ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor2917767624 <...> Warning: Permanently added '10.128.1.105' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor2917767624", ["ci2-android-5-10/syz-executor2917767624"], 0x7ffcfd5a4f90 /* 10 vars */) = 0 brk(NULL) = 0x5555751f3000 brk(0x5555751f3d40) = 0x5555751f3d40 arch_prctl(ARCH_SET_FS, 0x5555751f33c0) = 0 set_tid_address(0x5555751f3690) = 297 set_robust_list(0x5555751f36a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor2917767624", 4096) = 45 getrandom("\x54\xd6\xd3\x28\x4e\x85\x8f\x75", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555751f3d40 brk(0x555575214d40) = 0x555575214d40 brk(0x555575215000) = 0x555575215000 mprotect(0x7fc93a2d4000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 socket(AF_PPPOX, SOCK_STREAM, 1) = 3 socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP) = 4 connect(3, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00\x02\x00\x00\x00\xac\x14\x14\x20\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"}, 46) = 0 ioctl(3, SIOCGIFINDEX, NULL) = -1 EFAULT (Bad address) exit_group(0) = ? [ 87.282922][ T24] audit: type=1400 audit(1789829051.950:64): avc: denied { execmem } for pid=297 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 87.302786][ T24] audit: type=1400 audit(1789829051.970:65): avc: denied { create } for pid=297 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 87.323106][ T24] audit: type=1400 audit(1789829051.970:66): avc: denied { connect } for pid=297 comm="syz-executor291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 87.343215][ T24] audit: type=1400 audit(1789829052.000:67): avc: denied { ioctl } for pid=297 comm="syz-executor291" path="socket:[14513]" dev="sockfs" ino=14513 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 87.368694][ T297] ================================================================== [ 87.377010][ T297] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 87.383836][ T297] Write of size 8 at addr ffff88810bb7f150 by task syz-executor291/297 [ 87.392471][ T297] [ 87.394831][ T297] CPU: 1 PID: 297 Comm: syz-executor291 Not tainted syzkaller #0 [ 87.402538][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.412603][ T297] Call Trace: [ 87.415895][ T297] __dump_stack+0x21/0x24 [ 87.420225][ T297] dump_stack_lvl+0x1a7/0x208 [ 87.424922][ T297] ? show_regs_print_info+0x18/0x18 [ 87.430117][ T297] ? thaw_kernel_threads+0x220/0x220 [ 87.435399][ T297] print_address_description+0x7f/0x2c0 [ 87.440943][ T297] ? mutex_lock+0x85/0xf0 [ 87.445374][ T297] kasan_report+0x100/0x140 [ 87.449890][ T297] ? mutex_lock+0x85/0xf0 [ 87.454223][ T297] kasan_check_range+0x249/0x2a0 [ 87.459154][ T297] __kasan_check_write+0x14/0x20 [ 87.464129][ T297] mutex_lock+0x85/0xf0 [ 87.468299][ T297] ? mutex_trylock+0xb0/0xb0 [ 87.472900][ T297] ? l2tp_session_put+0xb2/0x1a0 [ 87.477841][ T297] ? l2tp_session_delete+0x3a9/0x4a0 [ 87.483132][ T297] pppol2tp_release+0x178/0x2b0 [ 87.487991][ T297] sock_close+0xb8/0x200 [ 87.492236][ T297] ? sock_mmap+0xa0/0xa0 [ 87.496490][ T297] __fput+0x2dc/0x730 [ 87.500658][ T297] ? _raw_spin_lock+0x94/0xf0 [ 87.505342][ T297] ____fput+0x15/0x20 [ 87.509373][ T297] task_work_run+0x127/0x190 [ 87.514100][ T297] do_exit+0xa7c/0x24e0 [ 87.518260][ T297] ? ptrace_notify+0x1ea/0x270 [ 87.523041][ T297] ? put_task_struct+0x90/0x90 [ 87.527828][ T297] ? do_notify_parent+0x810/0x810 [ 87.532870][ T297] do_group_exit+0x149/0x310 [ 87.537459][ T297] __x64_sys_exit_group+0x3f/0x40 [ 87.542498][ T297] do_syscall_64+0x31/0x40 [ 87.546929][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 87.552818][ T297] RIP: 0033:0x7fc93a243305 [ 87.557488][ T297] Code: Unable to access opcode bytes at RIP 0x7fc93a2432db. [ 87.564991][ T297] RSP: 002b:00007ffc786ac228 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 87.573417][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fc93a243305 [ 87.581449][ T297] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 