ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor2022140135 <...> cess permissive=1 [ 14.512777][ T28] audit: type=1400 audit(1791006759.019:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.49' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor2022140135", ["ci2-android-6-1/syz-executor2022140135"], 0x7ffe26daba90 /* 10 vars */) = 0 brk(NULL) = 0x555580d76000 brk(0x555580d76e00) = 0x555580d76e00 arch_prctl(ARCH_SET_FS, 0x555580d76480) = 0 set_tid_address(0x555580d76750) = 305 set_robust_list(0x555580d76760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor2022140135", 4096) = 44 getrandom("\x23\x2f\x54\x63\x35\x2c\xdb\xf4", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555580d76e00 brk(0x555580d97e00) = 0x555580d97e00 brk(0x555580d98000) = 0x555580d98000 mprotect(0x7f576b9a3000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f576b8fe4c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f576b902200}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f576b8fe4c0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f576b902200}, NULL, 8) = 0 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f57634f6000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f57634f6000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 [ 24.463164][ T28] audit: type=1400 audit(1791006768.979:64): avc: denied { execmem } for pid=305 comm="syz-executor202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.471742][ T305] loop0: detected capacity change from 0 to 512 [ 24.497638][ T28] audit: type=1400 audit(1791006768.979:65): avc: denied { read write } for pid=305 comm="syz-executor202" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.522012][ T28] audit: type=1400 audit(1791006768.979:66): avc: denied { open } for pid=305 comm="syz-executor202" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.546236][ T28] audit: type=1400 audit(1791006768.979:67): avc: denied { ioctl } for pid=305 comm="syz-executor202" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 mkdir("./file1", 0777) = 0 [ 24.701012][ T28] audit: type=1400 audit(1791006769.219:68): avc: denied { mounton } for pid=305 comm="syz-executor202" path="/root/file1" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 24.701314][ T305] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 24.736775][ T305] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode mount("/dev/loop0", "./file1", "ext4", MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_DIRSYNC|MS_REC, "debug_want_extra_isize=0x000000000000002e,lazytime,jqfmt=vfsv0,stripe=0x0000000000004000,errors=remo"...) = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 quotactl(QCMD(Q_QUOTAON, GRPQUOTA), "/dev/loop0", 0 /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) mprotect(0x200000000000, 12288, PROT_READ) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x200000000000 open(0x200000000300, O_RDWR|O_CREAT|O_NONBLOCK|O_DIRECT|O_NOFOLLOW|O_NOATIME, 0531) = 5 sendmsg(5, 0x200000000800, MSG_OOB|MSG_PROBE|MSG_NOSIGNAL|MSG_BATCH|MSG_ZEROCOPY) = -1 ENOTSOCK (Socket operation on non-socket) [ 24.748237][ T305] EXT4-fs (loop0): 1 truncate cleaned up [ 24.753872][ T305] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 24.762510][ T28] audit: type=1400 audit(1791006769.289:69): avc: denied { mount } for pid=305 comm="syz-executor202" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.770297][ T305] ================================================================== [ 24.792367][ T305] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0xb02/0x2230 [ 24.794417][ T28] audit: type=1400 audit(1791006769.289:70): avc: denied { append } for