ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor742706704 <...> Warning: Permanently added '10.128.1.48' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor742706704", ["ci2-android-5-15/syz-executor742706704"], 0x7fffa88b97b0 /* 10 vars */) = 0 brk(NULL) = 0x55557d3f9000 brk(0x55557d3f9d40) = 0x55557d3f9d40 arch_prctl(ARCH_SET_FS, 0x55557d3f93c0) = 0 set_tid_address(0x55557d3f9690) = 304 set_robust_list(0x55557d3f96a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor742706704", 4096) = 44 getrandom("\xce\x6f\x3d\xeb\xaf\x74\x3a\x25", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557d3f9d40 brk(0x55557d41ad40) = 0x55557d41ad40 brk(0x55557d41b000) = 0x55557d41b000 mprotect(0x7fa4ebdcf000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa4e3923000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7fa4e3923000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 25.748200][ T30] audit: type=1400 audit(1786037786.907:64): avc: denied { execmem } for pid=304 comm="syz-executor742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.769273][ T30] audit: type=1400 audit(1786037786.927:65): avc: denied { read write } for pid=304 comm="syz-executor742" name="loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 25.770888][ T304] loop0: detected capacity change from 0 to 512 [ 25.794766][ T30] audit: type=1400 audit(1786037786.927:66): avc: denied { open } for pid=304 comm="syz-executor742" path="/dev/loop0" dev="devtmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 close(4) = 0 mkdir("./file2", 0777) = 0 [ 25.823866][ T30] audit: type=1400 audit(1786037786.927:67): avc: denied { ioctl } for pid=304 comm="syz-executor742" path="/dev/loop0" dev="devtmpfs" ino=116 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.857917][ T30] audit: type=1400 audit(1786037787.017:68): avc: denied { mounton } for pid=304 comm="syz-executor742" path="/root/file2" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 25.940117][ T304] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 25.953427][ T304] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 25.963908][ T304] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 25.972525][ T304] EXT4-fs (loop0): orphan cleanup on readonly fs [ 25.979200][ T304] EXT4-fs (loop0): 1 truncate cleaned up mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "block_validity,,errors=continue") = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 chdir("./file0") = 0 openat(AT_FDCWD, ".", O_RDONLY) = 4 lseek(4, -4, SEEK_END) = 56 [ 25.984830][ T304] EXT4-fs (loop0): mounted filesystem without journal. Opts: block_validity,,errors=continue. Quota mode: none. [ 25.996933][ T30] audit: type=1400 audit(1786037787.157:69): avc: denied { mount } for pid=304 comm="syz-executor742" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.000021][ T304] ================================================================== [ 26.026811][ T304] BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry+0x7e3/0x990 [ 26.035093][ T304] Read of size 2 at addr ffff8881013e563c by task syz-executor742/304 [ 26.043259][ T304] [ 26.045585][ T304] CPU: 1 PID: 304 Comm: syz-executor742 Not tainted syzkaller #0 [ 26.053298][ T304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.063373][ T304] Call Trace: [ 26.066661][ T304] [ 26.069581][ T304] __dump_stack+0x21/0x30 [ 26.073900][ T304] dump_stack_lvl+0x110/0x170 [ 26.078579][ T304] ? show_regs_print_info+0x20/0x20 [ 26.083781][ T304] ? load_image+0x3f0/0x3f0 [ 26.088281][ T304] print_address_description+0x7f/0x2c0 [ 26.093832][ T304] ? __ext4_check_dir_entry+0x7e3/0x990 [ 26.099476][ T304] kasan_report+0x10f/0x150 [ 26.103975][ T304] ? __ext4_check_dir_entry+0x7e3/0x990 [ 26.109513][ T304] __asan_report_load2_noabort+0x14/0x20 [ 26.115150][ T304] __ext4_check_dir_entry+0x7e3/0x990 [ 26.120521][ T304] ext4_read_inline_dir+0x851/0xd00 [ 26.125714][ T304] ? ext4_inlinedir_to_tree+0xfa0/0xfa0 [ 26.131253][ T304] ext4_readdir+0x3af/0x3aa0 [ 26.135845][ T304] ? _raw_spin_unlock+0x4d/0x70 [ 26.140693][ T304] ? finish_task_switch+0x16b/0x790 [ 26.145886][ T304] ? switch_mm_irqs_off+0x730/0x960 [ 26.151077][ T304] ? __kasan_check_write+0x14/0x20 [ 26.156189][ T304] ? rwsem_read_trylock+0x2af/0x640 [ 26.161374][ T304] ? ext4_dir_llseek+0x4b0/0x4b0 [ 26.166302][ T304] ? downgrade_write+0x440/0x440 [ 26.171240][ T304] ? __kasan_check_write+0x14/0x20 [ 26.176342][ T304] ? down_read_killable+0xc1/0x110 [ 26.181453][ T304] ? down_read_interruptible+0x110/0x110 [ 26.187094][ T304] ? security_file_permission+0x83/0xa0 [ 26.192629][ T304] iterate_dir+0x25c/0x600 [ 26.197038][ T304] ? ext4_dir_llseek+0x4b0/0x4b0 [ 26.201968][ T304] __se_sys_getdents+0xf2/0x250 [ 26.206810][ T304] ? __x64_sys_getdents+0x90/0x90 [ 26.211830][ T304] ? fillonedir+0x430/0x430 [ 26.216322][ T304] ? __kasan_check_write+0x14/0x20 [ 26.221427][ T304] ? switch_fpu_return+0x15d/0x2c0 [ 26.226538][ T304] __x64_sys_getdents+0x7b/0x90 [ 26.231379][ T304] x64_sys_call+0xb4/0x9a0 [ 26.235785][ T304] do_syscall_64+0x4c/0xa0 [ 26.240193][ T304] ? clear_bhb_loop+0x50/0xa0 [ 26.244867][ T304] ? clear_bhb_loop+0x50/0xa0 [ 26.249538][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.255420][ T304] RIP: 0033:0x7fa4ebd462c9 [ 26.259829][ T304] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.279428][ T304] RSP: 002b:00007ffd15f22fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 26.287835][ T304] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fa4ebd462c9 [ 26.295793][ T304] RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004 [ 26.303754][ T304] RBP: 0000000000000001 R08: 00007ffd15f23118 R09: 00007ffd15f23118 [ 26.311886][ T304] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd15f23108 [ 26.319877][ T304] R13: 0000000000000002 R14: 00007fa4ebdcfc80 R15: 0000000000000002 [ 26.327854][ T304] [ 26.330867][ T304] [ 26.333180][ T304] Allocated by task 304: [ 26.337420][ T304] __kasan_kmalloc+0xd4/0x100 [ 26.342093][ T304] __kmalloc+0x13d/0x2c0 [ 26.346324][ T304] ext4_read_inline_dir+0x24d/0xd00 [ 26.351540][ T304] ext4_readdir+0x3af/0x3aa0 [ 26.356118][ T304] iterate_dir+0x25c/0x600 [ 26.360516][ T304] __se_sys_getdents+0xf2/0x250 [ 26.365348][ T304] __x64_sys_getdents+0x7b/0x90 [ 26.370192][ T304] x64_sys_call+0xb4/0x9a0 [ 26.374608][ T304] do_syscall_64+0x4c/0xa0 [ 26.379015][ T304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.384902][ T304] [ 26.387214][ T304] The buggy address belongs to the object at ffff8881013e5600 [ 26.387214][ T304] which belongs to the cache kmalloc-64 of size 64 [ 26.401089][ T304] The buggy address is located 60 bytes inside of [ 26.401089][ T304] 64-byte region [ffff8881013e5600, ffff8881013e5640) [ 26.414176][ T304] The buggy address belongs to the page: [ 26.419804][ T304] page:ffffea000404f940 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1013e5 [ 26.430032][ T304] flags: 0x4000000000000200(slab|zone=1) [ 26.435677][ T304] raw: 4000000000000200 ffffea000406e440 0000001000000010 ffff888100042780 [ 26.444256][ T304] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 26.452825][ T304] page dumped because: kasan: bad access detected [ 26.459220][ T304] page_owner tracks the page as allocated [ 26.464929][ T304] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2361577215, free_ts 2360826745 [ 26.480541][ T304] post_alloc_hook+0x192/0x1b0 [ 26.485294][ T304] prep_new_page+0x1c/0x110 [ 26.489794][ T304] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.495345][ T304] __alloc_pages+0x1a2/0x460 [ 26.499951][ T304] new_slab+0xa0/0x4d0 [ 26.504009][ T304] ___slab_alloc+0x3ac/0x840 [ 26.508586][ T304] __slab_alloc+0x49/0x90 [ 26.512905][ T304] kmem_cache_alloc_trace+0x146/0x270 [ 26.518277][ T304] __get_vm_area_node+0x11d/0x350 [ 26.523312][ T304] __vmalloc_node_range+0xe8/0xad0 [ 26.528414][ T304] vzalloc+0x78/0x90 [ 26.532312][ T304] bdev_disk_changed+0x5d8/0x1460 [ 26.537339][ T304] blkdev_get_whole+0x36f/0x410 [ 26.542194][ T304] blkdev_get_by_dev+0x286/0x990 [ 26.547124][ T304] disk_scan_partitions+0x191/0x250 [ 26.552329][ T304] device_add_disk+0x968/0xc40 [ 26.557100][ T304] page last free stack trace: [ 26.561764][ T304] free_unref_page_prepare+0x5fa/0x600 [ 26.567221][ T304] free_unref_page+0xae/0x540 [ 26.571897][ T304] __free_pages+0x6c/0x100 [ 26.576309][ T304] __vunmap+0x801/0x980 [ 26.580459][ T304] vfree+0x8b/0xc0 [ 26.584172][ T304] bdev_disk_changed+0x9b9/0x1460 [ 26.589201][ T304] blkdev_get_whole+0x36f/0x410 [ 26.594046][ T304] blkdev_get_by_dev+0x286/0x990 [ 26.598974][ T304] disk_scan_partitions+0x191/0x250 [ 26.604164][ T304] device_add_disk+0x968/0xc40 [ 26.608919][ T304] brd_alloc+0x528/0x760 [ 26.613166][ T304] brd_init+0x12b/0x1b0 [ 26.617573][ T304] do_one_initcall+0x1fc/0x5a0 [ 26.622368][ T304] do_initcall_level+0x174/0x2e0 [ 26.627304][ T304] do_initcalls+0x50/0xa0 [ 26.631623][ T304] do_basic_setup+0x81/0x90 [ 26.636134][ T304] [ 26.638461][ T304] Memory state around the buggy address: [ 26.644082][ T304] ffff8881013e5500: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 26.652147][ T304] ffff8881013e5580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.660199][ T304] >ffff8881013e5600: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc [ 26.668248][ T304] ^ [ 26.674327][ T304] ffff8881013e5680: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 26.682392][ T304] ffff8881013e5700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc getdents(4, NULL /* 0 entries */, 84) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 26.690442][ T304] ==============