ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor2918918733 <...> Warning: Permanently added '10.128.0.49' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor2918918733", ["ci2-android-5-15/syz-executor2918918733"], 0x7ffd1b7f5700 /* 10 vars */) = 0 brk(NULL) = 0x55555eed8000 brk(0x55555eed8d40) = 0x55555eed8d40 arch_prctl(ARCH_SET_FS, 0x55555eed83c0) = 0 set_tid_address(0x55555eed8690) = 303 set_robust_list(0x55555eed86a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor2918918733", 4096) = 45 getrandom("\xc9\x12\x36\x12\xd4\x0b\x43\x91", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555eed8d40 brk(0x55555eef9d40) = 0x55555eef9d40 brk(0x55555eefa000) = 0x55555eefa000 mprotect(0x7fd530991000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555eed8690) = 304 ci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] set_robust_list(0x55555eed86a0, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] setpgid(0, 0) = 0 [pid 304] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 304] write(3, "1000", 4) = 4 [pid 304] close(3) = 0 executing program [pid 304] write(1, "executing program\n", 18) = 18 [pid 304] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] rt_sigaction(SIGRT_1, {sa_handler=0x7fd5308fa290, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd5308ec560}, NULL, 8) = 0 [pid 304] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 304] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd5308a7000 [pid 304] mprotect(0x7fd5308a8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5308c7990, parent_tid=0x7fd5308c7990, exit_signal=0, stack=0x7fd5308a7000, stack_size=0x20300, tls=0x7fd5308c76c0}ci2-android-5-15/strace-static-x86_64: Process 305 attached [pid 305] set_robust_list(0x7fd5308c79a0, 24) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] futex(0x7fd530997b68, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... clone3 resumed> => {parent_tid=[305]}, 88) = 305 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 305] <... futex resumed>) = 0 [pid 305] socket(AF_INET, SOCK_STREAM, IPPROTO_IP [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... socket resumed>) = 3 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 305] futex(0x7fd530997b68, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 23.571910][ T30] audit: type=1400 audit(1790481166.626:64): avc: denied { execmem } for pid=303 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 305] bind(4, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 305] futex(0x7fd530997b68, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] <... futex resumed>) = 0 [pid 305] listen(4, 5) = 0 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 305] futex(0x7fd530997b68, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... futex resumed>) = 1 [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] <... futex resumed>) = 0 [pid 305] connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16 [pid 304] <... futex resumed>) = 1 [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... connect resumed>) = 0 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = 1 [pid 305] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = 1 [ 23.602941][ T30] audit: type=1400 audit(1790481166.656:65): avc: denied { name_bind } for pid=304 comm="syz-executor291" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 23.624837][ T30] audit: type=1400 audit(1790481166.656:66): avc: denied { node_bind } for pid=304 comm="syz-executor291" saddr=127.0.0.1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.648728][ T30] audit: type=1400 audit(1790481166.696:67): avc: denied { map_create } for pid=304 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [pid 305] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_MSG, insn_cnt=4, insns=0x200000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_SK_MSG_VERDICT, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0 [pid 304] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b7c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd530886000 [pid 304] mprotect(0x7fd530887000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5308a6990, parent_tid=0x7fd5308a6990, exit_signal=0, stack=0x7fd530886000, stack_size=0x20300, tls=0x7fd5308a66c0} => {parent_tid=[306]}, 88) = 306 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] futex(0x7fd530997b78, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.668283][ T30] audit: type=1400 audit(1790481166.696:68): avc: denied { map_read map_write } for pid=304 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.688406][ T30] audit: type=1400 audit(1790481166.696:69): avc: denied { prog_load } for pid=304 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x7fd5308a69a0, 24) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 306] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=-1, attach_type=BPF_SK_MSG_VERDICT, attach_flags=0, replace_bpf_fd=0, relative_fd=0, expected_revision=0}, 32) = -1 EBADF (Bad file descriptor) [pid 306] futex(0x7fd530997b7c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b78, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x200000000640, value=0x200000000680, flags=BPF_ANY}, 32) = 0 [pid 306] futex(0x7fd530997b7c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b78, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] sendto(3, "\x01", 