pid=305 comm="syz-executor202" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.800115][ T305] Read of size 18446744073709551600 at addr ffff88810b7beeb8 by task syz-executor202/305 [ 24.826649][ T28] audit: type=1400 audit(1791006769.289:71): avc: denied { map } for pid=305 comm="syz-executor202" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 24.833665][ T305] [ 24.833672][ T305] CPU: 0 PID: 305 Comm: syz-executor202 Not tainted syzkaller #0 [ 24.867616][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 24.877664][ T305] Call Trace: [ 24.880936][ T305] [ 24.883864][ T305] __dump_stack+0x21/0x24 [ 24.888198][ T305] dump_stack_lvl+0x110/0x170 [ 24.892874][ T305] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.897901][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 24.903365][ T305] print_address_description+0x71/0x200 [ 24.908912][ T305] print_report+0x4a/0x60 [ 24.913273][ T305] kasan_report+0x122/0x150 [ 24.917777][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 24.923237][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 24.928697][ T305] kasan_check_range+0x249/0x2a0 [ 24.933636][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 24.939093][ T305] memmove+0x2d/0x70 [ 24.942986][ T305] ext4_xattr_set_entry+0xb02/0x2230 [ 24.948301][ T305] ext4_xattr_ibody_set+0x25b/0x720 [ 24.953506][ T305] ext4_destroy_inline_data_nolock+0x234/0x5e0 [ 24.959659][ T305] ? ext4_destroy_inline_data+0xe0/0xe0 [ 24.965210][ T305] ? __kasan_kmalloc+0x95/0xb0 [ 24.969970][ T305] ? memcpy+0x56/0x70 [ 24.973945][ T305] ext4_convert_inline_data_nolock+0x3b0/0x9e0 [ 24.980098][ T305] ? ext4_add_dirent_to_inline+0x440/0x440 [ 24.986160][ T305] ? __kasan_check_read+0x11/0x20 [ 24.991178][ T305] ? __ext4_journal_start_sb+0x2ed/0x4a0 [ 24.996805][ T305] ext4_convert_inline_data+0x470/0x5b0 [ 25.002350][ T305] ? __cfi_ext4_convert_inline_data+0x10/0x10 [ 25.008416][ T305] ? setattr_prepare+0x206/0xcc0 [ 25.013369][ T305] ext4_setattr+0xf3c/0x1c80 [ 25.017957][ T305] ? current_time+0x19b/0x2c0 [ 25.022634][ T305] ? __cfi_current_time+0x10/0x10 [ 25.027656][ T305] ? __cfi_ext4_setattr+0x10/0x10 [ 25.032679][ T305] notify_change+0xd33/0x1030 [ 25.037357][ T305] do_truncate+0x1ac/0x240 [ 25.041768][ T305] ? __cfi_do_truncate+0x10/0x10 [ 25.046701][ T305] ? ____kasan_slab_free+0x13d/0x180 [ 25.051986][ T305] ? security_inode_permission+0xc5/0x110 [ 25.057710][ T305] ? break_lease+0x7b/0xd0 [ 25.062125][ T305] vfs_truncate+0x25b/0x2f0 [ 25.066622][ T305] do_sys_truncate+0xf2/0x1c0 [ 25.071295][ T305] ? __cfi_do_sys_truncate+0x10/0x10 [ 25.076582][ T305] ? fpregs_restore_userregs+0x128/0x260 [ 25.082220][ T305] __x64_sys_truncate+0x5b/0x70 [ 25.087066][ T305] x64_sys_call+0x679/0x9a0 [ 25.091569][ T305] do_syscall_64+0x4c/0xa0 [ 25.095983][ T305] ? clear_bhb_loop+0x30/0x80 [ 25.100665][ T305] ? clear_bhb_loop+0x30/0x80 [ 25.105338][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.111226][ T305] RIP: 0033:0x7f576b91ad59 [ 25.115638][ T305] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.135237][ T305] RSP: 002b:00007ffed52411d8 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 25.143646][ T305] RAX: ffffffffffffffda RBX: 6f6f6c2f7665642f RCX: 00007f576b91ad59 [ 25.151612][ T305] RDX: ffffffffffffffd8 RSI: 0000000002fffffd RDI: 0000200000000940 [ 25.159578][ T305] RBP: 00007ffed52411e8 R08: 00007f576b8fe4c0 R09: 00007f576b8fe4c0 [ 25.167542][ T305] R10: 00007f576b8fe4c0 R11: 0000000000000246 R12: 0000000000000000 [ 25.175522][ T305] R13: 0000000000000002 R14: 00007f576b9a3c80 R15: 0000000000000002 [ 25.183494][ T305] [ 25.186505][ T305] [ 25.188820][ T305] The buggy