ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor2359099735 <...> Warning: Permanently added '10.128.1.126' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor2359099735", ["ci2-android-6-1/syz-executor2359099735"], 0x7ffc6ff571e0 /* 10 vars */) = 0 brk(NULL) = 0x55557a2e6000 brk(0x55557a2e6d40) = 0x55557a2e6d40 arch_prctl(ARCH_SET_FS, 0x55557a2e63c0) = 0 set_tid_address(0x55557a2e6690) = 304 set_robust_list(0x55557a2e66a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor2359099735", 4096) = 44 getrandom("\x0b\x73\x56\x78\xe6\x60\x7f\xc5", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557a2e6d40 brk(0x55557a307d40) = 0x55557a307d40 brk(0x55557a308000) = 0x55557a308000 mprotect(0x7fd5ef04a000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 futex(0x7fd5ef050b4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7fd5eefb6ed0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fd5eefa97a0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd5eef62000 mprotect(0x7fd5eef63000, 131072, PROT_READ|PROT_WRITE) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5eef82990, parent_tid=0x7fd5eef82990, exit_signal=0, stack=0x7fd5eef62000, stack_size=0x20300, tls=0x7fd5eef826c0} => {parent_tid=[305]}, 88) = 305 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 futex(0x7fd5ef050b48, FUTEX_WAKE_PRIVATE, 1000000) = 0 futex(0x7fd5ef050b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=3, tv_nsec=50000000}ci2-android-6-1/strace-static-x86_64: Process 305 attached [pid 305] set_robust_list(0x7fd5eef829a0, 24) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 305] ioctl(3, USB_RAW_IOCTL_INIT, 0x7fd5eef811d0) = 0 [pid 305] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811d0) = 0 [ 30.219129][ T28] audit: type=1400 audit(1791708763.837:64): avc: denied { execmem } for pid=304 comm="syz-executor235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 30.239138][ T28] audit: type=1400 audit(1791708763.867:65): avc: denied { read write } for pid=304 comm="syz-executor235" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.263608][ T28] audit: type=1400 audit(1791708763.867:66): avc: denied { open } for pid=304 comm="syz-executor235" path="/dev/raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.287560][ T28] audit: type=1400 audit(1791708763.867:67): avc: denied { ioctl } for pid=304 comm="syz-executor235" path="/dev/raw-gadget" dev="devtmpfs" ino=258 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811d0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fd5eef801c0) = 18 [ 30.533145][ T40] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811d0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fd5eef801c0) = 18 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811d0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fd5eef801c0) = 9 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811d0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fd5eef801c0) = 36 [ 30.715705][ T40] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.726692][ T40] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 30.739504][ T40] usb 1-1: config 0 interface 0 has no altsetting 0 [ 30.746134][ T40] usb 1-1: New USB device found, idVendor=06a3, idProduct=0cd0, bcdDevice= 0.00 [ 30.755194][ T40] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811d0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x2) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7fd5ef050c8c) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fd5eef801c0) = 0 [ 30.764053][ T40] usb 1-1: config 0 descriptor?? [pid 305] futex(0x7fd5ef050b4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 305] <... futex resumed>) = 1 [pid 304] futex(0x7fd5ef050b48, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811f0 [pid 304] <... futex resumed>) = 0 [pid 305] <... ioctl resumed>) = 0 [pid 304] futex(0x7fd5ef050b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=350000000} [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7fd5eef801e0) = 0 [pid 305] futex(0x7fd5ef050b4c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 305] futex(0x7fd5ef050b48, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd5ef050b48, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 305] <... futex resumed>) = 0 [pid 