ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor2509802747 <...> Warning: Permanently added '10.128.0.183' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor2509802747", ["ci2-android-5-15/syz-executor2509802747"], 0x7ffe0bbf0310 /* 10 vars */) = 0 brk(NULL) = 0x55557afa1000 brk(0x55557afa1d40) = 0x55557afa1d40 arch_prctl(ARCH_SET_FS, 0x55557afa13c0) = 0 set_tid_address(0x55557afa1690) = 303 set_robust_list(0x55557afa16a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor2509802747", 4096) = 45 getrandom("\x35\x24\x3a\xa8\x43\xc7\xa8\xe7", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557afa1d40 brk(0x55557afc2d40) = 0x55557afc2d40 brk(0x55557afc3000) = 0x55557afc3000 mprotect(0x7f8d7d093000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 openat(AT_FDCWD, "/dev/net/tun", O_WRONLY|O_CREAT|O_NOCTTY|O_TRUNC|O_SYNC|O_NOATIME|O_CLOEXEC, 000) = 3 ioctl(3, TUNSETIFF, 0x2000000000c0) = 0 openat(AT_FDCWD, "/dev/net/tun", O_WRONLY|O_EXCL|O_SYNC|O_NOFOLLOW|O_CLOEXEC|FASYNC) = 4 close(4) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4 ioctl(4, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=48, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=8192, nlmsg_pid=0}, "\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xff\xff\xf1\xff\xff\xff\x00\x00\x00\x00\x0c\x00\x01\x00\x69\x6e\x67\x72\x65\x73\x73\x00"], iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [ 24.754975][ T30] audit: type=1400 audit(1792294661.676:64): avc: denied { execmem } for pid=303 comm="syz-executor250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.776321][ T30] audit: type=1400 audit(1792294661.696:65): avc: denied { module_request } for pid=301 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=100, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x400, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0f\x00\x00\x00\x01\x00\x09\x00\xff\xff\xff\xff\x00\x03\x01\x00\x0a\x00\x01\x00\x62\x61\x73\x69\x63\x00\x00\x00\x34\x00\x02\x00\x30\x00\x02\x80\x08\x00\x01\x00\x01\x00\x00\x00\x24\x00\x02\x80\x20\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x0c\x00\x01\x00\x02\x10\xfc\x00\x04\x10\x00\x00\x08\x00\x03\x00\x04\x00\x00\x00"], iov_len=100}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 100 ioctl(4, SIOCSIFFLAGS, {ifr_name="syzkaller0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_LOOPBACK|IFF_POINTOPOINT|IFF_NOTRAILERS|IFF_NOARP|IFF_PROMISC|IFF_ALLMULTI|IFF_SLAVE|IFF_MULTICAST|IFF_PORTSEL|IFF_DYNAMIC}) = 0 [ 24.800301][ T30] audit: type=1400 audit(1792294661.706:66): avc: denied { read } for pid=140 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 24.830855][ T303] device syzkaller0 entered promiscuous mode [ 24.837238][ T303] ================================================================================ [ 24.846572][ T303] UBSAN: shift-out-of-bounds in net/sched/em_meta.c:763:14 [ 24.853812][ T303] shift exponent 252 is too large for 64-bit type 'unsigned long' [ 24.861650][ T303] CPU: 0 PID: 303 Comm: syz-executor250 Not tainted syzkaller #0 [ 24.869378][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.879430][ T303] Call Trace: [ 24.882795][ T303] [ 24.885717][ T303] __dump_stack+0x21/0x30 [ 24.890043][ T303] dump_stack_lvl+0x110/0x170 [ 24.894731][ T303] ? show_regs_print_info+0x20/0x20 [ 24.899915][ T303] dump_stack+0x15/0x20 [ 24.904054][ T303] ubsan_epilogue+0xe/0x40 [ 24.908452][ T303] __ubsan_handle_shift_out_of_bounds+0x364/0x3f0 [ 24.914852][ T303] meta_int_apply_extras+0x13d/0x150 [ 24.920122][ T303] meta_get+0x1f3/0x3f0 [ 24.924285][ T303] ? meta_int_dump+0x1f0/0x1f0 [ 24.929039][ T303] em_meta_match+0xec/0x2f0 [ 24.933531][ T303] ? em_meta_change+0xa80/0xa80 [ 24.938370][ T303] __tcf_em_tree_match+0x1cb/0x7a0 [ 24.943473][ T303] ? tcf_em_tree_dump+0x930/0x930 [ 24.948485][ T303] basic_classify+0xd9/0x240 [ 24.953059][ T303] tcf_classify+0x154/0x410 [ 24.957571][ T303] __netif_receive_skb_core+0x186b/0x2fb0 [ 24.963277][ T303] ? set_rps_cpu+0x5d0/0x5d0 [ 24.967852][ T303] ? bpf_flow_dissect+0x3e0/0x3e0 [ 24.972881][ T303] ? stack_trace_save+0xa6/0xf0 [ 24.977722][ T303] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 24.983537][ T303] ? __stack_depot_save+0x441/0x480 [ 24.988724][ T303] __netif_receive_skb_list_core+0x24d/0x770 [ 24.994692][ T303] ? __alloc_skb+0x210/0x730 [ 24.999266][ T303] ? __napi_alloc_skb+0x162/0x2e0 [ 25.004275][ T303] ? __x64_sys_write+0x7b/0x90 [ 25.009028][ T303] ? __netif_receive_skb+0x280/0x280 [ 25.014302][ T303] netif_receive_skb_list_internal+0x7f8/0xaa0 [ 25.020444][ T303] ? __kasan_check_write+0x14/0x20 [ 25.025541][ T303] ? skb_header_pointer+0x92/0x120 [ 25.030640][ T303] ? netif_receive_skb_list+0x2a0/0x2a0 [ 25.036277][ T303] ? eth_type_trans+0x3c1/0x5e0 [ 25.041121][ T303] ? eth_get_headlen+0x200/0x200 [ 25.046048][ T303] napi_complete_done+0x375/0x7a0 [ 25.051061][ T303] ? __napi_schedule_irqoff+0x230/0x230 [ 25.056596][ T303] tun_get_user+0x265c/0x33e0 [ 25.061275][ T303] ? tun_do_read+0x1d70/0x1d70 [ 25.066030][ T303] ? __switch_to+0x56c/0x1070 [ 25.070698][ T303] ? avc_policy_seqno+0x1b/0x70 [ 25.075535][ T303] ? selinux_file_permission+0x2aa/0x510 [ 25.081154][ T303] tun_chr_write_iter+0x1ed/0x2f0 [ 25.086166][ T303] vfs_write+0x831/0xfd0 [ 25.090394][ T303] ? file_end_write+0x1b0/0x1b0 [ 25.095234][ T303] ? _raw_spin_unlock_irq+0x4e/0x70 [ 25.100416][ T303] ? cgroup_leave_frozen+0x165/0x2a0 [ 25.105700][ T303] ? __kasan_check_read+0x11/0x20 [ 25.110718][ T303] ? __fdget_pos+0x1f7/0x380 [ 25.115301][ T303] ksys_write+0x14a/0x260 [ 25.119624][ T303] ? __ia32_sys_read+0x90/0x90 [ 25.124377][ T303] ? __kasan_check_write+0x14/0x20 [ 25.129481][ T303] ? switch_fpu_return+0x15d/0x2c0 [ 25.134592][ T303] __x64_sys_write+0x7b/0x90 [ 25.139176][ T303] x64_sys_call+0x8ef/0x9a0 [ 25.143667][ T303] do_syscall_64+0x4c/0xa0 [ 25.148074][ T303] ? clear_bhb_loop+0x50/0xa0 [ 25.152737][ T303] ? clear_bhb_loop+0x50/0xa0 [ 25.157401][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.163288][ T303] RIP: 0033:0x7f8d7d0030f9 [ 25.167709][ T303] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.187302][ T303] RSP: 002b:00007ffe6cb01418 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 25.195716][ T303] RAX: ffffffffffffffda RBX: 00007ffe6cb01548 RCX: 00007f8d7d0030f9 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2f\x64\x65\x76\x2f\x6e\x65\x74\x2f\x74\x75\x6e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 102) = 102 exit_group(0) = ? [ 25.203674][ T303] RDX: 0000000000000066 RSI: 0000200000000000 RDI: 0000000000000003 [ 25.211631][ T303] RBP: 0000000000000001 R08: 00007ffe6cb01548 R09: 00007ffe6cb01548 [ 25.219590][ T303] R10: 00007ffe6cb01548 R11: 0000000000000246 R12: 00007ffe6cb01538 [ 25.227543][ T303] R13: 0000000000000002 R14: 00007f8d7d093ca0 R15: 0000000000000002 [ 25.235517][ T303] [ 25.238579][ T303] ================================================================================ +++ exited with 0 +++