87.589459][ T297] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffc786ac3b8 [ 87.597463][ T297] R10: 00007ffc786ac3b8 R11: 0000000000000206 R12: 0000000000000000 [ 87.605439][ T297] R13: 00007fc93a2d9110 R14: 00007fc93a2db3a8 R15: 00007fc93a2db3c0 [ 87.613427][ T297] [ 87.615793][ T297] Allocated by task 297: [ 87.620135][ T297] __kasan_kmalloc+0xd4/0x100 [ 87.624808][ T297] __kmalloc+0x19f/0x330 [ 87.629048][ T297] l2tp_session_create+0x39/0xb60 [ 87.634139][ T297] pppol2tp_connect+0xbf5/0x1640 [ 87.639137][ T297] __sys_connect+0x3ce/0x450 [ 87.643729][ T297] __x64_sys_connect+0x7a/0x90 [ 87.648499][ T297] do_syscall_64+0x31/0x40 [ 87.652916][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 87.658803][ T297] [ 87.661132][ T297] Freed by task 297: [ 87.665024][ T297] kasan_set_track+0x4a/0x70 [ 87.669735][ T297] kasan_set_free_info+0x23/0x40 [ 87.674660][ T297] ____kasan_slab_free+0x125/0x160 [ 87.679761][ T297] __kasan_slab_free+0x11/0x20 [ 87.684517][ T297] slab_free_freelist_hook+0xc5/0x190 [ 87.689877][ T297] kfree+0xc0/0x270 [ 87.693673][ T297] l2tp_session_put+0xb2/0x1a0 [ 87.698434][ T297] l2tp_session_delete+0x3a9/0x4a0 [ 87.703532][ T297] pppol2tp_release+0x169/0x2b0 [ 87.708374][ T297] sock_close+0xb8/0x200 [ 87.712616][ T297] __fput+0x2dc/0x730 [ 87.716587][ T297] ____fput+0x15/0x20 [ 87.720558][ T297] task_work_run+0x127/0x190 [ 87.725139][ T297] do_exit+0xa7c/0x24e0 [ 87.729286][ T297] do_group_exit+0x149/0x310 [ 87.733883][ T297] __x64_sys_exit_group+0x3f/0x40 [ 87.738984][ T297] do_syscall_64+0x31/0x40 [ 87.743391][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 87.749301][ T297] [ 87.751633][ T297] The buggy address belongs to the object at ffff88810bb7f000 [ 87.751633][ T297] which belongs to the cache kmalloc-512 of size 512 [ 87.765855][ T297] The buggy address is located 336 bytes inside of [ 87.765855][ T297] 512-byte region [ffff88810bb7f000, ffff88810bb7f200) [ 87.779115][ T297] The buggy address belongs to the page: [ 87.784758][ T297] page:ffffea00042edf00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bb7c [ 87.795005][ T297] head:ffffea00042edf00 order:2 compound_mapcount:0 compound_pincount:0 [ 87.803346][ T297] flags: 0x4000000000010200(slab|head) [ 87.808823][ T297] raw: 4000000000010200 ffffea00042eb400 0000000700000007 ffff888100043080 [ 87.817438][ T297] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 87.826029][ T297] page dumped because: kasan: bad access detected [ 87.832576][ T297] page_owner tracks the page as allocated [ 87.838332][ T297] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 3376576445, free_ts 0 [ 87.854667][ T297] prep_new_page+0x176/0x190 [ 87.859254][ T297] get_page_from_freelist+0x225f/0x23f0 [ 87.864800][ T297] __alloc_pages_nodemask+0x29a/0x640 [ 87.870164][ T297] new_slab+0x84/0x3f0 [ 87.874236][ T297] ___slab_alloc+0x2f8/0x4c0 [ 87.878828][ T297] __slab_alloc+0x63/0xa0 [ 87.883178][ T297] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 87.888555][ T297] usb_cache_string+0x64/0x100 [ 87.893312][ T297] usb_new_device+0x2c4/0x1460 [ 87.898071][ T297] register_root_hub+0x243/0x460 [ 87.903006][ T297] usb_add_hcd+0xa64/0xf10 [ 87.907486][ T297] dummy_hcd_probe+0x14a/0x290 [ 87.912249][ T297] platform_drv_probe+0x11b/0x1a0 [ 87.917268][ T297] really_probe+0x3bf/0xa60 [ 87.921772][ T297] driver_probe_device+0xe1/0x190 [ 87.926795][ T297] __device_attach_driver+0x282/0x3f0 [ 87.932164][ T297] page_owner free stack trace missing [ 87.937528][ T297] [ 87.939854][ T297] Memory state around the buggy address: [ 87.945613][ T297] ffff88810bb7f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.953685][ T297] ffff88810bb7f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.961955][ T297] >ffff88810bb7f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.970356][ T297] ^ [ 87.977024][ T297] ffff88810bb7f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +++ exited with 0 +++ [ 87.98509