ T316] ? clear_bhb_loop+0x30/0x80 [ 27.175068][ T316] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.180959][ T316] RIP: 0033:0x7fa2d8359b8e [ 27.185389][ T316] Code: 08 0f 85 65 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 27.205018][ T316] RSP: 002b:00007ffcb0d63a98 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 27.213433][ T316] RAX: 0000000000000000 RBX: 000055558e12c3c0 RCX: 00007fa2d8359b8e [ 27.221428][ T316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 27.229497][ T316] RBP: 0000000000006917 R08: 0000000000000000 R09: 0000000000000000 [ 27.237481][ T316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa2d83f5b2c [ 27.245482][ T316] R13: 00007ffcb0d63b40 R14: 00007ffcb0d63bb0 R15: 00007fa2d832e6d0 [ 27.253504][ T316] [ 27.256529][ T316] [ 27.258872][ T316] Allocated by task 317: [ 27.263126][ T316] kasan_set_track+0x4b/0x70 [ 27.267754][ T316] kasan_save_alloc_info+0x1f/0x30 [ 27.272891][ T316] __kasan_kmalloc+0x95/0xb0 [ 27.277509][ T316] kmalloc_trace+0x40/0xb0 [ 27.281951][ T316] gserial_alloc_line_no_console+0x238/0x700 [ 27.287950][ T316] gserial_alloc_line+0x15/0x20 [ 27.292825][ T316] acm_alloc_instance+0x86/0xe0 [ 27.297709][ T316] usb_get_function_instance+0xf3/0x310 [ 27.303295][ T316] function_make+0x118/0x360 [ 27.307917][ T316] configfs_mkdir+0x518/0x9e0 [ 27.312620][ T316] vfs_mkdir+0x39c/0x580 [ 27.316909][ T316] do_mkdirat+0x174/0x4d0 [ 27.321273][ T316] __x64_sys_mkdirat+0x89/0xa0 [ 27.326067][ T316] x64_sys_call+0x73d/0x9a0 [ 27.330602][ T316] do_syscall_64+0x4c/0xa0 [ 27.335039][ T316] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.340963][ T316] [ 27.343303][ T316] Freed by task 317: [ 27.347200][ T316] kasan_set_track+0x4b/0x70 [ 27.351790][ T316] kasan_save_free_info+0x2b/0x40 [ 27.356804][ T316] ____kasan_slab_free+0x132/0x180 [ 27.361914][ T316] __kasan_slab_free+0x11/0x20 [ 27.366687][ T316] slab_free_freelist_hook+0xc2/0x190 [ 27.372084][ T316] __kmem_cache_free+0xb7/0x1b0 [ 27.376950][ T316] kfree+0x6f/0xf0 [ 27.380684][ T316] gserial_free_port+0x240/0x2d0 [ 27.385639][ T316] gserial_free_line+0x9b/0x1a0 [ 27.390485][ T316] acm_free_instance+0x39/0x60 [ 27.395267][ T316] usb_put_function_instance+0x9b/0xc0 [ 27.400782][ T316] acm_attr_release+0x15/0x20 [ 27.405454][ T316] config_item_put+0x166/0x210 [ 27.410217][ T316] configfs_rmdir+0x8c9/0x980 [ 27.414894][ T316] vfs_rmdir+0x381/0x4f0 [ 27.419159][ T316] do_rmdir+0x261/0x6b0 [ 27.423350][ T316] __x64_sys_rmdir+0x49/0x50 [ 27.427990][ T316] x64_sys_call+0x68e/0x9a0 [ 27.432510][ T316] do_syscall_64+0x4c/0xa0 [ 27.436937][ T316] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.442830][ T316] [ 27.445150][ T316] The buggy address belongs to the object at ffff88810e764000 [ 27.445150][ T316] which belongs to the cache kmalloc-1k of size 1024 [ 27.459192][ T316] The buggy address is located 272 bytes inside of [ 27.459192][ T316] 1024-byte region [ffff88810e764000, ffff88810e764400) [ 27.472543][ T316] [ 27.474893][ T316] The buggy address belongs to the physical page: [ 27.481294][ T316] page:ffffea000439d800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e760 [ 27.491554][ T316] head:ffffea000439d800 order:3 compound_mapcount:0 compound_pincount:0 [ 27.499887][ T316] flags: 0x4000000000010200(slab|head|zone=1) [ 27.505969][ T316] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043080 [ 27.514543][ T316] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 27.523113][ T316] page dumped because: kasan: bad access detected [ 27.529536][ T316] page_owner tracks the page as allocated [ 27.535255][ T316] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 313, tgid 313 (syz-executor327), ts 26837077746, free_ts 18965421948 [ 27.558079][ T316] post_alloc_hook+0x1f5/0x210 [ 27.562873][ T316] prep_new_page+0x1c/0x110 [ 27.567378][ T316] get_page_from_freelist+0x2ca9/0x2d20 [ 27.572933][ T316] __alloc_pages+0x1fa/0x610 [ 27.577529][ T316] alloc_slab_page+0x6e/0xf0 [ 27.582138][ T316] new_slab+0x98/0x3e0 [ 27.586223][ T316] ___slab_alloc+0x70f/0xb70 [ 27.590843][ T316] __slab_alloc+0x5e/0xa0 [ 27.595183][ T316] __kmem_cache_alloc_node+0x204/0x2d0 [ 27.600653][ T316] __kmalloc_node_track_caller+0xa1/0x1e0 [ 27.606377][ T316] __alloc_skb+0x226/0x4a0 [ 27.610793][ T316] alloc_uevent_skb+0x85/0x240 [ 27.615565][ T316] kobject_uevent_net_broadcast+0x1b4/0x5b0 [ 27.621456][ T316] kobject_uevent_env+0x541/0x720 [ 27.626479][ T316] kobject_uevent+0x1d/0x30 [ 27.631007][ T316] device_add+0xa1a/0xec0 [ 27.635338][ T316] page last free stack trace: [ 27.640000][ T316] free_unref_page_prepare+0x81b/0x820 [ 27.645464][ T316] free_unref_page+0x93/0x530 [ 27.650146][ T316] __free_pages+0x67/0x100 [ 27.654582][ T316] __free_slab+0xc7/0x1a0 [ 27.658912][ T316] __unfreeze_partials+0x15a/0x190 [ 27.664026][ T316] put_cpu_partial+0xa9/0x100 [ 27.668705][ T316] __slab_free+0x1c4/0x280 [ 27.673126][ T316] ___cache_free+0xbf/0xd0 [ 27.677565][ T316] qlist_free_all+0xc6/0x140 [ 27.682261][ T316] kasan_quarantine_reduce+0x14a/0x170 [ 27.687737][ T316] __kasan_slab_alloc+0x24/0x80 [ 27.692592][ T316] slab_post_alloc_hook+0x4f/0x2d0 [ 27.697718][ T316] kmem_cache_alloc+0x166/0x320 [ 27.702574][ T316] mas_alloc_nodes+0x2d8/0x850 [ 27.707334][ T316] mas_preallocate+0xe3d/0x1430 [ 27.712199][ T316] vma_expand+0x437/0xad0 [ 27.716555][ T316] [ 27.718900][ T316] Memory state around the buggy address: [ 27.724516][ T316] ffff88810e764000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [pid 320] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 326] <... futex resumed>) = 0 [pid 327] openat(AT_FDCWD, "./dev/ttyGS0", O_RDWR [pid 326] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] futex(0x7fa2d83f5b2c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 321] <... futex resumed>) = 0 [pid 321] rmdir("./config/usb_gadget/g1/functions/acm.usb0") = 0 [pid 321] futex(0x7fa2d83f5b2c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 320] <... futex resumed>) = 0 [pid 321] futex(0x7fa2d83f5b28, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] close(3) = -1 EBADF (Bad file descriptor) [pid 320] close(4) = -1 EBADF (Bad file descriptor) [pid 320] close(5) = -1 EBADF (Bad file descriptor) [pid 320] close(6) = -1 EBADF (Bad file descriptor) [pid 320] close(7) = -1 EBADF (Bad file descriptor) [pid 320] close(8) = -1 EBADF (Bad file descriptor) [pid 320] close(9) = -1 EBADF (Bad file descriptor) [pid 320] close(10) = -1 EBADF (Bad file descriptor) [pid 320] close(11) = -1 EBADF (Bad file descriptor) [pid 320] close(12) = -1 EBADF (Bad file descriptor) [pid 320] close(13) = -1 EBADF (Bad file descriptor) [pid 320] close(14) = -1 EBADF (Bad file descriptor) [pid 320] close(15) = -1 EBADF (Bad file descriptor) [pid 320] close(16) = -1 EBADF (Bad file descriptor) [pid 320] close(17) = -1 EBADF (Bad file descriptor) [pid 320] close(18) = -1 EBADF (Bad file descriptor) [pid 320] close(19) = -1 EBADF (Bad file descriptor) [pid 320] close(20) = -1 EBADF (Bad file descriptor) [pid 320] close(21) = -1 EBADF (Bad file descriptor) [pid 320] close(22) = -1 EBADF (Bad file descriptor) [pid 320] close(23) = -1 EBADF (Bad file descriptor) [pid 320] close(24) = -1 EBADF (Bad file descriptor) [pid 320] close(25) = -1 EBADF (Bad file descriptor) [pid 320] close(26) = -1 EBADF (Bad file descriptor) [pid 320] close(27) = -1 EBADF (Bad file descriptor) [pid 320] close(28) = -1 EBADF (Bad file descriptor) [pid 