ci-upstream-kasan-gce/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce/syz-executor2785664265 <...> Warning: Permanently added '10.128.1.15' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce/syz-executor2785664265", ["ci-upstream-kasan-gce/syz-executor2785664265"], 0x7ffdf6b62f60 /* 10 vars */) = 0 brk(NULL) = 0x55556fc09000 brk(0x55556fc09d80) = 0x55556fc09d80 arch_prctl(ARCH_SET_FS, 0x55556fc09400) = 0 set_tid_address(0x55556fc096d0) = 5638 set_robust_list(0x55556fc096e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce/syz-executor2785664265", 4096) = 50 getrandom("\x54\x1d\x39\x89\x2f\x68\xf2\x40", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556fc09d80 brk(0x55556fc2ad80) = 0x55556fc2ad80 brk(0x55556fc2b000) = 0x55556fc2b000 mprotect(0x7f6c0bcc1000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_WRONLY) = 3 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3 write(3, "N", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5638}, {cmd=CTRL_CMD_NEWFAMILY, version=2}, [[{nla_len=13, nla_type=CTRL_ATTR_FAMILY_NAME}, "\x6e\x6c\x38\x30\x32\x31\x35\x34\x00"...], [{nla_len=6, nla_type=CTRL_ATTR_FAMILY_ID}, 0x1e], [{nla_len=8, nla_type=CTRL_ATTR_VERSION}, 1], [{nla_len=8, nla_type=CTRL_ATTR_HDRSIZE}, 0], [{nla_len=8, nla_type=CTRL_ATTR_MAXATTR}, 48], [{nla_len=744, nla_type=CTRL_ATTR_OPS}, [[{nla_len=20, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWFAMILY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELOPS], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DO|GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x3}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_NEWMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x4}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_DELMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x5}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETMCAST_GRP], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x6}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0xd /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x7}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0xe /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x8}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0xc /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x9}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x14 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0xa}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, CTRL_CMD_GETPOLICY], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0xb}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0xb /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0xc}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x10 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0xd}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x11 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0xe}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0xf /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0xf}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x12 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x10}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x13 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x11}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x23 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x12}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x24 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x13}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x26 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x14}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x27 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x15}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x28 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x16}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x29 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x17}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x2a /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x18}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x2b /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x19}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x15 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x1a}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x16 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x1b}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x17 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x1c}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x18 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x1d}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x19 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x1e}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x1a /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x1f}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x1b /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x20}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x1c /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x21}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x1d /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x22}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x1e /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x23}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x1f /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DUMP|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x24}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x20 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]], [{nla_len=20, nla_type=0x25}, [[{nla_len=8, nla_type=CTRL_ATTR_OP_ID}, 0x21 /* CTRL_CMD_??? */], [{nla_len=8, nla_type=CTRL_ATTR_OP_FLAGS}, GENL_ADMIN_PERM|GENL_CMD_CAP_DO|GENL_CMD_CAP_HASPOL]]]]], [{nla_len=52, nla_type=CTRL_ATTR_MCAST_GROUPS}, [[{nla_len=24, nla_type=0x1}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0xc], [{nla_len=11, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x63\x6f\x6e\x66\x69\x67\x00"...]]], [{nla_len=24, nla_type=0x2}, [[{nla_len=8, nla_type=CTRL_ATTR_MCAST_GRP_ID}, 0xd], [{nla_len=9, nla_type=CTRL_ATTR_MCAST_GRP_NAME}, "\x73\x63\x61\x6e\x00"...]]]]]]], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0xb, version=0}, [[{nla_len=8, nla_type=0x3}, "\x0b\x00\x00\x00"], [{nla_len=6, nla_type=0xa}, "\xa0\xaa"]]], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=84, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=8, nla_type=IFLA_NUM_TX_QUEUES}, 2], [{nla_len=8, nla_type=IFLA_NUM_RX_QUEUES}, 2], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 84, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 84 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=84, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {cmd=0xb, version=0}, [[{nla_len=8, nla_type=0x3}, "\x0c\x00\x00\x00"], [{nla_len=6, nla_type=0xa}, "\xa1\xaa"]]], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5638}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 getrandom("\xd0\x16\x98\xfb\xc1\x8e\x45\xcf", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.m0p89A", 0700) = 0 chmod("./syzkaller.m0p89A", 0777) = 0 chdir("./syzkaller.m0p89A") = 0 mkdir("./0", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 5641 ci-upstream-kasan-gce/strace-static-x86_64: Process 5641 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5641] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5641] <... set_robust_list resumed>) = 0 [pid 5641] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5641] chdir("./0") = 0 [pid 5641] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5641] setpgid(0, 0) = 0 [pid 5641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5641] write(3, "1000", 4) = 4 [pid 5641] close(3) = 0 [pid 5641] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5641] write(1, "executing program\n", 18) = 18 [pid 5641] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5641] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5641] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5641] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=30}) = 0 [pid 5641] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5641] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5641] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x1e\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5641] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5641] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5641] write(6, "6", 1) = 1 [ 81.623240][ T5641] FAULT_INJECTION: forcing a failure. [ 81.623240][ T5641] name failslab, interval 1, probability 0, space 0, times 1 [ 81.623284][ T5641] CPU: 0 UID: 0 PID: 5641 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 81.623306][ T5641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 81.623324][ T5641] Call Trace: [ 81.623334][ T5641] [ 81.623347][ T5641] dump_stack_lvl+0xe8/0x150 [ 81.623389][ T5641] should_fail_ex+0x410/0x560 [ 81.623418][ T5641] ? __alloc_empty_sheaf+0x28/0x40 [ 81.623447][ T5641] should_failslab+0xa8/0x100 [ 81.623496][ T5641] ? __alloc_empty_sheaf+0x28/0x40 [ 81.623527][ T5641] __kmalloc_flags_noprof+0x128/0x7a0 [ 81.623570][ T5641] ? __alloc_empty_sheaf+0x28/0x40 [ 81.623611][ T5641] __alloc_empty_sheaf+0x28/0x40 [ 81.623643][ T5641] __pcs_replace_empty_main+0x43b/0x6c0 [ 81.623683][ T5641] kmem_cache_alloc_noprof+0x399/0x600 [ 81.623716][ T5641] ? __nf_conntrack_alloc+0x81/0x3e0 [pid 5641] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5641] exit_group(0) = ? [ 81.623750][ T5641] ? kmem_cache_alloc_noprof+0x156/0x600 [ 81.623784][ T5641] ? __nf_conntrack_alloc+0x81/0x3e0 [ 81.623821][ T5641] __nf_conntrack_alloc+0x81/0x3e0 [ 81.623856][ T5641] init_conntrack+0x22c/0x1080 [ 81.623895][ T5641] ? __pfx_init_conntrack+0x10/0x10 [ 81.623925][ T5641] ? __queue_work+0x1f8/0x10d0 [ 81.623963][ T5641] ? __pfx___nf_conntrack_find_get+0x10/0x10 [ 81.623992][ T5641] ? lockdep_hardirqs_on+0x7b/0x110 [ 81.624016][ T5641] ? __siphash_unaligned+0x25c/0x3e0 [ 81.624051][ T5641] nf_conntrack_in+0xc13/0x1600 [ 81.624103][ T5641] ? __pfx_nf_conntrack_in+0x10/0x10 [ 81.624151][ T5641] ? rcu_read_lock_any_held+0x33/0x90 [ 81.624179][ T5641] ? flow_offload_lookup+0x62d/0x6b0 [ 81.624212][ T5641] ? nf_ct_set+0x6b/0x130 [ 81.624239][ T5641] tcf_ct_act+0x2220/0x4050 [ 81.624288][ T5641] ? __pfx_tcf_ct_act+0x10/0x10 [ 81.624332][ T5641] ? __lock_acquire+0x747/0x2de0 [ 81.624372][ T5641] ? lock_acquire+0x115/0x350 [ 81.624402][ T5641] tcf_action_exec+0x185/0x8d0 [ 81.624435][ T5641] basic_classify+0x1b2/0x2d0 [ 81.624479][ T5641] tcf_classify+0x43d/0x1160 [ 81.624521][ T5641] tc_run+0x42d/0x750 [ 81.624552][ T5641] ? __pfx_tc_run+0x10/0x10 [ 81.624584][ T5641] __netif_receive_skb_core+0x1443/0x30c0 [ 81.624629][ T5641] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 81.624653][ T5641] ? __alloc_skb+0x27a/0x7a0 [ 81.624678][ T5641] ? rcu_is_watching+0x16/0xb0 [ 81.624705][ T5641] ? __alloc_skb+0x27a/0x7a0 [ 81.624728][ T5641] ? trace_kmem_cache_alloc+0x29/0xe0 [ 81.624790][ T5641] ? netif_receive_skb+0x102/0xbf0 [ 81.624807][ T5641] ? netif_receive_skb+0x102/0xbf0 [ 81.624827][ T5641] netif_receive_skb+0x1fe/0xbf0 [ 81.624851][ T5641] ? __pfx_netif_receive_skb+0x10/0x10 [ 81.624876][ T5641] ? tun_rx_batched+0x185/0x790 [ 81.624899][ T5641] tun_rx_batched+0x1de/0x790 [ 81.624926][ T5641] ? __pfx_tun_rx_batched+0x10/0x10 [ 81.624947][ T5641] ? lock_acquire+0x115/0x350 [ 81.624971][ T5641] ? tun_get_user+0x23ba/0x44d0 [ 81.624991][ T5641] ? __local_bh_enable_ip+0xd6/0x140 [ 81.625015][ T5641] ? tun_get_user+0x27b0/0x44d0 [ 81.625037][ T5641] tun_get_user+0x2be0/0x44d0 [ 81.625070][ T5641] ? tun_get_user+0x27b0/0x44d0 [ 81.625089][ T5641] ? aa_file_perm+0x18b/0x15f0 [ 81.625119][ T5641] ? aa_file_perm+0x4ed/0x15f0 [ 81.625144][ T5641] ? __pfx_tun_get_user+0x10/0x10 [ 81.625167][ T5641] ? __lock_acquire+0x747/0x2de0 [ 81.625192][ T5641] ? finish_task_switch+0x40e/0xc60 [ 81.625221][ T5641] ? ref_tracker_alloc+0x341/0x4b0 [ 81.625246][ T5641] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 81.625271][ T5641] ? lock_acquire+0x115/0x350 [ 81.625290][ T5641] ? tun_get+0x1c/0x2f0 [ 81.625319][ T5641] ? tun_get+0x1c/0x2f0 [ 81.625337][ T5641] ? tun_get+0x1c/0x2f0 [ 81.625362][ T5641] tun_chr_write_iter+0x113/0x200 [ 81.625384][ T5641] vfs_write+0x612/0xba0 [ 81.625420][ T5641] ? __pfx_vfs_write+0x10/0x10 [ 81.625458][ T5641] ? _raw_spin_unlock_irq+0x23/0x50 [ 81.625493][ T5641] ksys_write+0x150/0x270 [ 81.625523][ T5641] ? __pfx_ksys_write+0x10/0x10 [ 81.625562][ T5641] do_syscall_64+0x166/0x520 [ 81.625584][ T5641] ? trace_irq_disable+0x3b/0x140 [ 81.625602][ T5641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.625621][ T5641] ? clear_bhb_loop+0x70/0xc0 [ 81.625645][ T5641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.625664][ T5641] RIP: 0033:0x7f6c0bc30879 [ 81.625691][ T5641] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 81.625707][ T5641] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [pid 5641] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5641, si_uid=0, si_status=0, si_utime=0, si_stime=11 /* 0.11 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5649 attached [pid 5649] set_robust_list(0x55556fc096e0, 24) = 0 [ 81.625732][ T5641] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 81.625746][ T5641] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 81.625758][ T5641] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 81.625769][ T5641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 81.625782][ T5641] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.625808][ T5641] [pid 5649] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5649 [pid 5649] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5649] chdir("./1" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5649] <... chdir resumed>) = 0 [pid 5649] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5649] setpgid(0, 0) = 0 [pid 5649] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5649] write(3, "1000", 4) = 4 [pid 5649] close(3) = 0 [pid 5649] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5649] write(1, "executing program\n", 18) = 18 [pid 5649] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5649] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5649] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5649] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=31}) = 0 [pid 5649] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5649] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5649] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5649] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5649] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5649] write(6, "6", 1) = 1 [ 82.252109][ T5649] FAULT_INJECTION: forcing a failure. [ 82.252109][ T5649] name failslab, interval 1, probability 0, space 0, times 0 [ 82.252140][ T5649] CPU: 0 UID: 0 PID: 5649 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 82.252161][ T5649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 82.252172][ T5649] Call Trace: [ 82.252179][ T5649] [ 82.252187][ T5649] dump_stack_lvl+0xe8/0x150 [ 82.252219][ T5649] should_fail_ex+0x410/0x560 [pid 5649] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5649] exit_group(0) = ? [ 82.252243][ T5649] should_failslab+0xa8/0x100 [ 82.252263][ T5649] ? dst_alloc+0x105/0x170 [ 82.252286][ T5649] kmem_cache_alloc_noprof+0xa1/0x600 [ 82.252314][ T5649] ? dst_alloc+0x105/0x170 [ 82.252344][ T5649] ? fib_lookup+0x76/0x440 [ 82.252373][ T5649] dst_alloc+0x105/0x170 [ 82.252403][ T5649] ip_route_input_rcu+0x20ca/0x3190 [ 82.252449][ T5649] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 82.252501][ T5649] ? tc_run+0x50f/0x750 [ 82.252521][ T5649] ? ip_route_input_noref+0xad/0x270 [ 82.252552][ T5649] ip_route_input_noref+0x17c/0x270 [ 82.252585][ T5649] ? __pfx_ip_route_input_noref+0x10/0x10 [ 82.252618][ T5649] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 82.252644][ T5649] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 82.252671][ T5649] ip_rcv_finish_core+0x593/0x1c00 [ 82.252707][ T5649] ip_rcv_finish+0x14c/0x2a0 [ 82.252734][ T5649] NF_HOOK+0x336/0x3c0 [ 82.252759][ T5649] ? __pfx_ip_rcv_finish+0x10/0x10 [ 82.252782][ T5649] ? NF_HOOK+0x9e/0x3c0 [ 82.252805][ T5649] ? __pfx_NF_HOOK+0x10/0x10 [ 82.252829][ T5649] ? __pfx_sock_wfree+0x10/0x10 [ 82.252853][ T5649] ? ip_rcv_core+0x7fa/0xd50 [ 82.252882][ T5649] ? netif_receive_skb+0x102/0xbf0 [ 82.252901][ T5649] ? __pfx_ip_rcv+0x10/0x10 [ 82.252924][ T5649] netif_receive_skb+0x45b/0xbf0 [ 82.252949][ T5649] ? __pfx_netif_receive_skb+0x10/0x10 [ 82.252973][ T5649] ? tun_rx_batched+0x185/0x790 [ 82.252997][ T5649] tun_rx_batched+0x1de/0x790 [ 82.253024][ T5649] ? __pfx_tun_rx_batched+0x10/0x10 [ 82.253045][ T5649] ? lock_acquire+0x115/0x350 [ 82.253071][ T5649] ? tun_get_user+0x23ba/0x44d0 [ 82.253091][ T5649] ? __local_bh_enable_ip+0xd6/0x140 [ 82.253116][ T5649] ? tun_get_user+0x27b0/0x44d0 [ 82.253137][ T5649] tun_get_user+0x2be0/0x44d0 [ 82.253170][ T5649] ? tun_get_user+0x27b0/0x44d0 [ 82.253189][ T5649] ? aa_file_perm+0x18b/0x15f0 [ 82.253219][ T5649] ? aa_file_perm+0x4ed/0x15f0 [ 82.253261][ T5649] ? __pfx_tun_get_user+0x10/0x10 [ 82.253285][ T5649] ? __lock_acquire+0x747/0x2de0 [ 82.253310][ T5649] ? finish_task_switch+0x40e/0xc60 [ 82.253341][ T5649] ? ref_tracker_alloc+0x341/0x4b0 [ 82.253367][ T5649] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 82.253394][ T5649] ? lock_acquire+0x115/0x350 [ 82.253414][ T5649] ? tun_get+0x1c/0x2f0 [ 82.253447][ T5649] ? tun_get+0x1c/0x2f0 [ 82.253467][ T5649] ? tun_get+0x1c/0x2f0 [ 82.253493][ T5649] tun_chr_write_iter+0x113/0x200 [ 82.253517][ T5649] vfs_write+0x612/0xba0 [ 82.253555][ T5649] ? __pfx_vfs_write+0x10/0x10 [ 82.253595][ T5649] ? _raw_spin_unlock_irq+0x23/0x50 [ 82.253625][ T5649] ksys_write+0x150/0x270 [ 82.253657][ T5649] ? __pfx_ksys_write+0x10/0x10 [ 82.253716][ T5649] do_syscall_64+0x166/0x520 [ 82.253739][ T5649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.253772][ T5649] ? clear_bhb_loop+0x70/0xc0 [ 82.253797][ T5649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.253816][ T5649] RIP: 0033:0x7f6c0bc30879 [ 82.253834][ T5649] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [pid 5649] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5649, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 82.253851][ T5649] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 82.253872][ T5649] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 82.253886][ T5649] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 82.253898][ T5649] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 82.253910][ T5649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 82.253922][ T5649] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 82.253952][ T5649] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5660 attached , child_tidptr=0x55556fc096d0) = 5660 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5660] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5660] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5660] chdir("./2") = 0 [pid 5660] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5660] setpgid(0, 0) = 0 [pid 5660] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5660] write(3, "1000", 4) = 4 [pid 5660] close(3) = 0 [pid 5660] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5660] write(1, "executing program\n", 18) = 18 executing program [pid 5660] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5660] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5660] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5660] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=32}) = 0 [pid 5660] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5660] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5660] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x20\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5660] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5660] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5660] write(6, "6", 1) = 1 [pid 5660] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5660] exit_group(0) = ? [ 82.884340][ T5660] FAULT_INJECTION: forcing a failure. [ 82.884340][ T5660] name failslab, interval 1, probability 0, space 0, times 0 [ 82.884371][ T5660] CPU: 1 UID: 0 PID: 5660 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 82.884392][ T5660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 82.884403][ T5660] Call Trace: [ 82.884411][ T5660] [ 82.884419][ T5660] dump_stack_lvl+0xe8/0x150 [ 82.884451][ T5660] should_fail_ex+0x410/0x560 [ 82.884477][ T5660] should_failslab+0xa8/0x100 [ 82.884503][ T5660] __kmalloc_cache_noprof+0xa3/0x600 [ 82.884524][ T5660] ? nf_flow_offload_work_alloc+0x98/0x200 [ 82.884543][ T5660] ? nf_flow_offload_work_alloc+0x98/0x200 [ 82.884568][ T5660] nf_flow_offload_work_alloc+0x98/0x200 [ 82.884591][ T5660] nf_flow_offload_add+0xca/0x240 [ 82.884613][ T5660] flow_offload_add+0x171c/0x24b0 [ 82.884641][ T5660] ? flow_offload_add+0x18c/0x24b0 [ 82.884678][ T5660] tcf_ct_flow_table_process_conn+0x5e7/0x7c0 [ 82.884707][ T5660] tcf_ct_act+0x2a75/0x4050 [ 82.884750][ T5660] ? __pfx_tcf_ct_act+0x10/0x10 [ 82.884790][ T5660] ? is_bpf_text_address+0x26/0x2b0 [ 82.884826][ T5660] ? lock_acquire+0x115/0x350 [ 82.884850][ T5660] tcf_action_exec+0x185/0x8d0 [ 82.884878][ T5660] basic_classify+0x1b2/0x2d0 [ 82.884919][ T5660] tcf_classify+0x43d/0x1160 [ 82.884955][ T5660] tc_run+0x42d/0x750 [ 82.884982][ T5660] ? __pfx_tc_run+0x10/0x10 [ 82.885010][ T5660] __netif_receive_skb_core+0x1443/0x30c0 [ 82.885047][ T5660] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 82.885070][ T5660] ? __alloc_skb+0x27a/0x7a0 [ 82.885091][ T5660] ? rcu_is_watching+0x16/0xb0 [ 82.885113][ T5660] ? __alloc_skb+0x27a/0x7a0 [ 82.885131][ T5660] ? trace_kmem_cache_alloc+0x29/0xe0 [ 82.885175][ T5660] ? netif_receive_skb+0x102/0xbf0 [ 82.885192][ T5660] ? netif_receive_skb+0x102/0xbf0 [ 82.885212][ T5660] netif_receive_skb+0x1fe/0xbf0 [ 82.885235][ T5660] ? __pfx_netif_receive_skb+0x10/0x10 [ 82.885257][ T5660] ? tun_rx_batched+0x185/0x790 [ 82.885279][ T5660] tun_rx_batched+0x1de/0x790 [ 82.885305][ T5660] ? __pfx_tun_rx_batched+0x10/0x10 [ 82.885326][ T5660] ? lock_acquire+0x115/0x350 [ 82.885351][ T5660] ? tun_get_user+0x23ba/0x44d0 [ 82.885370][ T5660] ? __local_bh_enable_ip+0xd6/0x140 [ 82.885393][ T5660] ? tun_get_user+0x27b0/0x44d0 [ 82.885415][ T5660] tun_get_user+0x2be0/0x44d0 [ 82.885448][ T5660] ? tun_get_user+0x27b0/0x44d0 [ 82.885465][ T5660] ? aa_file_perm+0x18b/0x15f0 [ 82.885493][ T5660] ? aa_file_perm+0x4ed/0x15f0 [ 82.885517][ T5660] ? __pfx_tun_get_user+0x10/0x10 [ 82.885539][ T5660] ? __lock_acquire+0x747/0x2de0 [ 82.885563][ T5660] ? finish_task_switch+0x40e/0xc60 [ 82.885591][ T5660] ? ref_tracker_alloc+0x341/0x4b0 [ 82.885616][ T5660] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 82.885640][ T5660] ? lock_acquire+0x115/0x350 [ 82.885659][ T5660] ? tun_get+0x1c/0x2f0 [ 82.885682][ T5660] ? tun_get+0x1c/0x2f0 [ 82.885701][ T5660] ? tun_get+0x1c/0x2f0 [ 82.885724][ T5660] tun_chr_write_iter+0x113/0x200 [ 82.885746][ T5660] vfs_write+0x612/0xba0 [ 82.885782][ T5660] ? __pfx_vfs_write+0x10/0x10 [ 82.885819][ T5660] ? _raw_spin_unlock_irq+0x29/0x50 [ 82.885846][ T5660] ksys_write+0x150/0x270 [ 82.885876][ T5660] ? __pfx_ksys_write+0x10/0x10 [ 82.885920][ T5660] do_syscall_64+0x166/0x520 [ 82.885940][ T5660] ? trace_irq_disable+0x3b/0x140 [ 82.885964][ T5660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.885983][ T5660] ? clear_bhb_loop+0x70/0xc0 [ 82.886026][ T5660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.886048][ T5660] RIP: 0033:0x7f6c0bc30879 [pid 5660] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5660, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [ 82.886069][ T5660] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 82.886087][ T5660] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 82.886111][ T5660] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 82.886127][ T5660] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 [ 82.886141][ T5660] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 82.886154][ T5660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 82.886167][ T5660] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 82.886199][ T5660] rmdir("./2") = 0 mkdir("./3", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5671 attached [pid 5671] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5671] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5671 [pid 5671] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5671] chdir("./3" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5671] <... chdir resumed>) = 0 [pid 5671] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5671] setpgid(0, 0) = 0 [pid 5671] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5671] write(3, "1000", 4) = 4 [pid 5671] close(3) = 0 [pid 5671] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5671] write(1, "executing program\n", 18) = 18 [pid 5671] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5671] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5671] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5671] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=33}) = 0 [pid 5671] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5671] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5671] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x21\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5671] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5671] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5671] write(6, "6", 1) = 1 [ 83.543667][ T5671] FAULT_INJECTION: forcing a failure. [ 83.543667][ T5671] name failslab, interval 1, probability 0, space 0, times 0 [ 83.543698][ T5671] CPU: 0 UID: 0 PID: 5671 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 83.543719][ T5671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.543730][ T5671] Call Trace: [ 83.543738][ T5671] [ 83.543746][ T5671] dump_stack_lvl+0xe8/0x150 [pid 5671] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5671] exit_group(0) = ? [ 83.543794][ T5671] should_fail_ex+0x410/0x560 [ 83.543822][ T5671] should_failslab+0xa8/0x100 [ 83.543847][ T5671] ? dst_alloc+0x105/0x170 [ 83.543877][ T5671] kmem_cache_alloc_noprof+0xa1/0x600 [ 83.543911][ T5671] ? dst_alloc+0x105/0x170 [ 83.543942][ T5671] ? fib_lookup+0x76/0x440 [ 83.543975][ T5671] dst_alloc+0x105/0x170 [ 83.544010][ T5671] ip_route_input_rcu+0x20ca/0x3190 [ 83.544052][ T5671] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 83.544110][ T5671] ? tc_run+0x50f/0x750 [ 83.544131][ T5671] ? ip_route_input_noref+0xad/0x270 [ 83.544165][ T5671] ip_route_input_noref+0x17c/0x270 [ 83.544203][ T5671] ? __pfx_ip_route_input_noref+0x10/0x10 [ 83.544238][ T5671] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 83.544266][ T5671] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 83.544295][ T5671] ip_rcv_finish_core+0x593/0x1c00 [ 83.544334][ T5671] ip_rcv_finish+0x14c/0x2a0 [ 83.544364][ T5671] NF_HOOK+0x336/0x3c0 [ 83.544391][ T5671] ? __pfx_ip_rcv_finish+0x10/0x10 [ 83.544416][ T5671] ? NF_HOOK+0x9e/0x3c0 [ 83.544449][ T5671] ? __pfx_NF_HOOK+0x10/0x10 [ 83.544475][ T5671] ? __pfx_sock_wfree+0x10/0x10 [ 83.544500][ T5671] ? ip_rcv_core+0x7fa/0xd50 [ 83.544532][ T5671] ? netif_receive_skb+0x102/0xbf0 [ 83.544552][ T5671] ? __pfx_ip_rcv+0x10/0x10 [ 83.544577][ T5671] netif_receive_skb+0x45b/0xbf0 [ 83.544603][ T5671] ? __pfx_netif_receive_skb+0x10/0x10 [ 83.544629][ T5671] ? tun_rx_batched+0x185/0x790 [ 83.544653][ T5671] tun_rx_batched+0x1de/0x790 [ 83.544682][ T5671] ? __pfx_tun_rx_batched+0x10/0x10 [ 83.544705][ T5671] ? lock_acquire+0x115/0x350 [ 83.544733][ T5671] ? tun_get_user+0x23ba/0x44d0 [ 83.544754][ T5671] ? __local_bh_enable_ip+0xd6/0x140 [ 83.544780][ T5671] ? tun_get_user+0x27b0/0x44d0 [ 83.544804][ T5671] tun_get_user+0x2be0/0x44d0 [ 83.544838][ T5671] ? tun_get_user+0x27b0/0x44d0 [ 83.544859][ T5671] ? aa_file_perm+0x18b/0x15f0 [ 83.544890][ T5671] ? aa_file_perm+0x4ed/0x15f0 [ 83.544915][ T5671] ? __pfx_tun_get_user+0x10/0x10 [ 83.544939][ T5671] ? __lock_acquire+0x747/0x2de0 [ 83.544966][ T5671] ? finish_task_switch+0x40e/0xc60 [ 83.544996][ T5671] ? ref_tracker_alloc+0x341/0x4b0 [ 83.545023][ T5671] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 83.545050][ T5671] ? lock_acquire+0x115/0x350 [ 83.545080][ T5671] ? tun_get+0x1c/0x2f0 [ 83.545104][ T5671] ? tun_get+0x1c/0x2f0 [ 83.545124][ T5671] ? tun_get+0x1c/0x2f0 [ 83.545147][ T5671] tun_chr_write_iter+0x113/0x200 [ 83.545169][ T5671] vfs_write+0x612/0xba0 [ 83.545205][ T5671] ? __pfx_vfs_write+0x10/0x10 [ 83.545241][ T5671] ? _raw_spin_unlock_irq+0x23/0x50 [ 83.545269][ T5671] ksys_write+0x150/0x270 [pid 5671] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5671, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 [ 83.545299][ T5671] ? __pfx_ksys_write+0x10/0x10 [ 83.545338][ T5671] do_syscall_64+0x166/0x520 [ 83.545359][ T5671] ? trace_irq_disable+0x3b/0x140 [ 83.545378][ T5671] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.545397][ T5671] ? clear_bhb_loop+0x70/0xc0 [ 83.545421][ T5671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.545440][ T5671] RIP: 0033:0x7f6c0bc30879 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 [ 83.545467][ T5671] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 83.545482][ T5671] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 83.545502][ T5671] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 83.545517][ T5671] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 83.545529][ T5671] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 83.545540][ T5671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 mkdir("./4", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 5682 ci-upstream-kasan-gce/strace-static-x86_64: Process 5682 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 83.545551][ T5671] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 83.545579][ T5671] [pid 5682] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5682] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5682] chdir("./4") = 0 [pid 5682] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5682] setpgid(0, 0) = 0 [pid 5682] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5682] write(3, "1000", 4) = 4 [pid 5682] close(3) = 0 [pid 5682] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5682] write(1, "executing program\n", 18) = 18 executing program [pid 5682] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5682] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5682] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5682] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=34}) = 0 [pid 5682] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5682] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5682] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x22\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5682] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5682] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5682] write(6, "6", 1) = 1 [pid 5682] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 84.117697][ T5682] FAULT_INJECTION: forcing a failure. [ 84.117697][ T5682] name failslab, interval 1, probability 0, space 0, times 0 [ 84.117728][ T5682] CPU: 0 UID: 0 PID: 5682 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 84.117749][ T5682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.117760][ T5682] Call Trace: [ 84.117767][ T5682] [ 84.117775][ T5682] dump_stack_lvl+0xe8/0x150 [ 84.117806][ T5682] should_fail_ex+0x410/0x560 [pid 5682] exit_group(0) = ? [ 84.117833][ T5682] should_failslab+0xa8/0x100 [ 84.117866][ T5682] ? dst_alloc+0x105/0x170 [ 84.117894][ T5682] kmem_cache_alloc_noprof+0xa1/0x600 [ 84.117926][ T5682] ? dst_alloc+0x105/0x170 [ 84.117954][ T5682] ? fib_lookup+0x76/0x440 [ 84.118004][ T5682] dst_alloc+0x105/0x170 [ 84.118038][ T5682] ip_route_input_rcu+0x20ca/0x3190 [ 84.118079][ T5682] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 84.118136][ T5682] ? tc_run+0x50f/0x750 [ 84.118157][ T5682] ? ip_route_input_noref+0xad/0x270 [ 84.118190][ T5682] ip_route_input_noref+0x17c/0x270 [ 84.118225][ T5682] ? __pfx_ip_route_input_noref+0x10/0x10 [ 84.118260][ T5682] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 84.118287][ T5682] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 84.118315][ T5682] ip_rcv_finish_core+0x593/0x1c00 [ 84.118354][ T5682] ip_rcv_finish+0x14c/0x2a0 [ 84.118383][ T5682] NF_HOOK+0x336/0x3c0 [ 84.118410][ T5682] ? __pfx_ip_rcv_finish+0x10/0x10 [ 84.118435][ T5682] ? NF_HOOK+0x9e/0x3c0 [ 84.118458][ T5682] ? __pfx_NF_HOOK+0x10/0x10 [ 84.118485][ T5682] ? __pfx_sock_wfree+0x10/0x10 [ 84.118513][ T5682] ? ip_rcv_core+0x7fa/0xd50 [ 84.118545][ T5682] ? netif_receive_skb+0x102/0xbf0 [ 84.118565][ T5682] ? __pfx_ip_rcv+0x10/0x10 [ 84.118589][ T5682] netif_receive_skb+0x45b/0xbf0 [ 84.118615][ T5682] ? __pfx_netif_receive_skb+0x10/0x10 [ 84.118641][ T5682] ? tun_rx_batched+0x185/0x790 [ 84.118665][ T5682] tun_rx_batched+0x1de/0x790 [ 84.118694][ T5682] ? __pfx_tun_rx_batched+0x10/0x10 [ 84.118717][ T5682] ? lock_acquire+0x115/0x350 [ 84.118745][ T5682] ? tun_get_user+0x23ba/0x44d0 [ 84.118766][ T5682] ? __local_bh_enable_ip+0xd6/0x140 [ 84.118792][ T5682] ? tun_get_user+0x27b0/0x44d0 [ 84.118816][ T5682] tun_get_user+0x2be0/0x44d0 [ 84.118856][ T5682] ? tun_get_user+0x27b0/0x44d0 [ 84.118877][ T5682] ? aa_file_perm+0x18b/0x15f0 [ 84.118908][ T5682] ? aa_file_perm+0x4ed/0x15f0 [ 84.118934][ T5682] ? __pfx_tun_get_user+0x10/0x10 [ 84.118958][ T5682] ? __lock_acquire+0x747/0x2de0 [ 84.118985][ T5682] ? finish_task_switch+0x40e/0xc60 [pid 5682] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5682, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 84.119032][ T5682] ? ref_tracker_alloc+0x341/0x4b0 [ 84.119079][ T5682] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 84.119122][ T5682] ? lock_acquire+0x115/0x350 [ 84.119142][ T5682] ? tun_get+0x1c/0x2f0 [ 84.119169][ T5682] ? tun_get+0x1c/0x2f0 [ 84.119190][ T5682] ? tun_get+0x1c/0x2f0 [ 84.119216][ T5682] tun_chr_write_iter+0x113/0x200 [ 84.119241][ T5682] vfs_write+0x612/0xba0 [ 84.119280][ T5682] ? __pfx_vfs_write+0x10/0x10 [ 84.119319][ T5682] ? _raw_spin_unlock_irq+0x23/0x50 openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 [ 84.119349][ T5682] ksys_write+0x150/0x270 [ 84.119382][ T5682] ? __pfx_ksys_write+0x10/0x10 [ 84.119424][ T5682] do_syscall_64+0x166/0x520 [ 84.119446][ T5682] ? trace_irq_disable+0x3b/0x140 [ 84.119467][ T5682] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.119488][ T5682] ? clear_bhb_loop+0x70/0xc0 [ 84.119513][ T5682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.119534][ T5682] RIP: 0033:0x7f6c0bc30879 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 [ 84.119552][ T5682] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 84.119569][ T5682] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.119590][ T5682] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 84.119605][ T5682] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 84.119617][ T5682] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 84.119640][ T5682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 5689 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci-upstream-kasan-gce/strace-static-x86_64: Process 5689 attached [pid 5689] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5689] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5689] chdir("./5") = 0 [pid 5689] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5689] setpgid(0, 0) = 0 [pid 5689] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5689] write(3, "1000", 4) = 4 [pid 5689] close(3) = 0 [pid 5689] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5689] write(1, "executing program\n", 18) = 18 executing program [pid 5689] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5689] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [ 84.119651][ T5682] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 84.119679][ T5682] [pid 5689] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5689] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=35}) = 0 [pid 5689] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5689] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5689] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x23\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5689] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5689] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5689] write(6, "6", 1) = 1 [pid 5689] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5689] exit_group(0) = ? [ 84.624714][ T5689] FAULT_INJECTION: forcing a failure. [ 84.624714][ T5689] name failslab, interval 1, probability 0, space 0, times 0 [ 84.624747][ T5689] CPU: 0 UID: 0 PID: 5689 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 