1, 0, NULL, 0) = 1 [pid 306] futex(0x7fd530997b7c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd530997b78, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] sendto(3, "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 18446744073709551493, MSG_OOB|MSG_DONTROUTE|MSG_EOR|MSG_NOSIGNAL|MSG_MORE, NULL, 0 [pid 304] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd530997b8c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd530865000 [pid 304] mprotect(0x7fd530866000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd530885990, parent_tid=0x7fd530885990, exit_signal=0, stack=0x7fd530865000, stack_size=0x20300, tls=0x7fd5308856c0} => {parent_tid=[307]}, 88) = 307 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] futex(0x7fd530997b88, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7fd530997b8c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 307 attached [pid 307] set_robust_list(0x7fd5308859a0, 24) = 0 [pid 307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 23.707973][ T30] audit: type=1400 audit(1790481166.696:70): avc: denied { bpf } for pid=304 comm="syz-executor291" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 307] sendto(3, "\x7b\x65\xb6\x62\x76\x57\xb4\x07\x8b\x6b", 10, MSG_MORE, NULL, 0 [pid 305] <... bpf resumed>, log_true_size=0, prog_token_fd=0}, 148) = 6 [pid 305] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 305] futex(0x7fd530997b68, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 23.780115][ T30] audit: type=1400 audit(1790481166.826:71): avc: denied { perfmon } for pid=304 comm="syz-executor291" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 23.801377][ T30] audit: type=1400 audit(1790481166.846:72): avc: denied { prog_run } for pid=304 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [pid 304] exit_group(0 [pid 307] <... sendto resumed>) = ? [pid 306] <... sendto resumed>) = ? [pid 304] <... exit_group resumed>) = ? [pid 307] +++ exited with 0 +++ [pid 306] +++ exited with 0 +++ [pid 305] <... futex resumed>) = ? [pid 305] +++ exited with 0 +++ [pid 304] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=304, si_uid=0, si_status=0, si_utime=0, si_stime=14 /* 0.14 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-android-5-15/strace-static-x86_64: Process 308 attached [pid 308] set_robust_list(0x55555eed86a0, 24) = 0 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 308] setpgid(0, 0) = 0 [pid 308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 303] <... clone resumed>, child_tidptr=0x55555eed8690) = 308 [pid 308] <... openat resumed>) = 3 [pid 308] write(3, "1000", 4) = 4 [pid 308] close(3) = 0 [pid 308] write(1, "executing program\n", 18) = 18 executing program [pid 308] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] rt_sigaction(SIGRT_1, {sa_handler=0x7fd5308fa290, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd5308ec560}, NULL, 8) = 0 [pid 308] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd5308a7000 [pid 308] mprotect(0x7fd5308a8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5308c7990, parent_tid=0x7fd5308c7990, exit_signal=0, stack=0x7fd5308a7000, stack_size=0x20300, tls=0x7fd5308c76c0} => {parent_tid=[309]}, 88) = 309 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 309 attached [pid 309] set_robust_list(0x7fd5308c79a0, 24) = 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 309] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] rt_sigprocmask(SIG_SETMASK, [] [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] <... futex resumed>) = 1 [pid 309] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 4 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] <... futex resumed>) = 1 [pid 309] bind(4, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] <... futex resumed>) = 1 [pid 309] listen(4, 5) = 0 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] <... futex resumed>) = 1 [pid 309] connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_MSG, insn_cnt=4, insns=0x200000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_SK_MSG_VERDICT, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 6 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=6, attach_type=BPF_SK_MSG_VERDICT, attach_flags=0, replace_bpf_fd=0, relative_fd=0, expected_revision=0}, 32) = 0 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x200000000640, value=0x200000000680, flags=BPF_ANY}, 32 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] <... bpf resumed>) = 0 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] sendto(3, "\x01", 1, 0, NULL, 0 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] <... sendto resumed>) = 1 [pid 309] futex(0x7fd530997b6c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 308] <... futex resumed>) = 0 [pid 308] futex(0x7fd530997b68, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b6c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] sendto(3, "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 18446744073709551493, MSG_OOB|MSG_DONTROUTE|MSG_EOR|MSG_NOSIGNAL|MSG_MORE, NULL, 0 [pid 308] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] futex(0x7fd530997b7c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd530886000 [pid 308] mprotect(0x7fd530887000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5308a6990, parent_tid=0x7fd5308a6990, exit_signal=0, stack=0x7fd530886000, stack_size=0x20300, tls=0x7fd5308a66c0} => {parent_tid=[310]}, 