320] close(29) = -1 EBADF (Bad file descriptor) [pid 320] exit_group(0 [pid 321] <... futex resumed>) = ? [pid 320] <... exit_group resumed>) = ? [pid 321] +++ exited with 0 +++ [pid 328] <... futex resumed>) = ? [pid 328] +++ exited with 0 +++ [pid 320] +++ exited with 0 +++ [pid 311] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 311] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 311] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 311] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 311] fstat(3, {st_mode=S_IFDIR|0700, st_size=160, ...}) = 0 [pid 311] getdents64(3, 0x55558e12d750 /* 8 entries */, 32768) = 232 [pid 311] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 326] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 326] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 326] <... futex resumed>) = 0 [pid 322] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 326] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 322] <... futex resumed>) = 0 [pid 326] <... mmap resumed>) = 0x7fa2d82e2000 [pid 323] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 322] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 326] mprotect(0x7fa2d82e3000, 131072, PROT_READ|PROT_WRITE [pid 323] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... mmap resumed>) = 0x7fa2d82e2000 [pid 326] <... mprotect resumed>) = 0 [pid 323] <... futex resumed>) = 0 [pid 322] mprotect(0x7fa2d82e3000, 131072, PROT_READ|PROT_WRITE [pid 326] rt_sigprocmask(SIG_BLOCK, ~[] [pid 323] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 322] <... mprotect resumed>) = 0 [pid 326] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 323] <... mmap resumed>) = 0x7fa2d82e2000 [pid 322] rt_sigprocmask(SIG_BLOCK, ~[] [pid 326] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8302990, parent_tid=0x7fa2d8302990, exit_signal=0, stack=0x7fa2d82e2000, stack_size=0x20300, tls=0x7fa2d83026c0} [pid 323] mprotect(0x7fa2d82e3000, 131072, PROT_READ|PROT_WRITE [pid 322] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 323] <... mprotect resumed>) = 0 [pid 322] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8302990, parent_tid=0x7fa2d8302990, exit_signal=0, stack=0x7fa2d82e2000, stack_size=0x20300, tls=0x7fa2d83026c0}ci2-android-6-1/strace-static-x86_64: Process 330 attached [pid 326] <... clone3 resumed> => {parent_tid=[4]}, 88) = 4 [pid 323] rt_sigprocmask(SIG_BLOCK, ~[] [pid 330] set_robust_list(0x7fa2d83029a0, 24 [pid 326] rt_sigprocmask(SIG_SETMASK, [] [pid 323] <... rt_sigprocmask resumed>, [], 8) = 0 [pid 322] <... clone3 resumed> => {parent_tid=[4]}, 88) = 4 [pid 330] <... set_robust_list resumed>) = 0 [pid 326] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 323] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fa2d8302990, parent_tid=0x7fa2d8302990, exit_signal=0, stack=0x7fa2d82e2000, stack_size=0x20300, tls=0x7fa2d83026c0} [pid 322] rt_sigprocmask(SIG_SETMASK, [] [pid 330] rt_sigprocmask(SIG_SETMASK, [] [pid 326] futex(0x7fa2d83f5b38, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 330] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 326] <... futex resumed>) = 0 [pid 323] <... clone3 resumed> => {parent_tid=[4]}, 88) = 4 [pid 322] futex(0x7fa2d83f5b38, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] rmdir("./config/usb_gadget/g1/functions/acm.usb0" [pid 326] futex(0x7fa2d83f5b3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] rt_sigprocmask(SIG_SETMASK, [] [pid 322] <... futex resumed>) = 0 [pid 330] <... rmdir resumed>) = -1 ENOENT (No such file or directory) [pid 323] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 322] futex(0x7fa2d83f5b3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 330] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] futex(0x7fa2d83f5b38, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 330] <... futex resumed>) = 0 [pid 323] <... futex resumed>) = 0 [pid 330] futex(0x7fa2d83f5b38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] futex(0x7fa2d83f5b3c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 329 attached [pid 329] set_robust_list(0x7fa2d83029a0, 24) = 0 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] rmdir("./config/usb_gadget/g1/functions/acm.usb0") = -1 ENOENT (No such file or directory) [pid 329] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 326] <... futex resumed>) = 0 [pid 329] futex(0x7fa2d83f5b38, FUTEX_WAIT_PRIVATE, 0, NULLci2-android-6-1/strace-static-x86_64: Process 331 attached [pid 331] set_robust_list(0x7fa2d83029a0, 24) = 0 [pid 331] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 331] rmdir("./config/usb_gadget/g1/functions/acm.usb0") = -1 ENOENT (No such file or directory) [pid 331] futex(0x7fa2d83f5b3c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 323] <... futex resumed>) = 0 [pid 331] futex(0x7fa2d83f5b38, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] close(3) = -1 EBADF (Bad file descriptor) [pid 322] close(4 [pid 326] close(3 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(5 [pid 326] close(4 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(6 [pid 326] close(5 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(7 [pid 326] close(6 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(8 [pid 326] close(7 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(9 [pid 326] close(8 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(10 [pid 326] close(9 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(11 [pid 326] close(10 [pid 323] close(3 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(12 [pid 326] close(11 [pid 323] close(4 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(13 [pid 326] close(12 [pid 323] close(5 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(14 [pid 326] close(13 [pid 323] close(6 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(15 [pid 326] close(14 [pid 323] close(7 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(16 [pid 326] close(15 [pid 323] close(8 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(17 [pid 326] close(16 [pid 323] close(9 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(18 [pid 326] close(17 [pid 323] close(10 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(19 [pid 326] close(18 [pid 323] close(11 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(20 [pid 326] close(19 [pid 323] close(12 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(21 [pid 326] close(20 [pid 323] close(13 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(22 [pid 326] close(21 [pid 323] close(14 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(23 [pid 326] close(22 [pid 323] close(15 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(24 [pid 326] close(23 [pid 323] close(16 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(25 [pid 326] close(24 [pid 323] close(17 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(26 [pid 326] close(25 [pid 323] close(18 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(27 [pid 326] close(26 [pid 323] close(19 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(28 [pid 326] close(27 [pid 323] close(20 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] close(29 [pid 326] close(28 [pid 323] close(21 [pid 322] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] exit_group(0 [pid 330] <... futex resumed>) = ? [pid 326] close(29 [pid 324] <... openat resumed>) = ? [pid 323] close(22 [pid 322] <... exit_group