84.624769][ T5689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.624781][ T5689] Call Trace: [ 84.624789][ T5689] [ 84.624797][ T5689] dump_stack_lvl+0xe8/0x150 [ 84.624831][ T5689] should_fail_ex+0x410/0x560 [ 84.624857][ T5689] should_failslab+0xa8/0x100 [ 84.624881][ T5689] ? dst_alloc+0x105/0x170 [ 84.624912][ T5689] kmem_cache_alloc_noprof+0xa1/0x600 [ 84.624944][ T5689] ? dst_alloc+0x105/0x170 [ 84.624973][ T5689] ? fib_lookup+0x76/0x440 [ 84.625004][ T5689] dst_alloc+0x105/0x170 [ 84.625037][ T5689] ip_route_input_rcu+0x20ca/0x3190 [ 84.625076][ T5689] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 84.625132][ T5689] ? tc_run+0x50f/0x750 [ 84.625153][ T5689] ? ip_route_input_noref+0xad/0x270 [ 84.625186][ T5689] ip_route_input_noref+0x17c/0x270 [ 84.625221][ T5689] ? __pfx_ip_route_input_noref+0x10/0x10 [ 84.625256][ T5689] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 84.625296][ T5689] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 84.625324][ T5689] ip_rcv_finish_core+0x593/0x1c00 [ 84.625363][ T5689] ip_rcv_finish+0x14c/0x2a0 [ 84.625391][ T5689] NF_HOOK+0x336/0x3c0 [ 84.625418][ T5689] ? __pfx_ip_rcv_finish+0x10/0x10 [ 84.625443][ T5689] ? NF_HOOK+0x9e/0x3c0 [pid 5689] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5689, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 84.625467][ T5689] ? __pfx_NF_HOOK+0x10/0x10 [ 84.625493][ T5689] ? __pfx_sock_wfree+0x10/0x10 [ 84.625518][ T5689] ? ip_rcv_core+0x7fa/0xd50 [ 84.625549][ T5689] ? netif_receive_skb+0x102/0xbf0 [ 84.625569][ T5689] ? __pfx_ip_rcv+0x10/0x10 [ 84.625593][ T5689] netif_receive_skb+0x45b/0xbf0 [ 84.625619][ T5689] ? __pfx_netif_receive_skb+0x10/0x10 [ 84.625645][ T5689] ? tun_rx_batched+0x185/0x790 [ 84.625669][ T5689] tun_rx_batched+0x1de/0x790 [ 84.625698][ T5689] ? __pfx_tun_rx_batched+0x10/0x10 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 84.625738][ T5689] ? lock_acquire+0x115/0x350 [ 84.625768][ T5689] ? tun_get_user+0x23ba/0x44d0 [ 84.625790][ T5689] ? __local_bh_enable_ip+0xd6/0x140 [ 84.625819][ T5689] ? tun_get_user+0x27b0/0x44d0 [ 84.625845][ T5689] tun_get_user+0x2be0/0x44d0 [ 84.625882][ T5689] ? tun_get_user+0x27b0/0x44d0 [ 84.625903][ T5689] ? aa_file_perm+0x18b/0x15f0 [ 84.625938][ T5689] ? aa_file_perm+0x4ed/0x15f0 [ 84.625971][ T5689] ? __pfx_tun_get_user+0x10/0x10 [ 84.626015][ T5689] ? __lock_acquire+0x747/0x2de0 unlink("./5/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 84.626045][ T5689] ? finish_task_switch+0x40e/0xc60 [ 84.626079][ T5689] ? ref_tracker_alloc+0x341/0x4b0 [ 84.626109][ T5689] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 84.626139][ T5689] ? lock_acquire+0x115/0x350 [ 84.626161][ T5689] ? tun_get+0x1c/0x2f0 [ 84.626191][ T5689] ? tun_get+0x1c/0x2f0 [ 84.626214][ T5689] ? tun_get+0x1c/0x2f0 [ 84.626243][ T5689] tun_chr_write_iter+0x113/0x200 [ 84.626276][ T5689] vfs_write+0x612/0xba0 [ 84.626320][ T5689] ? __pfx_vfs_write+0x10/0x10 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5697 attached , child_tidptr=0x55556fc096d0) = 5697 [pid 5697] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5697] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5697] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5697] chdir("./6") = 0 [pid 5697] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5697] setpgid(0, 0) = 0 [pid 5697] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5697] write(3, "1000", 4) = 4 [pid 5697] close(3) = 0 [pid 5697] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5697] write(1, "executing program\n", 18) = 18 [pid 5697] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [ 84.626365][ T5689] ? _raw_spin_unlock_irq+0x23/0x50 [ 84.626398][ T5689] ksys_write+0x150/0x270 [ 84.626434][ T5689] ? __pfx_ksys_write+0x10/0x10 [ 84.626480][ T5689] do_syscall_64+0x166/0x520 [ 84.626504][ T5689] ? trace_irq_disable+0x3b/0x140 [ 84.626527][ T5689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.626551][ T5689] ? clear_bhb_loop+0x70/0xc0 [ 84.626579][ T5689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.626601][ T5689] RIP: 0033:0x7f6c0bc30879 [pid 5697] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5697] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [ 84.626621][ T5689] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 84.626640][ T5689] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.626664][ T5689] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 84.626681][ T5689] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 84.626695][ T5689] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 5697] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=36}) = 0 [pid 5697] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5697] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5697] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x24\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5697] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [ 84.626708][ T5689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 84.626723][ T5689] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 84.626756][ T5689] [pid 5697] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5697] write(6, "6", 1) = 1 [pid 5697] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5697] exit_group(0) = ? [ 85.110876][ T5697] ref_tracker: memory allocation failure, unreliable refcount tracker. [pid 5697] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5697, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5703 attached [pid 5703] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5703 [pid 5703] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5703] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5703] chdir("./7") = 0 [pid 5703] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5703] setpgid(0, 0) = 0 [pid 5703] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5703] write(3, "1000", 4) = 4 [pid 5703] close(3) = 0 [pid 5703] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5703] write(1, "executing program\n", 18) = 18 [pid 5703] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5703] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5703] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5703] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=37}) = 0 [pid 5703] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5703] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5703] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x25\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5703] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5703] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5703] write(6, "6", 1) = 1 [pid 5703] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 85.354705][ T5703] FAULT_INJECTION: forcing a failure. [ 85.354705][ T5703] name failslab, interval 1, probability 0, space 0, times 0 [ 85.354738][ T5703] CPU: 0 UID: 0 PID: 5703 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 85.354760][ T5703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 85.354772][ T5703] Call Trace: [ 85.354780][ T5703] [ 85.354788][ T5703] dump_stack_lvl+0xe8/0x150 [ 85.354822][ T5703] should_fail_ex+0x410/0x560 [pid 5703] exit_group(0) = ? [ 85.354849][ T5703] should_failslab+0xa8/0x100 [ 85.354874][ T5703] ? dst_alloc+0x105/0x170 [ 85.354905][ T5703] kmem_cache_alloc_noprof+0xa1/0x600 [ 85.354939][ T5703] ? dst_alloc+0x105/0x170 [ 85.354969][ T5703] ? fib_lookup+0x76/0x440 [ 85.355002][ T5703] dst_alloc+0x105/0x170 [ 85.355037][ T5703] ip_route_input_rcu+0x20ca/0x3190 [ 85.355079][ T5703] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 85.355136][ T5703] ? tc_run+0x50f/0x750 [ 85.355157][ T5703] ? ip_route_input_noref+0xad/0x270 [ 85.355190][ T5703] ip_route_input_noref+0x17c/0x270 [ 85.355237][ T5703] ? __pfx_ip_route_input_noref+0x10/0x10 [ 85.355272][ T5703] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 85.355300][ T5703] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 85.355326][ T5703] ip_rcv_finish_core+0x593/0x1c00 [ 85.355365][ T5703] ip_rcv_finish+0x14c/0x2a0 [ 85.355394][ T5703] NF_HOOK+0x336/0x3c0 [ 85.355422][ T5703] ? __pfx_ip_rcv_finish+0x10/0x10 [ 85.355457][ T5703] ? NF_HOOK+0x9e/0x3c0 [ 85.355480][ T5703] ? __pfx_NF_HOOK+0x10/0x10 [ 85.355504][ T5703] ? __pfx_sock_wfree+0x10/0x10 [ 85.355528][ T5703] ? ip_rcv_core+0x7fa/0xd50 [ 85.355557][ T5703] ? netif_receive_skb+0x102/0xbf0 [ 85.355576][ T5703] ? __pfx_ip_rcv+0x10/0x10 [ 85.355599][ T5703] netif_receive_skb+0x45b/0xbf0 [ 85.355623][ T5703] ? __pfx_netif_receive_skb+0x10/0x10 [ 85.355647][ T5703] ? tun_rx_batched+0x185/0x790 [ 85.355670][ T5703] tun_rx_batched+0x1de/0x790 [ 85.355700][ T5703] ? __pfx_tun_rx_batched+0x10/0x10 [ 85.355722][ T5703] ? lock_acquire+0x115/0x350 [ 85.355748][ T5703] ? tun_get_user+0x23ba/0x44d0 [ 85.355768][ T5703] ? __local_bh_enable_ip+0xd6/0x140 [ 85.355794][ T5703] ? tun_get_user+0x27b0/0x44d0 [ 85.355816][ T5703] tun_get_user+0x2be0/0x44d0 [ 85.355849][ T5703] ? tun_get_user+0x27b0/0x44d0 [ 85.355869][ T5703] ? aa_file_perm+0x18b/0x15f0 [ 85.355899][ T5703] ? aa_file_perm+0x4ed/0x15f0 [ 85.355924][ T5703] ? __pfx_tun_get_user+0x10/0x10 [ 85.355951][ T5703] ? __lock_acquire+0x747/0x2de0 [ 85.355977][ T5703] ? finish_task_switch+0x40e/0xc60 [pid 5703] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5703, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 85.356037][ T5703] ? ref_tracker_alloc+0x341/0x4b0 [ 85.356068][ T5703] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 85.356098][ T5703] ? lock_acquire+0x115/0x350 [ 85.356120][ T5703] ? tun_get+0x1c/0x2f0 [ 85.356150][ T5703] ? tun_get+0x1c/0x2f0 [ 85.356173][ T5703] ? tun_get+0x1c/0x2f0 [ 85.356202][ T5703] tun_chr_write_iter+0x113/0x200 [ 85.356236][ T5703] vfs_write+0x612/0xba0 [ 85.356280][ T5703] ? __pfx_vfs_write+0x10/0x10 [ 85.356324][ T5703] ? _raw_spin_unlock_irq+0x23/0x50 [ 85.356357][ T5703] ksys_write+0x150/0x270 [ 85.356394][ T5703] ? __pfx_ksys_write+0x10/0x10 [ 85.356440][ T5703] do_syscall_64+0x166/0x520 [ 85.356464][ T5703] ? trace_irq_disable+0x3b/0x140 [ 85.356486][ T5703] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.356510][ T5703] ? clear_bhb_loop+0x70/0xc0 [ 85.356537][ T5703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.356560][ T5703] RIP: 0033:0x7f6c0bc30879 [ 85.356581][ T5703] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 85.356599][ T5703] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.356624][ T5703] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 85.356640][ T5703] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 85.356655][ T5703] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 85.356668][ T5703] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5713 attached , child_tidptr=0x55556fc096d0) = 5713 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5713] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5713] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5713] chdir("./8" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5713] <... chdir resumed>) = 0 [pid 5713] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5713] setpgid(0, 0) = 0 [pid 5713] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5713] write(3, "1000", 4) = 4 [pid 5713] close(3) = 0 [pid 5713] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5713] write(1, "executing program\n", 18) = 18 [ 85.356682][ T5703] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 85.356715][ T5703] [pid 5713] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5713] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5713] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5713] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=38}) = 0 [pid 5713] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5713] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5713] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x26\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5713] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5713] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5713] write(6, "6", 1) = 1 [pid 5713] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5713] exit_group(0) = ? [pid 5713] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5713, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5724 attached , child_tidptr=0x55556fc096d0) = 5724 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5724] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5724] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5724] chdir("./9") = 0 [pid 5724] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5724] setpgid(0, 0) = 0 [pid 5724] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5724] write(3, "1000", 4) = 4 [pid 5724] close(3) = 0 [pid 5724] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5724] write(1, "executing program\n", 18) = 18 [pid 5724] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5724] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5724] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5724] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=39}) = 0 [pid 5724] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5724] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5724] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x27\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5724] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5724] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5724] write(6, "6", 1) = 1 [pid 5724] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5724] exit_group(0) = ? [pid 5724] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5724, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5737 attached [pid 5737] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5737] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5737 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5737] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5737] chdir("./10") = 0 [pid 5737] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5737] setpgid(0, 0) = 0 [pid 5737] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5737] write(3, "1000", 4) = 4 [pid 5737] close(3) = 0 [pid 5737] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5737] write(1, "executing program\n", 18) = 18 [pid 5737] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5737] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5737] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5737] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=40}) = 0 [pid 5737] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5737] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5737] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x28\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5737] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5737] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5737] write(6, "6", 1) = 1 [pid 5737] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 86.435070][ T5737] FAULT_INJECTION: forcing a failure. [ 86.435070][ T5737] name failslab, interval 1, probability 0, space 0, times 0 [ 86.435102][ T5737] CPU: 0 UID: 0 PID: 5737 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 86.435123][ T5737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.435134][ T5737] Call Trace: [ 86.435153][ T5737] [ 86.435161][ T5737] dump_stack_lvl+0xe8/0x150 [ 86.435193][ T5737] should_fail_ex+0x410/0x560 [pid 5737] exit_group(0) = ? [ 86.435220][ T5737] should_failslab+0xa8/0x100 [ 86.435244][ T5737] ? dst_alloc+0x105/0x170 [ 86.435273][ T5737] kmem_cache_alloc_noprof+0xa1/0x600 [ 86.435304][ T5737] ? dst_alloc+0x105/0x170 [ 86.435332][ T5737] ? fib_lookup+0x76/0x440 [ 86.435363][ T5737] dst_alloc+0x105/0x170 [ 86.435395][ T5737] ip_route_input_rcu+0x20ca/0x3190 [ 86.435433][ T5737] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 86.435486][ T5737] ? tc_run+0x50f/0x750 [ 86.435505][ T5737] ? ip_route_input_noref+0xad/0x270 [ 86.435540][ T5737] ip_route_input_noref+0x17c/0x270 [ 86.435573][ T5737] ? __pfx_ip_route_input_noref+0x10/0x10 [ 86.435606][ T5737] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 86.435631][ T5737] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 86.435657][ T5737] ip_rcv_finish_core+0x593/0x1c00 [ 86.435693][ T5737] ip_rcv_finish+0x14c/0x2a0 [ 86.435721][ T5737] NF_HOOK+0x336/0x3c0 [ 86.435745][ T5737] ? __pfx_ip_rcv_finish+0x10/0x10 [ 86.435769][ T5737] ? NF_HOOK+0x9e/0x3c0 [ 86.435792][ T5737] ? __pfx_NF_HOOK+0x10/0x10 [ 86.435816][ T5737] ? __pfx_sock_wfree+0x10/0x10 [ 86.435840][ T5737] ? ip_rcv_core+0x7fa/0xd50 [ 86.435871][ T5737] ? netif_receive_skb+0x102/0xbf0 [ 86.435889][ T5737] ? __pfx_ip_rcv+0x10/0x10 [ 86.435912][ T5737] netif_receive_skb+0x45b/0xbf0 [ 86.435936][ T5737] ? __pfx_netif_receive_skb+0x10/0x10 [ 86.435965][ T5737] ? tun_rx_batched+0x185/0x790 [ 86.435989][ T5737] tun_rx_batched+0x1de/0x790 [ 86.436037][ T5737] ? __pfx_tun_rx_batched+0x10/0x10 [ 86.436063][ T5737] ? lock_acquire+0x115/0x350 [ 86.436094][ T5737] ? tun_get_user+0x23ba/0x44d0 [ 86.436118][ T5737] ? __local_bh_enable_ip+0xd6/0x140 [ 86.436155][ T5737] ? tun_get_user+0x27b0/0x44d0 [ 86.436181][ T5737] tun_get_user+0x2be0/0x44d0 [ 86.436220][ T5737] ? tun_get_user+0x27b0/0x44d0 [ 86.436243][ T5737] ? aa_file_perm+0x18b/0x15f0 [ 86.436279][ T5737] ? aa_file_perm+0x4ed/0x15f0 [ 86.436308][ T5737] ? __pfx_tun_get_user+0x10/0x10 [ 86.436335][ T5737] ? __lock_acquire+0x747/0x2de0 [ 86.436365][ T5737] ? finish_task_switch+0x40e/0xc60 [ 86.436399][ T5737] ? ref_tracker_alloc+0x341/0x4b0 [ 86.436429][ T5737] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 86.436458][ T5737] ? lock_acquire+0x115/0x350 [ 86.436481][ T5737] ? tun_get+0x1c/0x2f0 [ 86.436510][ T5737] ? tun_get+0x1c/0x2f0 [ 86.436533][ T5737] ? tun_get+0x1c/0x2f0 [ 86.436562][ T5737] tun_chr_write_iter+0x113/0x200 [ 86.436590][ T5737] vfs_write+0x612/0xba0 [ 86.436633][ T5737] ? __pfx_vfs_write+0x10/0x10 [ 86.436678][ T5737] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.436711][ T5737] ksys_write+0x150/0x270 [ 86.436747][ T5737] ? __pfx_ksys_write+0x10/0x10 [ 86.436793][ T5737] do_syscall_64+0x166/0x520 [ 86.436817][ T5737] ? trace_irq_disable+0x3b/0x140 [ 86.436840][ T5737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.436862][ T5737] ? clear_bhb_loop+0x70/0xc0 [ 86.436890][ T5737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.436912][ T5737] RIP: 0033:0x7f6c0bc30879 [ 86.436933][ T5737] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 86.436951][ T5737] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.436975][ T5737] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 86.436992][ T5737] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 86.437007][ T5737] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 5737] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5737, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5743 attached , child_tidptr=0x55556fc096d0) = 5743 [pid 5743] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5743] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5743] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5743] chdir("./11") = 0 [pid 5743] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5743] setpgid(0, 0) = 0 [pid 5743] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 86.437019][ T5737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 86.437034][ T5737] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 86.437065][ T5737] [ 86.552696][ T1234] cfg80211: failed to load regulatory.db [pid 5743] write(3, "1000", 4) = 4 [pid 5743] close(3) = 0 [pid 5743] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5743] write(1, "executing program\n", 18) = 18 executing program [pid 5743] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5743] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5743] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5743] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=41}) = 0 [pid 5743] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5743] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5743] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x29\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5743] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5743] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5743] write(6, "6", 1) = 1 [pid 5743] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5743] exit_group(0) = ? [pid 5743] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5743, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5749 attached [pid 5749] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5749 [pid 5749] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5749] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5749] chdir("./12") = 0 [pid 5749] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5749] setpgid(0, 0) = 0 [pid 5749] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5749] write(3, "1000", 4) = 4 [pid 5749] close(3) = 0 [pid 5749] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5749] write(1, "executing program\n", 18) = 18 [pid 5749] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5749] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5749] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5749] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=42}) = 0 [pid 5749] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5749] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5749] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x2a\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5749] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5749] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5749] write(6, "6", 1) = 1 [pid 5749] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5749] exit_group(0) = ? [pid 5749] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5749, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5758 attached [pid 5758] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5758] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5758] chdir("./13" [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5758 [pid 5758] <... chdir resumed>) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5758] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5758] <... prctl resumed>) = 0 [pid 5758] setpgid(0, 0) = 0 [pid 5758] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5758] write(3, "1000", 4) = 4 [pid 5758] close(3) = 0 [pid 5758] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5758] write(1, "executing program\n", 18) = 18 executing program [pid 5758] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5758] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5758] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5758] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=43}) = 0 [pid 5758] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5758] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5758] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x2b\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5758] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5758] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5758] write(6, "6", 1) = 1 [ 87.472067][ T5758] FAULT_INJECTION: forcing a failure. [ 87.472067][ T5758] name failslab, interval 1, probability 0, space 0, times 0 [ 87.472102][ T5758] CPU: 0 UID: 0 PID: 5758 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 87.472137][ T5758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.472150][ T5758] Call Trace: [ 87.472159][ T5758] [ 87.472168][ T5758] dump_stack_lvl+0xe8/0x150 [ 87.472203][ T5758] should_fail_ex+0x410/0x560 [ 87.472233][ T5758] should_failslab+0xa8/0x100 [ 87.472259][ T5758] ? dst_alloc+0x105/0x170 [ 87.472303][ T5758] kmem_cache_alloc_noprof+0xa1/0x600 [ 87.472337][ T5758] ? dst_alloc+0x105/0x170 [ 87.472367][ T5758] ? fib_lookup+0x76/0x440 [ 87.472399][ T5758] dst_alloc+0x105/0x170 [ 87.472433][ T5758] ip_route_input_rcu+0x20ca/0x3190 [ 87.472474][ T5758] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 87.472531][ T5758] ? tc_run+0x50f/0x750 [ 87.472552][ T5758] ? ip_route_input_noref+0xad/0x270 [pid 5758] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5758] exit_group(0) = ? [ 87.472585][ T5758] ip_route_input_noref+0x17c/0x270 [ 87.472619][ T5758] ? __pfx_ip_route_input_noref+0x10/0x10 [ 87.472654][ T5758] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 87.472681][ T5758] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 87.472708][ T5758] ip_rcv_finish_core+0x593/0x1c00 [ 87.472747][ T5758] ip_rcv_finish+0x14c/0x2a0 [ 87.472775][ T5758] NF_HOOK+0x336/0x3c0 [ 87.472802][ T5758] ? __pfx_ip_rcv_finish+0x10/0x10 [ 87.472827][ T5758] ? NF_HOOK+0x9e/0x3c0 [ 87.472851][ T5758] ? __pfx_NF_HOOK+0x10/0x10 [ 87.472877][ T5758] ? __pfx_sock_wfree+0x10/0x10 [ 87.472903][ T5758] ? ip_rcv_core+0x7fa/0xd50 [ 87.472937][ T5758] ? netif_receive_skb+0x102/0xbf0 [ 87.472956][ T5758] ? __pfx_ip_rcv+0x10/0x10 [ 87.472981][ T5758] netif_receive_skb+0x45b/0xbf0 [ 87.473006][ T5758] ? __pfx_netif_receive_skb+0x10/0x10 [ 87.473031][ T5758] ? tun_rx_batched+0x185/0x790 [ 87.473057][ T5758] tun_rx_batched+0x1de/0x790 [ 87.473085][ T5758] ? __pfx_tun_rx_batched+0x10/0x10 [ 87.473108][ T5758] ? lock_acquire+0x115/0x350 [ 87.473151][ T5758] ? tun_get_user+0x23ba/0x44d0 [ 87.473172][ T5758] ? __local_bh_enable_ip+0xd6/0x140 [ 87.473199][ T5758] ? tun_get_user+0x27b0/0x44d0 [ 87.473222][ T5758] tun_get_user+0x2be0/0x44d0 [ 87.473258][ T5758] ? tun_get_user+0x27b0/0x44d0 [ 87.473278][ T5758] ? aa_file_perm+0x18b/0x15f0 [ 87.473310][ T5758] ? aa_file_perm+0x4ed/0x15f0 [ 87.473336][ T5758] ? __pfx_tun_get_user+0x10/0x10 [ 87.473360][ T5758] ? __lock_acquire+0x747/0x2de0 [ 87.473388][ T5758] ? finish_task_switch+0x40e/0xc60 [ 87.473421][ T5758] ? ref_tracker_alloc+0x341/0x4b0 [ 87.473448][ T5758] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 87.473475][ T5758] ? lock_acquire+0x115/0x350 [ 87.473495][ T5758] ? tun_get+0x1c/0x2f0 [ 87.473522][ T5758] ? tun_get+0x1c/0x2f0 [ 87.473543][ T5758] ? tun_get+0x1c/0x2f0 [ 87.473568][ T5758] tun_chr_write_iter+0x113/0x200 [ 87.473610][ T5758] vfs_write+0x612/0xba0 [ 87.473650][ T5758] ? __pfx_vfs_write+0x10/0x10 [ 87.473693][ T5758] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.473725][ T5758] ksys_write+0x150/0x270 [ 87.473760][ T5758] ? __pfx_ksys_write+0x10/0x10 [ 87.473804][ T5758] do_syscall_64+0x166/0x520 [ 87.473828][ T5758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.473851][ T5758] ? clear_bhb_loop+0x70/0xc0 [ 87.473878][ T5758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.473899][ T5758] RIP: 0033:0x7f6c0bc30879 [ 87.473919][ T5758] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [pid 5758] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5758, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 87.473937][ T5758] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.473960][ T5758] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 87.473976][ T5758] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 87.473989][ T5758] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 87.474002][ T5758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 87.474015][ T5758] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 87.474047][ T5758] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5768 attached , child_tidptr=0x55556fc096d0) = 5768 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5768] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5768] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5768] chdir("./14") = 0 [pid 5768] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5768] setpgid(0, 0) = 0 [pid 5768] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5768] write(3, "1000", 4) = 4 [pid 5768] close(3) = 0 [pid 5768] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5768] write(1, "executing program\n", 18) = 18 [pid 5768] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5768] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5768] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5768] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=44}) = 0 [pid 5768] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5768] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5768] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x2c\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5768] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5768] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5768] write(6, "6", 1) = 1 [pid 5768] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5768] exit_group(0) = ? [pid 5768] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5768, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5775 attached [pid 5775] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5775] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5775 [pid 5775] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5775] chdir("./15" [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5775] <... chdir resumed>) = 0 [pid 5775] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5775] setpgid(0, 0) = 0 [pid 5775] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5775] write(3, "1000", 4) = 4 [pid 5775] close(3) = 0 [pid 5775] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5775] write(1, "executing program\n", 18) = 18 executing program [pid 5775] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5775] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5775] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5775] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=45}) = 0 [pid 5775] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5775] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5775] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x2d\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5775] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5775] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5775] write(6, "6", 1) = 1 [pid 5775] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5775] exit_group(0) = ? [pid 5775] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5775, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 mkdir("./16", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5789 attached [pid 5789] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5789] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5789] chdir("./16" [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5789 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5789] <... chdir resumed>) = 0 [pid 5789] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5789] setpgid(0, 0) = 0 [pid 5789] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5789] write(3, "1000", 4) = 4 [pid 5789] close(3) = 0 [pid 5789] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5789] write(1, "executing program\n", 18) = 18 [pid 5789] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5789] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5789] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5789] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=46}) = 0 [pid 5789] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5789] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5789] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x2e\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5789] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5789] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5789] write(6, "6", 1) = 1 [pid 5789] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5789] exit_group(0) = ? [ 88.627433][ T5789] FAULT_INJECTION: forcing a failure. [ 88.627433][ T5789] name failslab, interval 1, probability 0, space 0, times 0 [ 88.627475][ T5789] CPU: 0 UID: 0 PID: 5789 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 88.627496][ T5789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.627506][ T5789] Call Trace: [ 88.627514][ T5789] [ 88.627521][ T5789] dump_stack_lvl+0xe8/0x150 [ 88.627553][ T5789] should_fail_ex+0x410/0x560 [ 88.627579][ T5789] should_failslab+0xa8/0x100 [ 88.627602][ T5789] ? dst_alloc+0x105/0x170 [ 88.627630][ T5789] kmem_cache_alloc_noprof+0xa1/0x600 [ 88.627662][ T5789] ? dst_alloc+0x105/0x170 [ 88.627690][ T5789] ? fib_lookup+0x76/0x440 [ 88.627720][ T5789] dst_alloc+0x105/0x170 [ 88.627752][ T5789] ip_route_input_rcu+0x20ca/0x3190 [ 88.627790][ T5789] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 88.627844][ T5789] ? tc_run+0x50f/0x750 [ 88.627863][ T5789] ? ip_route_input_noref+0xad/0x270 [ 88.627894][ T5789] ip_route_input_noref+0x17c/0x270 [ 88.627927][ T5789] ? __pfx_ip_route_input_noref+0x10/0x10 [ 88.627960][ T5789] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 88.628003][ T5789] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 88.628030][ T5789] ip_rcv_finish_core+0x593/0x1c00 [ 88.628083][ T5789] ip_rcv_finish+0x14c/0x2a0 [ 88.628112][ T5789] NF_HOOK+0x336/0x3c0 [ 88.628139][ T5789] ? __pfx_ip_rcv_finish+0x10/0x10 [ 88.628165][ T5789] ? NF_HOOK+0x9e/0x3c0 [ 88.628188][ T5789] ? __pfx_NF_HOOK+0x10/0x10 [ 88.628214][ T5789] ? __pfx_sock_wfree+0x10/0x10 [ 88.628240][ T5789] ? ip_rcv_core+0x7fa/0xd50 [ 88.628271][ T5789] ? netif_receive_skb+0x102/0xbf0 [ 88.628291][ T5789] ? __pfx_ip_rcv+0x10/0x10 [ 88.628315][ T5789] netif_receive_skb+0x45b/0xbf0 [ 88.628341][ T5789] ? __pfx_netif_receive_skb+0x10/0x10 [ 88.628367][ T5789] ? tun_rx_batched+0x185/0x790 [ 88.628392][ T5789] tun_rx_batched+0x1de/0x790 [ 88.628424][ T5789] ? __pfx_tun_rx_batched+0x10/0x10 [ 88.628447][ T5789] ? lock_acquire+0x115/0x350 [ 88.628475][ T5789] ? tun_get_user+0x23ba/0x44d0 [ 88.628496][ T5789] ? __local_bh_enable_ip+0xd6/0x140 [ 88.628522][ T5789] ? tun_get_user+0x27b0/0x44d0 [ 88.628545][ T5789] tun_get_user+0x2be0/0x44d0 [ 88.628581][ T5789] ? tun_get_user+0x27b0/0x44d0 [ 88.628601][ T5789] ? aa_file_perm+0x18b/0x15f0 [ 88.628633][ T5789] ? aa_file_perm+0x4ed/0x15f0 [ 88.628659][ T5789] ? __pfx_tun_get_user+0x10/0x10 [ 88.628683][ T5789] ? __lock_acquire+0x747/0x2de0 [pid 5789] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5789, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 88.628710][ T5789] ? finish_task_switch+0x40e/0xc60 [ 88.628741][ T5789] ? ref_tracker_alloc+0x341/0x4b0 [ 88.628768][ T5789] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 88.628795][ T5789] ? lock_acquire+0x115/0x350 [ 88.628815][ T5789] ? tun_get+0x1c/0x2f0 [ 88.628842][ T5789] ? tun_get+0x1c/0x2f0 [ 88.628861][ T5789] ? tun_get+0x1c/0x2f0 [ 88.628886][ T5789] tun_chr_write_iter+0x113/0x200 [ 88.628909][ T5789] vfs_write+0x612/0xba0 [ 88.628947][ T5789] ? __pfx_vfs_write+0x10/0x10 umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 88.628987][ T5789] ? _raw_spin_unlock_irq+0x23/0x50 [ 88.629017][ T5789] ksys_write+0x150/0x270 [ 88.629056][ T5789] ? __pfx_ksys_write+0x10/0x10 [ 88.629097][ T5789] do_syscall_64+0x166/0x520 [ 88.629119][ T5789] ? trace_irq_disable+0x3b/0x140 [ 88.629139][ T5789] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.629159][ T5789] ? clear_bhb_loop+0x70/0xc0 [ 88.629184][ T5789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.629204][ T5789] RIP: 0033:0x7f6c0bc30879 newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./16/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 [ 88.629223][ T5789] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 88.629239][ T5789] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 88.629261][ T5789] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 88.629276][ T5789] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 88.629289][ T5789] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 rmdir("./16") = 0 mkdir("./17", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5797 attached , child_tidptr=0x55556fc096d0) = 5797 [pid 5797] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5797] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5797] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5797] chdir("./17") = 0 [pid 5797] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5797] setpgid(0, 0) = 0 [pid 5797] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5797] write(3, "1000", 4) = 4 [pid 5797] close(3) = 0 [pid 5797] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5797] write(1, "executing program\n", 18) = 18 [pid 5797] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [ 88.629300][ T5789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 88.629313][ T5789] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 88.629342][ T5789] [pid 5797] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5797] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5797] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=47}) = 0 [pid 5797] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5797] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5797] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x2f\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5797] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5797] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5797] write(6, "6", 1) = 1 [pid 5797] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5797] exit_group(0) = ? [ 89.119439][ T5797] FAULT_INJECTION: forcing a failure. [ 89.119439][ T5797] name failslab, interval 1, probability 0, space 0, times 0 [ 89.119473][ T5797] CPU: 0 UID: 0 PID: 5797 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 89.119496][ T5797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.119508][ T5797] Call Trace: [ 89.119516][ T5797] [ 89.119524][ T5797] dump_stack_lvl+0xe8/0x150 [ 89.119559][ T5797] should_fail_ex+0x410/0x560 [ 89.119587][ T5797] should_failslab+0xa8/0x100 [ 89.119611][ T5797] ? dst_alloc+0x105/0x170 [ 89.119642][ T5797] kmem_cache_alloc_noprof+0xa1/0x600 [ 89.119675][ T5797] ? dst_alloc+0x105/0x170 [ 89.119704][ T5797] ? fib_lookup+0x76/0x440 [ 89.119736][ T5797] dst_alloc+0x105/0x170 [ 89.119771][ T5797] ip_route_input_rcu+0x20ca/0x3190 [ 89.119812][ T5797] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 89.119870][ T5797] ? tc_run+0x50f/0x750 [ 89.119891][ T5797] ? ip_route_input_noref+0xad/0x270 [ 89.119934][ T5797] ip_route_input_noref+0x17c/0x270 [ 89.119967][ T5797] ? __pfx_ip_route_input_noref+0x10/0x10 [ 89.120006][ T5797] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 89.120031][ T5797] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 89.120056][ T5797] ip_rcv_finish_core+0x593/0x1c00 [ 89.120092][ T5797] ip_rcv_finish+0x14c/0x2a0 [ 89.120119][ T5797] NF_HOOK+0x336/0x3c0 [ 89.120145][ T5797] ? __pfx_ip_rcv_finish+0x10/0x10 [ 89.120168][ T5797] ? NF_HOOK+0x9e/0x3c0 [ 89.120191][ T5797] ? __pfx_NF_HOOK+0x10/0x10 [ 89.120216][ T5797] ? __pfx_sock_wfree+0x10/0x10 [ 89.120241][ T5797] ? ip_rcv_core+0x7fa/0xd50 [ 89.120269][ T5797] ? netif_receive_skb+0x102/0xbf0 [ 89.120287][ T5797] ? __pfx_ip_rcv+0x10/0x10 [ 89.120310][ T5797] netif_receive_skb+0x45b/0xbf0 [ 89.120333][ T5797] ? __pfx_netif_receive_skb+0x10/0x10 [ 89.120357][ T5797] ? tun_rx_batched+0x185/0x790 [ 89.120382][ T5797] tun_rx_batched+0x1de/0x790 [ 89.120408][ T5797] ? __pfx_tun_rx_batched+0x10/0x10 [ 89.120439][ T5797] ? lock_acquire+0x115/0x350 [ 89.120468][ T5797] ? tun_get_user+0x23ba/0x44d0 [ 89.120488][ T5797] ? __local_bh_enable_ip+0xd6/0x140 [ 89.120513][ T5797] ? tun_get_user+0x27b0/0x44d0 [ 89.120536][ T5797] tun_get_user+0x2be0/0x44d0 [ 89.120569][ T5797] ? tun_get_user+0x27b0/0x44d0 [ 89.120588][ T5797] ? aa_file_perm+0x18b/0x15f0 [ 89.120617][ T5797] ? aa_file_perm+0x4ed/0x15f0 [ 89.120642][ T5797] ? __pfx_tun_get_user+0x10/0x10 [ 89.120665][ T5797] ? __lock_acquire+0x747/0x2de0 [ 89.120690][ T5797] ? finish_task_switch+0x40e/0xc60 [ 89.120720][ T5797] ? ref_tracker_alloc+0x341/0x4b0 [ 89.120745][ T5797] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 89.120770][ T5797] ? lock_acquire+0x115/0x350 [ 89.120790][ T5797] ? tun_get+0x1c/0x2f0 [ 89.120814][ T5797] ? tun_get+0x1c/0x2f0 [ 89.120833][ T5797] ? tun_get+0x1c/0x2f0 [ 89.120858][ T5797] tun_chr_write_iter+0x113/0x200 [ 89.120881][ T5797] vfs_write+0x612/0xba0 [ 89.120917][ T5797] ? __pfx_vfs_write+0x10/0x10 [ 89.120954][ T5797] ? _raw_spin_unlock_irq+0x23/0x50 [ 89.120983][ T5797] ksys_write+0x150/0x270 [ 89.121014][ T5797] ? __pfx_ksys_write+0x10/0x10 [ 89.121053][ T5797] do_syscall_64+0x166/0x520 [ 89.121074][ T5797] ? trace_irq_disable+0x3b/0x140 [ 89.121093][ T5797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.121112][ T5797] ? clear_bhb_loop+0x70/0xc0 [ 89.121137][ T5797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.121156][ T5797] RIP: 0033:0x7f6c0bc30879 [pid 5797] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5797, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 [ 89.121174][ T5797] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 89.121190][ T5797] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 89.121209][ T5797] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 89.121223][ T5797] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 89.121235][ T5797] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 89.121246][ T5797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./17/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./17") = 0 mkdir("./18", 0777) = 0 [ 89.121258][ T5797] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.121286][ T5797] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5804 attached , child_tidptr=0x55556fc096d0) = 5804 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5804] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5804] <... set_robust_list resumed>) = 0 [pid 5804] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5804] chdir("./18") = 0 [pid 5804] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5804] setpgid(0, 0) = 0 [pid 5804] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5804] write(3, "1000", 4) = 4 [pid 5804] close(3) = 0 [pid 5804] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5804] write(1, "executing program\n", 18) = 18 executing program [pid 5804] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5804] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5804] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5804] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=48}) = 0 [pid 5804] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5804] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5804] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x30\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5804] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5804] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5804] write(6, "6", 1) = 1 [ 89.752494][ T5804] FAULT_INJECTION: forcing a failure. [ 89.752494][ T5804] name failslab, interval 1, probability 0, space 0, times 0 [ 89.752526][ T5804] CPU: 0 UID: 0 PID: 5804 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 89.752548][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.752559][ T5804] Call Trace: [ 89.752567][ T5804] [ 89.752575][ T5804] dump_stack_lvl+0xe8/0x150 [ 89.752609][ T5804] should_fail_ex+0x410/0x560 [ 89.752637][ T5804] should_failslab+0xa8/0x100 [ 89.752662][ T5804] ? dst_alloc+0x105/0x170 [ 89.752692][ T5804] kmem_cache_alloc_noprof+0xa1/0x600 [ 89.752726][ T5804] ? dst_alloc+0x105/0x170 [ 89.752767][ T5804] ? fib_lookup+0x76/0x440 [ 89.752798][ T5804] dst_alloc+0x105/0x170 [ 89.752830][ T5804] ip_route_input_rcu+0x20ca/0x3190 [ 89.752872][ T5804] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 89.752934][ T5804] ? tc_run+0x50f/0x750 [ 89.752954][ T5804] ? ip_route_input_noref+0xad/0x270 [pid 5804] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 89.752986][ T5804] ip_route_input_noref+0x17c/0x270 [ 89.753018][ T5804] ? __pfx_ip_route_input_noref+0x10/0x10 [ 89.753053][ T5804] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 89.753079][ T5804] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 89.753105][ T5804] ip_rcv_finish_core+0x593/0x1c00 [ 89.753142][ T5804] ip_rcv_finish+0x14c/0x2a0 [ 89.753170][ T5804] NF_HOOK+0x336/0x3c0 [ 89.753196][ T5804] ? __pfx_ip_rcv_finish+0x10/0x10 [ 89.753220][ T5804] ? NF_HOOK+0x9e/0x3c0 [pid 5804] exit_group(0) = ? [ 89.753242][ T5804] ? __pfx_NF_HOOK+0x10/0x10 [ 89.753267][ T5804] ? __pfx_sock_wfree+0x10/0x10 [ 89.753291][ T5804] ? ip_rcv_core+0x7fa/0xd50 [ 89.753321][ T5804] ? netif_receive_skb+0x102/0xbf0 [ 89.753340][ T5804] ? __pfx_ip_rcv+0x10/0x10 [ 89.753363][ T5804] netif_receive_skb+0x45b/0xbf0 [ 89.753387][ T5804] ? __pfx_netif_receive_skb+0x10/0x10 [ 89.753411][ T5804] ? tun_rx_batched+0x185/0x790 [ 89.753435][ T5804] tun_rx_batched+0x1de/0x790 [ 89.753461][ T5804] ? __pfx_tun_rx_batched+0x10/0x10 [ 89.753482][ T5804] ? lock_acquire+0x115/0x350 [ 89.753509][ T5804] ? tun_get_user+0x23ba/0x44d0 [ 89.753529][ T5804] ? __local_bh_enable_ip+0xd6/0x140 [ 89.753554][ T5804] ? tun_get_user+0x27b0/0x44d0 [ 89.753576][ T5804] tun_get_user+0x2be0/0x44d0 [ 89.753610][ T5804] ? tun_get_user+0x27b0/0x44d0 [ 89.753629][ T5804] ? aa_file_perm+0x18b/0x15f0 [ 89.753659][ T5804] ? aa_file_perm+0x4ed/0x15f0 [ 89.753683][ T5804] ? __pfx_tun_get_user+0x10/0x10 [ 89.753706][ T5804] ? __lock_acquire+0x747/0x2de0 [ 89.753731][ T5804] ? finish_task_switch+0x40e/0xc60 [ 89.753760][ T5804] ? ref_tracker_alloc+0x341/0x4b0 [ 89.753785][ T5804] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 89.753811][ T5804] ? lock_acquire+0x115/0x350 [ 89.753830][ T5804] ? tun_get+0x1c/0x2f0 [ 89.753855][ T5804] ? tun_get+0x1c/0x2f0 [ 89.753893][ T5804] ? tun_get+0x1c/0x2f0 [ 89.753926][ T5804] tun_chr_write_iter+0x113/0x200 [ 89.753951][ T5804] vfs_write+0x612/0xba0 [ 89.753989][ T5804] ? __pfx_vfs_write+0x10/0x10 [ 89.754028][ T5804] ? _raw_spin_unlock_irq+0x23/0x50 [ 89.754059][ T5804] ksys_write+0x150/0x270 [ 89.754092][ T5804] ? __pfx_ksys_write+0x10/0x10 [ 89.754152][ T5804] do_syscall_64+0x166/0x520 [ 89.754175][ T5804] ? trace_irq_disable+0x3b/0x140 [ 89.754196][ T5804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.754218][ T5804] ? clear_bhb_loop+0x70/0xc0 [ 89.754245][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.754266][ T5804] RIP: 0033:0x7f6c0bc30879 [ 89.754286][ T5804] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 89.754303][ T5804] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 89.754327][ T5804] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 89.754342][ T5804] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [pid 5804] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5804, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./18/binderfs") = 0 [ 89.754356][ T5804] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 89.754368][ T5804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 89.754381][ T5804] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 89.754412][ T5804] getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./18") = 0 mkdir("./19", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5814 attached , child_tidptr=0x55556fc096d0) = 5814 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5814] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5814] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5814] chdir("./19") = 0 [pid 5814] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5814] setpgid(0, 0) = 0 [pid 5814] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5814] write(3, "1000", 4) = 4 [pid 5814] close(3) = 0 [pid 5814] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5814] write(1, "executing program\n", 18) = 18 executing program [pid 5814] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5814] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5814] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5814] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=49}) = 0 [pid 5814] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5814] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5814] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x31\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5814] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5814] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5814] write(6, "6", 1) = 1 [pid 5814] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5814] exit_group(0) = ? [pid 5814] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5814, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./19/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./19") = 0 mkdir("./20", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5825 attached [pid 5825] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5825 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5825] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5825] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5825] chdir("./20") = 0 [pid 5825] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5825] setpgid(0, 0) = 0 [pid 5825] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5825] write(3, "1000", 4) = 4 [pid 5825] close(3) = 0 [pid 5825] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5825] write(1, "executing program\n", 18) = 18 [pid 5825] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5825] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5825] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5825] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=50}) = 0 [pid 5825] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5825] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5825] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x32\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5825] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5825] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5825] write(6, "6", 1) = 1 [pid 5825] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5825] exit_group(0) = ? [pid 5825] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5825, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./20/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./20") = 0 mkdir("./21", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5837 attached [pid 5837] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5837] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5837 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5837] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5837] chdir("./21") = 0 [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5837] setpgid(0, 0) = 0 [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5837] write(3, "1000", 4) = 4 [pid 5837] close(3) = 0 [pid 5837] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5837] write(1, "executing program\n", 18) = 18 [pid 5837] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5837] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5837] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5837] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=51}) = 0 [pid 5837] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5837] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5837] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x33\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5837] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5837] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5837] write(6, "6", 1) = 1 [ 90.977638][ T5837] FAULT_INJECTION: forcing a failure. [ 90.977638][ T5837] name failslab, interval 1, probability 0, space 0, times 0 [ 90.977668][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 90.977689][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.977700][ T5837] Call Trace: [ 90.977707][ T5837] [ 90.977716][ T5837] dump_stack_lvl+0xe8/0x150 [ 90.977747][ T5837] should_fail_ex+0x410/0x560 [pid 5837] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5837] exit_group(0) = ? [ 90.977774][ T5837] should_failslab+0xa8/0x100 [ 90.977798][ T5837] ? dst_alloc+0x105/0x170 [ 90.977838][ T5837] kmem_cache_alloc_noprof+0xa1/0x600 [ 90.977870][ T5837] ? dst_alloc+0x105/0x170 [ 90.977899][ T5837] ? fib_lookup+0x76/0x440 [ 90.977929][ T5837] dst_alloc+0x105/0x170 [ 90.977962][ T5837] ip_route_input_rcu+0x20ca/0x3190 [ 90.978001][ T5837] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 90.978055][ T5837] ? tc_run+0x50f/0x750 [ 90.978074][ T5837] ? ip_route_input_noref+0xad/0x270 [ 90.978106][ T5837] ip_route_input_noref+0x17c/0x270 [ 90.978139][ T5837] ? __pfx_ip_route_input_noref+0x10/0x10 [ 90.978173][ T5837] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 90.978198][ T5837] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 90.978224][ T5837] ip_rcv_finish_core+0x593/0x1c00 [ 90.978261][ T5837] ip_rcv_finish+0x14c/0x2a0 [ 90.978288][ T5837] NF_HOOK+0x336/0x3c0 [ 90.978314][ T5837] ? __pfx_ip_rcv_finish+0x10/0x10 [ 90.978337][ T5837] ? NF_HOOK+0x9e/0x3c0 [ 90.978360][ T5837] ? __pfx_NF_HOOK+0x10/0x10 [ 90.978385][ T5837] ? __pfx_sock_wfree+0x10/0x10 [ 90.978409][ T5837] ? ip_rcv_core+0x7fa/0xd50 [ 90.978439][ T5837] ? netif_receive_skb+0x102/0xbf0 [ 90.978458][ T5837] ? __pfx_ip_rcv+0x10/0x10 [ 90.978481][ T5837] netif_receive_skb+0x45b/0xbf0 [ 90.978511][ T5837] ? __pfx_netif_receive_skb+0x10/0x10 [ 90.978546][ T5837] ? tun_rx_batched+0x185/0x790 [ 90.978586][ T5837] tun_rx_batched+0x1de/0x790 [ 90.978615][ T5837] ? __pfx_tun_rx_batched+0x10/0x10 [ 90.978638][ T5837] ? lock_acquire+0x115/0x350 [ 90.978665][ T5837] ? tun_get_user+0x23ba/0x44d0 [ 90.978687][ T5837] ? __local_bh_enable_ip+0xd6/0x140 [ 90.978713][ T5837] ? tun_get_user+0x27b0/0x44d0 [ 90.978737][ T5837] tun_get_user+0x2be0/0x44d0 [ 90.978773][ T5837] ? tun_get_user+0x27b0/0x44d0 [ 90.978794][ T5837] ? aa_file_perm+0x18b/0x15f0 [ 90.978833][ T5837] ? aa_file_perm+0x4ed/0x15f0 [ 90.978859][ T5837] ? __pfx_tun_get_user+0x10/0x10 [ 90.978884][ T5837] ? __lock_acquire+0x747/0x2de0 [ 90.978911][ T5837] ? finish_task_switch+0x40e/0xc60 [ 90.978943][ T5837] ? ref_tracker_alloc+0x341/0x4b0 [ 90.978970][ T5837] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 90.978997][ T5837] ? lock_acquire+0x115/0x350 [ 90.979018][ T5837] ? tun_get+0x1c/0x2f0 [ 90.979045][ T5837] ? tun_get+0x1c/0x2f0 [ 90.979066][ T5837] ? tun_get+0x1c/0x2f0 [ 90.979092][ T5837] tun_chr_write_iter+0x113/0x200 [ 90.979116][ T5837] vfs_write+0x612/0xba0 [ 90.979155][ T5837] ? __pfx_vfs_write+0x10/0x10 [ 90.979194][ T5837] ? _raw_spin_unlock_irq+0x23/0x50 [ 90.979225][ T5837] ksys_write+0x150/0x270 [ 90.979257][ T5837] ? __pfx_ksys_write+0x10/0x10 [ 90.979299][ T5837] do_syscall_64+0x166/0x520 [ 90.979322][ T5837] ? trace_irq_disable+0x3b/0x140 [ 90.979342][ T5837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.979362][ T5837] ? clear_bhb_loop+0x70/0xc0 [ 90.979387][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.979408][ T5837] RIP: 0033:0x7f6c0bc30879 [ 90.979426][ T5837] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 90.979442][ T5837] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 90.979463][ T5837] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 90.979478][ T5837] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 90.979491][ T5837] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 90.979503][ T5837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 5837] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5837, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 90.979515][ T5837] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 90.979545][ T5837] unlink("./21/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./21") = 0 mkdir("./22", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5850 attached [pid 5850] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5850 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5850] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5850] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5850] chdir("./22") = 0 [pid 5850] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5850] setpgid(0, 0) = 0 [pid 5850] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5850] write(3, "1000", 4) = 4 [pid 5850] close(3) = 0 [pid 5850] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5850] write(1, "executing program\n", 18) = 18 [pid 5850] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5850] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5850] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5850] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=52}) = 0 [pid 5850] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5850] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5850] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x34\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5850] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5850] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5850] write(6, "6", 1) = 1 [pid 5850] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 91.665710][ T5850] FAULT_INJECTION: forcing a failure. [ 91.665710][ T5850] name failslab, interval 1, probability 0, space 0, times 0 [ 91.665746][ T5850] CPU: 0 UID: 0 PID: 5850 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 91.665772][ T5850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.665795][ T5850] Call Trace: [ 91.665804][ T5850] [ 91.665813][ T5850] dump_stack_lvl+0xe8/0x150 [pid 5850] exit_group(0) = ? [ 91.665851][ T5850] should_fail_ex+0x410/0x560 [ 91.665883][ T5850] should_failslab+0xa8/0x100 [ 91.665910][ T5850] ? dst_alloc+0x105/0x170 [ 91.665944][ T5850] kmem_cache_alloc_noprof+0xa1/0x600 [ 91.665987][ T5850] ? dst_alloc+0x105/0x170 [ 91.666021][ T5850] ? fib_lookup+0x76/0x440 [ 91.666057][ T5850] dst_alloc+0x105/0x170 [ 91.666094][ T5850] ip_route_input_rcu+0x20ca/0x3190 [ 91.666141][ T5850] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 91.666205][ T5850] ? tc_run+0x50f/0x750 [ 91.666234][ T5850] ? ip_route_input_noref+0xad/0x270 [ 91.666271][ T5850] ip_route_input_noref+0x17c/0x270 [ 91.666310][ T5850] ? __pfx_ip_route_input_noref+0x10/0x10 [ 91.666350][ T5850] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 91.666380][ T5850] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 91.666411][ T5850] ip_rcv_finish_core+0x593/0x1c00 [ 91.666454][ T5850] ip_rcv_finish+0x14c/0x2a0 [ 91.666486][ T5850] NF_HOOK+0x336/0x3c0 [ 91.666516][ T5850] ? __pfx_ip_rcv_finish+0x10/0x10 [ 91.666544][ T5850] ? NF_HOOK+0x9e/0x3c0 [ 91.666571][ T5850] ? __pfx_NF_HOOK+0x10/0x10 [ 91.666600][ T5850] ? __pfx_sock_wfree+0x10/0x10 [ 91.666629][ T5850] ? ip_rcv_core+0x7fa/0xd50 [ 91.666664][ T5850] ? netif_receive_skb+0x102/0xbf0 [ 91.666686][ T5850] ? __pfx_ip_rcv+0x10/0x10 [ 91.666713][ T5850] netif_receive_skb+0x45b/0xbf0 [ 91.666741][ T5850] ? __pfx_netif_receive_skb+0x10/0x10 [ 91.666770][ T5850] ? tun_rx_batched+0x185/0x790 [ 91.666806][ T5850] tun_rx_batched+0x1de/0x790 [ 91.666838][ T5850] ? __pfx_tun_rx_batched+0x10/0x10 [ 91.666863][ T5850] ? lock_acquire+0x115/0x350 [ 91.666894][ T5850] ? tun_get_user+0x23ba/0x44d0 [ 91.666917][ T5850] ? __local_bh_enable_ip+0xd6/0x140 [ 91.666947][ T5850] ? tun_get_user+0x27b0/0x44d0 [ 91.666973][ T5850] tun_get_user+0x2be0/0x44d0 [ 91.667012][ T5850] ? tun_get_user+0x27b0/0x44d0 [ 91.667035][ T5850] ? aa_file_perm+0x18b/0x15f0 [ 91.667074][ T5850] ? aa_file_perm+0x4ed/0x15f0 [ 91.667103][ T5850] ? __pfx_tun_get_user+0x10/0x10 [ 91.667129][ T5850] ? __lock_acquire+0x747/0x2de0 [pid 5850] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5850, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./22", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 91.667160][ T5850] ? finish_task_switch+0x40e/0xc60 [ 91.667194][ T5850] ? ref_tracker_alloc+0x341/0x4b0 [ 91.667223][ T5850] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 91.667253][ T5850] ? lock_acquire+0x115/0x350 [ 91.667275][ T5850] ? tun_get+0x1c/0x2f0 [ 91.667304][ T5850] ? tun_get+0x1c/0x2f0 [ 91.667327][ T5850] ? tun_get+0x1c/0x2f0 [ 91.667356][ T5850] tun_chr_write_iter+0x113/0x200 [ 91.667383][ T5850] vfs_write+0x612/0xba0 [ 91.667437][ T5850] ? __pfx_vfs_write+0x10/0x10 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./22/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./22/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./22") = 0 mkdir("./23", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 91.667479][ T5850] ? _raw_spin_unlock_irq+0x23/0x50 [ 91.667511][ T5850] ksys_write+0x150/0x270 [ 91.667546][ T5850] ? __pfx_ksys_write+0x10/0x10 [ 91.667590][ T5850] do_syscall_64+0x166/0x520 [ 91.667614][ T5850] ? trace_irq_disable+0x3b/0x140 [ 91.667636][ T5850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.667658][ T5850] ? clear_bhb_loop+0x70/0xc0 [ 91.667685][ T5850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.667707][ T5850] RIP: 0033:0x7f6c0bc30879 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 5859 ci-upstream-kasan-gce/strace-static-x86_64: Process 5859 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5859] set_robust_list(0x55556fc096e0, 24) = 0 [ 91.667727][ T5850] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 91.667745][ T5850] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 91.667768][ T5850] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 91.667792][ T5850] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 91.667806][ T5850] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 5859] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5859] chdir("./23") = 0 [pid 5859] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5859] setpgid(0, 0) = 0 [pid 5859] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5859] write(3, "1000", 4) = 4 [pid 5859] close(3) = 0 [pid 5859] symlink("/dev/binderfs", "./binderfs") = 0 [ 91.667818][ T5850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 91.667832][ T5850] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 91.667864][ T5850] [pid 5859] write(1, "executing program\n", 18) = 18 executing program [pid 5859] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5859] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5859] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5859] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=53}) = 0 [pid 5859] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5859] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5859] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x35\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5859] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5859] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5859] write(6, "6", 1) = 1 [pid 5859] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 92.200385][ T5859] FAULT_INJECTION: forcing a failure. [ 92.200385][ T5859] name failslab, interval 1, probability 0, space 0, times 0 [ 92.200416][ T5859] CPU: 0 UID: 0 PID: 5859 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 92.200438][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.200450][ T5859] Call Trace: [ 92.200458][ T5859] [ 92.200467][ T5859] dump_stack_lvl+0xe8/0x150 [ 92.200501][ T5859] should_fail_ex+0x410/0x560 [pid 5859] exit_group(0) = ? [ 92.200528][ T5859] should_failslab+0xa8/0x100 [ 92.200552][ T5859] ? dst_alloc+0x105/0x170 [ 92.200582][ T5859] kmem_cache_alloc_noprof+0xa1/0x600 [ 92.200615][ T5859] ? dst_alloc+0x105/0x170 [ 92.200644][ T5859] ? fib_lookup+0x76/0x440 [ 92.200677][ T5859] dst_alloc+0x105/0x170 [ 92.200711][ T5859] ip_route_input_rcu+0x20ca/0x3190 [ 92.200762][ T5859] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 92.200819][ T5859] ? tc_run+0x50f/0x750 [ 92.200840][ T5859] ? ip_route_input_noref+0xad/0x270 [ 92.200874][ T5859] ip_route_input_noref+0x17c/0x270 [ 92.200909][ T5859] ? __pfx_ip_route_input_noref+0x10/0x10 [ 92.200945][ T5859] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 92.200972][ T5859] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 92.201003][ T5859] ip_rcv_finish_core+0x593/0x1c00 [ 92.201042][ T5859] ip_rcv_finish+0x14c/0x2a0 [ 92.201071][ T5859] NF_HOOK+0x336/0x3c0 [ 92.201099][ T5859] ? __pfx_ip_rcv_finish+0x10/0x10 [ 92.201124][ T5859] ? NF_HOOK+0x9e/0x3c0 [ 92.201148][ T5859] ? __pfx_NF_HOOK+0x10/0x10 [ 92.201174][ T5859] ? __pfx_sock_wfree+0x10/0x10 [ 92.201199][ T5859] ? ip_rcv_core+0x7fa/0xd50 [ 92.201232][ T5859] ? netif_receive_skb+0x102/0xbf0 [ 92.201251][ T5859] ? __pfx_ip_rcv+0x10/0x10 [ 92.201276][ T5859] netif_receive_skb+0x45b/0xbf0 [ 92.201302][ T5859] ? __pfx_netif_receive_skb+0x10/0x10 [ 92.201328][ T5859] ? tun_rx_batched+0x185/0x790 [ 92.201352][ T5859] tun_rx_batched+0x1de/0x790 [ 92.201381][ T5859] ? __pfx_tun_rx_batched+0x10/0x10 [ 92.201404][ T5859] ? lock_acquire+0x115/0x350 [ 92.201432][ T5859] ? tun_get_user+0x23ba/0x44d0 [ 92.201453][ T5859] ? __local_bh_enable_ip+0xd6/0x140 [ 92.201480][ T5859] ? tun_get_user+0x27b0/0x44d0 [ 92.201504][ T5859] tun_get_user+0x2be0/0x44d0 [ 92.201540][ T5859] ? tun_get_user+0x27b0/0x44d0 [ 92.201560][ T5859] ? aa_file_perm+0x18b/0x15f0 [ 92.201593][ T5859] ? aa_file_perm+0x4ed/0x15f0 [ 92.201619][ T5859] ? __pfx_tun_get_user+0x10/0x10 [ 92.201643][ T5859] ? __lock_acquire+0x747/0x2de0 [ 92.201670][ T5859] ? finish_task_switch+0x40e/0xc60 [ 92.201701][ T5859] ? ref_tracker_alloc+0x341/0x4b0 [ 92.201728][ T5859] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 92.201762][ T5859] ? lock_acquire+0x115/0x350 [ 92.201782][ T5859] ? tun_get+0x1c/0x2f0 [ 92.201827][ T5859] ? tun_get+0x1c/0x2f0 [ 92.201848][ T5859] ? tun_get+0x1c/0x2f0 [ 92.201875][ T5859] tun_chr_write_iter+0x113/0x200 [ 92.201902][ T5859] vfs_write+0x612/0xba0 [ 92.201943][ T5859] ? __pfx_vfs_write+0x10/0x10 [ 92.201986][ T5859] ? _raw_spin_unlock_irq+0x23/0x50 [ 92.202019][ T5859] ksys_write+0x150/0x270 [ 92.202053][ T5859] ? __pfx_ksys_write+0x10/0x10 [ 92.202097][ T5859] do_syscall_64+0x166/0x520 [ 92.202120][ T5859] ? trace_irq_disable+0x3b/0x140 [ 92.202142][ T5859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.202164][ T5859] ? clear_bhb_loop+0x70/0xc0 [ 92.202191][ T5859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.202213][ T5859] RIP: 0033:0x7f6c0bc30879 [ 92.202233][ T5859] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 92.202250][ T5859] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.202274][ T5859] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 92.202289][ T5859] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 92.202303][ T5859] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 92.202316][ T5859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 5859] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5859, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [ 92.202330][ T5859] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 92.202361][ T5859] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./23", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./23/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./23/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./23") = 0 mkdir("./24", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5873 attached , child_tidptr=0x55556fc096d0) = 5873 [pid 5873] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5873] <... set_robust_list resumed>) = 0 [pid 5873] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5873] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5873] chdir("./24") = 0 [pid 5873] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5873] setpgid(0, 0) = 0 [pid 5873] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5873] write(3, "1000", 4) = 4 [pid 5873] close(3) = 0 [pid 5873] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5873] write(1, "executing program\n", 18) = 18 executing program [pid 5873] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5873] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5873] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5873] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=54}) = 0 [pid 5873] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5873] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5873] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x36\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5873] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5873] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5873] write(6, "6", 1) = 1 [ 92.812746][ T5873] FAULT_INJECTION: forcing a failure. [ 92.812746][ T5873] name failslab, interval 1, probability 0, space 0, times 0 [ 92.812777][ T5873] CPU: 0 UID: 0 PID: 5873 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 92.812798][ T5873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.812809][ T5873] Call Trace: [ 92.812817][ T5873] [ 92.812825][ T5873] dump_stack_lvl+0xe8/0x150 [ 92.812858][ T5873] should_fail_ex+0x410/0x560 [pid 5873] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5873] exit_group(0) = ? [ 92.812885][ T5873] should_failslab+0xa8/0x100 [ 92.812909][ T5873] ? dst_alloc+0x105/0x170 [ 92.812937][ T5873] kmem_cache_alloc_noprof+0xa1/0x600 [ 92.812969][ T5873] ? dst_alloc+0x105/0x170 [ 92.812997][ T5873] ? fib_lookup+0x76/0x440 [ 92.813028][ T5873] dst_alloc+0x105/0x170 [ 92.813060][ T5873] ip_route_input_rcu+0x20ca/0x3190 [ 92.813099][ T5873] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 92.813153][ T5873] ? tc_run+0x50f/0x750 [ 92.813173][ T5873] ? ip_route_input_noref+0xad/0x270 [ 92.813204][ T5873] ip_route_input_noref+0x17c/0x270 [ 92.813238][ T5873] ? __pfx_ip_route_input_noref+0x10/0x10 [ 92.813271][ T5873] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 92.813297][ T5873] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 92.813323][ T5873] ip_rcv_finish_core+0x593/0x1c00 [ 92.813360][ T5873] ip_rcv_finish+0x14c/0x2a0 [ 92.813387][ T5873] NF_HOOK+0x336/0x3c0 [ 92.813412][ T5873] ? __pfx_ip_rcv_finish+0x10/0x10 [ 92.813435][ T5873] ? NF_HOOK+0x9e/0x3c0 [ 92.813457][ T5873] ? __pfx_NF_HOOK+0x10/0x10 [ 92.813481][ T5873] ? __pfx_sock_wfree+0x10/0x10 [ 92.813506][ T5873] ? ip_rcv_core+0x7fa/0xd50 [ 92.813536][ T5873] ? netif_receive_skb+0x102/0xbf0 [ 92.813554][ T5873] ? __pfx_ip_rcv+0x10/0x10 [ 92.813577][ T5873] netif_receive_skb+0x45b/0xbf0 [ 92.813601][ T5873] ? __pfx_netif_receive_skb+0x10/0x10 [ 92.813626][ T5873] ? tun_rx_batched+0x185/0x790 [ 92.813650][ T5873] tun_rx_batched+0x1de/0x790 [ 92.813676][ T5873] ? __pfx_tun_rx_batched+0x10/0x10 [ 92.813706][ T5873] ? lock_acquire+0x115/0x350 [ 92.813732][ T5873] ? tun_get_user+0x23ba/0x44d0 [ 92.813752][ T5873] ? __local_bh_enable_ip+0xd6/0x140 [ 92.813776][ T5873] ? tun_get_user+0x27b0/0x44d0 [ 92.813799][ T5873] tun_get_user+0x2be0/0x44d0 [ 92.813835][ T5873] ? tun_get_user+0x27b0/0x44d0 [ 92.813854][ T5873] ? aa_file_perm+0x18b/0x15f0 [ 92.813883][ T5873] ? aa_file_perm+0x4ed/0x15f0 [ 92.813908][ T5873] ? __pfx_tun_get_user+0x10/0x10 [ 92.813930][ T5873] ? __lock_acquire+0x747/0x2de0 [ 92.813954][ T5873] ? finish_task_switch+0x40e/0xc60 [ 92.813982][ T5873] ? ref_tracker_alloc+0x341/0x4b0 [ 92.814007][ T5873] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 92.814031][ T5873] ? lock_acquire+0x115/0x350 [ 92.814050][ T5873] ? tun_get+0x1c/0x2f0 [ 92.814075][ T5873] ? tun_get+0x1c/0x2f0 [ 92.814094][ T5873] ? tun_get+0x1c/0x2f0 [ 92.814118][ T5873] tun_chr_write_iter+0x113/0x200 [ 92.814140][ T5873] vfs_write+0x612/0xba0 [ 92.814176][ T5873] ? __pfx_vfs_write+0x10/0x10 [ 92.814212][ T5873] ? _raw_spin_unlock_irq+0x23/0x50 [ 92.814240][ T5873] ksys_write+0x150/0x270 [ 92.814270][ T5873] ? __pfx_ksys_write+0x10/0x10 [ 92.814309][ T5873] do_syscall_64+0x166/0x520 [ 92.814330][ T5873] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.814350][ T5873] ? clear_bhb_loop+0x70/0xc0 [ 92.814373][ T5873] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.814392][ T5873] RIP: 0033:0x7f6c0bc30879 [ 92.814410][ T5873] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [pid 5873] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5873, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./24", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./24/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 92.814425][ T5873] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.814445][ T5873] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 92.814459][ T5873] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 92.814471][ T5873] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 92.814481][ T5873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 92.814493][ T5873] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 unlink("./24/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./24") = 0 mkdir("./25", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 92.814520][ T5873] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5879 attached , child_tidptr=0x55556fc096d0) = 5879 [pid 5879] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5879] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5879] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5879] chdir("./25") = 0 [pid 5879] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5879] setpgid(0, 0) = 0 [pid 5879] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5879] write(3, "1000", 4) = 4 [pid 5879] close(3) = 0 [pid 5879] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5879] write(1, "executing program\n", 18) = 18 [pid 5879] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5879] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5879] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5879] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=55}) = 0 [pid 5879] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5879] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5879] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x37\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5879] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5879] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5879] write(6, "6", 1) = 1 [pid 5879] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = -1 EFAULT (Bad address) [ 93.395065][ T5879] FAULT_INJECTION: forcing a failure. [ 93.395065][ T5879] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 93.395099][ T5879] CPU: 0 UID: 0 PID: 5879 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 93.395122][ T5879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.395133][ T5879] Call Trace: [ 93.395141][ T5879] [ 93.395150][ T5879] dump_stack_lvl+0xe8/0x150 [pid 5879] exit_group(0) = ? [ 93.395184][ T5879] should_fail_ex+0x410/0x560 [ 93.395211][ T5879] _copy_from_iter+0x1d3/0x1660 [ 93.395233][ T5879] ? skb_set_owner_w+0x263/0x3d0 [ 93.395271][ T5879] ? __pfx__copy_from_iter+0x10/0x10 [ 93.395301][ T5879] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 93.395335][ T5879] skb_copy_datagram_from_iter+0xe6/0x720 [ 93.395370][ T5879] ? skb_put+0x112/0x210 [ 93.395397][ T5879] tun_get_user+0xc7f/0x44d0 [ 93.395433][ T5879] ? aa_file_perm+0x18b/0x15f0 [ 93.395465][ T5879] ? aa_file_perm+0x4ed/0x15f0 [ 93.395491][ T5879] ? __pfx_tun_get_user+0x10/0x10 [ 93.395515][ T5879] ? __lock_acquire+0x747/0x2de0 [ 93.395543][ T5879] ? finish_task_switch+0x40e/0xc60 [ 93.395593][ T5879] ? ref_tracker_alloc+0x341/0x4b0 [ 93.395622][ T5879] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 93.395662][ T5879] ? lock_acquire+0x115/0x350 [ 93.395695][ T5879] ? tun_get+0x1c/0x2f0 [ 93.395722][ T5879] ? tun_get+0x1c/0x2f0 [ 93.395743][ T5879] ? tun_get+0x1c/0x2f0 [ 93.395768][ T5879] tun_chr_write_iter+0x113/0x200 [ 93.395793][ T5879] vfs_write+0x612/0xba0 [ 93.395833][ T5879] ? __pfx_vfs_write+0x10/0x10 [ 93.395872][ T5879] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.395902][ T5879] ksys_write+0x150/0x270 [ 93.395934][ T5879] ? __pfx_ksys_write+0x10/0x10 [ 93.395975][ T5879] do_syscall_64+0x166/0x520 [ 93.396015][ T5879] ? trace_irq_disable+0x3b/0x140 [ 93.396037][ T5879] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.396078][ T5879] ? clear_bhb_loop+0x70/0xc0 [ 93.396105][ T5879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.396128][ T5879] RIP: 0033:0x7f6c0bc30879 [ 93.396148][ T5879] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 93.396166][ T5879] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.396190][ T5879] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 93.396207][ T5879] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 93.396221][ T5879] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 93.396234][ T5879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 93.396248][ T5879] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 93.396279][ T5879] [pid 5879] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5879, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./25", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./25/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./25/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./25") = 0 mkdir("./26", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5891 attached , child_tidptr=0x55556fc096d0) = 5891 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5891] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5891] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5891] chdir("./26") = 0 [pid 5891] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5891] setpgid(0, 0) = 0 [pid 5891] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5891] write(3, "1000", 4) = 4 [pid 5891] close(3) = 0 [pid 5891] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5891] write(1, "executing program\n", 18) = 18 [pid 5891] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5891] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5891] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5891] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=56}) = 0 [pid 5891] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5891] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5891] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x38\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5891] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5891] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5891] write(6, "6", 1) = 1 [pid 5891] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5891] exit_group(0) = ? [pid 5891] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5891, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./26", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./26/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./26/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./26") = 0 mkdir("./27", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5904 attached [pid 5904] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5904 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5904] <... set_robust_list resumed>) = 0 [pid 5904] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5904] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5904] chdir("./27") = 0 [pid 5904] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5904] setpgid(0, 0) = 0 [pid 5904] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5904] write(3, "1000", 4) = 4 [pid 5904] close(3) = 0 [pid 5904] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5904] write(1, "executing program\n", 18) = 18 [pid 5904] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5904] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5904] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5904] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=57}) = 0 [pid 5904] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5904] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5904] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x39\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5904] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5904] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5904] write(6, "6", 1) = 1 [pid 5904] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5904] exit_group(0) = ? [pid 5904] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5904, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./27", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./27/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./27/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./27") = 0 mkdir("./28", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5918 attached , child_tidptr=0x55556fc096d0) = 5918 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5918] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5918] <... set_robust_list resumed>) = 0 [pid 5918] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5918] chdir("./28") = 0 [pid 5918] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5918] setpgid(0, 0) = 0 [pid 5918] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5918] write(3, "1000", 4) = 4 [pid 5918] close(3) = 0 executing program [pid 5918] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5918] write(1, "executing program\n", 18) = 18 [pid 5918] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5918] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5918] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5918] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=58}) = 0 [pid 5918] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5918] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5918] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x3a\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5918] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5918] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5918] write(6, "6", 1) = 1 [pid 5918] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 94.568314][ T5918] FAULT_INJECTION: forcing a failure. [ 94.568314][ T5918] name failslab, interval 1, probability 0, space 0, times 0 [ 94.568349][ T5918] CPU: 0 UID: 0 PID: 5918 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 94.568374][ T5918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.568387][ T5918] Call Trace: [ 94.568395][ T5918] [ 94.568405][ T5918] dump_stack_lvl+0xe8/0x150 [pid 5918] exit_group(0) = ? [ 94.568442][ T5918] should_fail_ex+0x410/0x560 [ 94.568473][ T5918] should_failslab+0xa8/0x100 [ 94.568500][ T5918] ? dst_alloc+0x105/0x170 [ 94.568534][ T5918] kmem_cache_alloc_noprof+0xa1/0x600 [ 94.568570][ T5918] ? dst_alloc+0x105/0x170 [ 94.568603][ T5918] ? fib_lookup+0x76/0x440 [ 94.568639][ T5918] dst_alloc+0x105/0x170 [ 94.568677][ T5918] ip_route_input_rcu+0x20ca/0x3190 [ 94.568723][ T5918] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 94.568787][ T5918] ? tc_run+0x50f/0x750 [ 94.568811][ T5918] ? ip_route_input_noref+0xad/0x270 [ 94.568848][ T5918] ip_route_input_noref+0x17c/0x270 [ 94.568887][ T5918] ? __pfx_ip_route_input_noref+0x10/0x10 [ 94.568927][ T5918] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 94.568957][ T5918] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 94.568988][ T5918] ip_rcv_finish_core+0x593/0x1c00 [ 94.569032][ T5918] ip_rcv_finish+0x14c/0x2a0 [ 94.569075][ T5918] NF_HOOK+0x336/0x3c0 [ 94.569105][ T5918] ? __pfx_ip_rcv_finish+0x10/0x10 [ 94.569137][ T5918] ? NF_HOOK+0x9e/0x3c0 [ 94.569164][ T5918] ? __pfx_NF_HOOK+0x10/0x10 [ 94.569193][ T5918] ? __pfx_sock_wfree+0x10/0x10 [ 94.569233][ T5918] ? ip_rcv_core+0x7fa/0xd50 [ 94.569267][ T5918] ? netif_receive_skb+0x102/0xbf0 [ 94.569288][ T5918] ? __pfx_ip_rcv+0x10/0x10 [ 94.569315][ T5918] netif_receive_skb+0x45b/0xbf0 [ 94.569343][ T5918] ? __pfx_netif_receive_skb+0x10/0x10 [ 94.569382][ T5918] ? tun_rx_batched+0x185/0x790 [ 94.569407][ T5918] tun_rx_batched+0x1de/0x790 [ 94.569435][ T5918] ? __pfx_tun_rx_batched+0x10/0x10 [ 94.569458][ T5918] ? lock_acquire+0x115/0x350 [ 94.569486][ T5918] ? tun_get_user+0x23ba/0x44d0 [ 94.569508][ T5918] ? __local_bh_enable_ip+0xd6/0x140 [ 94.569535][ T5918] ? tun_get_user+0x27b0/0x44d0 [ 94.569559][ T5918] tun_get_user+0x2be0/0x44d0 [ 94.569594][ T5918] ? tun_get_user+0x27b0/0x44d0 [ 94.569615][ T5918] ? aa_file_perm+0x18b/0x15f0 [ 94.569647][ T5918] ? aa_file_perm+0x4ed/0x15f0 [ 94.569673][ T5918] ? __pfx_tun_get_user+0x10/0x10 [ 94.569697][ T5918] ? __lock_acquire+0x747/0x2de0 [ 94.569724][ T5918] ? finish_task_switch+0x40e/0xc60 [ 94.569755][ T5918] ? ref_tracker_alloc+0x341/0x4b0 [ 94.569782][ T5918] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 94.569810][ T5918] ? lock_acquire+0x115/0x350 [ 94.569830][ T5918] ? tun_get+0x1c/0x2f0 [ 94.569857][ T5918] ? tun_get+0x1c/0x2f0 [ 94.569877][ T5918] ? tun_get+0x1c/0x2f0 [ 94.569903][ T5918] tun_chr_write_iter+0x113/0x200 [ 94.569927][ T5918] vfs_write+0x612/0xba0 [ 94.569966][ T5918] ? __pfx_vfs_write+0x10/0x10 [ 94.570006][ T5918] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.570036][ T5918] ksys_write+0x150/0x270 [ 94.570078][ T5918] ? __pfx_ksys_write+0x10/0x10 [ 94.570119][ T5918] do_syscall_64+0x166/0x520 [ 94.570142][ T5918] ? trace_irq_disable+0x3b/0x140 [ 94.570162][ T5918] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.570183][ T5918] ? clear_bhb_loop+0x70/0xc0 [ 94.570208][ T5918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.570228][ T5918] RIP: 0033:0x7f6c0bc30879 [ 94.570246][ T5918] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 94.570263][ T5918] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.570285][ T5918] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 94.570300][ T5918] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 94.570312][ T5918] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 5918] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5918, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./28", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./28/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./28/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./28") = 0 mkdir("./29", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5927 attached [pid 5927] set_robust_list(0x55556fc096e0, 24) = 0 [ 94.570324][ T5918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 94.570337][ T5918] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 94.570366][ T5918] [pid 5927] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5927 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5927] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5927] chdir("./29") = 0 [pid 5927] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5927] setpgid(0, 0) = 0 [pid 5927] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5927] write(3, "1000", 4) = 4 [pid 5927] close(3) = 0 [pid 5927] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5927] write(1, "executing program\n", 18) = 18 executing program [pid 5927] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5927] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5927] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5927] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=59}) = 0 [pid 5927] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5927] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5927] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x3b\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5927] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5927] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5927] write(6, "6", 1) = 1 [pid 5927] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5927] exit_group(0) = ? [pid 5927] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5927, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./29", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./29/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./29/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./29") = 0 mkdir("./30", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 5934 ci-upstream-kasan-gce/strace-static-x86_64: Process 5934 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5934] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5934] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5934] chdir("./30") = 0 [pid 5934] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5934] setpgid(0, 0) = 0 [pid 5934] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5934] write(3, "1000", 4) = 4 [pid 5934] close(3) = 0 [pid 5934] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5934] write(1, "executing program\n", 18) = 18 [pid 5934] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5934] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5934] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5934] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=60}) = 0 [pid 5934] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5934] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5934] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x3c\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5934] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5934] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5934] write(6, "6", 1) = 1 [pid 5934] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5934] exit_group(0) = ? [pid 5934] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5934, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./30", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./30/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./30/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./30") = 0 mkdir("./31", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5942 attached [pid 5942] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5942] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5942 [pid 5942] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5942] chdir("./31" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5942] <... chdir resumed>) = 0 [pid 5942] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5942] setpgid(0, 0) = 0 [pid 5942] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5942] write(3, "1000", 4) = 4 [pid 5942] close(3) = 0 [pid 5942] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5942] write(1, "executing program\n", 18) = 18 [pid 5942] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5942] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5942] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5942] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=61}) = 0 [pid 5942] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5942] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5942] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x3d\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5942] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5942] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5942] write(6, "6", 1) = 1 [pid 5942] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5942] exit_group(0) = ? [pid 5942] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5942, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./31", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./31/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./31/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./31") = 0 mkdir("./32", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5956 attached [pid 5956] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5956] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5956 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5956] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5956] chdir("./32") = 0 [pid 5956] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5956] setpgid(0, 0) = 0 [pid 5956] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5956] write(3, "1000", 4) = 4 [pid 5956] close(3) = 0 [pid 5956] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5956] write(1, "executing program\n", 18) = 18 executing program [pid 5956] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5956] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5956] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5956] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=62}) = 0 [pid 5956] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5956] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5956] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x3e\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5956] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5956] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5956] write(6, "6", 1) = 1 [ 95.942669][ T5956] FAULT_INJECTION: forcing a failure. [ 95.942669][ T5956] name failslab, interval 1, probability 0, space 0, times 0 [ 95.942701][ T5956] CPU: 0 UID: 0 PID: 5956 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 95.942722][ T5956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.942733][ T5956] Call Trace: [ 95.942740][ T5956] [ 95.942748][ T5956] dump_stack_lvl+0xe8/0x150 [ 95.942781][ T5956] should_fail_ex+0x410/0x560 [ 95.942806][ T5956] should_failslab+0xa8/0x100 [ 95.942829][ T5956] ? dst_alloc+0x105/0x170 [ 95.942858][ T5956] kmem_cache_alloc_noprof+0xa1/0x600 [ 95.942889][ T5956] ? dst_alloc+0x105/0x170 [ 95.942916][ T5956] ? fib_lookup+0x76/0x440 [ 95.942947][ T5956] dst_alloc+0x105/0x170 [ 95.942983][ T5956] ip_route_input_rcu+0x20ca/0x3190 [ 95.943021][ T5956] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 95.943075][ T5956] ? tc_run+0x50f/0x750 [ 95.943094][ T5956] ? ip_route_input_noref+0xad/0x270 [ 95.943145][ T5956] ip_route_input_noref+0x17c/0x270 [ 95.943180][ T5956] ? __pfx_ip_route_input_noref+0x10/0x10 [ 95.943216][ T5956] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 95.943243][ T5956] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 95.943270][ T5956] ip_rcv_finish_core+0x593/0x1c00 [ 95.943309][ T5956] ip_rcv_finish+0x14c/0x2a0 [ 95.943338][ T5956] NF_HOOK+0x336/0x3c0 [ 95.943365][ T5956] ? __pfx_ip_rcv_finish+0x10/0x10 [ 95.943389][ T5956] ? NF_HOOK+0x9e/0x3c0 [ 95.943414][ T5956] ? __pfx_NF_HOOK+0x10/0x10 [pid 5956] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5956] exit_group(0) = ? [ 95.943440][ T5956] ? __pfx_sock_wfree+0x10/0x10 [ 95.943474][ T5956] ? ip_rcv_core+0x7fa/0xd50 [ 95.943506][ T5956] ? netif_receive_skb+0x102/0xbf0 [ 95.943537][ T5956] ? __pfx_ip_rcv+0x10/0x10 [ 95.943560][ T5956] netif_receive_skb+0x45b/0xbf0 [ 95.943584][ T5956] ? __pfx_netif_receive_skb+0x10/0x10 [ 95.943608][ T5956] ? tun_rx_batched+0x185/0x790 [ 95.943632][ T5956] tun_rx_batched+0x1de/0x790 [ 95.943658][ T5956] ? __pfx_tun_rx_batched+0x10/0x10 [ 95.943680][ T5956] ? lock_acquire+0x115/0x350 [ 95.943706][ T5956] ? tun_get_user+0x23ba/0x44d0 [ 95.943726][ T5956] ? __local_bh_enable_ip+0xd6/0x140 [ 95.943751][ T5956] ? tun_get_user+0x27b0/0x44d0 [ 95.943773][ T5956] tun_get_user+0x2be0/0x44d0 [ 95.943806][ T5956] ? tun_get_user+0x27b0/0x44d0 [ 95.943826][ T5956] ? aa_file_perm+0x18b/0x15f0 [ 95.943856][ T5956] ? aa_file_perm+0x4ed/0x15f0 [ 95.943881][ T5956] ? __pfx_tun_get_user+0x10/0x10 [ 95.943904][ T5956] ? __lock_acquire+0x747/0x2de0 [ 95.943929][ T5956] ? finish_task_switch+0x40e/0xc60 [ 95.943959][ T5956] ? ref_tracker_alloc+0x341/0x4b0 [ 95.943984][ T5956] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 95.944009][ T5956] ? lock_acquire+0x115/0x350 [ 95.944028][ T5956] ? tun_get+0x1c/0x2f0 [ 95.944054][ T5956] ? tun_get+0x1c/0x2f0 [ 95.944073][ T5956] ? tun_get+0x1c/0x2f0 [ 95.944097][ T5956] tun_chr_write_iter+0x113/0x200 [ 95.944120][ T5956] vfs_write+0x612/0xba0 [ 95.944157][ T5956] ? __pfx_vfs_write+0x10/0x10 [ 95.944193][ T5956] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.944221][ T5956] ksys_write+0x150/0x270 [ 95.944252][ T5956] ? __pfx_ksys_write+0x10/0x10 [ 95.944291][ T5956] do_syscall_64+0x166/0x520 [ 95.944312][ T5956] ? trace_irq_disable+0x3b/0x140 [ 95.944330][ T5956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.944350][ T5956] ? clear_bhb_loop+0x70/0xc0 [ 95.944373][ T5956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.944409][ T5956] RIP: 0033:0x7f6c0bc30879 [ 95.944427][ T5956] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 95.944444][ T5956] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.944472][ T5956] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 95.944487][ T5956] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 95.944500][ T5956] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 95.944512][ T5956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 5956] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5956, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [ 95.944524][ T5956] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 95.944565][ T5956] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./32", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./32/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./32/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./32") = 0 mkdir("./33", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5968 attached , child_tidptr=0x55556fc096d0) = 5968 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5968] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5968] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5968] chdir("./33") = 0 [pid 5968] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5968] setpgid(0, 0) = 0 [pid 5968] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5968] write(3, "1000", 4) = 4 [pid 5968] close(3) = 0 [pid 5968] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5968] write(1, "executing program\n", 18) = 18 [pid 5968] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5968] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5968] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5968] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=63}) = 0 [pid 5968] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5968] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5968] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x3f\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5968] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5968] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5968] write(6, "6", 1) = 1 [pid 5968] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5968] exit_group(0) = ? [pid 5968] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5968, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./33", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./33/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./33/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./33") = 0 mkdir("./34", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5978 attached , child_tidptr=0x55556fc096d0) = 5978 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5978] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5978] <... set_robust_list resumed>) = 0 [pid 5978] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5978] chdir("./34") = 0 [pid 5978] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5978] setpgid(0, 0) = 0 [pid 5978] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5978] write(3, "1000", 4) = 4 [pid 5978] close(3) = 0 [pid 5978] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5978] write(1, "executing program\n", 18) = 18 executing program [pid 5978] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5978] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5978] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5978] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=64}) = 0 [pid 5978] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5978] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5978] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5978] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5978] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5978] write(6, "6", 1) = 1 [pid 5978] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 96.879179][ T5978] FAULT_INJECTION: forcing a failure. [ 96.879179][ T5978] name failslab, interval 1, probability 0, space 0, times 0 [ 96.879214][ T5978] CPU: 0 UID: 0 PID: 5978 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 96.879238][ T5978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.879252][ T5978] Call Trace: [ 96.879260][ T5978] [ 96.879270][ T5978] dump_stack_lvl+0xe8/0x150 [pid 5978] exit_group(0) = ? [ 96.879307][ T5978] should_fail_ex+0x410/0x560 [ 96.879337][ T5978] should_failslab+0xa8/0x100 [ 96.879365][ T5978] ? dst_alloc+0x105/0x170 [ 96.879408][ T5978] kmem_cache_alloc_noprof+0xa1/0x600 [ 96.879445][ T5978] ? dst_alloc+0x105/0x170 [ 96.879479][ T5978] ? fib_lookup+0x76/0x440 [ 96.879516][ T5978] dst_alloc+0x105/0x170 [ 96.879555][ T5978] ip_route_input_rcu+0x20ca/0x3190 [ 96.879601][ T5978] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 96.879665][ T5978] ? tc_run+0x50f/0x750 [ 96.879690][ T5978] ? ip_route_input_noref+0xad/0x270 [ 96.879727][ T5978] ip_route_input_noref+0x17c/0x270 [ 96.879767][ T5978] ? __pfx_ip_route_input_noref+0x10/0x10 [ 96.879807][ T5978] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 96.879838][ T5978] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 96.879869][ T5978] ip_rcv_finish_core+0x593/0x1c00 [ 96.879913][ T5978] ip_rcv_finish+0x14c/0x2a0 [ 96.879946][ T5978] NF_HOOK+0x336/0x3c0 [ 96.879976][ T5978] ? __pfx_ip_rcv_finish+0x10/0x10 [ 96.880004][ T5978] ? NF_HOOK+0x9e/0x3c0 [ 96.880031][ T5978] ? __pfx_NF_HOOK+0x10/0x10 [ 96.880060][ T5978] ? __pfx_sock_wfree+0x10/0x10 [ 96.880089][ T5978] ? ip_rcv_core+0x7fa/0xd50 [ 96.880125][ T5978] ? netif_receive_skb+0x102/0xbf0 [ 96.880147][ T5978] ? __pfx_ip_rcv+0x10/0x10 [ 96.880173][ T5978] netif_receive_skb+0x45b/0xbf0 [ 96.880202][ T5978] ? __pfx_netif_receive_skb+0x10/0x10 [ 96.880235][ T5978] ? tun_rx_batched+0x185/0x790 [ 96.880263][ T5978] tun_rx_batched+0x1de/0x790 [ 96.880294][ T5978] ? __pfx_tun_rx_batched+0x10/0x10 [ 96.880320][ T5978] ? lock_acquire+0x115/0x350 [ 96.880352][ T5978] ? tun_get_user+0x23ba/0x44d0 [ 96.880376][ T5978] ? __local_bh_enable_ip+0xd6/0x140 [ 96.880412][ T5978] ? tun_get_user+0x27b0/0x44d0 [ 96.880439][ T5978] tun_get_user+0x2be0/0x44d0 [ 96.880478][ T5978] ? tun_get_user+0x27b0/0x44d0 [ 96.880500][ T5978] ? aa_file_perm+0x18b/0x15f0 [ 96.880535][ T5978] ? aa_file_perm+0x4ed/0x15f0 [ 96.880565][ T5978] ? __pfx_tun_get_user+0x10/0x10 [ 96.880592][ T5978] ? __lock_acquire+0x747/0x2de0 [ 96.880622][ T5978] ? finish_task_switch+0x40e/0xc60 [ 96.880657][ T5978] ? ref_tracker_alloc+0x341/0x4b0 [ 96.880688][ T5978] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 96.880717][ T5978] ? lock_acquire+0x115/0x350 [ 96.880740][ T5978] ? tun_get+0x1c/0x2f0 [ 96.880770][ T5978] ? tun_get+0x1c/0x2f0 [ 96.880794][ T5978] ? tun_get+0x1c/0x2f0 [ 96.880822][ T5978] tun_chr_write_iter+0x113/0x200 [ 96.880849][ T5978] vfs_write+0x612/0xba0 [ 96.880893][ T5978] ? __pfx_vfs_write+0x10/0x10 [ 96.880937][ T5978] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.880970][ T5978] ksys_write+0x150/0x270 [ 96.881007][ T5978] ? __pfx_ksys_write+0x10/0x10 [ 96.881053][ T5978] do_syscall_64+0x166/0x520 [ 96.881077][ T5978] ? trace_irq_disable+0x3b/0x140 [ 96.881100][ T5978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.881123][ T5978] ? clear_bhb_loop+0x70/0xc0 [ 96.881152][ T5978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.881174][ T5978] RIP: 0033:0x7f6c0bc30879 [ 96.881195][ T5978] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 96.881214][ T5978] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 96.881238][ T5978] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 96.881255][ T5978] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 96.881269][ T5978] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 96.881282][ T5978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 5978] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5978, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 96.881296][ T5978] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 96.881328][ T5978] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./34", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./34/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./34/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./34") = 0 mkdir("./35", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 5992 attached [pid 5992] set_robust_list(0x55556fc096e0, 24) = 0 [pid 5992] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 5992 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 5992] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5992] chdir("./35") = 0 [pid 5992] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5992] setpgid(0, 0) = 0 [pid 5992] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5992] write(3, "1000", 4) = 4 [pid 5992] close(3) = 0 [pid 5992] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5992] write(1, "executing program\n", 18) = 18 executing program [pid 5992] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 5992] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 5992] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 5992] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=65}) = 0 [pid 5992] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 5992] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 5992] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x41\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5992] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 5992] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 5992] write(6, "6", 1) = 1 [pid 5992] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 5992] exit_group(0) = ? [pid 5992] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5992, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./35", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./35/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./35/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./35") = 0 mkdir("./36", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6002 attached , child_tidptr=0x55556fc096d0) = 6002 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6002] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6002] <... set_robust_list resumed>) = 0 [pid 6002] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6002] chdir("./36") = 0 [pid 6002] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6002] setpgid(0, 0) = 0 [pid 6002] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6002] write(3, "1000", 4) = 4 [pid 6002] close(3) = 0 [pid 6002] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6002] write(1, "executing program\n", 18) = 18 [pid 6002] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6002] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6002] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6002] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=66}) = 0 [pid 6002] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6002] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6002] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x42\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6002] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6002] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6002] write(6, "6", 1) = 1 [pid 6002] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 97.849843][ T6002] FAULT_INJECTION: forcing a failure. [ 97.849843][ T6002] name failslab, interval 1, probability 0, space 0, times 0 [ 97.849874][ T6002] CPU: 0 UID: 0 PID: 6002 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 97.849895][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.849906][ T6002] Call Trace: [ 97.849913][ T6002] [ 97.849921][ T6002] dump_stack_lvl+0xe8/0x150 [pid 6002] exit_group(0) = ? [ 97.849953][ T6002] should_fail_ex+0x410/0x560 [ 97.849979][ T6002] should_failslab+0xa8/0x100 [ 97.850002][ T6002] ? dst_alloc+0x105/0x170 [ 97.850030][ T6002] kmem_cache_alloc_noprof+0xa1/0x600 [ 97.850061][ T6002] ? dst_alloc+0x105/0x170 [ 97.850089][ T6002] ? fib_lookup+0x76/0x440 [ 97.850119][ T6002] dst_alloc+0x105/0x170 [ 97.850170][ T6002] ip_route_input_rcu+0x20ca/0x3190 [ 97.850212][ T6002] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 97.850270][ T6002] ? tc_run+0x50f/0x750 [ 97.850291][ T6002] ? ip_route_input_noref+0xad/0x270 [ 97.850324][ T6002] ip_route_input_noref+0x17c/0x270 [ 97.850370][ T6002] ? __pfx_ip_route_input_noref+0x10/0x10 [ 97.850406][ T6002] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 97.850434][ T6002] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 97.850463][ T6002] ip_rcv_finish_core+0x593/0x1c00 [ 97.850501][ T6002] ip_rcv_finish+0x14c/0x2a0 [ 97.850540][ T6002] NF_HOOK+0x336/0x3c0 [ 97.850565][ T6002] ? __pfx_ip_rcv_finish+0x10/0x10 [ 97.850589][ T6002] ? NF_HOOK+0x9e/0x3c0 [ 97.850611][ T6002] ? __pfx_NF_HOOK+0x10/0x10 [ 97.850635][ T6002] ? __pfx_sock_wfree+0x10/0x10 [ 97.850658][ T6002] ? ip_rcv_core+0x7fa/0xd50 [ 97.850690][ T6002] ? netif_receive_skb+0x102/0xbf0 [ 97.850709][ T6002] ? __pfx_ip_rcv+0x10/0x10 [ 97.850732][ T6002] netif_receive_skb+0x45b/0xbf0 [ 97.850756][ T6002] ? __pfx_netif_receive_skb+0x10/0x10 [ 97.850780][ T6002] ? tun_rx_batched+0x185/0x790 [ 97.850805][ T6002] tun_rx_batched+0x1de/0x790 [ 97.850831][ T6002] ? __pfx_tun_rx_batched+0x10/0x10 [ 97.850852][ T6002] ? lock_acquire+0x115/0x350 [ 97.850878][ T6002] ? tun_get_user+0x23ba/0x44d0 [ 97.850897][ T6002] ? __local_bh_enable_ip+0xd6/0x140 [ 97.850922][ T6002] ? tun_get_user+0x27b0/0x44d0 [ 97.850945][ T6002] tun_get_user+0x2be0/0x44d0 [ 97.850978][ T6002] ? tun_get_user+0x27b0/0x44d0 [ 97.850997][ T6002] ? aa_file_perm+0x18b/0x15f0 [ 97.851027][ T6002] ? aa_file_perm+0x4ed/0x15f0 [ 97.851052][ T6002] ? __pfx_tun_get_user+0x10/0x10 [ 97.851074][ T6002] ? __lock_acquire+0x747/0x2de0 [ 97.851099][ T6002] ? finish_task_switch+0x40e/0xc60 [ 97.851128][ T6002] ? ref_tracker_alloc+0x341/0x4b0 [ 97.851153][ T6002] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 97.851178][ T6002] ? lock_acquire+0x115/0x350 [ 97.851197][ T6002] ? tun_get+0x1c/0x2f0 [ 97.851222][ T6002] ? tun_get+0x1c/0x2f0 [ 97.851241][ T6002] ? tun_get+0x1c/0x2f0 [ 97.851265][ T6002] tun_chr_write_iter+0x113/0x200 [ 97.851288][ T6002] vfs_write+0x612/0xba0 [ 97.851324][ T6002] ? __pfx_vfs_write+0x10/0x10 [ 97.851366][ T6002] ? _raw_spin_unlock_irq+0x23/0x50 [ 97.851395][ T6002] ksys_write+0x150/0x270 [ 97.851426][ T6002] ? __pfx_ksys_write+0x10/0x10 [ 97.851464][ T6002] do_syscall_64+0x166/0x520 [ 97.851486][ T6002] ? trace_irq_disable+0x3b/0x140 [ 97.851505][ T6002] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.851524][ T6002] ? clear_bhb_loop+0x70/0xc0 [ 97.851547][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.851565][ T6002] RIP: 0033:0x7f6c0bc30879 [ 97.851582][ T6002] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 97.851598][ T6002] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.851618][ T6002] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 97.851632][ T6002] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 97.851643][ T6002] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 6002] +++ exited with 0 +++ [ 97.851654][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 97.851666][ T6002] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 97.851693][ T6002] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6002, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./36", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./36/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./36/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./36") = 0 mkdir("./37", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6015 attached [pid 6015] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6015] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6015 [pid 6015] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6015] chdir("./37" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6015] <... chdir resumed>) = 0 [pid 6015] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6015] setpgid(0, 0) = 0 [pid 6015] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6015] write(3, "1000", 4) = 4 [pid 6015] close(3) = 0 [pid 6015] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6015] write(1, "executing program\n", 18) = 18 executing program [pid 6015] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6015] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6015] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6015] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=67}) = 0 [pid 6015] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6015] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6015] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x43\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6015] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6015] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6015] write(6, "6", 1) = 1 [pid 6015] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6015] exit_group(0) = ? [pid 6015] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6015, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./37", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./37/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./37/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./37") = 0 mkdir("./38", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6023 attached [pid 6023] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6023] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6023 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6023] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6023] chdir("./38") = 0 [pid 6023] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6023] setpgid(0, 0) = 0 [pid 6023] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6023] write(3, "1000", 4) = 4 [pid 6023] close(3) = 0 [pid 6023] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6023] write(1, "executing program\n", 18) = 18 executing program [pid 6023] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6023] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6023] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6023] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=68}) = 0 [pid 6023] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6023] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6023] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x44\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6023] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6023] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6023] write(6, "6", 1) = 1 [pid 6023] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6023] exit_group(0) = ? [ 98.685298][ T6023] FAULT_INJECTION: forcing a failure. [ 98.685298][ T6023] name failslab, interval 1, probability 0, space 0, times 0 [ 98.685332][ T6023] CPU: 0 UID: 0 PID: 6023 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 98.685354][ T6023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.685365][ T6023] Call Trace: [ 98.685373][ T6023] [ 98.685392][ T6023] dump_stack_lvl+0xe8/0x150 [ 98.685423][ T6023] should_fail_ex+0x410/0x560 [ 98.685449][ T6023] should_failslab+0xa8/0x100 [ 98.685473][ T6023] ? dst_alloc+0x105/0x170 [ 98.685500][ T6023] kmem_cache_alloc_noprof+0xa1/0x600 [ 98.685547][ T6023] ? dst_alloc+0x105/0x170 [ 98.685576][ T6023] ? fib_lookup+0x76/0x440 [ 98.685613][ T6023] dst_alloc+0x105/0x170 [ 98.685647][ T6023] ip_route_input_rcu+0x20ca/0x3190 [ 98.685687][ T6023] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 98.685743][ T6023] ? tc_run+0x50f/0x750 [ 98.685764][ T6023] ? ip_route_input_noref+0xad/0x270 [ 98.685805][ T6023] ip_route_input_noref+0x17c/0x270 [ 98.685841][ T6023] ? __pfx_ip_route_input_noref+0x10/0x10 [ 98.685877][ T6023] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 98.685904][ T6023] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 98.685931][ T6023] ip_rcv_finish_core+0x593/0x1c00 [ 98.685970][ T6023] ip_rcv_finish+0x14c/0x2a0 [ 98.686016][ T6023] NF_HOOK+0x336/0x3c0 [ 98.686046][ T6023] ? __pfx_ip_rcv_finish+0x10/0x10 [ 98.686074][ T6023] ? NF_HOOK+0x9e/0x3c0 [ 98.686101][ T6023] ? __pfx_NF_HOOK+0x10/0x10 [ 98.686130][ T6023] ? __pfx_sock_wfree+0x10/0x10 [ 98.686158][ T6023] ? ip_rcv_core+0x7fa/0xd50 [ 98.686193][ T6023] ? netif_receive_skb+0x102/0xbf0 [ 98.686215][ T6023] ? __pfx_ip_rcv+0x10/0x10 [ 98.686243][ T6023] netif_receive_skb+0x45b/0xbf0 [ 98.686272][ T6023] ? __pfx_netif_receive_skb+0x10/0x10 [ 98.686302][ T6023] ? tun_rx_batched+0x185/0x790 [ 98.686329][ T6023] tun_rx_batched+0x1de/0x790 [ 98.686361][ T6023] ? __pfx_tun_rx_batched+0x10/0x10 [ 98.686386][ T6023] ? lock_acquire+0x115/0x350 [ 98.686417][ T6023] ? tun_get_user+0x23ba/0x44d0 [ 98.686440][ T6023] ? __local_bh_enable_ip+0xd6/0x140 [ 98.686469][ T6023] ? tun_get_user+0x27b0/0x44d0 [ 98.686495][ T6023] tun_get_user+0x2be0/0x44d0 [ 98.686534][ T6023] ? tun_get_user+0x27b0/0x44d0 [ 98.686556][ T6023] ? aa_file_perm+0x18b/0x15f0 [ 98.686592][ T6023] ? aa_file_perm+0x4ed/0x15f0 [ 98.686621][ T6023] ? __pfx_tun_get_user+0x10/0x10 [ 98.686648][ T6023] ? __lock_acquire+0x747/0x2de0 [ 98.686677][ T6023] ? finish_task_switch+0x40e/0xc60 [pid 6023] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6023, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./38", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 98.686711][ T6023] ? ref_tracker_alloc+0x341/0x4b0 [ 98.686741][ T6023] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 98.686771][ T6023] ? lock_acquire+0x115/0x350 [ 98.686793][ T6023] ? tun_get+0x1c/0x2f0 [ 98.686831][ T6023] ? tun_get+0x1c/0x2f0 [ 98.686854][ T6023] ? tun_get+0x1c/0x2f0 [ 98.686883][ T6023] tun_chr_write_iter+0x113/0x200 [ 98.686911][ T6023] vfs_write+0x612/0xba0 [ 98.686954][ T6023] ? __pfx_vfs_write+0x10/0x10 [ 98.686999][ T6023] ? _raw_spin_unlock_irq+0x23/0x50 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./38/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./38/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 [ 98.687034][ T6023] ksys_write+0x150/0x270 [ 98.687070][ T6023] ? __pfx_ksys_write+0x10/0x10 [ 98.687116][ T6023] do_syscall_64+0x166/0x520 [ 98.687140][ T6023] ? trace_irq_disable+0x3b/0x140 [ 98.687161][ T6023] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.687183][ T6023] ? clear_bhb_loop+0x70/0xc0 [ 98.687209][ T6023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.687230][ T6023] RIP: 0033:0x7f6c0bc30879 rmdir("./38") = 0 mkdir("./39", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6026 attached , child_tidptr=0x55556fc096d0) = 6026 [pid 6026] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6026] <... set_robust_list resumed>) = 0 [ 98.687251][ T6023] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 98.687269][ T6023] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.687299][ T6023] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 98.687316][ T6023] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 98.687330][ T6023] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 98.687342][ T6023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 6026] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6026] chdir("./39" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6026] <... chdir resumed>) = 0 [pid 6026] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6026] setpgid(0, 0) = 0 [pid 6026] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6026] write(3, "1000", 4) = 4 [pid 6026] close(3) = 0 [pid 6026] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6026] write(1, "executing program\n", 18) = 18 [pid 6026] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6026] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6026] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6026] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=69}) = 0 [pid 6026] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [ 98.687356][ T6023] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 98.687389][ T6023] [pid 6026] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6026] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x45\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6026] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6026] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6026] write(6, "6", 1) = 1 [pid 6026] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6026] exit_group(0) = ? [pid 6026] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6026, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./39", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./39/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./39/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./39") = 0 mkdir("./40", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6033 attached , child_tidptr=0x55556fc096d0) = 6033 [pid 6033] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6033] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6033] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6033] chdir("./40") = 0 [pid 6033] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6033] setpgid(0, 0) = 0 [pid 6033] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6033] write(3, "1000", 4) = 4 [pid 6033] close(3) = 0 [pid 6033] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6033] write(1, "executing program\n", 18) = 18 executing program [pid 6033] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6033] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6033] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6033] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=70}) = 0 [pid 6033] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6033] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6033] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x46\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6033] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6033] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6033] write(6, "6", 1) = 1 [pid 6033] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6033] exit_group(0) = ? [pid 6033] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6033, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./40", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./40/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./40/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./40") = 0 mkdir("./41", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6039 attached [pid 6039] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6039] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6039 [pid 6039] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6039] chdir("./41" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6039] <... chdir resumed>) = 0 [pid 6039] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6039] setpgid(0, 0) = 0 [pid 6039] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6039] write(3, "1000", 4) = 4 [pid 6039] close(3) = 0 [pid 6039] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6039] write(1, "executing program\n", 18) = 18 executing program [pid 6039] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6039] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6039] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6039] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=71}) = 0 [pid 6039] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6039] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6039] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6039] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6039] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6039] write(6, "6", 1) = 1 [pid 6039] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6039] exit_group(0) = ? [pid 6039] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6039, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./41", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./41/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./41/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./41") = 0 mkdir("./42", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6053 attached [pid 6053] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6053] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6053] chdir("./42" [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6053 [pid 6053] <... chdir resumed>) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6053] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6053] setpgid(0, 0) = 0 [pid 6053] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6053] write(3, "1000", 4) = 4 [pid 6053] close(3) = 0 [pid 6053] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6053] write(1, "executing program\n", 18) = 18 [pid 6053] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [pid 6053] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6053] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6053] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=72}) = 0 [pid 6053] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6053] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6053] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x48\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6053] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6053] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6053] write(6, "6", 1) = 1 [pid 6053] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6053] exit_group(0) = ? [pid 6053] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6053, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./42", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./42/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./42/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./42") = 0 mkdir("./43", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6065 attached , child_tidptr=0x55556fc096d0) = 6065 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6065] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6065] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6065] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6065] chdir("./43") = 0 [pid 6065] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6065] setpgid(0, 0) = 0 [pid 6065] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6065] write(3, "1000", 4) = 4 [pid 6065] close(3) = 0 [pid 6065] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6065] write(1, "executing program\n", 18) = 18 executing program [pid 6065] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6065] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6065] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6065] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=73}) = 0 [pid 6065] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6065] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6065] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x49\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6065] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6065] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6065] write(6, "6", 1) = 1 [pid 6065] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 100.251632][ T6065] FAULT_INJECTION: forcing a failure. [ 100.251632][ T6065] name failslab, interval 1, probability 0, space 0, times 0 [ 100.251693][ T6065] CPU: 0 UID: 0 PID: 6065 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 100.251718][ T6065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.251731][ T6065] Call Trace: [ 100.251740][ T6065] [ 100.251749][ T6065] dump_stack_lvl+0xe8/0x150 [ 100.251787][ T6065] should_fail_ex+0x410/0x560 [pid 6065] exit_group(0) = ? [ 100.251818][ T6065] should_failslab+0xa8/0x100 [ 100.251846][ T6065] ? dst_alloc+0x105/0x170 [ 100.251880][ T6065] kmem_cache_alloc_noprof+0xa1/0x600 [ 100.251918][ T6065] ? dst_alloc+0x105/0x170 [ 100.251952][ T6065] ? fib_lookup+0x76/0x440 [ 100.251988][ T6065] dst_alloc+0x105/0x170 [ 100.252025][ T6065] ip_route_input_rcu+0x20ca/0x3190 [ 100.252071][ T6065] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 100.252136][ T6065] ? tc_run+0x50f/0x750 [ 100.252159][ T6065] ? ip_route_input_noref+0xad/0x270 [ 100.252196][ T6065] ip_route_input_noref+0x17c/0x270 [ 100.252236][ T6065] ? __pfx_ip_route_input_noref+0x10/0x10 [ 100.252286][ T6065] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 100.252334][ T6065] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 100.252382][ T6065] ip_rcv_finish_core+0x593/0x1c00 [ 100.252423][ T6065] ip_rcv_finish+0x14c/0x2a0 [ 100.252454][ T6065] NF_HOOK+0x336/0x3c0 [ 100.252483][ T6065] ? __pfx_ip_rcv_finish+0x10/0x10 [ 100.252510][ T6065] ? NF_HOOK+0x9e/0x3c0 [ 100.252536][ T6065] ? __pfx_NF_HOOK+0x10/0x10 [ 100.252563][ T6065] ? __pfx_sock_wfree+0x10/0x10 [ 100.252590][ T6065] ? ip_rcv_core+0x7fa/0xd50 [ 100.252623][ T6065] ? netif_receive_skb+0x102/0xbf0 [ 100.252660][ T6065] ? __pfx_ip_rcv+0x10/0x10 [ 100.252686][ T6065] netif_receive_skb+0x45b/0xbf0 [ 100.252713][ T6065] ? __pfx_netif_receive_skb+0x10/0x10 [ 100.252740][ T6065] ? tun_rx_batched+0x185/0x790 [ 100.252767][ T6065] tun_rx_batched+0x1de/0x790 [ 100.252796][ T6065] ? __pfx_tun_rx_batched+0x10/0x10 [ 100.252820][ T6065] ? lock_acquire+0x115/0x350 [ 100.252849][ T6065] ? tun_get_user+0x23ba/0x44d0 [ 100.252871][ T6065] ? __local_bh_enable_ip+0xd6/0x140 [ 100.252899][ T6065] ? tun_get_user+0x27b0/0x44d0 [ 100.252925][ T6065] tun_get_user+0x2be0/0x44d0 [ 100.252972][ T6065] ? tun_get_user+0x27b0/0x44d0 [ 100.252992][ T6065] ? aa_file_perm+0x18b/0x15f0 [ 100.253022][ T6065] ? aa_file_perm+0x4ed/0x15f0 [ 100.253048][ T6065] ? __pfx_tun_get_user+0x10/0x10 [ 100.253071][ T6065] ? __lock_acquire+0x747/0x2de0 [ 100.253098][ T6065] ? finish_task_switch+0x40e/0xc60 [ 100.253129][ T6065] ? ref_tracker_alloc+0x341/0x4b0 [ 100.253155][ T6065] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 100.253181][ T6065] ? lock_acquire+0x115/0x350 [ 100.253201][ T6065] ? tun_get+0x1c/0x2f0 [ 100.253228][ T6065] ? tun_get+0x1c/0x2f0 [ 100.253266][ T6065] ? tun_get+0x1c/0x2f0 [ 100.253293][ T6065] tun_chr_write_iter+0x113/0x200 [ 100.253318][ T6065] vfs_write+0x612/0xba0 [ 100.253370][ T6065] ? __pfx_vfs_write+0x10/0x10 [ 100.253409][ T6065] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.253440][ T6065] ksys_write+0x150/0x270 [ 100.253471][ T6065] ? __pfx_ksys_write+0x10/0x10 [ 100.253512][ T6065] do_syscall_64+0x166/0x520 [ 100.253534][ T6065] ? trace_irq_disable+0x3b/0x140 [ 100.253555][ T6065] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.253576][ T6065] ? clear_bhb_loop+0x70/0xc0 [ 100.253601][ T6065] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.253620][ T6065] RIP: 0033:0x7f6c0bc30879 [ 100.253649][ T6065] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 100.253666][ T6065] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 100.253689][ T6065] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 100.253704][ T6065] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 100.253717][ T6065] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 100.253729][ T6065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 6065] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6065, si_uid=0, si_status=0, si_utime=0, si_stime=7 /* 0.07 s */} --- umount2("./43", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 [ 100.253742][ T6065] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 100.253772][ T6065] umount2("./43/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./43/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./43") = 0 mkdir("./44", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6074 attached [pid 6074] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6074] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6074 [pid 6074] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6074] chdir("./44" [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6074] <... chdir resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6074] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6074] setpgid(0, 0) = 0 [pid 6074] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6074] write(3, "1000", 4) = 4 [pid 6074] close(3) = 0 [pid 6074] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6074] write(1, "executing program\n", 18) = 18 executing program [pid 6074] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6074] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6074] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6074] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=74}) = 0 [pid 6074] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6074] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6074] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x4a\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6074] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6074] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6074] write(6, "6", 1) = 1 [pid 6074] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6074] exit_group(0) = ? [pid 6074] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6074, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./44", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./44/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./44/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./44") = 0 mkdir("./45", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6084 attached , child_tidptr=0x55556fc096d0) = 6084 [pid 6084] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6084] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6084] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6084] chdir("./45") = 0 [pid 6084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6084] setpgid(0, 0) = 0 [pid 6084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6084] write(3, "1000", 4) = 4 [pid 6084] close(3) = 0 [pid 6084] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6084] write(1, "executing program\n", 18) = 18 executing program [pid 6084] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6084] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6084] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6084] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=75}) = 0 [pid 6084] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6084] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6084] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x4b\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6084] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6084] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6084] write(6, "6", 1) = 1 [pid 6084] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6084] exit_group(0) = ? [pid 6084] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6084, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./45", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./45/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./45/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./45") = 0 mkdir("./46", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6093 attached [pid 6093] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6093] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6093 [pid 6093] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6093] chdir("./46" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6093] <... chdir resumed>) = 0 [pid 6093] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6093] setpgid(0, 0) = 0 [pid 6093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6093] write(3, "1000", 4) = 4 [pid 6093] close(3) = 0 [pid 6093] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6093] write(1, "executing program\n", 18) = 18 [pid 6093] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6093] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6093] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6093] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=76}) = 0 [pid 6093] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6093] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6093] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x4c\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6093] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6093] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6093] write(6, "6", 1) = 1 [ 101.374032][ T6093] FAULT_INJECTION: forcing a failure. [ 101.374032][ T6093] name failslab, interval 1, probability 0, space 0, times 0 [ 101.374063][ T6093] CPU: 0 UID: 0 PID: 6093 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 101.374084][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.374095][ T6093] Call Trace: [ 101.374102][ T6093] [ 101.374111][ T6093] dump_stack_lvl+0xe8/0x150 [ 101.374143][ T6093] should_fail_ex+0x410/0x560 [pid 6093] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6093] exit_group(0) = ? [ 101.374172][ T6093] should_failslab+0xa8/0x100 [ 101.374196][ T6093] ? dst_alloc+0x105/0x170 [ 101.374224][ T6093] kmem_cache_alloc_noprof+0xa1/0x600 [ 101.374255][ T6093] ? dst_alloc+0x105/0x170 [ 101.374283][ T6093] ? fib_lookup+0x76/0x440 [ 101.374314][ T6093] dst_alloc+0x105/0x170 [ 101.374346][ T6093] ip_route_input_rcu+0x20ca/0x3190 [ 101.374384][ T6093] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 101.374438][ T6093] ? tc_run+0x50f/0x750 [ 101.374458][ T6093] ? ip_route_input_noref+0xad/0x270 [ 101.374489][ T6093] ip_route_input_noref+0x17c/0x270 [ 101.374520][ T6093] ? __pfx_ip_route_input_noref+0x10/0x10 [ 101.374553][ T6093] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 101.374587][ T6093] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 101.374613][ T6093] ip_rcv_finish_core+0x593/0x1c00 [ 101.374650][ T6093] ip_rcv_finish+0x14c/0x2a0 [ 101.374678][ T6093] NF_HOOK+0x336/0x3c0 [ 101.374703][ T6093] ? __pfx_ip_rcv_finish+0x10/0x10 [ 101.374726][ T6093] ? NF_HOOK+0x9e/0x3c0 [ 101.374748][ T6093] ? __pfx_NF_HOOK+0x10/0x10 [ 101.374771][ T6093] ? __pfx_sock_wfree+0x10/0x10 [ 101.374795][ T6093] ? ip_rcv_core+0x7fa/0xd50 [ 101.374824][ T6093] ? netif_receive_skb+0x102/0xbf0 [ 101.374843][ T6093] ? __pfx_ip_rcv+0x10/0x10 [ 101.374866][ T6093] netif_receive_skb+0x45b/0xbf0 [ 101.374890][ T6093] ? __pfx_netif_receive_skb+0x10/0x10 [ 101.374914][ T6093] ? tun_rx_batched+0x185/0x790 [ 101.374938][ T6093] tun_rx_batched+0x1de/0x790 [ 101.374964][ T6093] ? __pfx_tun_rx_batched+0x10/0x10 [ 101.374985][ T6093] ? lock_acquire+0x115/0x350 [ 101.375011][ T6093] ? tun_get_user+0x23ba/0x44d0 [ 101.375031][ T6093] ? __local_bh_enable_ip+0xd6/0x140 [ 101.375056][ T6093] ? tun_get_user+0x27b0/0x44d0 [ 101.375078][ T6093] tun_get_user+0x2be0/0x44d0 [ 101.375111][ T6093] ? tun_get_user+0x27b0/0x44d0 [ 101.375131][ T6093] ? aa_file_perm+0x18b/0x15f0 [ 101.375160][ T6093] ? aa_file_perm+0x4ed/0x15f0 [ 101.375185][ T6093] ? __pfx_tun_get_user+0x10/0x10 [ 101.375207][ T6093] ? __lock_acquire+0x747/0x2de0 [ 101.375232][ T6093] ? finish_task_switch+0x40e/0xc60 [ 101.375262][ T6093] ? ref_tracker_alloc+0x341/0x4b0 [ 101.375287][ T6093] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 101.375313][ T6093] ? lock_acquire+0x115/0x350 [ 101.375332][ T6093] ? tun_get+0x1c/0x2f0 [ 101.375357][ T6093] ? tun_get+0x1c/0x2f0 [ 101.375376][ T6093] ? tun_get+0x1c/0x2f0 [ 101.375399][ T6093] tun_chr_write_iter+0x113/0x200 [ 101.375422][ T6093] vfs_write+0x612/0xba0 [ 101.375458][ T6093] ? __pfx_vfs_write+0x10/0x10 [ 101.375494][ T6093] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.375522][ T6093] ksys_write+0x150/0x270 [pid 6093] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6093, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./46", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 101.375553][ T6093] ? __pfx_ksys_write+0x10/0x10 [ 101.375600][ T6093] do_syscall_64+0x166/0x520 [ 101.375621][ T6093] ? trace_irq_disable+0x3b/0x140 [ 101.375640][ T6093] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.375660][ T6093] ? clear_bhb_loop+0x70/0xc0 [ 101.375683][ T6093] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.375702][ T6093] RIP: 0033:0x7f6c0bc30879 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./46/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 101.375720][ T6093] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 101.375736][ T6093] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.375756][ T6093] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 101.375770][ T6093] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 101.375782][ T6093] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 101.375793][ T6093] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 unlink("./46/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./46") = 0 mkdir("./47", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6099 ci-upstream-kasan-gce/strace-static-x86_64: Process 6099 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6099] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6099] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6099] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6099] chdir("./47") = 0 [pid 6099] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6099] setpgid(0, 0) = 0 [pid 6099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6099] write(3, "1000", 4) = 4 [pid 6099] close(3) = 0 [ 101.375805][ T6093] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 101.375832][ T6093] [pid 6099] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6099] write(1, "executing program\n", 18) = 18 executing program [pid 6099] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6099] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6099] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6099] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=77}) = 0 [pid 6099] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6099] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6099] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x4d\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6099] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6099] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6099] write(6, "6", 1) = 1 [ 101.922012][ T6099] FAULT_INJECTION: forcing a failure. [ 101.922012][ T6099] name failslab, interval 1, probability 0, space 0, times 0 [ 101.922048][ T6099] CPU: 0 UID: 0 PID: 6099 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 101.922073][ T6099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.922086][ T6099] Call Trace: [ 101.922094][ T6099] [ 101.922104][ T6099] dump_stack_lvl+0xe8/0x150 [ 101.922141][ T6099] should_fail_ex+0x410/0x560 [ 101.922172][ T6099] should_failslab+0xa8/0x100 [ 101.922200][ T6099] ? dst_alloc+0x105/0x170 [ 101.922234][ T6099] kmem_cache_alloc_noprof+0xa1/0x600 [ 101.922272][ T6099] ? dst_alloc+0x105/0x170 [ 101.922305][ T6099] ? fib_lookup+0x76/0x440 [ 101.922342][ T6099] dst_alloc+0x105/0x170 [ 101.922380][ T6099] ip_route_input_rcu+0x20ca/0x3190 [ 101.922427][ T6099] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 101.922492][ T6099] ? tc_run+0x50f/0x750 [ 101.922516][ T6099] ? ip_route_input_noref+0xad/0x270 [ 101.922563][ T6099] ip_route_input_noref+0x17c/0x270 [ 101.922602][ T6099] ? __pfx_ip_route_input_noref+0x10/0x10 [ 101.922641][ T6099] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 101.922671][ T6099] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 101.922705][ T6099] ip_rcv_finish_core+0x593/0x1c00 [ 101.922748][ T6099] ip_rcv_finish+0x14c/0x2a0 [ 101.922780][ T6099] NF_HOOK+0x336/0x3c0 [ 101.922810][ T6099] ? __pfx_ip_rcv_finish+0x10/0x10 [ 101.922850][ T6099] ? NF_HOOK+0x9e/0x3c0 [ 101.922885][ T6099] ? __pfx_NF_HOOK+0x10/0x10 [pid 6099] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6099] exit_group(0) = ? [ 101.922913][ T6099] ? __pfx_sock_wfree+0x10/0x10 [ 101.922941][ T6099] ? ip_rcv_core+0x7fa/0xd50 [ 101.922974][ T6099] ? netif_receive_skb+0x102/0xbf0 [ 101.922995][ T6099] ? __pfx_ip_rcv+0x10/0x10 [ 101.923021][ T6099] netif_receive_skb+0x45b/0xbf0 [ 101.923049][ T6099] ? __pfx_netif_receive_skb+0x10/0x10 [ 101.923076][ T6099] ? tun_rx_batched+0x185/0x790 [ 101.923103][ T6099] tun_rx_batched+0x1de/0x790 [ 101.923133][ T6099] ? __pfx_tun_rx_batched+0x10/0x10 [ 101.923157][ T6099] ? lock_acquire+0x115/0x350 [ 101.923188][ T6099] ? tun_get_user+0x23ba/0x44d0 [ 101.923211][ T6099] ? __local_bh_enable_ip+0xd6/0x140 [ 101.923239][ T6099] ? tun_get_user+0x27b0/0x44d0 [ 101.923265][ T6099] tun_get_user+0x2be0/0x44d0 [ 101.923302][ T6099] ? tun_get_user+0x27b0/0x44d0 [ 101.923324][ T6099] ? aa_file_perm+0x18b/0x15f0 [ 101.923358][ T6099] ? aa_file_perm+0x4ed/0x15f0 [ 101.923386][ T6099] ? __pfx_tun_get_user+0x10/0x10 [ 101.923412][ T6099] ? __lock_acquire+0x747/0x2de0 [ 101.923439][ T6099] ? finish_task_switch+0x40e/0xc60 [ 101.923472][ T6099] ? ref_tracker_alloc+0x341/0x4b0 [ 101.923500][ T6099] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 101.923536][ T6099] ? lock_acquire+0x115/0x350 [ 101.923558][ T6099] ? tun_get+0x1c/0x2f0 [ 101.923587][ T6099] ? tun_get+0x1c/0x2f0 [ 101.923609][ T6099] ? tun_get+0x1c/0x2f0 [ 101.923637][ T6099] tun_chr_write_iter+0x113/0x200 [ 101.923663][ T6099] vfs_write+0x612/0xba0 [ 101.923704][ T6099] ? __pfx_vfs_write+0x10/0x10 [ 101.923746][ T6099] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.923779][ T6099] ksys_write+0x150/0x270 [ 101.923814][ T6099] ? __pfx_ksys_write+0x10/0x10 [ 101.923859][ T6099] do_syscall_64+0x166/0x520 [ 101.923883][ T6099] ? trace_irq_disable+0x3b/0x140 [ 101.923904][ T6099] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.923926][ T6099] ? clear_bhb_loop+0x70/0xc0 [ 101.923953][ T6099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.923975][ T6099] RIP: 0033:0x7f6c0bc30879 [ 101.923994][ T6099] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 101.924011][ T6099] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.924034][ T6099] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 101.924050][ T6099] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 101.924064][ T6099] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 101.924076][ T6099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 101.924090][ T6099] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 101.924121][ T6099] [pid 6099] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6099, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./47", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./47/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./47/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./47") = 0 mkdir("./48", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6111 attached [pid 6111] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6111 [pid 6111] <... set_robust_list resumed>) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6111] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6111] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6111] chdir("./48") = 0 [pid 6111] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6111] setpgid(0, 0) = 0 [pid 6111] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6111] write(3, "1000", 4) = 4 [pid 6111] close(3) = 0 [pid 6111] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6111] write(1, "executing program\n", 18) = 18 [pid 6111] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6111] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6111] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6111] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=78}) = 0 [pid 6111] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6111] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6111] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x4e\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6111] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6111] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6111] write(6, "6", 1) = 1 [pid 6111] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6111] exit_group(0) = ? [ 102.548169][ T6111] FAULT_INJECTION: forcing a failure. [ 102.548169][ T6111] name failslab, interval 1, probability 0, space 0, times 0 [ 102.548204][ T6111] CPU: 0 UID: 0 PID: 6111 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 102.548229][ T6111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.548242][ T6111] Call Trace: [ 102.548251][ T6111] [ 102.548260][ T6111] dump_stack_lvl+0xe8/0x150 [ 102.548298][ T6111] should_fail_ex+0x410/0x560 [ 102.548328][ T6111] should_failslab+0xa8/0x100 [ 102.548359][ T6111] __kmalloc_cache_noprof+0xa3/0x600 [ 102.548383][ T6111] ? nf_flow_offload_work_alloc+0x98/0x200 [ 102.548407][ T6111] ? nf_flow_offload_work_alloc+0x98/0x200 [ 102.548438][ T6111] nf_flow_offload_work_alloc+0x98/0x200 [ 102.548467][ T6111] nf_flow_offload_add+0xca/0x240 [ 102.548493][ T6111] flow_offload_add+0x171c/0x24b0 [ 102.548557][ T6111] ? flow_offload_add+0x18c/0x24b0 [ 102.548613][ T6111] tcf_ct_flow_table_process_conn+0x5e7/0x7c0 [ 102.548671][ T6111] tcf_ct_act+0x2a75/0x4050 [ 102.548723][ T6111] ? __pfx_tcf_ct_act+0x10/0x10 [ 102.548774][ T6111] ? is_bpf_text_address+0x26/0x2b0 [ 102.548816][ T6111] ? lock_acquire+0x115/0x350 [ 102.548847][ T6111] tcf_action_exec+0x185/0x8d0 [ 102.548880][ T6111] basic_classify+0x1b2/0x2d0 [ 102.548917][ T6111] tcf_classify+0x43d/0x1160 [ 102.548960][ T6111] tc_run+0x42d/0x750 [ 102.548990][ T6111] ? __pfx_tc_run+0x10/0x10 [ 102.549021][ T6111] __netif_receive_skb_core+0x1443/0x30c0 [ 102.549065][ T6111] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 102.549089][ T6111] ? __alloc_skb+0x27a/0x7a0 [ 102.549113][ T6111] ? rcu_is_watching+0x16/0xb0 [ 102.549144][ T6111] ? __alloc_skb+0x27a/0x7a0 [ 102.549167][ T6111] ? trace_kmem_cache_alloc+0x29/0xe0 [ 102.549219][ T6111] ? netif_receive_skb+0x102/0xbf0 [ 102.549240][ T6111] ? netif_receive_skb+0x102/0xbf0 [ 102.549263][ T6111] netif_receive_skb+0x1fe/0xbf0 [ 102.549292][ T6111] ? __pfx_netif_receive_skb+0x10/0x10 [ 102.549320][ T6111] ? tun_rx_batched+0x185/0x790 [ 102.549347][ T6111] tun_rx_batched+0x1de/0x790 [ 102.549377][ T6111] ? __pfx_tun_rx_batched+0x10/0x10 [ 102.549402][ T6111] ? lock_acquire+0x115/0x350 [ 102.549431][ T6111] ? tun_get_user+0x23ba/0x44d0 [ 102.549454][ T6111] ? __local_bh_enable_ip+0xd6/0x140 [ 102.549483][ T6111] ? tun_get_user+0x27b0/0x44d0 [ 102.549518][ T6111] tun_get_user+0x2be0/0x44d0 [ 102.549561][ T6111] ? tun_get_user+0x27b0/0x44d0 [ 102.549584][ T6111] ? aa_file_perm+0x18b/0x15f0 [ 102.549618][ T6111] ? aa_file_perm+0x4ed/0x15f0 [ 102.549648][ T6111] ? __pfx_tun_get_user+0x10/0x10 [ 102.549674][ T6111] ? __lock_acquire+0x747/0x2de0 [ 102.549704][ T6111] ? finish_task_switch+0x40e/0xc60 [ 102.549738][ T6111] ? ref_tracker_alloc+0x341/0x4b0 [ 102.549768][ T6111] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 102.549797][ T6111] ? lock_acquire+0x115/0x350 [ 102.549820][ T6111] ? tun_get+0x1c/0x2f0 [ 102.549849][ T6111] ? tun_get+0x1c/0x2f0 [ 102.549872][ T6111] ? tun_get+0x1c/0x2f0 [ 102.549901][ T6111] tun_chr_write_iter+0x113/0x200 [ 102.549928][ T6111] vfs_write+0x612/0xba0 [pid 6111] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6111, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- [ 102.549971][ T6111] ? __pfx_vfs_write+0x10/0x10 [ 102.550015][ T6111] ? _raw_spin_unlock_irq+0x23/0x50 [ 102.550047][ T6111] ksys_write+0x150/0x270 [ 102.550084][ T6111] ? __pfx_ksys_write+0x10/0x10 [ 102.550130][ T6111] do_syscall_64+0x166/0x520 [ 102.550154][ T6111] ? trace_irq_disable+0x3b/0x140 [ 102.550177][ T6111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.550200][ T6111] ? clear_bhb_loop+0x70/0xc0 [ 102.550228][ T6111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.550250][ T6111] RIP: 0033:0x7f6c0bc30879 umount2("./48", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./48/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./48/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 [ 102.550270][ T6111] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 102.550289][ T6111] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.550312][ T6111] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 102.550329][ T6111] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 rmdir("./48") = 0 mkdir("./49", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6118 ci-upstream-kasan-gce/strace-static-x86_64: Process 6118 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6118] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6118] <... set_robust_list resumed>) = 0 [pid 6118] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 102.550343][ T6111] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 102.550356][ T6111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 102.550370][ T6111] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 102.550403][ T6111] [pid 6118] chdir("./49") = 0 [pid 6118] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6118] setpgid(0, 0) = 0 [pid 6118] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6118] write(3, "1000", 4) = 4 [pid 6118] close(3) = 0 [pid 6118] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6118] write(1, "executing program\n", 18) = 18 executing program [pid 6118] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6118] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6118] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6118] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=79}) = 0 [pid 6118] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6118] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6118] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x4f\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6118] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6118] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6118] write(6, "6", 1) = 1 [ 103.159251][ T6118] FAULT_INJECTION: forcing a failure. [ 103.159251][ T6118] name failslab, interval 1, probability 0, space 0, times 0 [ 103.159283][ T6118] CPU: 0 UID: 0 PID: 6118 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 103.159304][ T6118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 103.159315][ T6118] Call Trace: [ 103.159323][ T6118] [pid 6118] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 103.159331][ T6118] dump_stack_lvl+0xe8/0x150 [ 103.159364][ T6118] should_fail_ex+0x410/0x560 [ 103.159389][ T6118] should_failslab+0xa8/0x100 [ 103.159413][ T6118] ? dst_alloc+0x105/0x170 [ 103.159441][ T6118] kmem_cache_alloc_noprof+0xa1/0x600 [ 103.159481][ T6118] ? dst_alloc+0x105/0x170 [ 103.159510][ T6118] ? fib_lookup+0x76/0x440 [ 103.159540][ T6118] dst_alloc+0x105/0x170 [ 103.159573][ T6118] ip_route_input_rcu+0x20ca/0x3190 [ 103.159611][ T6118] ? __pfx_ip_route_input_rcu+0x10/0x10 [pid 6118] exit_group(0) = ? [ 103.159664][ T6118] ? tc_run+0x50f/0x750 [ 103.159684][ T6118] ? ip_route_input_noref+0xad/0x270 [ 103.159716][ T6118] ip_route_input_noref+0x17c/0x270 [ 103.159749][ T6118] ? __pfx_ip_route_input_noref+0x10/0x10 [ 103.159783][ T6118] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 103.159809][ T6118] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 103.159835][ T6118] ip_rcv_finish_core+0x593/0x1c00 [ 103.159871][ T6118] ip_rcv_finish+0x14c/0x2a0 [ 103.159899][ T6118] NF_HOOK+0x336/0x3c0 [ 103.159928][ T6118] ? __pfx_ip_rcv_finish+0x10/0x10 [ 103.159951][ T6118] ? NF_HOOK+0x9e/0x3c0 [ 103.159974][ T6118] ? __pfx_NF_HOOK+0x10/0x10 [ 103.159999][ T6118] ? __pfx_sock_wfree+0x10/0x10 [ 103.160023][ T6118] ? ip_rcv_core+0x7fa/0xd50 [ 103.160054][ T6118] ? netif_receive_skb+0x102/0xbf0 [ 103.160072][ T6118] ? __pfx_ip_rcv+0x10/0x10 [ 103.160096][ T6118] netif_receive_skb+0x45b/0xbf0 [ 103.160120][ T6118] ? __pfx_netif_receive_skb+0x10/0x10 [ 103.160145][ T6118] ? tun_rx_batched+0x185/0x790 [ 103.160168][ T6118] tun_rx_batched+0x1de/0x790 [ 103.160195][ T6118] ? __pfx_tun_rx_batched+0x10/0x10 [ 103.160217][ T6118] ? lock_acquire+0x115/0x350 [ 103.160244][ T6118] ? tun_get_user+0x23ba/0x44d0 [ 103.160264][ T6118] ? __local_bh_enable_ip+0xd6/0x140 [ 103.160289][ T6118] ? tun_get_user+0x27b0/0x44d0 [ 103.160328][ T6118] tun_get_user+0x2be0/0x44d0 [ 103.160364][ T6118] ? tun_get_user+0x27b0/0x44d0 [ 103.160385][ T6118] ? aa_file_perm+0x18b/0x15f0 [ 103.160417][ T6118] ? aa_file_perm+0x4ed/0x15f0 [ 103.160470][ T6118] ? __pfx_tun_get_user+0x10/0x10 [ 103.160496][ T6118] ? __lock_acquire+0x747/0x2de0 [ 103.160525][ T6118] ? finish_task_switch+0x40e/0xc60 [ 103.160557][ T6118] ? ref_tracker_alloc+0x341/0x4b0 [ 103.160587][ T6118] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 103.160615][ T6118] ? lock_acquire+0x115/0x350 [ 103.160638][ T6118] ? tun_get+0x1c/0x2f0 [ 103.160667][ T6118] ? tun_get+0x1c/0x2f0 [ 103.160689][ T6118] ? tun_get+0x1c/0x2f0 [ 103.160717][ T6118] tun_chr_write_iter+0x113/0x200 [ 103.160743][ T6118] vfs_write+0x612/0xba0 [ 103.160785][ T6118] ? __pfx_vfs_write+0x10/0x10 [ 103.160886][ T6118] ? _raw_spin_unlock_irq+0x23/0x50 [ 103.160921][ T6118] ksys_write+0x150/0x270 [ 103.160957][ T6118] ? __pfx_ksys_write+0x10/0x10 [ 103.161005][ T6118] do_syscall_64+0x166/0x520 [ 103.161030][ T6118] ? trace_irq_disable+0x3b/0x140 [ 103.161052][ T6118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.161075][ T6118] ? clear_bhb_loop+0x70/0xc0 [ 103.161104][ T6118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.161126][ T6118] RIP: 0033:0x7f6c0bc30879 [ 103.161147][ T6118] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 103.161166][ T6118] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.161191][ T6118] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 103.161207][ T6118] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 103.161221][ T6118] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 6118] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6118, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- [ 103.161234][ T6118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 103.161248][ T6118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 103.161280][ T6118] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./49", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./49/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./49/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./49") = 0 mkdir("./50", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6130 attached , child_tidptr=0x55556fc096d0) = 6130 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6130] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6130] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6130] chdir("./50") = 0 [pid 6130] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6130] setpgid(0, 0) = 0 [pid 6130] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6130] write(3, "1000", 4) = 4 [pid 6130] close(3) = 0 [pid 6130] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6130] write(1, "executing program\n", 18) = 18 [pid 6130] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6130] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6130] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6130] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=80}) = 0 [pid 6130] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6130] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6130] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x50\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6130] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6130] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6130] write(6, "6", 1) = 1 [pid 6130] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 103.776965][ T6130] FAULT_INJECTION: forcing a failure. [ 103.776965][ T6130] name failslab, interval 1, probability 0, space 0, times 0 [ 103.777002][ T6130] CPU: 0 UID: 0 PID: 6130 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 103.777027][ T6130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 103.777041][ T6130] Call Trace: [ 103.777049][ T6130] [ 103.777059][ T6130] dump_stack_lvl+0xe8/0x150 [pid 6130] exit_group(0) = ? [ 103.777096][ T6130] should_fail_ex+0x410/0x560 [ 103.777128][ T6130] should_failslab+0xa8/0x100 [ 103.777156][ T6130] ? dst_alloc+0x105/0x170 [ 103.777190][ T6130] kmem_cache_alloc_noprof+0xa1/0x600 [ 103.777226][ T6130] ? dst_alloc+0x105/0x170 [ 103.777259][ T6130] ? fib_lookup+0x76/0x440 [ 103.777295][ T6130] dst_alloc+0x105/0x170 [ 103.777334][ T6130] ip_route_input_rcu+0x20ca/0x3190 [ 103.777380][ T6130] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 103.777454][ T6130] ? tc_run+0x50f/0x750 [ 103.777478][ T6130] ? ip_route_input_noref+0xad/0x270 [ 103.777515][ T6130] ip_route_input_noref+0x17c/0x270 [ 103.777554][ T6130] ? __pfx_ip_route_input_noref+0x10/0x10 [ 103.777594][ T6130] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 103.777640][ T6130] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 103.777672][ T6130] ip_rcv_finish_core+0x593/0x1c00 [ 103.777715][ T6130] ip_rcv_finish+0x14c/0x2a0 [ 103.777747][ T6130] NF_HOOK+0x336/0x3c0 [ 103.777777][ T6130] ? __pfx_ip_rcv_finish+0x10/0x10 [ 103.777804][ T6130] ? NF_HOOK+0x9e/0x3c0 [ 103.777831][ T6130] ? __pfx_NF_HOOK+0x10/0x10 [ 103.777859][ T6130] ? __pfx_sock_wfree+0x10/0x10 [ 103.777888][ T6130] ? ip_rcv_core+0x7fa/0xd50 [ 103.777924][ T6130] ? netif_receive_skb+0x102/0xbf0 [ 103.777945][ T6130] ? __pfx_ip_rcv+0x10/0x10 [ 103.777972][ T6130] netif_receive_skb+0x45b/0xbf0 [ 103.778001][ T6130] ? __pfx_netif_receive_skb+0x10/0x10 [ 103.778029][ T6130] ? tun_rx_batched+0x185/0x790 [ 103.778057][ T6130] tun_rx_batched+0x1de/0x790 [ 103.778088][ T6130] ? __pfx_tun_rx_batched+0x10/0x10 [ 103.778122][ T6130] ? lock_acquire+0x115/0x350 [ 103.778150][ T6130] ? tun_get_user+0x23ba/0x44d0 [ 103.778171][ T6130] ? __local_bh_enable_ip+0xd6/0x140 [ 103.778197][ T6130] ? tun_get_user+0x27b0/0x44d0 [ 103.778221][ T6130] tun_get_user+0x2be0/0x44d0 [ 103.778259][ T6130] ? tun_get_user+0x27b0/0x44d0 [ 103.778280][ T6130] ? aa_file_perm+0x18b/0x15f0 [ 103.778311][ T6130] ? aa_file_perm+0x4ed/0x15f0 [ 103.778337][ T6130] ? __pfx_tun_get_user+0x10/0x10 [ 103.778361][ T6130] ? __lock_acquire+0x747/0x2de0 [ 103.778388][ T6130] ? finish_task_switch+0x40e/0xc60 [ 103.778426][ T6130] ? ref_tracker_alloc+0x341/0x4b0 [ 103.778454][ T6130] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 103.778481][ T6130] ? lock_acquire+0x115/0x350 [ 103.778501][ T6130] ? tun_get+0x1c/0x2f0 [ 103.778527][ T6130] ? tun_get+0x1c/0x2f0 [ 103.778547][ T6130] ? tun_get+0x1c/0x2f0 [ 103.778573][ T6130] tun_chr_write_iter+0x113/0x200 [ 103.778596][ T6130] vfs_write+0x612/0xba0 [ 103.778635][ T6130] ? __pfx_vfs_write+0x10/0x10 [ 103.778675][ T6130] ? _raw_spin_unlock_irq+0x23/0x50 [pid 6130] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6130, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./50", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 103.778705][ T6130] ksys_write+0x150/0x270 [ 103.778738][ T6130] ? __pfx_ksys_write+0x10/0x10 [ 103.778779][ T6130] do_syscall_64+0x166/0x520 [ 103.778802][ T6130] ? trace_irq_disable+0x3b/0x140 [ 103.778822][ T6130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.778843][ T6130] ? clear_bhb_loop+0x70/0xc0 [ 103.778869][ T6130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.778889][ T6130] RIP: 0033:0x7f6c0bc30879 openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./50/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./50/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./50") = 0 mkdir("./51", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 103.778908][ T6130] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 103.778925][ T6130] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 103.778947][ T6130] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 103.778962][ T6130] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 103.778975][ T6130] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 103.778986][ T6130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6136 ci-upstream-kasan-gce/strace-static-x86_64: Process 6136 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6136] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6136] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6136] chdir("./51") = 0 [pid 6136] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6136] setpgid(0, 0) = 0 [pid 6136] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6136] write(3, "1000", 4) = 4 [pid 6136] close(3) = 0 [pid 6136] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6136] write(1, "executing program\n", 18) = 18 executing program [pid 6136] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6136] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6136] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [ 103.778999][ T6130] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 103.779028][ T6130] [pid 6136] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=81}) = 0 [pid 6136] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6136] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6136] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x51\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6136] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6136] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6136] write(6, "6", 1) = 1 [pid 6136] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6136] exit_group(0) = ? [ 104.289813][ T6136] FAULT_INJECTION: forcing a failure. [ 104.289813][ T6136] name failslab, interval 1, probability 0, space 0, times 0 [ 104.289847][ T6136] CPU: 1 UID: 0 PID: 6136 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 104.289870][ T6136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.289893][ T6136] Call Trace: [ 104.289900][ T6136] [ 104.289908][ T6136] dump_stack_lvl+0xe8/0x150 [ 104.289941][ T6136] should_fail_ex+0x410/0x560 [ 104.289967][ T6136] should_failslab+0xa8/0x100 [ 104.289990][ T6136] ? dst_alloc+0x105/0x170 [ 104.290029][ T6136] kmem_cache_alloc_noprof+0xa1/0x600 [ 104.290060][ T6136] ? dst_alloc+0x105/0x170 [ 104.290087][ T6136] ? fib_lookup+0x76/0x440 [ 104.290117][ T6136] dst_alloc+0x105/0x170 [ 104.290150][ T6136] ip_route_input_rcu+0x20ca/0x3190 [ 104.290189][ T6136] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 104.290243][ T6136] ? tc_run+0x50f/0x750 [ 104.290263][ T6136] ? ip_route_input_noref+0xad/0x270 [ 104.290296][ T6136] ip_route_input_noref+0x17c/0x270 [ 104.290329][ T6136] ? __pfx_ip_route_input_noref+0x10/0x10 [ 104.290362][ T6136] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 104.290387][ T6136] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 104.290413][ T6136] ip_rcv_finish_core+0x593/0x1c00 [ 104.290454][ T6136] ip_rcv_finish+0x14c/0x2a0 [ 104.290481][ T6136] NF_HOOK+0x336/0x3c0 [ 104.290507][ T6136] ? __pfx_ip_rcv_finish+0x10/0x10 [ 104.290530][ T6136] ? NF_HOOK+0x9e/0x3c0 [ 104.290553][ T6136] ? __pfx_NF_HOOK+0x10/0x10 [ 104.290578][ T6136] ? __pfx_sock_wfree+0x10/0x10 [ 104.290602][ T6136] ? ip_rcv_core+0x7fa/0xd50 [ 104.290630][ T6136] ? netif_receive_skb+0x102/0xbf0 [ 104.290649][ T6136] ? __pfx_ip_rcv+0x10/0x10 [ 104.290672][ T6136] netif_receive_skb+0x45b/0xbf0 [ 104.290696][ T6136] ? __pfx_netif_receive_skb+0x10/0x10 [ 104.290721][ T6136] ? tun_rx_batched+0x185/0x790 [ 104.290744][ T6136] tun_rx_batched+0x1de/0x790 [ 104.290771][ T6136] ? __pfx_tun_rx_batched+0x10/0x10 [ 104.290793][ T6136] ? lock_acquire+0x115/0x350 [ 104.290819][ T6136] ? tun_get_user+0x23ba/0x44d0 [ 104.290838][ T6136] ? __local_bh_enable_ip+0xd6/0x140 [ 104.290863][ T6136] ? tun_get_user+0x27b0/0x44d0 [ 104.290885][ T6136] tun_get_user+0x2be0/0x44d0 [ 104.290918][ T6136] ? tun_get_user+0x27b0/0x44d0 [ 104.290937][ T6136] ? aa_file_perm+0x18b/0x15f0 [ 104.290967][ T6136] ? aa_file_perm+0x4ed/0x15f0 [ 104.290992][ T6136] ? __pfx_tun_get_user+0x10/0x10 [ 104.291022][ T6136] ? __lock_acquire+0x747/0x2de0 [ 104.291047][ T6136] ? finish_task_switch+0x40e/0xc60 [ 104.291077][ T6136] ? ref_tracker_alloc+0x341/0x4b0 [ 104.291102][ T6136] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 104.291128][ T6136] ? lock_acquire+0x115/0x350 [ 104.291148][ T6136] ? tun_get+0x1c/0x2f0 [ 104.291173][ T6136] ? tun_get+0x1c/0x2f0 [ 104.291192][ T6136] ? tun_get+0x1c/0x2f0 [ 104.291216][ T6136] tun_chr_write_iter+0x113/0x200 [ 104.291240][ T6136] vfs_write+0x612/0xba0 [ 104.291277][ T6136] ? __pfx_vfs_write+0x10/0x10 [ 104.291314][ T6136] ? _raw_spin_unlock_irq+0x23/0x50 [ 104.291343][ T6136] ksys_write+0x150/0x270 [ 104.291373][ T6136] ? __pfx_ksys_write+0x10/0x10 [ 104.291413][ T6136] do_syscall_64+0x166/0x520 [ 104.291434][ T6136] ? trace_irq_disable+0x3b/0x140 [ 104.291453][ T6136] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.291473][ T6136] ? clear_bhb_loop+0x70/0xc0 [ 104.291496][ T6136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.291516][ T6136] RIP: 0033:0x7f6c0bc30879 [pid 6136] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6136, si_uid=0, si_status=0, si_utime=0, si_stime=6 /* 0.06 s */} --- umount2("./51", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./51/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 104.291534][ T6136] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 104.291549][ T6136] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 104.291569][ T6136] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 104.291583][ T6136] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 104.291595][ T6136] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 104.291606][ T6136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./51/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./51") = 0 [ 104.291618][ T6136] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 104.291645][ T6136] mkdir("./52", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6145 ci-upstream-kasan-gce/strace-static-x86_64: Process 6145 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6145] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6145] <... set_robust_list resumed>) = 0 [pid 6145] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6145] chdir("./52") = 0 [pid 6145] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6145] setpgid(0, 0) = 0 [pid 6145] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6145] write(3, "1000", 4) = 4 [pid 6145] close(3) = 0 [pid 6145] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6145] write(1, "executing program\n", 18) = 18 executing program [pid 6145] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6145] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6145] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6145] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=82}) = 0 [pid 6145] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6145] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6145] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x52\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6145] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6145] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6145] write(6, "6", 1) = 1 [pid 6145] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6145] exit_group(0) = ? [pid 6145] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6145, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./52", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./52/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./52/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./52") = 0 mkdir("./53", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6157 attached [pid 6157] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6157 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6157] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6157] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6157] chdir("./53") = 0 [pid 6157] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6157] setpgid(0, 0) = 0 [pid 6157] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6157] write(3, "1000", 4) = 4 [pid 6157] close(3) = 0 [pid 6157] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6157] write(1, "executing program\n", 18) = 18 executing program [pid 6157] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6157] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6157] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6157] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=83}) = 0 [pid 6157] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6157] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6157] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x53\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6157] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6157] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6157] write(6, "6", 1) = 1 [pid 6157] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 105.168534][ T6157] FAULT_INJECTION: forcing a failure. [ 105.168534][ T6157] name failslab, interval 1, probability 0, space 0, times 0 [ 105.168567][ T6157] CPU: 0 UID: 0 PID: 6157 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 105.168589][ T6157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.168600][ T6157] Call Trace: [ 105.168608][ T6157] [ 105.168616][ T6157] dump_stack_lvl+0xe8/0x150 [ 105.168653][ T6157] should_fail_ex+0x410/0x560 [ 105.168679][ T6157] should_failslab+0xa8/0x100 [ 105.168703][ T6157] ? dst_alloc+0x105/0x170 [ 105.168731][ T6157] kmem_cache_alloc_noprof+0xa1/0x600 [ 105.168763][ T6157] ? dst_alloc+0x105/0x170 [ 105.168799][ T6157] ? fib_lookup+0x76/0x440 [ 105.168830][ T6157] dst_alloc+0x105/0x170 [ 105.168862][ T6157] ip_route_input_rcu+0x20ca/0x3190 [ 105.168901][ T6157] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 105.168954][ T6157] ? tc_run+0x50f/0x750 [pid 6157] exit_group(0) = ? [ 105.168974][ T6157] ? ip_route_input_noref+0xad/0x270 [ 105.169005][ T6157] ip_route_input_noref+0x17c/0x270 [ 105.169038][ T6157] ? __pfx_ip_route_input_noref+0x10/0x10 [ 105.169071][ T6157] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 105.169096][ T6157] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 105.169123][ T6157] ip_rcv_finish_core+0x593/0x1c00 [ 105.169159][ T6157] ip_rcv_finish+0x14c/0x2a0 [ 105.169186][ T6157] NF_HOOK+0x336/0x3c0 [ 105.169211][ T6157] ? __pfx_ip_rcv_finish+0x10/0x10 [ 105.169234][ T6157] ? NF_HOOK+0x9e/0x3c0 [ 105.169256][ T6157] ? __pfx_NF_HOOK+0x10/0x10 [ 105.169280][ T6157] ? __pfx_sock_wfree+0x10/0x10 [ 105.169304][ T6157] ? ip_rcv_core+0x7fa/0xd50 [ 105.169334][ T6157] ? netif_receive_skb+0x102/0xbf0 [ 105.169353][ T6157] ? __pfx_ip_rcv+0x10/0x10 [ 105.169376][ T6157] netif_receive_skb+0x45b/0xbf0 [ 105.169400][ T6157] ? __pfx_netif_receive_skb+0x10/0x10 [ 105.169424][ T6157] ? tun_rx_batched+0x185/0x790 [ 105.169447][ T6157] tun_rx_batched+0x1de/0x790 [ 105.169474][ T6157] ? __pfx_tun_rx_batched+0x10/0x10 [ 105.169514][ T6157] ? lock_acquire+0x115/0x350 [ 105.169542][ T6157] ? tun_get_user+0x23ba/0x44d0 [ 105.169563][ T6157] ? __local_bh_enable_ip+0xd6/0x140 [ 105.169589][ T6157] ? tun_get_user+0x27b0/0x44d0 [ 105.169613][ T6157] tun_get_user+0x2be0/0x44d0 [ 105.169647][ T6157] ? tun_get_user+0x27b0/0x44d0 [ 105.169667][ T6157] ? aa_file_perm+0x18b/0x15f0 [ 105.169699][ T6157] ? aa_file_perm+0x4ed/0x15f0 [ 105.169724][ T6157] ? __pfx_tun_get_user+0x10/0x10 [ 105.169745][ T6157] ? __lock_acquire+0x747/0x2de0 [ 105.169771][ T6157] ? finish_task_switch+0x40e/0xc60 [ 105.169810][ T6157] ? ref_tracker_alloc+0x341/0x4b0 [ 105.169837][ T6157] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 105.169864][ T6157] ? lock_acquire+0x115/0x350 [ 105.169885][ T6157] ? tun_get+0x1c/0x2f0 [ 105.169912][ T6157] ? tun_get+0x1c/0x2f0 [ 105.169932][ T6157] ? tun_get+0x1c/0x2f0 [ 105.169958][ T6157] tun_chr_write_iter+0x113/0x200 [ 105.169983][ T6157] vfs_write+0x612/0xba0 [ 105.170022][ T6157] ? __pfx_vfs_write+0x10/0x10 [ 105.170072][ T6157] ? _raw_spin_unlock_irq+0x23/0x50 [ 105.170100][ T6157] ksys_write+0x150/0x270 [ 105.170130][ T6157] ? __pfx_ksys_write+0x10/0x10 [ 105.170168][ T6157] do_syscall_64+0x166/0x520 [ 105.170189][ T6157] ? trace_irq_disable+0x3b/0x140 [ 105.170225][ T6157] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.170246][ T6157] ? clear_bhb_loop+0x70/0xc0 [ 105.170270][ T6157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.170290][ T6157] RIP: 0033:0x7f6c0bc30879 [ 105.170308][ T6157] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 105.170325][ T6157] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.170347][ T6157] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 105.170362][ T6157] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 105.170375][ T6157] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 6157] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6157, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./53", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./53/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./53/binderfs") = 0 [ 105.170387][ T6157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 105.170399][ T6157] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 105.170428][ T6157] getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./53") = 0 mkdir("./54", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6168 attached , child_tidptr=0x55556fc096d0) = 6168 [pid 6168] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6168] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6168] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6168] chdir("./54") = 0 [pid 6168] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6168] setpgid(0, 0) = 0 [pid 6168] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6168] write(3, "1000", 4) = 4 [pid 6168] close(3) = 0 [pid 6168] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6168] write(1, "executing program\n", 18) = 18 [pid 6168] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6168] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6168] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6168] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=84}) = 0 [pid 6168] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6168] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6168] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x54\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6168] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6168] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6168] write(6, "6", 1) = 1 [pid 6168] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6168] exit_group(0) = ? [pid 6168] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6168, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./54", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./54/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./54/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./54") = 0 mkdir("./55", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6182 attached [pid 6182] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6182] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6182] chdir("./55" [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6182 [pid 6182] <... chdir resumed>) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6182] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6182] <... prctl resumed>) = 0 [pid 6182] setpgid(0, 0) = 0 [pid 6182] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6182] write(3, "1000", 4) = 4 [pid 6182] close(3) = 0 [pid 6182] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6182] write(1, "executing program\n", 18) = 18 [pid 6182] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6182] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6182] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6182] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=85}) = 0 [pid 6182] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6182] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6182] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x55\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6182] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6182] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6182] write(6, "6", 1) = 1 [pid 6182] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6182] exit_group(0) = ? [pid 6182] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6182, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./55", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./55/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./55/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./55") = 0 mkdir("./56", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6190 attached [pid 6190] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6190] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6190 [pid 6190] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6190] chdir("./56" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6190] <... chdir resumed>) = 0 [pid 6190] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6190] setpgid(0, 0) = 0 [pid 6190] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6190] write(3, "1000", 4) = 4 [pid 6190] close(3) = 0 [pid 6190] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6190] write(1, "executing program\n", 18) = 18 [pid 6190] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6190] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6190] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6190] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=86}) = 0 [pid 6190] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6190] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6190] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x56\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6190] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6190] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6190] write(6, "6", 1) = 1 [pid 6190] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6190] exit_group(0) = ? [pid 6190] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6190, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./56", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./56/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./56/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./56") = 0 mkdir("./57", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6197 attached [pid 6197] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6197] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6197 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6197] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6197] chdir("./57") = 0 [pid 6197] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6197] setpgid(0, 0) = 0 [pid 6197] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6197] write(3, "1000", 4) = 4 [pid 6197] close(3) = 0 [pid 6197] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6197] write(1, "executing program\n", 18) = 18 executing program [pid 6197] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6197] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6197] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6197] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=87}) = 0 [pid 6197] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6197] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6197] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x57\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6197] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6197] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6197] write(6, "6", 1) = 1 [pid 6197] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6197] exit_group(0) = ? [pid 6197] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6197, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./57", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./57/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./57/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./57") = 0 mkdir("./58", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6208 attached , child_tidptr=0x55556fc096d0) = 6208 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6208] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6208] <... set_robust_list resumed>) = 0 [pid 6208] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6208] chdir("./58") = 0 [pid 6208] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6208] setpgid(0, 0) = 0 [pid 6208] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6208] write(3, "1000", 4) = 4 [pid 6208] close(3) = 0 [pid 6208] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6208] write(1, "executing program\n", 18) = 18 executing program [pid 6208] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6208] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6208] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6208] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=88}) = 0 [pid 6208] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6208] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6208] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x58\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6208] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6208] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6208] write(6, "6", 1) = 1 [pid 