address belongs to the physical page: [ 25.195225][ T305] page:ffffea00042def80 refcount:3 mapcount:1 mapping:ffff8881004894d0 index:0x3 pfn:0x10b7be [ 25.205456][ T305] memcg:ffff88810023c440 [ 25.209688][ T305] aops:def_blk_aops ino:700000 [ 25.214451][ T305] flags: 0x6600000000022056(referenced|uptodate|lru|workingset|private|mappedtodisk|zone=1) [ 25.224512][ T305] raw: 6600000000022056 ffffea00043ea248 ffffea0004404f48 ffff8881004894d0 [ 25.233101][ T305] raw: 0000000000000003 ffff8881245fc150 0000000300000000 ffff88810023c440 [ 25.241670][ T305] page dumped because: kasan: bad access detected [ 25.248069][ T305] page_owner tracks the page as allocated [ 25.253775][ T305] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 305, tgid 305 (syz-executor202), ts 24767463096, free_ts 24767002230 [ 25.274348][ T305] post_alloc_hook+0x1f5/0x210 [ 25.279114][ T305] prep_new_page+0x1c/0x110 [ 25.283614][ T305] get_page_from_freelist+0x2ca9/0x2d20 [ 25.289168][ T305] __alloc_pages+0x1fa/0x610 [ 25.293755][ T305] __folio_alloc+0x12/0x40 [ 25.298167][ T305] page_cache_ra_unbounded+0x24d/0x850 [ 25.303631][ T305] page_cache_ra_order+0xb0c/0xe50 [ 25.308741][ T305] do_sync_mmap_readahead+0x8a4/0xb20 [ 25.314107][ T305] filemap_fault+0x3e3/0x1370 [ 25.318779][ T305] do_fault+0x19de/0x1e30 [ 25.323101][ T305] handle_mm_fault+0x1363/0x26b0 [ 25.328030][ T305] __get_user_pages+0x34b/0xdb0 [ 25.332873][ T305] __mm_populate+0x2ea/0x430 [ 25.337454][ T305] vm_mmap_pgoff+0x271/0x3f0 [ 25.342038][ T305] ksys_mmap_pgoff+0x161/0x1d0 [ 25.346804][ T305] __x64_sys_mmap+0xfa/0x110 [ 25.351392][ T305] page last free stack trace: [ 25.356059][ T305] free_unref_page_prepare+0x81b/0x820 [ 25.361518][ T305] free_unref_page+0x93/0x530 [ 25.366191][ T305] free_the_page+0x13/0x20 [ 25.370603][ T305] page_frag_free+0x10a/0x120 [ 25.375276][ T305] skb_release_data+0x70d/0x8a0 [ 25.380126][ T305] __kfree_skb+0x50/0x70 [ 25.384363][ T305] tcp_rcv_established+0xdc1/0x1ab0 [ 25.389557][ T305] tcp_v4_do_rcv+0x446/0x9c0 [ 25.394140][ T305] tcp_v4_rcv+0x239f/0x2ae0 [ 25.399157][ T305] ip_protocol_deliver_rcu+0x371/0x780 [ 25.404610][ T305] ip_local_deliver_finish+0x23e/0x400 [ 25.410064][ T305] ip_local_deliver+0x1dc/0x350 [ 25.414910][ T305] ip_sublist_rcv+0x787/0x8d0 [ 25.419601][ T305] ip_list_rcv+0x3e4/0x430 [ 25.424014][ T305] __netif_receive_skb_list_core+0x5a8/0x7b0 [ 25.429989][ T305] netif_receive_skb_list_internal+0x7f8/0xaa0 [ 25.436139][ T305] [ 25.438456][ T305] Memory state around the buggy address: [ 25.444077][ T305] ffff88810b7bed80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.452130][ T305] ffff88810b7bee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.460185][ T305] >ffff88810b7bee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.468237][ T305] ^ [ 25.474125][ T305] ffff88810b7bef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.482174][ T305] ffff88810b7bef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.490222][ T305] ================================================================== [ 25.498536][ T28] audit: type=1400 audit(1791006769.289:72): avc: denied { write } for pid=305 comm="syz-executor202" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.520416][ T305] Disabling lock debugging due to kernel taint [ 25.520459][ T28] audit: type=1400 audit(1791006769.289:73): avc: denied { add_name } for pid=305 comm="syz-executor202" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 truncate(0x200000000940, 50331645) = -1 ENOSPC (No space left on device) exit_group(0) = ? +++ exited with 0 +++ [ 25.526826][ T305] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:477: