ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor3923551286 <...> Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor3923551286", ["ci2-android-5-10/syz-executor3923551286"], 0x7ffdb6710530 /* 10 vars */) = 0 brk(NULL) = 0x55558df18000 brk(0x55558df18d40) = 0x55558df18d40 arch_prctl(ARCH_SET_FS, 0x55558df183c0) = 0 set_tid_address(0x55558df18690) = 297 set_robust_list(0x55558df186a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor3923551286", 4096) = 45 getrandom("\xb0\x75\x7f\x6e\x4d\x45\xc2\x72", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558df18d40 brk(0x55558df39d40) = 0x55558df39d40 brk(0x55558df3a000) = 0x55558df3a000 mprotect(0x7f59c2af8000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 3 ioctl(3, TUNSETIFF, 0x200000000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 4 socket(AF_UNIX, SOCK_STREAM, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=56, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x6540, nlmsg_seq=7388458, nlmsg_pid=-1}, "\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x02\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x03\x00"], iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 26.400406][ T24] audit: type=1400 audit(1792963290.120:64): avc: denied { execmem } for pid=297 comm="syz-executor392" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 26.423593][ T24] audit: type=1400 audit(1792963290.140:65): avc: denied { read } for pid=134 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 26.437973][ T297] ================================================================== [ 26.452796][ T297] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3160 [ 26.460970][ T297] Read of size 8 at addr ffff88811d0866d8 by task syz-executor392/297 [ 26.462524][ T24] audit: type=1400 audit(1792963290.150:66): avc: denied { module_request } for pid=295 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.469122][ T297] [ 26.469148][ T297] CPU: 1 PID: 297 Comm: syz-executor392 Not tainted syzkaller #0 [ 26.469163][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 26.513271][ T297] Call Trace: [ 26.516587][ T297] __dump_stack+0x21/0x24 [ 26.520962][ T297] dump_stack_lvl+0x1a7/0x208 [ 26.525657][ T297] ? show_regs_print_info+0x18/0x18 [ 26.530860][ T297] ? thaw_kernel_threads+0x220/0x220 [ 26.536179][ T297] print_address_description+0x7f/0x2c0 [ 26.541929][ T297] ? tc_setup_flow_action+0x88e/0x3160 [ 26.547390][ T297] kasan_report+0x100/0x140 [ 26.552082][ T297] ? flow_action_cookie_create+0x28/0x90 [ 26.557747][ T297] ? tc_setup_flow_action+0x88e/0x3160 [ 26.563210][ T297] __asan_report_load8_noabort+0x14/0x20 [ 26.568840][ T297] tc_setup_flow_action+0x88e/0x3160 [ 26.574124][ T297] mall_replace_hw_filter+0x2db/0x8c0 [ 26.579495][ T297] ? pcpu_block_update_hint_alloc+0x8b0/0xc50 [ 26.585552][ T297] ? mall_set_parms+0x450/0x450 [ 26.590390][ T297] ? tcf_exts_destroy+0xb0/0xb0 [ 26.595232][ T297] ? pcpu_alloc+0xf8d/0x16c0 [ 26.599946][ T297] ? mall_set_parms+0x1a0/0x450 [ 26.604961][ T297] mall_change+0x546/0x770 [ 26.609388][ T297] ? __kasan_check_write+0x14/0x20 [ 26.614497][ T297] ? mall_get+0xa0/0xa0 [ 26.618652][ T297] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 26.624542][ T297] tc_new_tfilter+0x1487/0x1ab0 [ 26.629387][ T297] ? mall_get+0xa0/0xa0 [ 26.633552][ T297] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.639201][ T297] ? security_capable+0x87/0xb0 [ 26.644059][ T297] ? ns_capable+0x8c/0xf0 [ 26.648380][ T297] ? netlink_net_capable+0x125/0x160 [ 26.653656][ T297] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.659301][ T297] rtnetlink_rcv_msg+0x811/0xca0 [ 26.664234][ T297] ? unwind_get_return_address+0x4d/0x90 [ 26.669853][ T297] ? rtnetlink_bind+0x80/0x80 [ 26.674524][ T297] ? stack_trace_save+0xa6/0xf0 [ 26.679364][ T297] ? stack_trace_snprint+0xe0/0xe0 [ 26.684478][ T297] ? do_syscall_64+0x31/0x40 [ 26.689075][ T297] ? avc_has_perm+0x168/0x3d0 [ 26.693750][ T297] ? memcpy+0x56/0x70 [ 26.697739][ T297] ? avc_has_perm+0x27f/0x3d0 [ 26.702444][ T297] ? __kasan_slab_alloc+0xc9/0xe0 [ 26.707465][ T297] ? avc_has_perm_noaudit+0x3b0/0x3b0 [ 26.712831][ T297] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.718898][ T297] ? selinux_nlmsg_lookup+0x398/0x430 [ 26.724278][ T297] netlink_rcv_skb+0x1e9/0x430 [ 26.729219][ T297] ? rtnetlink_bind+0x80/0x80 [ 26.733896][ T297] ? netlink_ack+0xb30/0xb30 [ 26.738494][ T297] ? __netlink_lookup+0x387/0x3b0 [ 26.743516][ T297] rtnetlink_rcv+0x1c/0x20 [ 26.748099][ T297] netlink_unicast+0x86c/0xa30 [ 26.753023][ T297] netlink_sendmsg+0x949/0xb70 [ 26.757789][ T297] ? netlink_getsockopt+0x530/0x530 [ 26.762985][ T297] ? security_socket_sendmsg+0x82/0xa0 [ 26.768453][ T297] ? netlink_getsockopt+0x530/0x530 [ 26.773647][ T297] ____sys_sendmsg+0x5be/0x8f0 [ 26.778412][ T297] ? __sys_sendmsg_sock+0x40/0x40 [ 26.783531][ T297] ? import_iovec+0x7c/0xb0 [ 26.788031][ T297] ___sys_sendmsg+0x236/0x2e0 [ 26.792718][ T297] ? finish_task_switch+0x12e/0x5a0 [ 26.797915][ T297] ? __sys_sendmsg+0x280/0x280 [ 26.802669][ T297] ? _raw_spin_lock_irqsave+0x130/0x130 [ 26.808212][ T297] ? cgroup_update_frozen+0x15c/0x980 [ 26.813607][ T297] ? __kasan_check_read+0x11/0x20 [ 26.818671][ T297] ? __fdget+0x15b/0x230 [ 26.822947][ T297] __x64_sys_sendmsg+0x201/0x2d0 [ 26.827901][ T297] ? ___sys_sendmsg+0x2e0/0x2e0 [ 26.832766][ T297] ? syscall_trace_enter+0x4b/0x170 [ 26.837982][ T297] do_syscall_64+0x31/0x40 [ 26.842407][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.848308][ T297] RIP: 0033:0x7f59c2a68079 [ 26.852733][ T297] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.872348][ T297] RSP: 002b:00007ffc23613988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.880781][ T297] RAX: ffffffffffffffda RBX: 00007ffc23613ab8 RCX: 00007f59c2a68079 [ 26.888772][ T297] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 26.896756][ T297] RBP: 0000000000000001 R08: 0000000000000003 R09: 00007ffc23613ab8 [ 26.904731][ T297] R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffc23613aa8 [ 26.912706][ T297] R13: 0000000000000002 R14: 00007f59c2af8ca0 R15: 0000000000000002 [ 26.920688][ T297] [ 26.923023][ T297] Allocated by task 297: [ 26.927274][ T297] __kasan_kmalloc+0xd4/0x100 [ 26.931961][ T297] __kmalloc+0x19f/0x330 [ 26.936207][ T297] tcf_idr_create+0x5f/0x790 [ 26.940805][ T297] tcf_idr_create_from_flags+0x61/0x70 [ 26.946272][ T297] tcf_gact_init+0x2e6/0x560 [ 26.950870][ T297] tcf_action_init_1+0x443/0x6d0 [ 26.955808][ T297] tcf_action_init+0x227/0x780 [ 26.960572][ T297] tcf_exts_validate+0x23c/0x540 [ 26.965512][ T297] mall_set_parms+0x4a/0x450 [ 26.970107][ T297] mall_change+0x47a/0x770 [ 26.974547][ T297] tc_new_tfilter+0x1487/0x1ab0 [ 26.979399][ T297] rtnetlink_rcv_msg+0x811/0xca0 [ 26.984338][ T297] netlink_rcv_skb+0x1e9/0x430 [ 26.989118][ T297] rtnetlink_rcv+0x1c/0x20 [ 26.993546][ T297] netlink_unicast+0x86c/0xa30 [ 26.998324][ T297] netlink_sendmsg+0x949/0xb70 [ 27.003111][ T297] ____sys_sendmsg+0x5be/0x8f0 [ 27.007881][ T297] ___sys_sendmsg+0x236/0x2e0 [ 27.012560][ T297] __x64_sys_sendmsg+0x201/0x2d0 [ 27.017500][ T297] do_syscall_64+0x31/0x40 [ 27.021919][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.027806][ T297] [ 27.030147][ T297] The buggy address belongs to the object at ffff88811d086600 [ 27.030147][ T297] which belongs to the cache kmalloc-256 of size 256 [ 27.044225][ T297] The buggy address is located 216 bytes inside of [ 27.044225][ T297] 256-byte region [ffff88811d086600, ffff88811d086700) [ 27.057669][ T297] The buggy address belongs to the page: [ 27.063326][ T297] page:ffffea0004742180 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d086 [ 27.073563][ T297] head:ffffea0004742180 order:1 compound_mapcount:0 [ 27.080158][ T297] flags: 0x4000000000010200(slab|head) [ 27.085636][ T297] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043200 [ 27.094235][ T297] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.102820][ T297] page dumped because: kasan: bad access detected [ 27.109243][ T297] page_owner tracks the page as allocated [ 27.114987][ T297] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 224, ts 16708302739, free_ts 0 [ 27.132342][ T297] prep_new_page+0x176/0x190 [ 27.137028][ T297] get_page_from_freelist+0x225f/0x23f0 [ 27.142576][ T297] __alloc_pages_nodemask+0x29a/0x640 [ 27.147948][ T297] new_slab+0x84/0x3f0 [ 27.152022][ T297] ___slab_alloc+0x2f8/0x4c0 [ 27.156618][ T297] __slab_alloc+0x63/0xa0 [ 27.160947][ T297] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 27.166323][ T297] inode_doinit_use_xattr+0x5d/0x400 [ 27.171609][ T297] inode_doinit_with_dentry+0x82c/0xd70 [ 27.177183][ T297] selinux_d_instantiate+0x27/0x40 [ 27.182305][ T297] security_d_instantiate+0x9e/0xf0 [ 27.187502][ T297] d_splice_alias+0x6d/0x390 [ 27.192092][ T297] ext4_lookup+0x4aa/0x8c0 [ 27.196515][ T297] path_openat+0x145d/0x3040 [ 27.201125][ T297] do_filp_open+0x1df/0x400 [ 27.205627][ T297] do_sys_openat2+0x19f/0x750 [ 27.210299][ T297] page_owner free stack trace missing [ 27.215667][ T297] [ 27.218027][ T297] Memory state around the buggy address: [ 27.223662][ T297] ffff88811d086580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.231722][ T297] ffff88811d086600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.239819][ T297] >ffff88811d086680: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=140, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_MULTI|NLM_F_ACK|NLM_F_DUMP_FILTERED|0xd00, nlmsg_seq=7388456, nlmsg_pid=635427840}, "\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf3\xff\x00\x00\x00\x00\x0b\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x58\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x02\x00\x00\x00\xa4\x8b\x00\x00\x00\x00\x00\x10\x0a\x00\x00\x01\x08\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00"...], iov_len=140}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 140 exit_group(0) = ? [ 27.247970][ T297] ^ [ 27.254907][ T297] ffff88811d086700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.262973][ T297] ffff88811d086780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.271034][ T297] ================================================================== [ 27.279096][ T297] Disabling lock debugging due to kernel taint [ 27.290769][ T24] audit: type=1400 audit(1792963291.010:67): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.312571][ T24] audit: type=1400 audit(1792963291.010:68): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 +++ exited with 0 +++ [ 27.333926][ T24] audit: type=1400 audit(1792963291.010:69): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1