6208] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6208] exit_group(0) = ? [pid 6208] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6208, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./58", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./58/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./58/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./58") = 0 mkdir("./59", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6220 attached , child_tidptr=0x55556fc096d0) = 6220 [pid 6220] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6220] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6220] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6220] chdir("./59") = 0 [pid 6220] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6220] setpgid(0, 0) = 0 [pid 6220] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6220] write(3, "1000", 4) = 4 [pid 6220] close(3) = 0 [pid 6220] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6220] write(1, "executing program\n", 18) = 18 [pid 6220] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6220] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6220] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6220] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=89}) = 0 [pid 6220] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6220] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6220] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x59\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6220] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6220] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6220] write(6, "6", 1) = 1 [pid 6220] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6220] exit_group(0) = ? [pid 6220] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6220, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./59", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./59/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./59/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./59") = 0 mkdir("./60", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6232 attached [pid 6232] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6232 [pid 6232] <... set_robust_list resumed>) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6232] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6232] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6232] chdir("./60") = 0 [pid 6232] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6232] setpgid(0, 0) = 0 [pid 6232] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6232] write(3, "1000", 4) = 4 [pid 6232] close(3) = 0 [pid 6232] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6232] write(1, "executing program\n", 18) = 18 [pid 6232] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6232] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6232] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6232] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=90}) = 0 [pid 6232] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6232] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6232] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x5a\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6232] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6232] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6232] write(6, "6", 1) = 1 [pid 6232] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [ 107.329599][ T6232] FAULT_INJECTION: forcing a failure. [ 107.329599][ T6232] name failslab, interval 1, probability 0, space 0, times 0 [ 107.329630][ T6232] CPU: 0 UID: 0 PID: 6232 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 107.329652][ T6232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 107.329664][ T6232] Call Trace: [ 107.329672][ T6232] [ 107.329680][ T6232] dump_stack_lvl+0xe8/0x150 [ 107.329712][ T6232] should_fail_ex+0x410/0x560 [ 107.329738][ T6232] should_failslab+0xa8/0x100 [ 107.329760][ T6232] ? dst_alloc+0x105/0x170 [ 107.329787][ T6232] kmem_cache_alloc_noprof+0xa1/0x600 [ 107.329819][ T6232] ? dst_alloc+0x105/0x170 [ 107.329847][ T6232] ? fib_lookup+0x76/0x440 [ 107.329882][ T6232] dst_alloc+0x105/0x170 [ 107.329915][ T6232] ip_route_input_rcu+0x20ca/0x3190 [ 107.329972][ T6232] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 107.330030][ T6232] ? tc_run+0x50f/0x750 [pid 6232] exit_group(0) = ? [ 107.330051][ T6232] ? ip_route_input_noref+0xad/0x270 [ 107.330085][ T6232] ip_route_input_noref+0x17c/0x270 [ 107.330120][ T6232] ? __pfx_ip_route_input_noref+0x10/0x10 [ 107.330156][ T6232] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 107.330190][ T6232] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 107.330218][ T6232] ip_rcv_finish_core+0x593/0x1c00 [ 107.330257][ T6232] ip_rcv_finish+0x14c/0x2a0 [ 107.330286][ T6232] NF_HOOK+0x336/0x3c0 [ 107.330313][ T6232] ? __pfx_ip_rcv_finish+0x10/0x10 [ 107.330338][ T6232] ? NF_HOOK+0x9e/0x3c0 [ 107.330362][ T6232] ? __pfx_NF_HOOK+0x10/0x10 [ 107.330388][ T6232] ? __pfx_sock_wfree+0x10/0x10 [ 107.330413][ T6232] ? ip_rcv_core+0x7fa/0xd50 [ 107.330444][ T6232] ? netif_receive_skb+0x102/0xbf0 [ 107.330464][ T6232] ? __pfx_ip_rcv+0x10/0x10 [ 107.330489][ T6232] netif_receive_skb+0x45b/0xbf0 [ 107.330515][ T6232] ? __pfx_netif_receive_skb+0x10/0x10 [ 107.330540][ T6232] ? tun_rx_batched+0x185/0x790 [ 107.330565][ T6232] tun_rx_batched+0x1de/0x790 [ 107.330593][ T6232] ? __pfx_tun_rx_batched+0x10/0x10 [ 107.330616][ T6232] ? lock_acquire+0x115/0x350 [ 107.330644][ T6232] ? tun_get_user+0x23ba/0x44d0 [ 107.330665][ T6232] ? __local_bh_enable_ip+0xd6/0x140 [ 107.330692][ T6232] ? tun_get_user+0x27b0/0x44d0 [ 107.330715][ T6232] tun_get_user+0x2be0/0x44d0 [ 107.330762][ T6232] ? tun_get_user+0x27b0/0x44d0 [ 107.330780][ T6232] ? aa_file_perm+0x18b/0x15f0 [ 107.330810][ T6232] ? aa_file_perm+0x4ed/0x15f0 [ 107.330836][ T6232] ? __pfx_tun_get_user+0x10/0x10 [ 107.330858][ T6232] ? __lock_acquire+0x747/0x2de0 [ 107.330884][ T6232] ? finish_task_switch+0x40e/0xc60 [ 107.330912][ T6232] ? ref_tracker_alloc+0x341/0x4b0 [ 107.330938][ T6232] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 107.330963][ T6232] ? lock_acquire+0x115/0x350 [ 107.330982][ T6232] ? tun_get+0x1c/0x2f0 [ 107.331008][ T6232] ? tun_get+0x1c/0x2f0 [ 107.331027][ T6232] ? tun_get+0x1c/0x2f0 [ 107.331051][ T6232] tun_chr_write_iter+0x113/0x200 [ 107.331073][ T6232] vfs_write+0x612/0xba0 [ 107.331109][ T6232] ? __pfx_vfs_write+0x10/0x10 [ 107.331146][ T6232] ? _raw_spin_unlock_irq+0x23/0x50 [ 107.331180][ T6232] ksys_write+0x150/0x270 [ 107.331210][ T6232] ? __pfx_ksys_write+0x10/0x10 [ 107.331249][ T6232] do_syscall_64+0x166/0x520 [ 107.331269][ T6232] ? trace_irq_disable+0x3b/0x140 [ 107.331288][ T6232] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.331307][ T6232] ? clear_bhb_loop+0x70/0xc0 [ 107.331331][ T6232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.331349][ T6232] RIP: 0033:0x7f6c0bc30879 [ 107.331367][ T6232] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 107.331382][ T6232] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 107.331401][ T6232] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 107.331415][ T6232] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 107.331427][ T6232] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 107.331438][ T6232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [pid 6232] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6232, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./60", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./60/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./60/binderfs") = 0 [ 107.331450][ T6232] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 107.331478][ T6232] getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./60") = 0 mkdir("./61", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6240 attached [pid 6240] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6240] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6240 [pid 6240] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6240] chdir("./61" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6240] <... chdir resumed>) = 0 [pid 6240] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6240] setpgid(0, 0) = 0 [pid 6240] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6240] write(3, "1000", 4) = 4 [pid 6240] close(3) = 0 [pid 6240] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6240] write(1, "executing program\n", 18) = 18 executing program [pid 6240] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6240] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6240] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6240] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=91}) = 0 [pid 6240] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6240] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6240] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x5b\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6240] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6240] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6240] write(6, "6", 1) = 1 [pid 6240] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6240] exit_group(0) = ? [pid 6240] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6240, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./61", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./61/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./61/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./61") = 0 mkdir("./62", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6251 attached [pid 6251] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6251] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6251] chdir("./62" [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6251 [pid 6251] <... chdir resumed>) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6251] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6251] setpgid(0, 0) = 0 [pid 6251] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6251] write(3, "1000", 4) = 4 [pid 6251] close(3) = 0 [pid 6251] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6251] write(1, "executing program\n", 18) = 18 [pid 6251] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [pid 6251] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6251] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6251] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=92}) = 0 [pid 6251] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6251] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6251] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x5c\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6251] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6251] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6251] write(6, "6", 1) = 1 [pid 6251] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6251] exit_group(0) = ? [pid 6251] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6251, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./62", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./62/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./62/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./62") = 0 mkdir("./63", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6262 attached [pid 6262] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6262 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6262] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6262] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6262] chdir("./63") = 0 [pid 6262] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6262] setpgid(0, 0) = 0 [pid 6262] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6262] write(3, "1000", 4) = 4 [pid 6262] close(3) = 0 [pid 6262] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6262] write(1, "executing program\n", 18) = 18 [pid 6262] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [pid 6262] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6262] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6262] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=93}) = 0 [pid 6262] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6262] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6262] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x5d\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6262] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6262] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6262] write(6, "6", 1) = 1 [ 108.492483][ T6262] FAULT_INJECTION: forcing a failure. [ 108.492483][ T6262] name failslab, interval 1, probability 0, space 0, times 0 [ 108.492515][ T6262] CPU: 0 UID: 0 PID: 6262 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 108.492540][ T6262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.492551][ T6262] Call Trace: [ 108.492559][ T6262] [ 108.492567][ T6262] dump_stack_lvl+0xe8/0x150 [ 108.492597][ T6262] should_fail_ex+0x410/0x560 [ 108.492623][ T6262] should_failslab+0xa8/0x100 [ 108.492647][ T6262] ? dst_alloc+0x105/0x170 [ 108.492675][ T6262] kmem_cache_alloc_noprof+0xa1/0x600 [ 108.492705][ T6262] ? dst_alloc+0x105/0x170 [ 108.492733][ T6262] ? fib_lookup+0x76/0x440 [ 108.492763][ T6262] dst_alloc+0x105/0x170 [ 108.492795][ T6262] ip_route_input_rcu+0x20ca/0x3190 [ 108.492833][ T6262] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 108.492887][ T6262] ? tc_run+0x50f/0x750 [ 108.492906][ T6262] ? ip_route_input_noref+0xad/0x270 [pid 6262] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6262] exit_group(0) = ? [ 108.492937][ T6262] ip_route_input_noref+0x17c/0x270 [ 108.492968][ T6262] ? __pfx_ip_route_input_noref+0x10/0x10 [ 108.493001][ T6262] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 108.493025][ T6262] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 108.493051][ T6262] ip_rcv_finish_core+0x593/0x1c00 [ 108.493086][ T6262] ip_rcv_finish+0x14c/0x2a0 [ 108.493120][ T6262] NF_HOOK+0x336/0x3c0 [ 108.493143][ T6262] ? __pfx_ip_rcv_finish+0x10/0x10 [ 108.493167][ T6262] ? NF_HOOK+0x9e/0x3c0 [ 108.493187][ T6262] ? __pfx_NF_HOOK+0x10/0x10 [ 108.493211][ T6262] ? __pfx_sock_wfree+0x10/0x10 [ 108.493234][ T6262] ? ip_rcv_core+0x7fa/0xd50 [ 108.493263][ T6262] ? netif_receive_skb+0x102/0xbf0 [ 108.493281][ T6262] ? __pfx_ip_rcv+0x10/0x10 [ 108.493302][ T6262] netif_receive_skb+0x45b/0xbf0 [ 108.493325][ T6262] ? __pfx_netif_receive_skb+0x10/0x10 [ 108.493350][ T6262] ? tun_rx_batched+0x185/0x790 [ 108.493373][ T6262] tun_rx_batched+0x1de/0x790 [ 108.493399][ T6262] ? __pfx_tun_rx_batched+0x10/0x10 [ 108.493420][ T6262] ? lock_acquire+0x115/0x350 [ 108.493447][ T6262] ? tun_get_user+0x23ba/0x44d0 [ 108.493465][ T6262] ? __local_bh_enable_ip+0xd6/0x140 [ 108.493490][ T6262] ? tun_get_user+0x27b0/0x44d0 [ 108.493510][ T6262] tun_get_user+0x2be0/0x44d0 [ 108.493543][ T6262] ? tun_get_user+0x27b0/0x44d0 [ 108.493562][ T6262] ? aa_file_perm+0x18b/0x15f0 [ 108.493592][ T6262] ? aa_file_perm+0x4ed/0x15f0 [ 108.493617][ T6262] ? __pfx_tun_get_user+0x10/0x10 [ 108.493640][ T6262] ? __lock_acquire+0x747/0x2de0 [ 108.493665][ T6262] ? finish_task_switch+0x40e/0xc60 [ 108.493694][ T6262] ? ref_tracker_alloc+0x341/0x4b0 [ 108.493719][ T6262] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 108.493744][ T6262] ? lock_acquire+0x115/0x350 [ 108.493763][ T6262] ? tun_get+0x1c/0x2f0 [ 108.493788][ T6262] ? tun_get+0x1c/0x2f0 [ 108.493807][ T6262] ? tun_get+0x1c/0x2f0 [ 108.493830][ T6262] tun_chr_write_iter+0x113/0x200 [ 108.493852][ T6262] vfs_write+0x612/0xba0 [ 108.493886][ T6262] ? __pfx_vfs_write+0x10/0x10 [ 108.493921][ T6262] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.493948][ T6262] ksys_write+0x150/0x270 [ 108.493977][ T6262] ? __pfx_ksys_write+0x10/0x10 [ 108.494015][ T6262] do_syscall_64+0x166/0x520 [ 108.494035][ T6262] ? trace_irq_disable+0x3b/0x140 [ 108.494054][ T6262] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.494073][ T6262] ? clear_bhb_loop+0x70/0xc0 [ 108.494105][ T6262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.494124][ T6262] RIP: 0033:0x7f6c0bc30879 [pid 6262] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6262, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} --- umount2("./63", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 108.494143][ T6262] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 108.494160][ T6262] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 108.494179][ T6262] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 108.494193][ T6262] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 108.494205][ T6262] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 108.494216][ T6262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 openat(AT_FDCWD, "./63", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./63/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./63/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./63/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 [ 108.494228][ T6262] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 108.494256][ T6262] close(3) = 0 rmdir("./63") = 0 mkdir("./64", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6274 attached [pid 6274] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6274] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6274 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6274] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6274] chdir("./64" [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6274] <... chdir resumed>) = 0 [pid 6274] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6274] setpgid(0, 0) = 0 [pid 6274] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6274] write(3, "1000", 4) = 4 [pid 6274] close(3) = 0 [pid 6274] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6274] write(1, "executing program\n", 18) = 18 [pid 6274] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6274] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6274] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6274] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=94}) = 0 [pid 6274] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6274] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6274] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x5e\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6274] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6274] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6274] write(6, "6", 1) = 1 [pid 6274] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6274] exit_group(0) = ? [pid 6274] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6274, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./64", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./64", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./64/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./64/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./64/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./64") = 0 mkdir("./65", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6281 attached , child_tidptr=0x55556fc096d0) = 6281 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6281] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6281] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6281] chdir("./65") = 0 [pid 6281] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6281] setpgid(0, 0) = 0 [pid 6281] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6281] write(3, "1000", 4) = 4 [pid 6281] close(3) = 0 [pid 6281] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6281] write(1, "executing program\n", 18) = 18 [pid 6281] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6281] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6281] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6281] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=95}) = 0 [pid 6281] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6281] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6281] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x5f\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6281] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6281] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6281] write(6, "6", 1) = 1 [pid 6281] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6281] exit_group(0) = ? [ 109.335442][ T6281] FAULT_INJECTION: forcing a failure. [ 109.335442][ T6281] name failslab, interval 1, probability 0, space 0, times 0 [ 109.335472][ T6281] CPU: 0 UID: 0 PID: 6281 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 109.335493][ T6281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 109.335503][ T6281] Call Trace: [ 109.335510][ T6281] [ 109.335518][ T6281] dump_stack_lvl+0xe8/0x150 [ 109.335550][ T6281] should_fail_ex+0x410/0x560 [ 109.335576][ T6281] should_failslab+0xa8/0x100 [ 109.335599][ T6281] ? dst_alloc+0x105/0x170 [ 109.335627][ T6281] kmem_cache_alloc_noprof+0xa1/0x600 [ 109.335658][ T6281] ? dst_alloc+0x105/0x170 [ 109.335686][ T6281] ? fib_lookup+0x76/0x440 [ 109.335715][ T6281] dst_alloc+0x105/0x170 [ 109.335748][ T6281] ip_route_input_rcu+0x20ca/0x3190 [ 109.335786][ T6281] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 109.335839][ T6281] ? tc_run+0x50f/0x750 [ 109.335858][ T6281] ? ip_route_input_noref+0xad/0x270 [ 109.335890][ T6281] ip_route_input_noref+0x17c/0x270 [ 109.335922][ T6281] ? __pfx_ip_route_input_noref+0x10/0x10 [ 109.335961][ T6281] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 109.335987][ T6281] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 109.336027][ T6281] ip_rcv_finish_core+0x593/0x1c00 [ 109.336087][ T6281] ip_rcv_finish+0x14c/0x2a0 [ 109.336119][ T6281] NF_HOOK+0x336/0x3c0 [ 109.336149][ T6281] ? __pfx_ip_rcv_finish+0x10/0x10 [ 109.336177][ T6281] ? NF_HOOK+0x9e/0x3c0 [ 109.336204][ T6281] ? __pfx_NF_HOOK+0x10/0x10 [ 109.336233][ T6281] ? __pfx_sock_wfree+0x10/0x10 [ 109.336262][ T6281] ? ip_rcv_core+0x7fa/0xd50 [ 109.336298][ T6281] ? netif_receive_skb+0x102/0xbf0 [ 109.336320][ T6281] ? __pfx_ip_rcv+0x10/0x10 [ 109.336348][ T6281] netif_receive_skb+0x45b/0xbf0 [ 109.336377][ T6281] ? __pfx_netif_receive_skb+0x10/0x10 [ 109.336406][ T6281] ? tun_rx_batched+0x185/0x790 [ 109.336433][ T6281] tun_rx_batched+0x1de/0x790 [ 109.336464][ T6281] ? __pfx_tun_rx_batched+0x10/0x10 [ 109.336490][ T6281] ? lock_acquire+0x115/0x350 [ 109.336521][ T6281] ? tun_get_user+0x23ba/0x44d0 [ 109.336544][ T6281] ? __local_bh_enable_ip+0xd6/0x140 [ 109.336574][ T6281] ? tun_get_user+0x27b0/0x44d0 [ 109.336604][ T6281] tun_get_user+0x2be0/0x44d0 [ 109.336644][ T6281] ? tun_get_user+0x27b0/0x44d0 [ 109.336667][ T6281] ? aa_file_perm+0x18b/0x15f0 [ 109.336702][ T6281] ? aa_file_perm+0x4ed/0x15f0 [ 109.336732][ T6281] ? __pfx_tun_get_user+0x10/0x10 [ 109.336758][ T6281] ? __lock_acquire+0x747/0x2de0 [ 109.336789][ T6281] ? finish_task_switch+0x40e/0xc60 [pid 6281] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6281, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 109.336823][ T6281] ? ref_tracker_alloc+0x341/0x4b0 [ 109.336854][ T6281] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 109.336884][ T6281] ? lock_acquire+0x115/0x350 [ 109.336907][ T6281] ? tun_get+0x1c/0x2f0 [ 109.336937][ T6281] ? tun_get+0x1c/0x2f0 [ 109.336960][ T6281] ? tun_get+0x1c/0x2f0 [ 109.336989][ T6281] tun_chr_write_iter+0x113/0x200 [ 109.337024][ T6281] vfs_write+0x612/0xba0 [ 109.337068][ T6281] ? __pfx_vfs_write+0x10/0x10 [ 109.337112][ T6281] ? _raw_spin_unlock_irq+0x23/0x50 umount2("./65", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./65", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./65/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./65/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./65/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 [ 109.337146][ T6281] ksys_write+0x150/0x270 [ 109.337183][ T6281] ? __pfx_ksys_write+0x10/0x10 [ 109.337243][ T6281] do_syscall_64+0x166/0x520 [ 109.337268][ T6281] ? trace_irq_disable+0x3b/0x140 [ 109.337291][ T6281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.337312][ T6281] ? clear_bhb_loop+0x70/0xc0 [ 109.337340][ T6281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.337362][ T6281] RIP: 0033:0x7f6c0bc30879 close(3) = 0 rmdir("./65") = 0 mkdir("./66", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 109.337382][ T6281] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 109.337401][ T6281] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.337425][ T6281] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 109.337442][ T6281] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 109.337456][ T6281] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 109.337470][ T6281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6287 attached , child_tidptr=0x55556fc096d0) = 6287 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6287] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6287] <... set_robust_list resumed>) = 0 [pid 6287] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6287] chdir("./66") = 0 [pid 6287] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6287] setpgid(0, 0) = 0 [pid 6287] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6287] write(3, "1000", 4) = 4 [pid 6287] close(3) = 0 [pid 6287] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6287] write(1, "executing program\n", 18) = 18 [pid 6287] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [pid 6287] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6287] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6287] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=96}) = 0 [pid 6287] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6287] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [ 109.337485][ T6281] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 109.337517][ T6281] [pid 6287] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x60\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6287] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6287] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6287] write(6, "6", 1) = 1 [pid 6287] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6287] exit_group(0) = ? [pid 6287] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6287, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./66", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./66", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./66/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./66/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./66/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./66") = 0 mkdir("./67", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6297 attached , child_tidptr=0x55556fc096d0) = 6297 [pid 6297] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6297] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6297] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6297] chdir("./67") = 0 [pid 6297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6297] setpgid(0, 0) = 0 [pid 6297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6297] write(3, "1000", 4) = 4 [pid 6297] close(3) = 0 [pid 6297] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6297] write(1, "executing program\n", 18) = 18 executing program [pid 6297] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6297] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6297] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6297] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=97}) = 0 [pid 6297] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6297] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6297] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x61\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6297] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6297] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6297] write(6, "6", 1) = 1 [pid 6297] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6297] exit_group(0) = ? [ 110.123866][ T6297] FAULT_INJECTION: forcing a failure. [ 110.123866][ T6297] name failslab, interval 1, probability 0, space 0, times 0 [ 110.123903][ T6297] CPU: 0 UID: 0 PID: 6297 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 110.123929][ T6297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.123943][ T6297] Call Trace: [ 110.123951][ T6297] [ 110.123960][ T6297] dump_stack_lvl+0xe8/0x150 [ 110.123999][ T6297] should_fail_ex+0x410/0x560 [ 110.124029][ T6297] should_failslab+0xa8/0x100 [ 110.124057][ T6297] ? dst_alloc+0x105/0x170 [ 110.124090][ T6297] kmem_cache_alloc_noprof+0xa1/0x600 [ 110.124128][ T6297] ? dst_alloc+0x105/0x170 [ 110.124162][ T6297] ? fib_lookup+0x76/0x440 [ 110.124201][ T6297] dst_alloc+0x105/0x170 [ 110.124240][ T6297] ip_route_input_rcu+0x20ca/0x3190 [ 110.124285][ T6297] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 110.124349][ T6297] ? tc_run+0x50f/0x750 [ 110.124372][ T6297] ? ip_route_input_noref+0xad/0x270 [ 110.124410][ T6297] ip_route_input_noref+0x17c/0x270 [ 110.124449][ T6297] ? __pfx_ip_route_input_noref+0x10/0x10 [ 110.124497][ T6297] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 110.124528][ T6297] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 110.124559][ T6297] ip_rcv_finish_core+0x593/0x1c00 [ 110.124603][ T6297] ip_rcv_finish+0x14c/0x2a0 [ 110.124636][ T6297] NF_HOOK+0x336/0x3c0 [ 110.124666][ T6297] ? __pfx_ip_rcv_finish+0x10/0x10 [ 110.124694][ T6297] ? NF_HOOK+0x9e/0x3c0 [ 110.124721][ T6297] ? __pfx_NF_HOOK+0x10/0x10 [ 110.124751][ T6297] ? __pfx_sock_wfree+0x10/0x10 [ 110.124780][ T6297] ? ip_rcv_core+0x7fa/0xd50 [ 110.124816][ T6297] ? netif_receive_skb+0x102/0xbf0 [ 110.124838][ T6297] ? __pfx_ip_rcv+0x10/0x10 [ 110.124865][ T6297] netif_receive_skb+0x45b/0xbf0 [ 110.124895][ T6297] ? __pfx_netif_receive_skb+0x10/0x10 [ 110.124924][ T6297] ? tun_rx_batched+0x185/0x790 [ 110.124968][ T6297] tun_rx_batched+0x1de/0x790 [ 110.124999][ T6297] ? __pfx_tun_rx_batched+0x10/0x10 [ 110.125024][ T6297] ? lock_acquire+0x115/0x350 [ 110.125054][ T6297] ? tun_get_user+0x23ba/0x44d0 [ 110.125077][ T6297] ? __local_bh_enable_ip+0xd6/0x140 [ 110.125105][ T6297] ? tun_get_user+0x27b0/0x44d0 [ 110.125132][ T6297] tun_get_user+0x2be0/0x44d0 [ 110.125193][ T6297] ? tun_get_user+0x27b0/0x44d0 [ 110.125216][ T6297] ? aa_file_perm+0x18b/0x15f0 [ 110.125252][ T6297] ? aa_file_perm+0x4ed/0x15f0 [ 110.125281][ T6297] ? __pfx_tun_get_user+0x10/0x10 [ 110.125319][ T6297] ? __lock_acquire+0x747/0x2de0 [ 110.125350][ T6297] ? finish_task_switch+0x40e/0xc60 [ 110.125383][ T6297] ? ref_tracker_alloc+0x341/0x4b0 [ 110.125421][ T6297] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 110.125451][ T6297] ? lock_acquire+0x115/0x350 [ 110.125501][ T6297] ? tun_get+0x1c/0x2f0 [ 110.125532][ T6297] ? tun_get+0x1c/0x2f0 [ 110.125554][ T6297] ? tun_get+0x1c/0x2f0 [ 110.125582][ T6297] tun_chr_write_iter+0x113/0x200 [ 110.125609][ T6297] vfs_write+0x612/0xba0 [ 110.125652][ T6297] ? __pfx_vfs_write+0x10/0x10 [ 110.125694][ T6297] ? _raw_spin_unlock_irq+0x23/0x50 [ 110.125729][ T6297] ksys_write+0x150/0x270 [ 110.125766][ T6297] ? __pfx_ksys_write+0x10/0x10 [ 110.125810][ T6297] do_syscall_64+0x166/0x520 [ 110.125835][ T6297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.125859][ T6297] ? clear_bhb_loop+0x70/0xc0 [ 110.125887][ T6297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.125909][ T6297] RIP: 0033:0x7f6c0bc30879 [ 110.125929][ T6297] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 110.125949][ T6297] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 110.125981][ T6297] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 110.125998][ T6297] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 110.126012][ T6297] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 110.126025][ T6297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 110.126040][ T6297] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.126073][ T6297] [pid 6297] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6297, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./67", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./67", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./67/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./67/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./67/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./67") = 0 mkdir("./68", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6310 attached [pid 6310] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6310 [pid 6310] <... set_robust_list resumed>) = 0 [pid 6310] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6310] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6310] chdir("./68") = 0 [pid 6310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6310] setpgid(0, 0) = 0 [pid 6310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6310] write(3, "1000", 4) = 4 [pid 6310] close(3) = 0 [pid 6310] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6310] write(1, "executing program\n", 18) = 18 [pid 6310] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6310] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6310] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6310] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=98}) = 0 [pid 6310] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6310] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6310] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x62\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6310] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6310] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6310] write(6, "6", 1) = 1 [pid 6310] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6310] exit_group(0) = ? [ 110.757682][ T6310] FAULT_INJECTION: forcing a failure. [ 110.757682][ T6310] name failslab, interval 1, probability 0, space 0, times 0 [ 110.757715][ T6310] CPU: 0 UID: 0 PID: 6310 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 110.757737][ T6310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.757749][ T6310] Call Trace: [ 110.757775][ T6310] [ 110.757784][ T6310] dump_stack_lvl+0xe8/0x150 [ 110.757817][ T6310] should_fail_ex+0x410/0x560 [ 110.757844][ T6310] should_failslab+0xa8/0x100 [ 110.757887][ T6310] ? dst_alloc+0x105/0x170 [ 110.757917][ T6310] kmem_cache_alloc_noprof+0xa1/0x600 [ 110.757950][ T6310] ? dst_alloc+0x105/0x170 [ 110.757980][ T6310] ? fib_lookup+0x76/0x440 [ 110.758013][ T6310] dst_alloc+0x105/0x170 [ 110.758047][ T6310] ip_route_input_rcu+0x20ca/0x3190 [ 110.758089][ T6310] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 110.758147][ T6310] ? tc_run+0x50f/0x750 [ 110.758169][ T6310] ? ip_route_input_noref+0xad/0x270 [ 110.758202][ T6310] ip_route_input_noref+0x17c/0x270 [ 110.758237][ T6310] ? __pfx_ip_route_input_noref+0x10/0x10 [ 110.758272][ T6310] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 110.758300][ T6310] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 110.758328][ T6310] ip_rcv_finish_core+0x593/0x1c00 [ 110.758387][ T6310] ip_rcv_finish+0x14c/0x2a0 [ 110.758418][ T6310] NF_HOOK+0x336/0x3c0 [ 110.758465][ T6310] ? __pfx_ip_rcv_finish+0x10/0x10 [ 110.758490][ T6310] ? NF_HOOK+0x9e/0x3c0 [ 110.758514][ T6310] ? __pfx_NF_HOOK+0x10/0x10 [ 110.758541][ T6310] ? __pfx_sock_wfree+0x10/0x10 [ 110.758568][ T6310] ? ip_rcv_core+0x7fa/0xd50 [ 110.758599][ T6310] ? netif_receive_skb+0x102/0xbf0 [ 110.758620][ T6310] ? __pfx_ip_rcv+0x10/0x10 [ 110.758645][ T6310] netif_receive_skb+0x45b/0xbf0 [ 110.758671][ T6310] ? __pfx_netif_receive_skb+0x10/0x10 [ 110.758697][ T6310] ? tun_rx_batched+0x185/0x790 [ 110.758722][ T6310] tun_rx_batched+0x1de/0x790 [ 110.758750][ T6310] ? __pfx_tun_rx_batched+0x10/0x10 [pid 6310] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6310, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 110.758772][ T6310] ? lock_acquire+0x115/0x350 [ 110.758801][ T6310] ? tun_get_user+0x23ba/0x44d0 [ 110.758822][ T6310] ? __local_bh_enable_ip+0xd6/0x140 [ 110.758848][ T6310] ? tun_get_user+0x27b0/0x44d0 [ 110.758873][ T6310] tun_get_user+0x2be0/0x44d0 [ 110.758908][ T6310] ? tun_get_user+0x27b0/0x44d0 [ 110.758927][ T6310] ? aa_file_perm+0x18b/0x15f0 [ 110.758960][ T6310] ? aa_file_perm+0x4ed/0x15f0 [ 110.758986][ T6310] ? __pfx_tun_get_user+0x10/0x10 [ 110.759010][ T6310] ? __lock_acquire+0x747/0x2de0 umount2("./68", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./68", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./68/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./68/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./68/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./68") = 0 mkdir("./69", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 110.759037][ T6310] ? finish_task_switch+0x40e/0xc60 [ 110.759068][ T6310] ? ref_tracker_alloc+0x341/0x4b0 [ 110.759095][ T6310] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 110.759122][ T6310] ? lock_acquire+0x115/0x350 [ 110.759142][ T6310] ? tun_get+0x1c/0x2f0 [ 110.759169][ T6310] ? tun_get+0x1c/0x2f0 [ 110.759189][ T6310] ? tun_get+0x1c/0x2f0 [ 110.759215][ T6310] tun_chr_write_iter+0x113/0x200 [ 110.759239][ T6310] vfs_write+0x612/0xba0 [ 110.759278][ T6310] ? __pfx_vfs_write+0x10/0x10 [ 110.759317][ T6310] ? _raw_spin_unlock_irq+0x23/0x50 [ 110.759346][ T6310] ksys_write+0x150/0x270 [ 110.759379][ T6310] ? __pfx_ksys_write+0x10/0x10 [ 110.759421][ T6310] do_syscall_64+0x166/0x520 [ 110.759449][ T6310] ? trace_irq_disable+0x3b/0x140 [ 110.759469][ T6310] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.759489][ T6310] ? clear_bhb_loop+0x70/0xc0 [ 110.759524][ T6310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.759543][ T6310] RIP: 0033:0x7f6c0bc30879 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6316 attached , child_tidptr=0x55556fc096d0) = 6316 [pid 6316] set_robust_list(0x55556fc096e0, 24 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6316] <... set_robust_list resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 110.759561][ T6310] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 110.759577][ T6310] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 110.759598][ T6310] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 110.759613][ T6310] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 110.759625][ T6310] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 6316] chdir("./69") = 0 [pid 6316] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6316] setpgid(0, 0) = 0 [pid 6316] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6316] write(3, "1000", 4) = 4 [pid 6316] close(3) = 0 [pid 6316] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6316] write(1, "executing program\n", 18) = 18 [pid 6316] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [ 110.759637][ T6310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 110.759649][ T6310] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 110.759677][ T6310] [pid 6316] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6316] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6316] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=99}) = 0 [pid 6316] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6316] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6316] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x63\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6316] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6316] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6316] write(6, "6", 1) = 1 [pid 6316] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6316] exit_group(0) = ? [pid 6316] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6316, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./69", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./69", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./69/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./69/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./69/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./69") = 0 mkdir("./70", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6325 ci-upstream-kasan-gce/strace-static-x86_64: Process 6325 attached [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6325] set_robust_list(0x55556fc096e0, 24 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6325] <... set_robust_list resumed>) = 0 [pid 6325] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6325] chdir("./70") = 0 [pid 6325] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6325] setpgid(0, 0) = 0 [pid 6325] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6325] write(3, "1000", 4) = 4 [pid 6325] close(3) = 0 [pid 6325] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6325] write(1, "executing program\n", 18) = 18 executing program [pid 6325] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6325] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6325] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6325] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=100}) = 0 [pid 6325] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6325] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6325] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x64\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6325] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6325] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6325] write(6, "6", 1) = 1 [pid 6325] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6325] exit_group(0) = ? [pid 6325] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6325, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./70", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./70", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./70/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./70/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./70/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./70") = 0 mkdir("./71", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6329 attached [pid 6329] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6329] rt_sigprocmask(SIG_SETMASK, [] [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6329 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6329] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6329] chdir("./71") = 0 [pid 6329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6329] setpgid(0, 0) = 0 [pid 6329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6329] write(3, "1000", 4) = 4 [pid 6329] close(3) = 0 [pid 6329] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6329] write(1, "executing program\n", 18) = 18 executing program [pid 6329] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6329] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6329] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6329] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=101}) = 0 [pid 6329] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6329] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6329] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x65\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6329] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6329] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6329] write(6, "6", 1) = 1 [pid 6329] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6329] exit_group(0) = ? [pid 6329] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6329, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./71", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./71", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./71/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./71/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./71/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./71") = 0 mkdir("./72", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6342 attached , child_tidptr=0x55556fc096d0) = 6342 [pid 6342] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6342] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6342] chdir("./72") = 0 [pid 6342] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6342] setpgid(0, 0) = 0 [pid 5638] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6342] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6342] write(3, "1000", 4) = 4 [pid 6342] close(3) = 0 [pid 6342] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6342] write(1, "executing program\n", 18) = 18 executing program [pid 6342] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [pid 6342] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6342] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6342] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=102}) = 0 [pid 6342] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6342] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6342] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x66\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6342] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6342] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6342] write(6, "6", 1) = 1 [pid 6342] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6342] exit_group(0) = ? [ 111.905003][ T6342] FAULT_INJECTION: forcing a failure. [ 111.905003][ T6342] name failslab, interval 1, probability 0, space 0, times 0 [ 111.905036][ T6342] CPU: 0 UID: 0 PID: 6342 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 111.905059][ T6342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 111.905072][ T6342] Call Trace: [ 111.905080][ T6342] [ 111.905088][ T6342] dump_stack_lvl+0xe8/0x150 [ 111.905121][ T6342] should_fail_ex+0x410/0x560 [ 111.905147][ T6342] should_failslab+0xa8/0x100 [ 111.905172][ T6342] ? dst_alloc+0x105/0x170 [ 111.905203][ T6342] kmem_cache_alloc_noprof+0xa1/0x600 [ 111.905236][ T6342] ? dst_alloc+0x105/0x170 [ 111.905267][ T6342] ? fib_lookup+0x76/0x440 [ 111.905300][ T6342] dst_alloc+0x105/0x170 [ 111.905333][ T6342] ip_route_input_rcu+0x20ca/0x3190 [ 111.905375][ T6342] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 111.905431][ T6342] ? tc_run+0x50f/0x750 [ 111.905454][ T6342] ? ip_route_input_noref+0xad/0x270 [ 111.905487][ T6342] ip_route_input_noref+0x17c/0x270 [ 111.905523][ T6342] ? __pfx_ip_route_input_noref+0x10/0x10 [ 111.905563][ T6342] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 111.905590][ T6342] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 111.905618][ T6342] ip_rcv_finish_core+0x593/0x1c00 [ 111.905658][ T6342] ip_rcv_finish+0x14c/0x2a0 [ 111.905687][ T6342] NF_HOOK+0x336/0x3c0 [ 111.905714][ T6342] ? __pfx_ip_rcv_finish+0x10/0x10 [ 111.905739][ T6342] ? NF_HOOK+0x9e/0x3c0 [ 111.905764][ T6342] ? __pfx_NF_HOOK+0x10/0x10 [ 111.905790][ T6342] ? __pfx_sock_wfree+0x10/0x10 [ 111.905817][ T6342] ? ip_rcv_core+0x7fa/0xd50 [ 111.905856][ T6342] ? netif_receive_skb+0x102/0xbf0 [ 111.905876][ T6342] ? __pfx_ip_rcv+0x10/0x10 [ 111.905900][ T6342] netif_receive_skb+0x45b/0xbf0 [ 111.905926][ T6342] ? __pfx_netif_receive_skb+0x10/0x10 [ 111.905952][ T6342] ? tun_rx_batched+0x185/0x790 [ 111.905982][ T6342] tun_rx_batched+0x1de/0x790 [ 111.906029][ T6342] ? __pfx_tun_rx_batched+0x10/0x10 [ 111.906053][ T6342] ? lock_acquire+0x115/0x350 [ 111.906084][ T6342] ? tun_get_user+0x23ba/0x44d0 [ 111.906107][ T6342] ? __local_bh_enable_ip+0xd6/0x140 [ 111.906136][ T6342] ? tun_get_user+0x27b0/0x44d0 [ 111.906163][ T6342] tun_get_user+0x2be0/0x44d0 [ 111.906203][ T6342] ? tun_get_user+0x27b0/0x44d0 [ 111.906225][ T6342] ? aa_file_perm+0x18b/0x15f0 [ 111.906260][ T6342] ? aa_file_perm+0x4ed/0x15f0 [ 111.906290][ T6342] ? __pfx_tun_get_user+0x10/0x10 [ 111.906317][ T6342] ? __lock_acquire+0x747/0x2de0 [pid 6342] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6342, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 111.906347][ T6342] ? finish_task_switch+0x40e/0xc60 [ 111.906382][ T6342] ? ref_tracker_alloc+0x341/0x4b0 [ 111.906412][ T6342] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 111.906442][ T6342] ? lock_acquire+0x115/0x350 [ 111.906465][ T6342] ? tun_get+0x1c/0x2f0 [ 111.906496][ T6342] ? tun_get+0x1c/0x2f0 [ 111.906519][ T6342] ? tun_get+0x1c/0x2f0 [ 111.906548][ T6342] tun_chr_write_iter+0x113/0x200 [ 111.906575][ T6342] vfs_write+0x612/0xba0 [ 111.906619][ T6342] ? __pfx_vfs_write+0x10/0x10 [ 111.906662][ T6342] ? _raw_spin_unlock_irq+0x23/0x50 umount2("./72", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./72", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./72/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./72/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./72/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 [ 111.906696][ T6342] ksys_write+0x150/0x270 [ 111.906734][ T6342] ? __pfx_ksys_write+0x10/0x10 [ 111.906779][ T6342] do_syscall_64+0x166/0x520 [ 111.906804][ T6342] ? trace_irq_disable+0x3b/0x140 [ 111.906834][ T6342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.906857][ T6342] ? clear_bhb_loop+0x70/0xc0 [ 111.906886][ T6342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.906908][ T6342] RIP: 0033:0x7f6c0bc30879 rmdir("./72") = 0 mkdir("./73", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 111.906929][ T6342] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 111.906949][ T6342] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 111.906973][ T6342] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 111.906991][ T6342] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 111.907006][ T6342] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6350 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci-upstream-kasan-gce/strace-static-x86_64: Process 6350 attached [pid 6350] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6350] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6350] chdir("./73") = 0 [pid 6350] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6350] setpgid(0, 0) = 0 [pid 6350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6350] write(3, "1000", 4) = 4 [pid 6350] close(3) = 0 [pid 6350] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6350] write(1, "executing program\n", 18) = 18 [pid 6350] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [ 111.907019][ T6342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 111.907034][ T6342] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 111.907067][ T6342] [pid 6350] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6350] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6350] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=103}) = 0 [pid 6350] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6350] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6350] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x67\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6350] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6350] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6350] write(6, "6", 1) = 1 [pid 6350] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6350] exit_group(0) = ? [pid 6350] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6350, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./73", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./73", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./73/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./73/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./73/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./73") = 0 mkdir("./74", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce/strace-static-x86_64: Process 6359 attached [pid 6359] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6359] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6359] chdir("./74" [pid 5638] <... clone resumed>, child_tidptr=0x55556fc096d0) = 6359 [pid 5638] rt_sigprocmask(SIG_SETMASK, [] [pid 6359] <... chdir resumed>) = 0 [pid 5638] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 6359] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6359] setpgid(0, 0) = 0 [pid 6359] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6359] write(3, "1000", 4) = 4 [pid 6359] close(3) = 0 [pid 6359] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6359] write(1, "executing program\n", 18) = 18 [pid 6359] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 executing program [pid 6359] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6359] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6359] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=104}) = 0 [pid 6359] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6359] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6359] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x68\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6359] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6359] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6359] write(6, "6", 1) = 1 [pid 6359] write(3, "\x45\x00\x00\x1c\x12\x34\x40\x00\x40\x11\x14\x9b\x0a\x00\x00\x01\x0a\x00\x00\x02\x04\xd2\x16\x2e\x00\x08\x00\x00", 28) = 28 [pid 6359] exit_group(0) = ? [ 112.718299][ T6359] FAULT_INJECTION: forcing a failure. [ 112.718299][ T6359] name failslab, interval 1, probability 0, space 0, times 0 [ 112.718335][ T6359] CPU: 0 UID: 0 PID: 6359 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 112.718359][ T6359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.718371][ T6359] Call Trace: [ 112.718379][ T6359] [ 112.718388][ T6359] dump_stack_lvl+0xe8/0x150 [ 112.718433][ T6359] should_fail_ex+0x410/0x560 [ 112.718462][ T6359] should_failslab+0xa8/0x100 [ 112.718488][ T6359] ? dst_alloc+0x105/0x170 [ 112.718519][ T6359] kmem_cache_alloc_noprof+0xa1/0x600 [ 112.718553][ T6359] ? dst_alloc+0x105/0x170 [ 112.718583][ T6359] ? fib_lookup+0x76/0x440 [ 112.718615][ T6359] dst_alloc+0x105/0x170 [ 112.718650][ T6359] ip_route_input_rcu+0x20ca/0x3190 [ 112.718691][ T6359] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 112.718749][ T6359] ? tc_run+0x50f/0x750 [ 112.718769][ T6359] ? ip_route_input_noref+0xad/0x270 [ 112.718804][ T6359] ip_route_input_noref+0x17c/0x270 [ 112.718839][ T6359] ? __pfx_ip_route_input_noref+0x10/0x10 [ 112.718875][ T6359] ? __pfx_udp_v4_early_demux+0x10/0x10 [ 112.718904][ T6359] ? __netif_receive_skb_core+0x2a10/0x30c0 [ 112.718932][ T6359] ip_rcv_finish_core+0x593/0x1c00 [ 112.718969][ T6359] ip_rcv_finish+0x14c/0x2a0 [ 112.719002][ T6359] NF_HOOK+0x336/0x3c0 [ 112.719030][ T6359] ? __pfx_ip_rcv_finish+0x10/0x10 [ 112.719055][ T6359] ? NF_HOOK+0x9e/0x3c0 [ 112.719079][ T6359] ? __pfx_NF_HOOK+0x10/0x10 [ 112.719106][ T6359] ? __pfx_sock_wfree+0x10/0x10 [ 112.719133][ T6359] ? ip_rcv_core+0x7fa/0xd50 [ 112.719164][ T6359] ? netif_receive_skb+0x102/0xbf0 [ 112.719184][ T6359] ? __pfx_ip_rcv+0x10/0x10 [ 112.719208][ T6359] netif_receive_skb+0x45b/0xbf0 [ 112.719235][ T6359] ? __pfx_netif_receive_skb+0x10/0x10 [ 112.719261][ T6359] ? tun_rx_batched+0x185/0x790 [ 112.719285][ T6359] tun_rx_batched+0x1de/0x790 [ 112.719313][ T6359] ? __pfx_tun_rx_batched+0x10/0x10 [ 112.719336][ T6359] ? lock_acquire+0x115/0x350 [ 112.719363][ T6359] ? tun_get_user+0x23ba/0x44d0 [ 112.719383][ T6359] ? __local_bh_enable_ip+0xd6/0x140 [ 112.719418][ T6359] ? tun_get_user+0x27b0/0x44d0 [ 112.719442][ T6359] tun_get_user+0x2be0/0x44d0 [ 112.719477][ T6359] ? tun_get_user+0x27b0/0x44d0 [ 112.719498][ T6359] ? aa_file_perm+0x18b/0x15f0 [ 112.719530][ T6359] ? aa_file_perm+0x4ed/0x15f0 [ 112.719556][ T6359] ? __pfx_tun_get_user+0x10/0x10 [ 112.719580][ T6359] ? __lock_acquire+0x747/0x2de0 [pid 6359] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6359, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [ 112.719607][ T6359] ? finish_task_switch+0x40e/0xc60 [ 112.719637][ T6359] ? ref_tracker_alloc+0x341/0x4b0 [ 112.719663][ T6359] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 112.719690][ T6359] ? lock_acquire+0x115/0x350 [ 112.719711][ T6359] ? tun_get+0x1c/0x2f0 [ 112.719736][ T6359] ? tun_get+0x1c/0x2f0 [ 112.719756][ T6359] ? tun_get+0x1c/0x2f0 [ 112.719782][ T6359] tun_chr_write_iter+0x113/0x200 [ 112.719806][ T6359] vfs_write+0x612/0xba0 [ 112.719845][ T6359] ? __pfx_vfs_write+0x10/0x10 [ 112.719884][ T6359] ? _raw_spin_unlock_irq+0x23/0x50 umount2("./74", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./74", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55556fc0a7a0 /* 3 entries */, 32768) = 80 umount2("./74/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./74/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./74/binderfs") = 0 getdents64(3, 0x55556fc0a7a0 /* 0 entries */, 32768) = 0 close(3) = 0 [ 112.719915][ T6359] ksys_write+0x150/0x270 [ 112.719948][ T6359] ? __pfx_ksys_write+0x10/0x10 [ 112.719988][ T6359] do_syscall_64+0x166/0x520 [ 112.720008][ T6359] ? trace_irq_disable+0x3b/0x140 [ 112.720026][ T6359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.720046][ T6359] ? clear_bhb_loop+0x70/0xc0 [ 112.720068][ T6359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.720085][ T6359] RIP: 0033:0x7f6c0bc30879 rmdir("./74") = 0 mkdir("./75", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556fc096d0) = 6366 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci-upstream-kasan-gce/strace-static-x86_64: Process 6366 attached [ 112.720103][ T6359] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 112.720118][ T6359] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.720138][ T6359] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 112.720152][ T6359] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 112.720164][ T6359] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [pid 6366] set_robust_list(0x55556fc096e0, 24) = 0 [pid 6366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6366] chdir("./75") = 0 [pid 6366] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6366] setpgid(0, 0) = 0 [pid 6366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6366] write(3, "1000", 4) = 4 [pid 6366] close(3) = 0 [pid 6366] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6366] write(1, "executing program\n", 18) = 18 [pid 6366] openat(AT_FDCWD, "/dev/net/tun", O_RDWR) = 3 [ 112.720175][ T6359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 112.720189][ T6359] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 112.720215][ T6359] [pid 6366] ioctl(3, TUNSETIFF, 0x200000000040) = 0 [pid 6366] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 [pid 6366] ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=105}) = 0 [pid 6366] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 [pid 6366] ioctl(5, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP}) = 0 [pid 6366] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x69\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 6366] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=132, nlmsg_type=RTM_NEWTFILTER, nlmsg_flags=NLM_F_REQUEST|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {tcm_family=AF_UNSPEC, tcm_ifindex=if_nametoindex("syzkaller0"), tcm_handle=1, tcm_parent=4294967281, tcm_info=65544}, [[{nla_len=10, nla_type=TCA_KIND}, "\x62\x61\x73\x69\x63\x00"...], [{nla_len=84, nla_type=TCA_OPTIONS}, "\x50\x00\x03\x00\x4c\x00\x01\x00\x07\x00\x01\x00\x63\x74\x00\x00\x24\x00\x02\x80\x18\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x03\x00\x01\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00"]]], iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 132 [pid 6366] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6 [pid 6366] write(6, "6", 1) = 1 [ 113.256593][ T6366] FAULT_INJECTION: forcing a failure. [ 113.256593][ T6366] name failslab, interval 1, probability 0, space 0, times 0 [ 113.256630][ T6366] CPU: 0 UID: 0 PID: 6366 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 113.256656][ T6366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.256669][ T6366] Call Trace: [ 113.256678][ T6366] [ 113.256687][ T6366] dump_stack_lvl+0xe8/0x150 [ 113.256725][ T6366] should_fail_ex+0x410/0x560 [ 113.256755][ T6366] should_failslab+0xa8/0x100 [ 113.256783][ T6366] ? flow_offload_alloc+0x82/0x990 [ 113.256814][ T6366] kmem_cache_alloc_noprof+0xa1/0x600 [ 113.256852][ T6366] ? flow_offload_alloc+0x82/0x990 [ 113.256894][ T6366] flow_offload_alloc+0x82/0x990 [ 113.256923][ T6366] ? __pfx_nf_ct_helper+0x10/0x10 [ 113.256949][ T6366] tcf_ct_flow_table_process_conn+0x3aa/0x7c0 [ 113.257000][ T6366] tcf_ct_act+0x2a75/0x4050 [ 113.257052][ T6366] ? __pfx_tcf_ct_act+0x10/0x10 [ 113.257102][ T6366] ? is_bpf_text_address+0x26/0x2b0 [ 113.257143][ T6366] ? lock_acquire+0x115/0x350 [ 113.257173][ T6366] tcf_action_exec+0x185/0x8d0 [ 113.257207][ T6366] basic_classify+0x1b2/0x2d0 [ 113.257255][ T6366] tcf_classify+0x43d/0x1160 [ 113.257296][ T6366] tc_run+0x42d/0x750 [ 113.257325][ T6366] ? __pfx_tc_run+0x10/0x10 [ 113.257379][ T6366] __netif_receive_skb_core+0x1443/0x30c0 [ 113.257423][ T6366] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 113.257447][ T6366] ? __alloc_skb+0x27a/0x7a0 [ 113.257471][ T6366] ? rcu_is_watching+0x16/0xb0 [ 113.257498][ T6366] ? __alloc_skb+0x27a/0x7a0 [ 113.257520][ T6366] ? trace_kmem_cache_alloc+0x29/0xe0 [ 113.257573][ T6366] ? netif_receive_skb+0x102/0xbf0 [ 113.257593][ T6366] ? netif_receive_skb+0x102/0xbf0 [ 113.257617][ T6366] netif_receive_skb+0x1fe/0xbf0 [ 113.257645][ T6366] ? __pfx_netif_receive_skb+0x10/0x10 [ 113.257674][ T6366] ? tun_rx_batched+0x185/0x790 [ 113.257701][ T6366] tun_rx_batched+0x1de/0x790 [ 113.257731][ T6366] ? __pfx_tun_rx_batched+0x10/0x10 [ 113.257756][ T6366] ? lock_acquire+0x115/0x350 [ 113.257786][ T6366] ? tun_get_user+0x23ba/0x44d0 [ 113.257809][ T6366] ? __local_bh_enable_ip+0xd6/0x140 [ 113.257838][ T6366] ? tun_get_user+0x27b0/0x44d0 [ 113.257864][ T6366] tun_get_user+0x2be0/0x44d0 [ 113.257901][ T6366] ? tun_get_user+0x27b0/0x44d0 [ 113.257923][ T6366] ? aa_file_perm+0x18b/0x15f0 [ 113.257956][ T6366] ? aa_file_perm+0x4ed/0x15f0 [ 113.257985][ T6366] ? __pfx_tun_get_user+0x10/0x10 [ 113.258011][ T6366] ? __lock_acquire+0x747/0x2de0 [ 113.258054][ T6366] ? finish_task_switch+0x40e/0xc60 [ 113.258085][ T6366] ? ref_tracker_alloc+0x341/0x4b0 [ 113.258113][ T6366] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 113.258140][ T6366] ? lock_acquire+0x115/0x350 [ 113.258160][ T6366] ? tun_get+0x1c/0x2f0 [ 113.258187][ T6366] ? tun_get+0x1c/0x2f0 [ 113.258207][ T6366] ? tun_get+0x1c/0x2f0 [ 113.258233][ T6366] tun_chr_write_iter+0x113/0x200 [ 113.258258][ T6366] vfs_write+0x612/0xba0 [ 113.258296][ T6366] ? __pfx_vfs_write+0x10/0x10 [ 113.258335][ T6366] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.258370][ T6366] ksys_write+0x150/0x270 [ 113.258403][ T6366] ? __pfx_ksys_write+0x10/0x10 [ 113.258444][ T6366] do_syscall_64+0x166/0x520 [ 113.258466][ T6366] ? trace_irq_disable+0x3b/0x140 [ 113.258486][ T6366] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.258507][ T6366] ? clear_bhb_loop+0x70/0xc0 [ 113.258532][ T6366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.258553][ T6366] RIP: 0033:0x7f6c0bc30879 [ 113.258571][ T6366] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 113.258589][ T6366] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 113.258611][ T6366] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 113.258627][ T6366] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 113.258640][ T6366] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 113.258652][ T6366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 113.258665][ T6366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 113.258695][ T6366] [ 113.259749][ T6366] ------------[ cut here ]------------ [ 113.259759][ T6366] 1 [ 113.259770][ T6366] WARNING: net/sched/act_ct.c:437 at tcf_ct_flow_table_process_conn+0x449/0x7c0, CPU#0: syz-executor278/6366 [ 113.685234][ T6366] Modules linked in: [ 113.689160][ T6366] CPU: 0 UID: 0 PID: 6366 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 113.698945][ T6366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.709051][ T6366] RIP: 0010:tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 113.715987][ T6366] Code: 85 81 02 00 00 41 0f b7 2f 31 ff 89 ee e8 2f 67 e9 f7 85 ed 0f 84 7c 01 00 00 e8 e2 62 e9 f7 e9 e0 01 00 00 e8 d8 62 e9 f7 90 <0f> 0b 90 e9 b2 01 00 00 e8 ca 62 e9 f7 4d 89 f7 40 84 ed 74 27 e8 [ 113.735679][ T6366] RSP: 0018:ffffc900042d6ef8 EFLAGS: 00010293 [ 113.741778][ T6366] RAX: ffffffff89de6f88 RBX: ffff888070202000 RCX: ffff888028c90000 [ 113.749826][ T6366] RDX: 0000000000000000 RSI: ffffffff8c6da060 RDI: ffffffff8c6da020 [ 113.758256][ T6366] RBP: 0000000000000000 R08: 00000000ffffffff R09: 1ffffffff1dd5cfe [ 113.766311][ T6366] R10: dffffc0000000000 R11: fffffbfff1dd5cff R12: dffffc0000000000 [ 113.774352][ T6366] R13: 1ffff1100e04041e R14: ffff8880702020c0 R15: 0000000000000001 [ 113.782358][ T6366] FS: 000055556fc09400(0000) GS:ffff888124cd1000(0000) knlGS:0000000000000000 [ 113.791379][ T6366] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.798032][ T6366] CR2: 00007ffe25dff4c8 CR3: 0000000079ba6000 CR4: 00000000003526f0 [ 113.806083][ T6366] Call Trace: [ 113.809395][ T6366] [ 113.812358][ T6366] tcf_ct_act+0x2a75/0x4050 [ 113.816976][ T6366] ? __pfx_tcf_ct_act+0x10/0x10 [ 113.821895][ T6366] ? is_bpf_text_address+0x26/0x2b0 [ 113.827212][ T6366] ? lock_acquire+0x115/0x350 [ 113.831931][ T6366] tcf_action_exec+0x185/0x8d0 [ 113.836762][ T6366] basic_classify+0x1b2/0x2d0 [ 113.841485][ T6366] tcf_classify+0x43d/0x1160 [ 113.846170][ T6366] tc_run+0x42d/0x750 [ 113.850194][ T6366] ? __pfx_tc_run+0x10/0x10 [ 113.854760][ T6366] __netif_receive_skb_core+0x1443/0x30c0 [ 113.860532][ T6366] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 113.866673][ T6366] ? __alloc_skb+0x27a/0x7a0 [ 113.871296][ T6366] ? rcu_is_watching+0x16/0xb0 [ 113.876130][ T6366] ? __alloc_skb+0x27a/0x7a0 [ 113.880761][ T6366] ? trace_kmem_cache_alloc+0x29/0xe0 [ 113.886241][ T6366] ? netif_receive_skb+0x102/0xbf0 [ 113.891388][ T6366] ? netif_receive_skb+0x102/0xbf0 [ 113.896583][ T6366] netif_receive_skb+0x1fe/0xbf0 [ 113.901564][ T6366] ? __pfx_netif_receive_skb+0x10/0x10 [ 113.907111][ T6366] ? tun_rx_batched+0x185/0x790 [ 113.912009][ T6366] tun_rx_batched+0x1de/0x790 [ 113.916765][ T6366] ? __pfx_tun_rx_batched+0x10/0x10 [ 113.921999][ T6366] ? lock_acquire+0x115/0x350 [ 113.926766][ T6366] ? tun_get_user+0x23ba/0x44d0 [ 113.931651][ T6366] ? __local_bh_enable_ip+0xd6/0x140 [ 113.937022][ T6366] ? tun_get_user+0x27b0/0x44d0 [ 113.941911][ T6366] tun_get_user+0x2be0/0x44d0 [ 113.946694][ T6366] ? tun_get_user+0x27b0/0x44d0 [ 113.951580][ T6366] ? aa_file_perm+0x18b/0x15f0 [ 113.956439][ T6366] ? aa_file_perm+0x4ed/0x15f0 [ 113.961255][ T6366] ? __pfx_tun_get_user+0x10/0x10 [ 113.966370][ T6366] ? __lock_acquire+0x747/0x2de0 [ 113.971370][ T6366] ? finish_task_switch+0x40e/0xc60 [ 113.976672][ T6366] ? ref_tracker_alloc+0x341/0x4b0 [ 113.981826][ T6366] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 113.987342][ T6366] ? lock_acquire+0x115/0x350 [ 113.992047][ T6366] ? tun_get+0x1c/0x2f0 [ 113.996270][ T6366] ? tun_get+0x1c/0x2f0 [ 114.000463][ T6366] ? tun_get+0x1c/0x2f0 [ 114.004676][ T6366] tun_chr_write_iter+0x113/0x200 [ 114.009735][ T6366] vfs_write+0x612/0xba0 [ 114.014030][ T6366] ? __pfx_vfs_write+0x10/0x10 [ 114.018884][ T6366] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.024195][ T6366] ksys_write+0x150/0x270 [ 114.028577][ T6366] ? __pfx_ksys_write+0x10/0x10 [ 114.033491][ T6366] do_syscall_64+0x166/0x520 [ 114.038142][ T6366] ? trace_irq_disable+0x3b/0x140 [ 114.043201][ T6366] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.049340][ T6366] ? clear_bhb_loop+0x70/0xc0 [ 114.054057][ T6366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.060013][ T6366] RIP: 0033:0x7f6c0bc30879 [ 114.064485][ T6366] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 114.084164][ T6366] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.092765][ T6366] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 114.100806][ T6366] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 114.108823][ T6366] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 114.116866][ T6366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 114.124913][ T6366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.132926][ T6366] [ 114.136034][ T6366] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 114.143362][ T6366] CPU: 0 UID: 0 PID: 6366 Comm: syz-executor278 Not tainted syzkaller #0 PREEMPT(full) [ 114.153101][ T6366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.163184][ T6366] Call Trace: [ 114.166498][ T6366] [ 114.169456][ T6366] vpanic+0x56d/0xa60 [ 114.173479][ T6366] ? __pfx__printk+0x10/0x10 [ 114.178099][ T6366] ? __pfx_vpanic+0x10/0x10 [ 114.182651][ T6366] ? is_bpf_text_address+0x292/0x2b0 [ 114.187992][ T6366] ? is_bpf_text_address+0x26/0x2b0 [ 114.193233][ T6366] panic+0xc5/0xd0 [ 114.196991][ T6366] ? __pfx_panic+0x10/0x10 [ 114.201470][ T6366] __warn+0x315/0x4c0 [ 114.205490][ T6366] ? tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 114.211765][ T6366] ? tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 114.218063][ T6366] __report_bug+0x276/0x570 [ 114.222687][ T6366] ? trace_irq_disable+0x3b/0x140 [ 114.227748][ T6366] ? tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 114.234038][ T6366] ? __pfx___report_bug+0x10/0x10 [ 114.239115][ T6366] ? dump_stack_lvl+0x135/0x150 [ 114.244003][ T6366] ? dump_stack_lvl+0x137/0x150 [ 114.248918][ T6366] ? tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 114.255204][ T6366] report_bug+0x16b/0x220 [ 114.259580][ T6366] ? tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 114.265865][ T6366] ? tcf_ct_flow_table_process_conn+0x44b/0x7c0 [ 114.272153][ T6366] handle_bug+0x9c/0x200 [ 114.276482][ T6366] exc_invalid_op+0x1a/0x50 [ 114.281025][ T6366] asm_exc_invalid_op+0x1a/0x20 [ 114.285896][ T6366] RIP: 0010:tcf_ct_flow_table_process_conn+0x449/0x7c0 [ 114.292795][ T6366] Code: 85 81 02 00 00 41 0f b7 2f 31 ff 89 ee e8 2f 67 e9 f7 85 ed 0f 84 7c 01 00 00 e8 e2 62 e9 f7 e9 e0 01 00 00 e8 d8 62 e9 f7 90 <0f> 0b 90 e9 b2 01 00 00 e8 ca 62 e9 f7 4d 89 f7 40 84 ed 74 27 e8 [ 114.312441][ T6366] RSP: 0018:ffffc900042d6ef8 EFLAGS: 00010293 [ 114.318540][ T6366] RAX: ffffffff89de6f88 RBX: ffff888070202000 RCX: ffff888028c90000 [ 114.326542][ T6366] RDX: 0000000000000000 RSI: ffffffff8c6da060 RDI: ffffffff8c6da020 [ 114.334550][ T6366] RBP: 0000000000000000 R08: 00000000ffffffff R09: 1ffffffff1dd5cfe [ 114.342553][ T6366] R10: dffffc0000000000 R11: fffffbfff1dd5cff R12: dffffc0000000000 [ 114.350544][ T6366] R13: 1ffff1100e04041e R14: ffff8880702020c0 R15: 0000000000000001 [ 114.359026][ T6366] ? tcf_ct_flow_table_process_conn+0x448/0x7c0 [ 114.365338][ T6366] ? tcf_ct_flow_table_process_conn+0x448/0x7c0 [ 114.371621][ T6366] tcf_ct_act+0x2a75/0x4050 [ 114.376196][ T6366] ? __pfx_tcf_ct_act+0x10/0x10 [ 114.381107][ T6366] ? is_bpf_text_address+0x26/0x2b0 [ 114.386350][ T6366] ? lock_acquire+0x115/0x350 [ 114.391059][ T6366] tcf_action_exec+0x185/0x8d0 [ 114.395867][ T6366] basic_classify+0x1b2/0x2d0 [ 114.400580][ T6366] tcf_classify+0x43d/0x1160 [ 114.405226][ T6366] tc_run+0x42d/0x750 [ 114.409236][ T6366] ? __pfx_tc_run+0x10/0x10 [ 114.413773][ T6366] __netif_receive_skb_core+0x1443/0x30c0 [ 114.419528][ T6366] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 114.425613][ T6366] ? __alloc_skb+0x27a/0x7a0 [ 114.430226][ T6366] ? rcu_is_watching+0x16/0xb0 [ 114.435009][ T6366] ? __alloc_skb+0x27a/0x7a0 [ 114.439629][ T6366] ? trace_kmem_cache_alloc+0x29/0xe0 [ 114.445051][ T6366] ? netif_receive_skb+0x102/0xbf0 [ 114.450189][ T6366] ? netif_receive_skb+0x102/0xbf0 [ 114.455350][ T6366] netif_receive_skb+0x1fe/0xbf0 [ 114.460325][ T6366] ? __pfx_netif_receive_skb+0x10/0x10 [ 114.465814][ T6366] ? tun_rx_batched+0x185/0x790 [ 114.470726][ T6366] tun_rx_batched+0x1de/0x790 [ 114.475455][ T6366] ? __pfx_tun_rx_batched+0x10/0x10 [ 114.480709][ T6366] ? lock_acquire+0x115/0x350 [ 114.485424][ T6366] ? tun_get_user+0x23ba/0x44d0 [ 114.490292][ T6366] ? __local_bh_enable_ip+0xd6/0x140 [ 114.495605][ T6366] ? tun_get_user+0x27b0/0x44d0 [ 114.500513][ T6366] tun_get_user+0x2be0/0x44d0 [ 114.505223][ T6366] ? tun_get_user+0x27b0/0x44d0 [ 114.510090][ T6366] ? aa_file_perm+0x18b/0x15f0 [ 114.514908][ T6366] ? aa_file_perm+0x4ed/0x15f0 [ 114.519696][ T6366] ? __pfx_tun_get_user+0x10/0x10 [ 114.524742][ T6366] ? __lock_acquire+0x747/0x2de0 [ 114.529700][ T6366] ? finish_task_switch+0x40e/0xc60 [ 114.534924][ T6366] ? ref_tracker_alloc+0x341/0x4b0 [ 114.540061][ T6366] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 114.545544][ T6366] ? lock_acquire+0x115/0x350 [ 114.550237][ T6366] ? tun_get+0x1c/0x2f0 [ 114.554411][ T6366] ? tun_get+0x1c/0x2f0 [ 114.558584][ T6366] ? tun_get+0x1c/0x2f0 [ 114.562763][ T6366] tun_chr_write_iter+0x113/0x200 [ 114.567826][ T6366] vfs_write+0x612/0xba0 [ 114.572123][ T6366] ? __pfx_vfs_write+0x10/0x10 [ 114.576955][ T6366] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.582190][ T6366] ksys_write+0x150/0x270 [ 114.586560][ T6366] ? __pfx_ksys_write+0x10/0x10 [ 114.591462][ T6366] do_syscall_64+0x166/0x520 [ 114.596100][ T6366] ? trace_irq_disable+0x3b/0x140 [ 114.601175][ T6366] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.607271][ T6366] ? clear_bhb_loop+0x70/0xc0 [ 114.611967][ T6366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.617884][ T6366] RIP: 0033:0x7f6c0bc30879 [ 114.622326][ T6366] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 114.641950][ T6366] RSP: 002b:00007ffff5b95668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.650395][ T6366] RAX: ffffffffffffffda RBX: 00007ffff5b95690 RCX: 00007f6c0bc30879 [ 114.658385][ T6366] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000003 [ 114.666374][ T6366] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 114.674461][ T6366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 114.682451][ T6366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 114.690457][ T6366] [ 114.694067][ T6366] Kernel Offset: disabled [ 114.698403][ T6366] Rebooting in 86400 seconds..