ci2-android-6-12-rust/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-12-rust/syz-executor1901808753 <...> Warning: Permanently added '10.128.0.152' (ED25519) to the list of known hosts. execve("ci2-android-6-12-rust/syz-executor1901808753", ["ci2-android-6-12-rust/syz-executor1901808753"], 0x7ffc74de0250 /* 10 vars */) = 0 brk(NULL) = 0x5555774a5000 brk(0x5555774a5d40) = 0x5555774a5d40 arch_prctl(ARCH_SET_FS, 0x5555774a53c0) = 0 set_tid_address(0x5555774a5690) = 312 set_robust_list(0x5555774a56a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-12-rust/syz-executor1901808753", 4096) = 50 getrandom("\x61\xba\xb9\x8b\x3e\x1d\xf4\x96", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555774a5d40 brk(0x5555774c6d40) = 0x5555774c6d40 brk(0x5555774c7000) = 0x5555774c7000 mprotect(0x7f16bf67a000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 executing program futex(0x7f16bf680b4c, FUTEX_WAKE_PRIVATE, 1000000) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f16bf5e6ed0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f16bf5d97a0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f16bf57e000 mprotect(0x7f16bf57f000, 131072, PROT_READ|PROT_WRITE) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f16bf59e990, parent_tid=0x7f16bf59e990, exit_signal=0, stack=0x7f16bf57e000, stack_size=0x20300, tls=0x7f16bf59e6c0}ci2-android-6-12-rust/strace-static-x86_64: Process 313 attached [pid 313] set_robust_list(0x7f16bf59e9a0, 24 [pid 312] <... clone3 resumed> => {parent_tid=[313]}, 88) = 313 [pid 312] rt_sigprocmask(SIG_SETMASK, [] [pid 313] <... set_robust_list resumed>) = 0 [pid 312] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [] [pid 312] futex(0x7f16bf680b48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 313] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 312] futex(0x7f16bf680b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=3, tv_nsec=50000000} [pid 313] openat(AT_FDCWD, "/dev/raw-gadget", O_RDWR) = 3 [pid 313] ioctl(3, USB_RAW_IOCTL_INIT, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, UI_DEV_CREATE or USB_RAW_IOCTL_RUN, 0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [ 29.639434][ T36] audit: type=1400 audit(1792382975.590:64): avc: denied { execmem } for pid=312 comm="syz-executor190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 29.660572][ T36] audit: type=1400 audit(1792382975.590:65): avc: denied { read write } for pid=312 comm="syz-executor190" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [ 29.685430][ T36] audit: type=1400 audit(1792382975.590:66): avc: denied { open } for pid=312 comm="syz-executor190" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.710868][ T36] audit: type=1400 audit(1792382975.590:67): avc: denied { ioctl } for pid=312 comm="syz-executor190" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7f16bf59c1c0) = 18 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [ 29.876627][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7f16bf59c1c0) = 18 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7f16bf59c1c0) = 9 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7f16bf59c1c0) = 36 [ 30.028468][ T10] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.039586][ T10] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 30.052694][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 30.059528][ T10] usb 1-1: New USB device found, idVendor=06a3, idProduct=0cd0, bcdDevice= 0.00 [ 30.068785][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1d0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_VBUS_DRAW, 0x2) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_CONFIGURE, 0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP_ENABLE, 0x7f16bf680c8c) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7f16bf59c1c0) = 0 [ 30.078540][ T10] usb 1-1: config 0 descriptor?? [pid 313] futex(0x7f16bf680b4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f16bf680b48, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 313] <... futex resumed>) = 1 [pid 312] futex(0x7f16bf680b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=350000000} [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1f0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_READ, 