resumed>) = ? [pid 330] +++ exited with 0 +++ [pid 326] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 324] +++ exited with 0 +++ [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 322] +++ exited with 0 +++ [pid 326] exit_group(0 [pid 323] close(23 [pid 313] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 329] <... futex resumed>) = ? [pid 327] <... openat resumed>) = ? [pid 326] <... exit_group resumed>) = ? [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 329] +++ exited with 0 +++ [pid 327] +++ exited with 0 +++ [pid 326] +++ exited with 0 +++ [pid 323] close(24) = -1 EBADF (Bad file descriptor) [pid 313] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 323] close(25 [pid 315] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 313] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 315] restart_syscall(<... resuming interrupted rt_sigprocmask ...> [pid 313] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 323] close(26 [pid 313] <... openat resumed>) = 3 [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] fstat(3 [pid 323] close(27 [pid 313] <... fstat resumed>, {st_mode=S_IFDIR|0700, st_size=160, ...}) = 0 [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] getdents64(3 [pid 323] close(28 [pid 313] <... getdents64 resumed>, 0x55558e12d750 /* 8 entries */, 32768) = 232 [pid 323] <... close resumed>) = -1 EBADF (Bad file descriptor) [pid 313] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 323] close(29) = -1 EBADF (Bad file descriptor) [pid 323] exit_group(0 [pid 331] <... futex resumed>) = ? [pid 325] <... openat resumed>) = ? [pid 323] <... exit_group resumed>) = ? [pid 315] <... restart_syscall resumed>) = 0 [pid 331] +++ exited with 0 +++ [pid 325] +++ exited with 0 +++ [pid 323] +++ exited with 0 +++ [pid 315] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 312] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 315] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 315] fstat(3, {st_mode=S_IFDIR|0700, st_size=160, ...}) = 0 [pid 315] getdents64(3, 0x55558e12d750 /* 8 entries */, 32768) = 232 [pid 312] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 315] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 312] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 312] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 312] fstat(3, {st_mode=S_IFDIR|0700, st_size=160, ...}) = 0 [pid 312] getdents64(3, 0x55558e12d750 /* 8 entries */, 32768) = 232 [ 27.732565][ T316] ffff88810e764080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.740646][ T316] >ffff88810e764100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.748697][ T316] ^ [ 27.753280][ T316] ffff88810e764180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.761340][ T316] ffff88810e764200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.769394][ T316] ================================================================== [ 27.777680][ T316] Disabling lock debugging due to kernel taint [ 27.783991][ T316] ------------[ cut here ]------------ [ 27.789481][ T316] WARNING: CPU: 0 PID: 316 at drivers/usb/gadget/function/u_serial.c:694 gs_close+0x17d/0x9b0 [ 27.799749][ T316] Modules linked in: [ 27.803638][ T316] CPU: 0 PID: 316 Comm: syz-executor327 Tainted: G B syzkaller #0 [ 27.812831][ T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.822984][ T316] RIP: 0010:gs_close+0x17d/0x9b0 [ 27.827936][ T316] Code: 04 23 fe 41 ff cc 42 0f b6 04 2b 84 c0 0f 85 cf 06 00 00 48 8b 44 24 20 44 89 20 48 8b 5c 24 38 e9 cb 02 00 00 e8 f3 03 23 fe <0f> 0b 48 8b 5c 24 38 e9 ba 02 00 00 e8 e2 03 23 fe 49 8d bf a8 02 [ 27.847572][ T316] RSP: 0018:ffffc90000e67a60 EFLAGS: 00010093 [ 27.853655][ T316] RAX: ffffffff834e662d RBX: 