ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor3304499685 <...> Warning: Permanently added '10.128.10.15' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor3304499685", ["ci2-android-5-15/syz-executor3304499685"], 0x7ffc260ed120 /* 10 vars */) = 0 brk(NULL) = 0x55555f84a000 brk(0x55555f84ad40) = 0x55555f84ad40 arch_prctl(ARCH_SET_FS, 0x55555f84a3c0) = 0 set_tid_address(0x55555f84a690) = 303 set_robust_list(0x55555f84a6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor3304499685", 4096) = 45 getrandom("\xcc\xbb\xbc\x04\x13\xa9\x94\x12", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555f84ad40 brk(0x55555f86bd40) = 0x55555f86bd40 brk(0x55555f86c000) = 0x55555f86c000 mprotect(0x7fb3d981f000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PPPOX, SOCK_STREAM, 1) = 4 connect(4, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x0a\x00\x00\x00\x04\x00\x00\x00\xff\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00"}, 50) = 0 ioctl(4, NILFS_IOCTL_GET_CPINFO, 0) = -1 ENOTTY (Inappropriate ioctl for device) exit_group(0) = ? [ 24.091561][ T30] audit: type=1400 audit(1789463353.417:64): avc: denied { execmem } for pid=303 comm="syz-executor330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.111096][ T30] audit: type=1400 audit(1789463353.417:65): avc: denied { create } for pid=303 comm="syz-executor330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 24.112776][ T303] ================================================================== [ 24.131154][ T30] audit: type=1400 audit(1789463353.417:66): avc: denied { connect } for pid=303 comm="syz-executor330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 24.138875][ T303] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 [ 24.138909][ T303] Write of size 8 at addr ffff88810b6aad50 by task syz-executor330/303 [ 24.158912][ T30] audit: type=1400 audit(1789463353.447:67): avc: denied { ioctl } for pid=303 comm="syz-executor330" path="socket:[15103]" dev="sockfs" ino=15103 ioctlcmd=0x6e82 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 24.165405][ T303] [ 24.165420][ T303] CPU: 1 PID: 303 Comm: syz-executor330 Not tainted syzkaller #0 [ 24.208536][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.218578][ T303] Call Trace: [ 24.221834][ T303] [ 24.224743][ T303] __dump_stack+0x21/0x30 [ 24.229070][ T303] dump_stack_lvl+0x110/0x170 [ 24.233733][ T303] ? show_regs_print_info+0x20/0x20 [ 24.238911][ T303] ? load_image+0x3f0/0x3f0 [ 24.243408][ T303] print_address_description+0x7f/0x2c0 [ 24.248940][ T303] ? mutex_lock+0x8e/0x1c0 [ 24.253346][ T303] kasan_report+0x10f/0x150 [ 24.257838][ T303] ? mutex_lock+0x8e/0x1c0 [ 24.262240][ T303] kasan_check_range+0x249/0x2a0 [ 24.267164][ T303] __kasan_check_write+0x14/0x20 [ 24.272094][ T303] mutex_lock+0x8e/0x1c0 [ 24.276322][ T303] ? wait_for_completion_killable_timeout+0x10/0x10 [ 24.282893][ T303] ? l2tp_session_put+0xaf/0x1a0 [ 24.287814][ T303] ? l2tp_session_delete+0x3a9/0x4a0 [ 24.293091][ T303] pppol2tp_release+0x178/0x2b0 [ 24.297928][ T303] sock_close+0xb8/0x200 [ 24.302153][ T303] ? sock_mmap+0xa0/0xa0 [ 24.306377][ T303] __fput+0x22b/0x900 [ 24.310340][ T303] ____fput+0x15/0x20 [ 24.314303][ T303] task_work_run+0x127/0x190 [ 24.318874][ T303] do_exit+0xb70/0x29a0 [ 24.323009][ T303] ? ptrace_stop+0x6d8/0xa70 [ 24.327582][ T303] ? put_task_struct+0x90/0x90 [ 24.332325][ T303] ? ptrace_notify+0x1ea/0x270 [ 24.337072][ T303] ? do_notify_parent+0x830/0x830 [ 24.342079][ T303] do_group_exit+0x149/0x310 [ 24.346648][ T303] __x64_sys_exit_group+0x3f/0x40 [ 24.351652][ T303] x64_sys_call+0x832/0x9a0 [ 24.356146][ T303] do_syscall_64+0x4c/0xa0 [ 24.360544][ T303] ? clear_bhb_loop+0x50/0xa0 [ 24.365203][ T303] ? clear_bhb_loop+0x50/0xa0 [ 24.369861][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.375734][ T303] RIP: 0033:0x7fb3d978e345 [ 24.380152][ T303] Code: Unable to access opcode bytes at RIP 0x7fb3d978e31b. [ 24.387505][ T303] RSP: 002b:00007ffe5d5a3478 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 24.395925][ T303] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fb3d978e345 [ 24.403879][ T303] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 24.411831][ T303] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffe5d5a3608 [ 24.419795][ T303] R10: 000000000000000a R11: 0000000000000206 R12: 0000000000000000 [ 24.427748][ T303] R13: 00007fb3d9824110 R14: 00007fb3d98263a8 R15: 00007fb3d98263c0 [ 24.435717][ T303] [ 24.438724][ T303] [ 24.441029][ T303] Allocated by task 303: [ 24.445251][ T303] __kasan_kmalloc+0xd4/0x100 [ 24.449930][ T303] __kmalloc+0x13d/0x2c0 [ 24.454161][ T303] l2tp_session_create+0x39/0xb60 [ 24.459168][ T303] pppol2tp_connect+0xbf5/0x1640 [ 24.464093][ T303] __sys_connect+0x3cb/0x450 [ 24.468663][ T303] __x64_sys_connect+0x7a/0x90 [ 24.473406][ T303] x64_sys_call+0x7c/0x9a0 [ 24.477802][ T303] do_syscall_64+0x4c/0xa0 [ 24.482199][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.488081][ T303] [ 24.490419][ T303] Freed by task 303: [ 24.494304][ T303] kasan_set_track+0x4a/0x70 [ 24.498888][ T303] kasan_set_free_info+0x23/0x40 [ 24.503813][ T303] ____kasan_slab_free+0x125/0x160 [ 24.508914][ T303] __kasan_slab_free+0x11/0x20 [ 24.513751][ T303] slab_free_freelist_hook+0xc2/0x190 [ 24.519123][ T303] kfree+0xc4/0x270 [ 24.522917][ T303] l2tp_session_put+0xaf/0x1a0 [ 24.527663][ T303] l2tp_session_delete+0x3a9/0x4a0 [ 24.532755][ T303] pppol2tp_release+0x169/0x2b0 [ 24.537589][ T303] sock_close+0xb8/0x200 [ 24.541819][ T303] __fput+0x22b/0x900 [ 24.545780][ T303] ____fput+0x15/0x20 [ 24.549740][ T303] task_work_run+0x127/0x190 [ 24.554311][ T303] do_exit+0xb70/0x29a0 [ 24.558447][ T303] do_group_exit+0x149/0x310 [ 24.563017][ T303] __x64_sys_exit_group+0x3f/0x40 [ 24.568021][ T303] x64_sys_call+0x832/0x9a0 [ 24.572507][ T303] do_syscall_64+0x4c/0xa0 [ 24.576903][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.582776][ T303] [ 24.585093][ T303] The buggy address belongs to the object at ffff88810b6aac00 [ 24.585093][ T303] which belongs to the cache kmalloc-512 of size 512 [ 24.599128][ T303] The buggy address is located 336 bytes inside of [ 24.599128][ T303] 512-byte region [ffff88810b6aac00, ffff88810b6aae00) [ 24.612387][ T303] The buggy address belongs to the page: [ 24.618006][ T303] page:ffffea00042daa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b6a8 [ 24.628230][ T303] head:ffffea00042daa00 order:2 compound_mapcount:0 compound_pincount:0 [ 24.636540][ T303] flags: 0x4000000000010200(slab|head|zone=1) [ 24.642721][ T303] raw: 4000000000010200 ffffea00042da100 0000000500000005 ffff888100042f00 [ 24.651383][ T303] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.659945][ T303] page dumped because: kasan: bad access detected [ 24.666383][ T303] page_owner tracks the page as allocated [ 24.672084][ T303] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 2237051880, free_ts 0 [ 24.689975][ T303] post_alloc_hook+0x192/0x1b0 [ 24.694732][ T303] prep_new_page+0x1c/0x110 [ 24.699218][ T303] get_page_from_freelist+0x2c3a/0x2cd0 [ 24.704750][ T303] __alloc_pages+0x1a2/0x460 [ 24.709321][ T303] new_slab+0xa0/0x4d0 [ 24.713367][ T303] ___slab_alloc+0x3ac/0x840 [ 24.717936][ T303] __slab_alloc+0x49/0x90 [ 24.722250][ T303] kmem_cache_alloc_trace+0x146/0x270 [ 24.727600][ T303] dev_pm_qos_constraints_allocate+0x53/0x3f0 [ 24.733672][ T303] __dev_pm_qos_add_request+0x132/0x3e0 [ 24.739230][ T303] dev_pm_qos_add_request+0x37/0x50 [ 24.744412][ T303] usb_hub_create_port_device+0x459/0xad0 [ 24.750119][ T303] hub_probe+0x1f7d/0x2ad0 [ 24.754518][ T303] usb_probe_interface+0x60f/0xb20 [ 24.759607][ T303] really_probe+0x27d/0x970 [ 24.764088][ T303] __driver_probe_device+0x193/0x270 [ 24.769364][ T303] page_owner free stack trace missing [ 24.774711][ T303] [ 24.777020][ T303] Memory state around the buggy address: [ 24.782624][ T303] ffff88810b6aac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.790661][ T303] ffff88810b6aac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.798706][ T303] >ffff88810b6aad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.806747][ T303] ^ [ 24.813406][ T303] ffff88810b6aad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.821444][ T303] ffff88810b6aae00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.829484][ T303] ================================================================== [ 24.837521][ T303] Disabling lock debugging due to kernel taint +++ exited with 0 +++ [