0x7f16bf59c1e0) = 0 [pid 313] futex(0x7f16bf680b4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = 1 [pid 312] futex(0x7f16bf680b48, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] futex(0x7f16bf680b48, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 312] futex(0x7f16bf680b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=350000000} [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1f0) = 0 [pid 313] ioctl(3, USB_RAW_IOCTL_EP0_WRITE, 0x7f16bf59c1e0) = 24 [ 30.489052][ T10] saitek 0003:06A3:0CD0.0001: No inputs registered, leaving [ 30.498964][ T10] saitek 0003:06A3:0CD0.0001: hiddev96,hidraw0: USB HID v0.00 Device [HID 06a3:0cd0] on usb-dummy_hcd.0-1/input0 [pid 313] futex(0x7f16bf680b4c, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = 1 [pid 312] futex(0x7f16bf680b48, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] futex(0x7f16bf680b48, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 312] futex(0x7f16bf680b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=350000000} [pid 313] ioctl(3, USB_RAW_IOCTL_EVENT_FETCH, 0x7f16bf59d1f0 [pid 312] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 312] futex(0x7f16bf680b4c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 312] futex(0x7f16bf680b5c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f16bf55d000 [pid 312] mprotect(0x7f16bf55e000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 312] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 312] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f16bf57d990, parent_tid=0x7f16bf57d990, exit_signal=0, stack=0x7f16bf55d000, stack_size=0x20300, tls=0x7f16bf57d6c0}ci2-android-6-12-rust/strace-static-x86_64: Process 317 attached => {parent_tid=[317]}, 88) = 317 [pid 317] set_robust_list(0x7f16bf57d9a0, 24 [pid 312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] <... set_robust_list resumed>) = 0 [pid 312] futex(0x7f16bf680b58, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] rt_sigprocmask(SIG_SETMASK, [] [pid 312] <... futex resumed>) = 0 [pid 317] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 312] futex(0x7f16bf680b5c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=100000000} [pid 317] openat(AT_FDCWD, "/dev/usb/hiddev0", O_RDONLY|O_EXCL|O_NOFOLLOW|O_NOATIME|FASYNC) = 4 [pid 317] futex(0x7f16bf680b5c, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 317] <... futex resumed>) = 1 [pid 312] futex(0x7f16bf680b58, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] ioctl(4, HIDIOCGUCODE, 0 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f16bf680b5c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... ioctl resumed>) = 0 [ 31.097517][ C1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.110297][ C1] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 31.119038][ C1] CPU: 1 UID: 0 PID: 309 Comm: sshd-session Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 31.131142][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.141192][ C1] RIP: 0010:saitek_event+0x55/0x2d0 [ 31.146431][ C1] Code: 5c fd 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 a9 89 b5 fd 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 8c 89 b5 fd 49 8b 06 48 89 45 d0 [ 31.166293][ C1] RSP: 0018:ffffc900002306e0 EFLAGS: 00010006 [ 31.172399][ C1] RAX: 0000000000000003 RBX: ffff8881076e5e88 RCX: ffff888105f00000 [ 31.180374][ C1] RDX: 0000000000000100 RSI: ffff8881076e5e00 RDI: ffff8881026ec000 [ 31.188347][ C1] RBP: ffffc90000230710 R08: 0000000000000000 R09: 0000000000000004 [ 31.196825][ C1] R10: 0000000000000000 R11: ffffffff842d3850 R12: dffffc0000000000 [ 31.205081][ C1] R13: 000000000000008d R14: 0000000000000018 R15: ffff8881026ec000 [ 31.213257][ C1] FS: 00007fb6db742300(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 31.222290][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.228899][ C1] CR2: 00007f16bf57cbb0 CR3: 0000000102ff8000 CR4: 00000000003526b0 [ 31.236974][ C1] Call Trace: [ 31.240361][ C1] [ 31.243203][ C1] ? hid_process_event+0x161/0x5f0 [ 31.248321][ C1] ? __cfi_saitek_event+0x10/0x10 [ 31.253358][ C1] hid_process_event+0x410/0x5f0 [ 31.258311][ C1] ? hidraw_report_event+0x40c/0x430 [ 31.263623][ C1] __hid_report_raw_event+0x100b/0x18e0 [ 31.269192][ C1] __hid_input_report+0x444/0x4d0 [ 31.274214][ C1] ? __cfi_saitek_raw_event+0x10/0x10 [ 31.279690][ C1] hid_safe_input_report+0x42/0x60 [ 31.284890][ C1] hid_ctrl+0x200/0x590 [ 31.289223][ C1] ? kcov_remote_start+0xfa/0x3c0 [ 31.294226][ C1] ? _raw_spin_lock+0x92/0x120 [ 31.298965][ C1] __usb_hcd_giveback_urb+0x36e/0x530 [ 31.304340][ C1] usb_hcd_giveback_urb+0x12b/0x400 [ 31.309563][ C1] dummy_timer+0xa3f/0x4900 [ 31.314055][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 31.319201][ C1] ? _raw_spin_lock_irq+0x93/0x120 [ 31.324318][ C1] ? timerqueue_del+0xd7/0x130 [ 31.329100][ C1] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 31.334665][ C1] ? __cfi_dummy_timer+0x10/0x10 [ 31.339614][ C1] __hrtimer_run_queues+0x3ab/0x8e0 [ 31.344838][ C1] ? hrtimer_interrupt+0xf30/0xf30 [ 31.349942][ C1] ? read_tsc+0xd/0x20 [ 31.354017][ C1] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 31.360101][ C1] hrtimer_run_softirq+0x159/0x560 [ 31.365275][ C1] ? irqtime_account_irq+0x51/0x1c0 [ 31.370492][ C1] handle_softirqs+0x1aa/0x5b0 [ 31.375238][ C1] __irq_exit_rcu+0x47/0xb0 [ 31.379837][ C1] irq_exit_rcu+0xd/0x30 [ 31.384090][ C1] sysvec_apic_timer_interrupt+0x82/0x90 [ 31.389738][ C1] [ 31.392655][ C1] [ 31.395654][ C1] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 31.401659][ C1] RIP: 0010:do_syscall_64+0x23/0xf0 [ 31.406936][ C1] Code: 90 90 90 90 90 90 90 66 0f 1f 00 55 48 89 e5 41 56 53 48 83 e4 f0 48 89 e3 49 89 fe 0f 1f 44 00 00 fb 65 48 8b 05 8d d4 5c 7a <48> 8b 50 08 f6 c2 3f 74 0e 48 63 f6 4c 89 f7 e8 09 63 cd fb 48 89 [ 31.426570][ C1] RSP: 0018:ffffc9000115ff30 EFLAGS: 00000286 [ 31.432627][ C1] RAX: ffff888105f00000 RBX: ffffc9000115ff30 RCX: 0000000000000000 [ 31.440931][ C1] RDX: 0000000000000000 RSI: 000000000000000e RDI: ffffc9000115ff58 [ 31.449492][ C1] RBP: ffffc9000115ff48 R08: 0000000000000000 R09: 0000000000000000 [ 31.457551][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 31.465535][ C1] R13: 0000000000000000 R14: ffffc9000115ff58 R15: 0000000000000000 [ 31.474291][ C1] ? clear_bhb_loop+0x50/0xa0 [ 31.479150][ C1] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.485177][ C1] RIP: 0033:0x7fb6db0b0f60 [ 31.489624][ C1] Code: 48 85 f6 74 15 48 b9 00 00 00 80 01 00 00 00 48 8b 06 48 85 c8 75 33 48 89 f0 48 89 c6 41 ba 08 00 00 00 b8 0e 00 00 00 0f 05 <89> c2 f7 da 3d 00 f0 ff ff b8 00 00 00 00 0f 47 c2 48 83 c4 10 c3 [ 31.509228][ C1] RSP: 002b:00007fffafd3d368 EFLAGS: 00000246 ORIG_RAX: 000000000000000e [ 31.518421][ C1] RAX: ffffffffffffffda RBX: 0000563d712bd3e0 RCX: 00007fb6db0b0f60 [ 31.526571][ C1] RDX: 00007fffafd3d470 RSI: 00007fffafd3d3f0 RDI: 0000000000000000 [ 31.534625][ C1] RBP: 00007fffafd3d3e0 R08: 0000000000000000 R09: 0000000000000000 [ 31.542588][ C1] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 31.550548][ C1] R13: 00007fffafd3d470 R14: 0000000000000000 R15: 0000000000000004 [ 31.559298][ C1] [ 31.562310][ C1] Modules linked in: [ 31.566821][ C1] ---[ end trace 0000000000000000 ]--- [ 31.572295][ C1] RIP: 0010:saitek_event+0x55/0x2d0 [ 31.577594][ C1] Code: 5c fd 49 83 c6 78 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 a9 89 b5 fd 4d 8b 36 49 83 c6 18 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 8c 89 b5 fd 49 8b 06 48 89 45 d0 [ 31.597411][ C1] RSP: 0018:ffffc900002306e0 EFLAGS: 00010006 [ 31.603752][ C1] RAX: 0000000000000003 RBX: ffff8881076e5e88 RCX: ffff888105f00000 [ 31.612162][ C1] RDX: 0000000000000100 RSI: ffff8881076e5e00 RDI: ffff8881026ec000 [ 31.620258][ C1] RBP: ffffc90000230710 R08: 0000000000000000 R09: 0000000000000004 [ 31.628230][ C1] R10: 0000000000000000 R11: ffffffff842d3850 R12: dffffc0000000000 [ 31.636220][ C1] R13: 000000000000008d R14: 0000000000000018 R15: ffff8881026ec000 [ 31.644220][ C1] FS: 00007fb6db742300(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 31.653152][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.659722][ C1] CR2: 00007f16bf57cbb0 CR3: 0000000102ff8000 CR4: 00000000003526b0 [ 31.667699][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 31.675581][ C1] Kernel Offset: disabled [ 31.679902][ C1] Rebooting in 86400 seconds..