304] futex(0x7fd5ef050b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=350000000} [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811f0) = 0 [pid 305] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7fd5eef801e0) = 24 [ 31.174259][ T40] saitek 0003:06A3:0CD0.0001: No inputs registered, leaving [ 31.182736][ T40] saitek 0003:06A3:0CD0.0001: hiddev96,hidraw0: USB HID v0.00 Device [HID 06a3:0cd0] on usb-dummy_hcd.0-1/input0 [pid 305] futex(0x7fd5ef050b4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... futex resumed>) = 0 [pid 305] <... futex resumed>) = 1 [pid 304] futex(0x7fd5ef050b48, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7fd5eef811f0 [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd5ef050b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=350000000}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd5ef050b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 304] futex(0x7fd5ef050b5c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fd5eef41000 [pid 304] mprotect(0x7fd5eef42000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 304] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 304] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5eef61990, parent_tid=0x7fd5eef61990, exit_signal=0, stack=0x7fd5eef41000, stack_size=0x20300, tls=0x7fd5eef616c0}ci2-android-6-1/strace-static-x86_64: Process 310 attached [pid 310] set_robust_list(0x7fd5eef619a0, 24) = 0 [pid 310] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 310] futex(0x7fd5ef050b58, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... clone3 resumed> => {parent_tid=[310]}, 88) = 310 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] futex(0x7fd5ef050b58, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] futex(0x7fd5ef050b5c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=100000000} [pid 310] <... futex resumed>) = 0 [pid 310] openat(AT_FDCWD, "/dev/usb/hiddev0", O_RDONLY|O_EXCL|O_NOFOLLOW|O_NOATIME|FASYNC) = 4 [pid 310] futex(0x7fd5ef050b5c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 310] futex(0x7fd5ef050b58, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... futex resumed>) = 0 [pid 304] futex(0x7fd5ef050b58, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] futex(0x7fd5ef050b5c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] <... futex resumed>) = 0 [pid 310] ioctl(4, HIDIOCGUCODE, 0 [pid 305] <... ioctl resumed>) = 0 [ 31.794262][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN [ 31.806048][ C0] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 31.814452][ C0] CPU: 0 PID: 301 Comm: sshd-session Not tainted syzkaller #0 [ 31.821907][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 31.831953][ C0] RIP: 0010:saitek_event+0x51/0x2c0 [ 31.837183][ C0] Code: be fd 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 dd a7 03 fe 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 c0 a7 03 fe 49 8b 06 48 89 45 d0 [ 31.856797][ C0] RSP: 0018:ffffc90000007768 EFLAGS: 00010006 [ 31.862907][ C0] RAX: 0000000000000003 RBX: ffff88810f127a88 RCX: ffff88810f9e3cc0 [ 31.870883][ C0] RDX: 0000000000000100 RSI: ffff88810f127a00 RDI: ffff88810b838000 [ 31.878959][ C0] RBP: ffffc90000007798 R08: 0000000000000000 R09: ffff88810f127aa4 [ 31.886932][ C0] R10: 0000000000000000 R11: ffffed1021e24f55 R12: dffffc0000000000 [ 31.894912][ C0] R13: 000000000000008d R14: 0000000000000018 R15: ffff88810b838000 [ 31.902903][ C0] FS: 00007fb5d53ab300(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.911832][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.918416][ C0] CR2: 00007fd5eef60bb0 CR3: 0000000123358000 CR4: 00000000003506b0 [ 31.926387][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.934382][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.942357][ C0] Call Trace: [ 31.945653][ C0] [ 31.948495][ C0] ? hid_process_event+0x159/0x5c0 [ 31.953655][ C0] ? __cfi_saitek_event+0x10/0x10 [ 31.958715][ C0] hid_process_event+0x3f9/0x5c0 [ 31.963672][ C0] ? hidraw_report_event+0x345/0x360 [ 31.968987][ C0] __hid_report_raw_event+0x10b6/0x1a20 [ 31.974562][ C0] ? __cfi_saitek_raw_event+0x10/0x10 [ 31.979939][ C0] hid_input_report+0x44f/0x510 [ 31.984836][ C0] hid_ctrl+0x235/0x510 [ 31.988991][ C0] __usb_hcd_giveback_urb+0x360/0x520 [ 31.994370][ C0] usb_hcd_giveback_urb+0x11f/0x3e0 [ 31.999655][ C0] dummy_timer+0xa25/0x3270 [ 32.004194][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 32.009131][ C0] ? resched_curr+0x114/0x3a0 [ 32.013812][ C0] ? timerqueue_del+0xd3/0x120 [ 32.018576][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 32.023513][ C0] __hrtimer_run_queues+0x398/0x8a0 [ 32.028727][ C0] ? hrtimer_interrupt+0x8c0/0x8c0 [ 32.033845][ C0] hrtimer_run_softirq+0x19b/0x260 [ 32.038951][ C0] handle_softirqs+0x1d7/0x600 [ 32.043718][ C0] __irq_exit_rcu+0x52/0xf0 [ 32.048217][ C0] irq_exit_rcu+0x9/0x10 [ 32.052452][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 32.058083][ C0] [ 32.061006][ C0] [ 32.063931][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 32.069906][ C0] RIP: 0010:should_fail_ex+0xc/0x510 [ 32.075206][ C0] Code: 5a 5a 2a ff e9 55 ff ff ff 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 84 6f ae f0 55 48 89 e5 41 57 41 56 41 55 41 54 <53> 48 83 ec 20 89 55 d0 49 89 f7 49 89 fe 48 ba 00 00 00 00 00 fc [ 32.094818][ C0] RSP: 0018:ffffc90000e17d60 EFLAGS: 00000246 [ 32.100875][ C0] RAX: ffffffff828ca919 RBX: 0000000000000008 RCX: ffff88810f9e3cc0 [ 32.108839][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff873c9d60 [ 32.116822][ C0] RBP: ffffc90000e17d80 R08: ffff88810f9e3cc7 R09: 1ffff11021f3c798 [ 32.124792][ C0] R10: dffffc0000000000 R11: ffffed1021f3c799 R12: 0000000000000000 [ 32.132769][ C0] R13: dffffc0000000000 R14: 00007fff9272c2c0 R15: ffffc90000e17e20 [ 32.140737][ C0] ? should_fail_usercopy+0x9/0x20 [ 32.145849][ C0] should_fail+0xb/0x10 [ 32.150003][ C0] should_fail_usercopy+0x1a/0x20 [ 32.155044][ C0] _copy_to_user+0x1e/0x90 [ 32.159462][ C0] __se_sys_rt_sigprocmask+0x207/0x290 [ 32.164955][ C0] ? __x64_sys_rt_sigprocmask+0xb0/0xb0 [ 32.170520][ C0] ? ksys_read+0x1eb/0x260 [ 32.174930][ C0] ? __cfi_ksys_read+0x10/0x10 [ 32.179691][ C0] __x64_sys_rt_sigprocmask+0x9b/0xb0 [ 32.185067][ C0] x64_sys_call+0x85c/0x9a0 [ 32.189569][ C0] do_syscall_64+0x4c/0xa0 [ 32.193984][ C0] ? clear_bhb_loop+0x30/0x80 [ 32.198655][ C0] ? clear_bhb_loop+0x30/0x80 [ 32.203327][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.209236][ C0] RIP: 0033:0x7fb5d4cb0f60 [ 32.213680][ C0] Code: 48 85 f6 74 15 48 b9 00 00 00 80 01 00 00 00 48 8b 06 48 85 c8 75 33 48 89 f0 48 89 c6 41 ba 08 00 00 00 b8 0e 00 00 00 0f 05 <89> c2 f7 da 3d 00 f0 ff ff b8 00 00 00 00 0f 47 c2 48 83 c4 10 c3 [ 32.233280][ C0] RSP: 002b:00007fff9272c1b8 EFLAGS: 00000246 ORIG_RAX: 000000000000000e [ 32.241705][ C0] RAX: ffffffffffffffda RBX: 00005611e9d173e0 RCX: 00007fb5d4cb0f60 [ 32.249668][ C0] RDX: 00007fff9272c2c0 RSI: 00007fff9272c240 RDI: 0000000000000000 [ 32.257634][ C0] RBP: 00007fff9272c230 R08: 0000000000000000 R09: 0000000000000000 [ 32.265595][ C0] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 32.273564][ C0] R13: 00007fff9272c2c0 R14: 0000000000000000 R15: 0000000000000004 [ 32.281551][ C0] [ 32.284599][ C0] Modules linked in: [ 32.288513][ C0] ---[ end trace 0000000000000000 ]--- [ 32.293972][ C0] RIP: 0010:saitek_event+0x51/0x2c0 [ 32.299193][ C0] Code: be fd 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 dd a7 03 fe 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 c0 a7 03 fe 49 8b 06 48 89 45 d0 [ 32.318810][ C0] RSP: 0018:ffffc90000007768 EFLAGS: 00010006 [ 32.324892][ C0] RAX: 0000000000000003 RBX: ffff88810f127a88 RCX: ffff88810f9e3cc0 [ 32.332877][ C0] RDX: 0000000000000100 RSI: ffff88810f127a00 RDI: ffff88810b838000 [ 32.340949][ C0] RBP: ffffc90000007798 R08: 0000000000000000 R09: ffff88810f127aa4 [ 32.348949][ C0] R10: 0000000000000000 R11: ffffed1021e24f55 R12: dffffc0000000000 [ 32.356934][ C0] R13: 000000000000008d R14: 0000000000000018 R15: ffff88810b838000 [ 32.364921][ C0] FS: 00007fb5d53ab300(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.373855][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.380448][ C0] CR2: 00007fd5eef60bb0 CR3: 0000000123358000 CR4: 00000000003506b0 [ 32.388438][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.396457][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.405246][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 32.413031][ C0] Kernel Offset: disabled [ 32.417378][ C0] Rebooting in 86400 seconds..