ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor3090403833 <...> Warning: Permanently added '10.128.1.28' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor3090403833", ["ci2-android-5-15/syz-executor3090403833"], 0x7ffcc8bd2450 /* 10 vars */) = 0 brk(NULL) = 0x55556fcea000 brk(0x55556fcead40) = 0x55556fcead40 arch_prctl(ARCH_SET_FS, 0x55556fcea3c0) = 0 set_tid_address(0x55556fcea690) = 303 set_robust_list(0x55556fcea6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor3090403833", 4096) = 45 getrandom("\xf4\x55\xe0\xe1\x9d\x52\xa9\xd3", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556fcead40 brk(0x55556fd0bd40) = 0x55556fd0bd40 brk(0x55556fd0c000) = 0x55556fd0c000 mprotect(0x7f8021d3f000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [ 25.709272][ T30] audit: type=1400 audit(1791163382.104:64): avc: denied { execmem } for pid=303 comm="syz-executor309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.729029][ T30] audit: type=1400 audit(1791163382.104:65): avc: denied { map_create } for pid=303 comm="syz-executor309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 25.749398][ T30] audit: type=1400 audit(1791163382.104:66): avc: denied { map_read map_write } for pid=303 comm="syz-executor309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 25.769730][ T30] audit: type=1400 audit(1791163382.124:67): avc: denied { prog_load } for pid=303 comm="syz-executor309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 25.789172][ T30] audit: type=1400 audit(1791163382.124:68): avc: denied { bpf } for pid=303 comm="syz-executor309" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=6, insns=0x200000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_SK_SKB_STREAM_VERDICT, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 6 bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=6, attach_type=BPF_SK_SKB_STREAM_VERDICT, attach_flags=0, replace_bpf_fd=0, relative_fd=0, expected_revision=0}, 32) = 0 bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x200000000640, value=0x200000000680, flags=BPF_ANY}, 32) = 0 [ 25.947830][ T30] audit: type=1400 audit(1791163382.334:69): avc: denied { perfmon } for pid=303 comm="syz-executor309" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 25.969286][ T30] audit: type=1400 audit(1791163382.364:70): avc: denied { prog_run } for pid=303 comm="syz-executor309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 25.976359][ T303] ================================================================== [ 25.996607][ T303] BUG: KASAN: slab-out-of-bounds in sk_skb_adjust_room+0x389/0x5c0 [ 26.004520][ T303] Read of size 8 at addr ffff8881257894e8 by task syz-executor309/303 [ 26.012768][ T303] [ 26.015113][ T303] CPU: 0 PID: 303 Comm: syz-executor309 Not tainted syzkaller #0 [ 26.022848][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 26.033021][ T303] Call Trace: [ 26.036339][ T303] [ 26.039475][ T303] __dump_stack+0x21/0x30 [ 26.043822][ T303] dump_stack_lvl+0x110/0x170 [ 26.048516][ T303] ? show_regs_print_info+0x20/0x20 [ 26.053825][ T303] ? load_image+0x3f0/0x3f0 [ 26.058343][ T303] print_address_description+0x7f/0x2c0 [ 26.064432][ T303] ? sk_skb_adjust_room+0x389/0x5c0 [ 26.069659][ T303] kasan_report+0x10f/0x150 [ 26.074196][ T303] ? sk_skb_adjust_room+0x389/0x5c0 [ 26.079585][ T303] __asan_report_load8_noabort+0x14/0x20 [ 26.085496][ T303] sk_skb_adjust_room+0x389/0x5c0 [ 26.090605][ T303] bpf_prog_e15ab8bd9cea3c06+0x19/0x708 [ 26.096160][ T303] sk_psock_verdict_recv+0x245/0x7f0 [ 26.101460][ T303] unix_read_sock+0x108/0x2d0 [ 26.106154][ T303] ? sk_psock_skb_redirect+0x440/0x440 [ 26.111621][ T303] ? unix_stream_splice_actor+0x120/0x120 [ 26.117363][ T303] ? copy_mc_pipe_to_iter+0x7e0/0x7e0 [ 26.122743][ T303] ? sk_psock_skb_redirect+0x440/0x440 [ 26.128219][ T303] unix_stream_read_sock+0x61/0x90 [ 26.133560][ T303] sk_psock_verdict_data_ready+0x167/0x1d0 [ 26.139386][ T303] ? sk_psock_start_verdict+0xc0/0xc0 [ 26.144765][ T303] ? _raw_spin_lock+0x94/0xf0 [ 26.149470][ T303] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 26.155581][ T303] ? skb_queue_tail+0xcb/0xf0 [ 26.160271][ T303] unix_stream_sendmsg+0x7d1/0xc90 [ 26.165414][ T303] ? unix_show_fdinfo+0xa0/0xa0 [ 26.170278][ T303] ? __schedule+0xbd7/0x14a0 [ 26.174879][ T303] ? security_socket_sendmsg+0x82/0xa0 [ 26.180523][ T303] __sys_sendto+0x46d/0x620 [ 26.185033][ T303] ? __ia32_sys_getpeername+0x90/0x90 [ 26.190413][ T303] ? __kasan_check_write+0x14/0x20 [ 26.195540][ T303] __x64_sys_sendto+0xe5/0x100 [ 26.200320][ T303] x64_sys_call+0x178/0x9a0 [ 26.204830][ T303] do_syscall_64+0x4c/0xa0 [ 26.209256][ T303] ? clear_bhb_loop+0x50/0xa0 [ 26.214036][ T303] ? clear_bhb_loop+0x50/0xa0 [ 26.218978][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.225068][ T303] RIP: 0033:0x7f8021caee79 [ 26.229485][ T303] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.249554][ T303] RSP: 002b:00007ffccbfdd368 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 26.258098][ T303] RAX: ffffffffffffffda RBX: 00007ffccbfdd4a8 RCX: 00007f8021caee79 [ 26.266363][ T303] RDX: 0000000000000001 RSI: 0000200000000800 RDI: 0000000000000004 [ 26.274357][ T303] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 26.282471][ T303] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffccbfdd498 [ 26.290465][ T303] R13: 0000000000000002 R14: 00007f8021d3fca0 R15: 0000000000000002 [ 26.298467][ T303] [ 26.301513][ T303] [ 26.303848][ T303] Allocated by task 303: [ 26.308229][ T303] __kasan_slab_alloc+0xb7/0xe0 [ 26.313185][ T303] slab_post_alloc_hook+0x4f/0x2b0 [ 26.318331][ T303] kmem_cache_alloc+0xf7/0x260 [ 26.323109][ T303] sk_prot_alloc+0x5f/0x320 [ 26.327742][ T303] sk_alloc+0x38/0x430 [ 26.331828][ T303] unix_create1+0xb4/0x610 [ 26.336287][ T303] unix_create+0x149/0x200 [ 26.340733][ T303] __sock_create+0x38d/0x7a0 [ 26.345337][ T303] __sys_socketpair+0x1a1/0x590 [ 26.350204][ T303] __x64_sys_socketpair+0x9b/0xb0 [ 26.355242][ T303] x64_sys_call+0x36/0x9a0 [ 26.359758][ T303] do_syscall_64+0x4c/0xa0 [ 26.364202][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.370310][ T303] [ 26.372675][ T303] The buggy address belongs to the object at ffff888125788fc0 [ 26.372675][ T303] which belongs to the cache UNIX-STREAM of size 1216 [ 26.387388][ T303] The buggy address is located 104 bytes to the right of [ 26.387388][ T303] 1216-byte region [ffff888125788fc0, ffff888125789480) [ 26.401572][ T303] The buggy address belongs to the page: [ 26.407399][ T303] page:ffffea000495e200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x125788 [ 26.417672][ T303] head:ffffea000495e200 order:2 compound_mapcount:0 compound_pincount:0 [ 26.426017][ T303] flags: 0x4000000000010200(slab|head|zone=1) [ 26.432135][ T303] raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881003e7080 [ 26.440823][ T303] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 26.449440][ T303] page dumped because: kasan: bad access detected [ 26.455861][ T303] page_owner tracks the page as allocated [ 26.461713][ T303] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 303, ts 25723889203, free_ts 25709206982 [ 26.480747][ T303] post_alloc_hook+0x192/0x1b0 [ 26.485539][ T303] prep_new_page+0x1c/0x110 [ 26.490145][ T303] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.495707][ T303] __alloc_pages+0x1a2/0x460 [ 26.500348][ T303] new_slab+0xa0/0x4d0 [ 26.504441][ T303] ___slab_alloc+0x3ac/0x840 [ 26.509052][ T303] __slab_alloc+0x49/0x90 [ 26.513414][ T303] kmem_cache_alloc+0x138/0x260 [ 26.518312][ T303] sk_prot_alloc+0x5f/0x320 [ 26.522922][ T303] sk_alloc+0x38/0x430 [ 26.527005][ T303] unix_create1+0xb4/0x610 [ 26.531727][ T303] unix_create+0x149/0x200 [ 26.536278][ T303] __sock_create+0x38d/0x7a0 [ 26.540916][ T303] __sys_socketpair+0x1a1/0x590 [ 26.545791][ T303] __x64_sys_socketpair+0x9b/0xb0 [ 26.551207][ T303] x64_sys_call+0x36/0x9a0 [ 26.555670][ T303] page last free stack trace: [ 26.560474][ T303] free_unref_page_prepare+0x5fa/0x600 [ 26.565960][ T303] free_unref_page+0xae/0x540 [ 26.570688][ T303] __free_pages+0x6c/0x100 [ 26.575117][ T303] free_pages+0x82/0x90 [ 26.579341][ T303] __stack_depot_save+0x453/0x480 [ 26.584496][ T303] __kasan_kmalloc+0xe6/0x100 [ 26.589274][ T303] __kmalloc_track_caller+0x13c/0x2c0 [ 26.594796][ T303] kmemdup+0x26/0x60 [ 26.598834][ T303] sidtab_sid2str_get+0x137/0x2c0 [ 26.603892][ T303] security_sid_to_context_core+0x2ac/0x480 [ 26.609894][ T303] security_sid_to_context+0x33/0x40 [ 26.615235][ T303] avc_audit_post_callback+0x135/0x830 [ 26.620730][ T303] common_lsm_audit+0x12b9/0x1670 [ 26.625766][ T303] slow_avc_audit+0x1c4/0x240 [ 26.630456][ T303] avc_has_perm+0x1fb/0x250 [ 26.635061][ T303] file_map_prot_check+0x199/0x270 [ 26.640323][ T303] [ 26.642665][ T303] Memory state around the buggy address: [ 26.648308][ T303] ffff888125789380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.656385][ T303] ffff888125789400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.664752][ T303] >ffff888125789480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.672833][ T303] ^ [ 26.680306][ T303] ffff888125789500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.688467][ T303] ffff888125789580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc sendto(4, "\x01", 1, 0, NULL, 0) = 1 exit_group(0) = ? +++ exited with 0 +++ [ 26.696540][ T303] ========================================