1ffff11021cec81a RCX: ffff888110060000 [ 27.861670][ T316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.869653][ T316] RBP: ffffc90000e67b80 R08: 0000000000000003 R09: 0000000000000004 [ 27.877637][ T316] R10: dffffc0000000000 R11: fffff520001ccf3c R12: 0000000000000000 [ 27.885619][ T316] R13: dffffc0000000000 R14: 1ffff920001ccf54 R15: ffff88810e764000 [ 27.893601][ T316] FS: 000055558e12c3c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 27.902605][ T316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.909315][ T316] CR2: 000055558e135758 CR3: 0000000125fb9000 CR4: 00000000003506b0 [ 27.917320][ T316] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.925302][ T316] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.933279][ T316] Call Trace: [ 27.936562][ T316] [ 27.939495][ T316] ? __kasan_check_write+0x14/0x20 [ 27.944624][ T316] ? _raw_spin_lock+0x94/0xf0 [ 27.949324][ T316] ? __cfi__raw_spin_lock+0x10/0x10 [ 27.954542][ T316] ? __cfi_gs_close+0x10/0x10 [ 27.959237][ T316] ? _raw_spin_unlock+0x4c/0x70 [ 27.964101][ T316] ? fasync_remove_entry+0x19c/0x1d0 [ 27.969391][ T316] ? __cfi_gs_close+0x10/0x10 [ 27.974072][ T316] tty_release+0x32b/0x11d0 [ 27.978620][ T316] ? __cfi_tty_release+0x10/0x10 [ 27.983582][ T316] __fput+0x1fd/0x8f0 [ 27.987609][ T316] ____fput+0x15/0x20 [ 27.991605][ T316] task_work_run+0x1e1/0x250 [ 27.996211][ T316] ? __cfi_task_work_run+0x10/0x10 [ 28.001340][ T316] ptrace_notify+0x23f/0x270 [ 28.005938][ T316] ? __cfi_task_work_add+0x10/0x10 [ 28.011056][ T316] ? __cfi_ptrace_notify+0x10/0x10 [ 28.016177][ T316] ? fput+0x15b/0x1a0 [ 28.020168][ T316] ? filp_close+0x111/0x160 [ 28.024678][ T316] syscall_exit_work+0x84/0x140 [ 28.029561][ T316] syscall_exit_to_user_mode_prepare+0x1c/0x20 [ 28.035729][ T316] syscall_exit_to_user_mode+0xd/0x30 [ 28.041112][ T316] do_syscall_64+0x58/0xa0 [ 28.045549][ T316] ? clear_bhb_loop+0x30/0x80 [ 28.050235][ T316] ? clear_bhb_loop+0x30/0x80 [ 28.054922][ T316] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.060817][ T316] RIP: 0033:0x7fa2d8359b8e [ 28.065234][ T316] Code: 08 0f 85 65 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 28.084833][ T316] RSP: 002b:00007ffcb0d63a98 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 28.093253][ T316] RAX: 0000000000000000 RBX: 000055558e12c3c0 RCX: 00007fa2d8359b8e [ 28.101228][ T316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 28.109193][ T316] RBP: 0000000000006917 R08: 0000000000000000 R09: 0000000000000000 [ 28.117165][ T316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa2d83f5b2c [ 28.125159][ T316] R13: 00007ffcb0d63b40 R14: 00007ffcb0d63bb0 R15: 00007fa2d832e6d0 [ 28.133141][ T316] [pid 312] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 315] <... umount2 resumed>) = 0 [pid 313] <... umount2 resumed>) = 0 [pid 312] <... umount2 resumed>) = 0 [pid 311] <... umount2 resumed>) = 0 [pid 315] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 312] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 311] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 315] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 312] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 311] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 315] newfstatat(AT_FDCWD, "./0/config" [pid 312] newfstatat(AT_FDCWD, "./0/config" [pid 311] newfstatat(AT_FDCWD, "./0/config" [pid 315] <... newfstatat resumed>, {st_mode=S_IFDIR|000, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 312] <... newfstatat resumed>, {st_mode=S_IFDIR|000, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 311] <... newfstatat resumed>, {st_mode=S_IFDIR|000, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 315] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 312] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 311] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW [pid 315] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 312] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 311] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 315] openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 312] openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 311] openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 315] <... openat resumed>) = 4 [pid 312] <... openat resumed>) = 4 [pid 311] <... openat resumed>) = 4 [pid 315] fstat(4 [pid 312] fstat(4 [pid 311] fstat(4 [pid 315] <... fstat resumed>, {st_mode=S_IFDIR|000, st_size=40, ...}) = 0 [pid 312] <... fstat resumed>, {st_mode=S_IFDIR|000, st_size=40, ...}) = 0 [pid 311] <... fstat resumed>, {st_mode=S_IFDIR|000, st_size=40, ...}) = 0 [pid 315] getdents64(4 [pid 312] getdents64(4 [pid 311] getdents64(4 [pid 315] <... getdents64 resumed>, 0x55558e135790 /* 2 entries */, 32768) = 48 [pid 312] <... getdents64 resumed>, 0x55558e135790 /* 2 entries */, 32768) = 48 [pid 311] <... getdents64 resumed>, 0x55558e135790 /* 2 entries */, 32768) = 48 [pid 315] getdents64(4 [pid 312] getdents64(4 [pid 311] getdents64(4 [pid 315] <... getdents64 resumed>, 0x55558e135790 /* 0 entries */, 32768) = 0 [pid 312] <... getdents64 resumed>, 0x55558e135790 /* 0 entries */, 32768) = 0 [pid 311] <... getdents64 resumed>, 0x55558e135790 /* 0 entries */, 32768) = 0 [pid 315] close(4 [pid 312] close(4 [pid 311] close(4 [pid 315] <... close resumed>) = 0 [pid 312] <... close resumed>) = 0 [pid 311] <... close resumed>) = 0 [pid 315] rmdir("./0/config" [pid 312] rmdir("./0/config" [pid 311] rmdir("./0/config" [pid 315] <... rmdir resumed>) = 0 [pid 312] <... rmdir resumed>) = 0 [pid 311] <... rmdir resumed>) = 0 [pid 315] umount2("./0/dev", MNT_FORCE|UMOUNT_NOFOLLOW [pid 312] umount2("./0/dev", MNT_FORCE|UMOUNT_NOFOLLOW [ 28.136164][ T316] ---[ end trace 0000000000000000 ]--- [ 28.142006][ T316] general protection fault, probably for non-canonical address 0xe0b8dc25c0000020: 0000 [#1] PREEMPT SMP KASAN [ 28.153754][ T316] KASAN: maybe wild-memory-access in range [0x05c7012e00000100-0x05c7012e00000107] [ 28.163047][ T316] CPU: 0 PID: 316 Comm: syz-executor327 Tainted: G B W syzkaller #0 [ 28.172260][ T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.182342][ T316] RIP: 0010:try_to_grab_pending+0x1be/0x580 [pid 311] umount2("./0/dev", MNT_FORCE|UMOUNT_NOFOLLOW [pid 313] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] newfstatat(AT_FDCWD, "./0/config", {st_mode=S_IFDIR|000, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 313] openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 313] fstat(4, {st_mode=S_IFDIR|000, st_size=40, ...}) = 0 [pid 313] getdents64(4, 0x55558e135790 /* 2 entries */, 32768) = 48 [pid 313] getdents64(4, 0x55558e135790 /* 0 entries */, 32768) = 0 [pid 313] close(4) = 0 [pid 313] rmdir("./0/config") = 0 [ 28.188317][ T316] Code: 00 e8 b6 43 29 00 e9 0a 01 00 00 e8 ac 43 29 00 31 c0 e9 98 01 00 00 e8 a0 43 29 00 49 81 e6 00 ff ff ff 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 c4 ce 6e 00 49 8b 06 48 85 c0 0f 84 [ 28.207948][ T316] RSP: 0018:ffffc90000e67900 EFLAGS: 00010002 [ 28.214020][ T316] RAX: 00b8e025c0000020 RBX: dffffc0000000000 RCX: ffff888110060000 [ 28.221990][ T316] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 28.229974][ T316] RBP: ffffc90000e679b0 R08: 0000000000000007 R09: 00000000fffffffb [ 28.237964][ T316] R10: dffffc0000000000 R11: ffffed1021cec801 R12: ffff88810e764008 [ 28.245935][ T316] R13: ffffc90000e679d8 R14: 05c7012e00000100 R15: 1ffff920001ccf3b [ 28.253920][ T316] FS: 000055558e12c3c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 28.262847][ T316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.269431][ T316] CR2: 000055558e135758 CR3: 0000000125fb9000 CR4: 00000000003506b0 [ 28.277398][ T316] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.285370][ T316] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.293334][ T316] Call Trace: [ 28.296613][ T316] [ 28.299575][ T316] ? mod_delayed_work_on+0xe0/0xe0 [ 28.304695][ T316] __cancel_work_timer+0xb5/0x4d0 [ 28.309724][ T316] ? cancel_work_sync+0x20/0x20 [ 28.314580][ T316] cancel_work_sync+0x17/0x20 [ 28.319270][ T316] tty_buffer_cancel_work+0x19/0x20 [ 28.324463][ T316] release_tty+0x487/0x830 [ 28.328886][ T316] tty_release_struct+0xbf/0xe0 [ 28.333735][ T316] tty_release+0xbb7/0x11d0 [ 28.338259][ T316] ? __cfi_tty_release+0x10/0x10 [ 28.343207][ T316] __fput+0x1fd/0x8f0 [ 28.347224][ T316] ____fput+0x15/0x20 [ 28.351214][ T316] task_work_run+0x1e1/0x250 [ 28.355797][ T316] ? __cfi_task_work_run+0x10/0x10 [ 28.360906][ T316] ptrace_notify+0x23f/0x270 [ 28.365499][ T316] ? __cfi_task_work_add+0x10/0x10 [ 28.370708][ T316] ? __cfi_ptrace_notify+0x10/0x10 [ 28.375826][ T316] ? fput+0x15b/0x1a0 [ 28.379813][ T316] ? filp_close+0x111/0x160 [ 28.384320][ T316] syscall_exit_work+0x84/0x140 [ 28.389169][ T316] syscall_exit_to_user_mode_prepare+0x1c/0x20 [ 28.395322][ T316] syscall_exit_to_user_mode+0xd/0x30 [ 28.400719][ T316] do_syscall_64+0x58/0xa0 [ 28.405156][ T316] ? clear_bhb_loop+0x30/0x80 [ 28.409846][ T316] ? clear_bhb_loop+0x30/0x80 [ 28.414547][ T316] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.420435][ T316] RIP: 0033:0x7fa2d8359b8e [ 28.424856][ T316] Code: 08 0f 85 65 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 28.444449][ T316] RSP: 002b:00007ffcb0d63a98 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 28.452862][ T316] RAX: 0000000000000000 RBX: 000055558e12c3c0 RCX: 00007fa2d8359b8e [ 28.460832][ T316] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 28.468807][ T316] RBP: 0000000000006917 R08: 0000000000000000 R09: 0000000000000000 [ 28.476791][ T316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa2d83f5b2c [ 28.484863][ T316] R13: 00007ffcb0d63b40 R14: 00007ffcb0d63bb0 R15: 00007fa2d832e6d0 [ 28.492834][ T316] [ 28.495845][ T316] Modules linked in: [ 28.499744][ T316] ---[ end trace 0000000000000000 ]--- [ 28.505189][ T316] RIP: 0010:try_to_grab_pending+0x1be/0x580 [ 28.511087][ T316] Code: 00 e8 b6 43 29 00 e9 0a 01 00 00 e8 ac 43 29 00 31 c0 e9 98 01 00 00 e8 a0 43 29 00 49 81 e6 00 ff ff ff 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 c4 ce 6e 00 49 8b 06 48 85 c0 0f 84 [ 28.530687][ T316] RSP: 0018:ffffc90000e67900 EFLAGS: 00010002 [ 28.536769][ T316] RAX: 00b8e025c0000020 RBX: dffffc0000000000 RCX: ffff888110060000 [ 28.544739][ T316] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 28.552718][ T316] RBP: ffffc90000e679b0 R08: 0000000000000007 R09: 00000000fffffffb [ 28.560704][ T316] R10: dffffc0000000000 R11: ffffed1021cec801 R12: ffff88810e764008 [ 28.568673][ T316] R13: ffffc90000e679d8 R14: 05c7012e00000100 R15: 1ffff920001ccf3b [ 28.576648][ T316] FS: 000055558e12c3c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 28.585598][ T316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.592202][ T316] CR2: 000055558e135758 CR3: 0000000125fb9000 CR4: 00000000003506b0 [ 28.600192][ T316] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.608187][ T316] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.616181][ T316] Kernel panic - not syncing: Fatal exception [ 28.622357][ T316] Kernel Offset: disabled [ 28.626677][ T316] Rebooting in 86400 seconds..