88) = 310 [pid 308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] futex(0x7fd530997b78, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 308] futex(0x7fd530997b7c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}ci2-android-5-15/strace-static-x86_64: Process 310 attached [pid 310] set_robust_list(0x7fd5308a69a0, 24) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 310] sendto(3, "\x7b\x65\xb6\x62\x76\x57\xb4\x07\x8b\x6b", 10, MSG_MORE, NULL, 0 [pid 308] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] exit_group(0 [pid 309] <... sendto resumed>) = ? [pid 308] <... exit_group resumed>) = ? [pid 309] +++ exited with 0 +++ [ 24.162386][ T310] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN [ 24.174131][ T310] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 24.182543][ T310] CPU: 0 PID: 310 Comm: syz-executor291 Not tainted syzkaller #0 [ 24.190245][ T310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.200278][ T310] RIP: 0010:__sk_msg_free+0x1f2/0x4c0 [ 24.205652][ T310] Code: 91 fd 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 70 42 d1 fd 4d 8b 2e 49 83 e5 fc 49 8d 5d 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 4f 42 d1 fd 48 8b 1b 89 de 83 e6 [ 24.225240][ T310] RSP: 0018:ffffc90000997630 EFLAGS: 00010202 [ 24.231286][ T310] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88810b0b2780 [ 24.239253][ T310] RDX: 0000000000000000 RSI: 000000000004121f RDI: 00000000001fffff [ 24.247205][ T310] RBP: ffffc900009976c8 R08: 0000000000000003 R09: 0000000000000004 [ 24.255155][ T310] R10: dffffc0000000000 R11: fffff52000132e44 R12: dffffc0000000000 [ 24.263110][ T310] R13: 0000000000000000 R14: ffff88810b1df020 R15: 0000000000000000 [ 24.271074][ T310] FS: 00007fd5308a66c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 24.280009][ T310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.286577][ T310] CR2: 00007fd53096297c CR3: 0000000124efa000 CR4: 00000000003506b0 [ 24.294532][ T310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.302478][ T310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.310425][ T310] Call Trace: [ 24.313682][ T310] [ 24.316596][ T310] sk_msg_free+0x3e/0x60 [ 24.320817][ T310] tcp_bpf_send_verdict+0xdd2/0xf50 [ 24.325987][ T310] tcp_bpf_sendmsg+0x676/0xa70 [ 24.330724][ T310] ? tcp_bpf_recvmsg+0x3f0/0x3f0 [ 24.335658][ T310] ? selinux_socket_accept+0x570/0x570 [ 24.341097][ T310] ? finish_task_switch+0x16b/0x790 [ 24.346271][ T310] ? switch_mm_irqs_off+0x730/0x960 [ 24.351446][ T310] ? __fget_files+0x2e1/0x340 [ 24.356100][ T310] ? inet_send_prepare+0x60/0x4c0 [ 24.361102][ T310] inet_sendmsg+0xa5/0xc0 [ 24.365403][ T310] __sys_sendto+0x46d/0x620 [ 24.369902][ T310] ? __ia32_sys_getpeername+0x90/0x90 [ 24.375257][ T310] ? __kasan_check_write+0x14/0x20 [ 24.380349][ T310] __x64_sys_sendto+0xe5/0x100 [ 24.385093][ T310] x64_sys_call+0x178/0x9a0 [ 24.389592][ T310] do_syscall_64+0x4c/0xa0 [ 24.393983][ T310] ? clear_bhb_loop+0x50/0xa0 [ 24.398636][ T310] ? clear_bhb_loop+0x50/0xa0 [ 24.403290][ T310] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.409164][ T310] RIP: 0033:0x7fd5308e73a9 [ 24.413571][ T310] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48 [ 24.433154][ T310] RSP: 002b:00007fd5308a6208 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 24.441553][ T310] RAX: ffffffffffffffda RBX: 00007fd530997b78 RCX: 00007fd5308e73a9 [ 24.449513][ T310] RDX: 000000000000000a RSI: 0000200000000840 RDI: 0000000000000003 [ 24.457467][ T310] RBP: 00007fd530997b70 R08: 0000000000000000 R09: 0000000000000000 [ 24.465419][ T310] R10: 0000000000008000 R11: 0000000000000246 R12: 00007fd530969378 [ 24.473371][ T310] R13: 0000200000000800 R14: 0000200000000840 R15: 07b4577662b6657b [ 24.481331][ T310] [ 24.484333][ T310] Modules linked in: [ 24.488434][ T310] ---[ end trace 97ca015bd8455fbc ]--- [ 24.489737][ T30] audit: type=1400 audit(1790481167.536:73): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 24.515760][ T310] RIP: 0010:__sk_msg_free+0x1f2/0x4c0 [ 24.521144][ T310] Code: 91 fd 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 70 42 d1 fd 4d 8b 2e 49 83 e5 fc 49 8d 5d 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 4f 42 d1 fd 48 8b 1b 89 de 83 e6 [ 24.540960][ T310] RSP: 0018:ffffc90000997630 EFLAGS: 00010202 [ 24.547098][ T310] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88810b0b2780 [ 24.555086][ T310] RDX: 0000000000000000 RSI: 000000000004121f RDI: 00000000001fffff [ 24.563060][ T310] RBP: ffffc900009976c8 R08: 0000000000000003 R09: 0000000000000004 [ 24.571022][ T310] R10: dffffc0000000000 R11: fffff52000132e44 R12: dffffc0000000000 [ 24.578997][ T310] R13: 0000000000000000 R14: ffff88810b1df020 R15: 0000000000000000 [ 24.586976][ T310] FS: 00007fd5308a66c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 24.595911][ T310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.602501][ T310] CR2: 00007fd53096297c CR3: 0000000124efa000 CR4: 00000000003506b0 [ 24.610456][ T310] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 24.618422][ T310] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.626402][ T310] Kernel panic - not syncing: Fatal exception [ 24.632663][ T310] Kernel Offset: disabled [ 24.636971][ T310] Rebooting in 86400 seconds..