ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor940476342 <...> T28] audit: type=1400 audit(1793567395.946:62): avc: denied { rlimitinh } for pid=226 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.280075][ T28] audit: type=1400 audit(1793567395.946:63): avc: denied { siginh } for pid=226 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.102' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor940476342", ["ci2-android-6-1/syz-executor940476342"], 0x7ffca7905d50 /* 10 vars */) = 0 brk(NULL) = 0x555582539000 brk(0x555582539d40) = 0x555582539d40 arch_prctl(ARCH_SET_FS, 0x5555825393c0) = 0 set_tid_address(0x555582539690) = 306 set_robust_list(0x5555825396a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor940476342", 4096) = 43 getrandom("\xac\x29\x37\xbe\xf1\xec\x77\xb8", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555582539d40 brk(0x55558255ad40) = 0x55558255ad40 brk(0x55558255b000) = 0x55558255b000 mprotect(0x7fb3f8fb1000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 mkdirat(AT_FDCWD, "./config", 0777) = 0 mount(NULL, "./config", "configfs", 0, NULL) = 0 mkdirat(AT_FDCWD, "./config/usb_gadget/g1", 0777) = 0 [ 23.023026][ T28] audit: type=1400 audit(1793567404.706:64): avc: denied { execmem } for pid=306 comm="syz-executor940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.028711][ T306] Mass Storage Function, version: 2009/09/11 [ 23.045978][ T28] audit: type=1400 audit(1793567404.706:65): avc: denied { mounton } for pid=306 comm="syz-executor940" path="/root/config" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 mkdirat(AT_FDCWD, "./config/usb_gadget/g1/functions/mass_storage.usb0", 0777) = 0 openat(AT_FDCWD, "./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers", O_WRONLY) = 3 [ 23.049485][ T306] LUN: removable file: (no medium) [ 23.072107][ T28] audit: type=1400 audit(1793567404.706:66): avc: denied { mount } for pid=306 comm="syz-executor940" name="/" dev="configfs" ino=8024 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 23.078230][ T306] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN [ 23.100162][ T28] audit: type=1400 audit(1793567404.706:67): avc: denied { search } for pid=306 comm="syz-executor940" name="/" dev="configfs" ino=8024 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.111531][ T306] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 23.111546][ T306] CPU: 0 PID: 306 Comm: syz-executor940 Not tainted syzkaller #0 [ 23.111563][ T306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 23.111572][ T306] RIP: 0010:fsg_common_set_num_buffers+0x60/0x2a0 [ 23.135217][ T28] audit: type=1400 audit(1793567404.706:68): avc: denied { write } for pid=306 comm="syz-executor940" name="usb_gadget" dev="configfs" ino=8025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.142529][ T306] Code: 9a 01 00 00 49 89 c6 49 bd 00 00 00 00 00 fc ff df bf 00 40 00 00 be c0 0c 00 00 e8 da 0e 57 fe 48 89 c3 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 11 49 66 fe 49 89 1e 48 85 db 0f [ 23.142549][ T306] RSP: 0018:ffffc90000f27b28 EFLAGS: 00010202 [ 23.142566][ T306] RAX: 0000000000000002 RBX: ffff8881241a4000 RCX: 0000000000000002 [ 23.142579][ T306] RDX: 0000000000000000 RSI: ffffffff8350c626 RDI: ffffed1024835000 [ 23.142591][ T306] RBP: ffffc90000f27b70 R08: 0000000000004000 R09: ffffed1024835000 [ 23.150724][ T28] audit: type=1400 audit(1793567404.706:69): avc: denied { add_name } for pid=306 comm="syz-executor940" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 23.160446][ T306] R10: dffffc0000000000 R11: fffff94000920d2c R12: ffff88810db05000 [ 23.160462][ T306] R13: dffffc0000000000 R14: 0000000000000010 R15: 0000000000000000 [ 23.160474][ T306] FS: 00005555825393c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 23.160490][ T306] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.167257][ T28] audit: type=1400 audit(1793567404.706:70): avc: denied { create } for pid=306 comm="syz-executor940" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 23.190506][ T306] CR2: 00007fb3f8fbd008 CR3: 00000001224b3000 CR4: 00000000003506b0 [ 23.190534][ T306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.190545][ T306] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.190556][ T306] Call Trace: [ 23.190562][ T306] [ 23.190570][ T306] ? kstrtou8+0x6f/0xe0 [ 23.210596][ T28] audit: type=1400 audit(1793567404.766:71): avc: denied { write } for pid=306 comm="syz-executor940" name="num_buffers" dev="configfs" ino=15482 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 23.216248][ T306] fsg_opts_num_buffers_store+0x138/0x1c0 [ 23.224411][ T28] audit: type=1400 audit(1793567404.766:72): avc: denied { open } for pid=306 comm="syz-executor940" path="/root/config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers" dev="configfs" ino=15482 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 23.232278][ T306] ? __cfi_fsg_opts_num_buffers_store+0x10/0x10 [ 23.232302][ T306] ? avc_policy_seqno+0x1b/0x70 [ 23.240436][ T28] audit: type=1400 audit(1793567404.826:73): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 23.260741][ T306] ? selinux_file_permission+0x2a5/0x510 [ 23.260773][ T306] configfs_write_iter+0x323/0x410 [ 23.447818][ T306] ? __cfi_fsg_opts_num_buffers_store+0x10/0x10 [ 23.454058][ T306] vfs_write+0x5ef/0xd00 [ 23.458293][ T306] ? __cfi_vfs_write+0x10/0x10 [ 23.463065][ T306] ? memset+0x35/0x40 [ 23.467052][ T306] ? __kasan_check_read+0x11/0x20 [ 23.472155][ T306] ? __fdget_pos+0x2d4/0x380 [ 23.476744][ T306] ksys_write+0x14a/0x260 [ 23.481063][ T306] ? __cfi_ksys_write+0x10/0x10 [ 23.485917][ T306] ? do_user_addr_fault+0x9a5/0x1030 [ 23.491289][ T306] ? debug_smp_processor_id+0x17/0x20 [ 23.496673][ T306] __x64_sys_write+0x7b/0x90 [ 23.501282][ T306] x64_sys_call+0x27b/0x9a0 [ 23.505792][ T306] do_syscall_64+0x4c/0xa0 [ 23.510216][ T306] ? clear_bhb_loop+0x30/0x80 [ 23.514898][ T306] ? clear_bhb_loop+0x30/0x80 [ 23.519567][ T306] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.525448][ T306] RIP: 0033:0x7fb3f8f20ef9 [ 23.529866][ T306] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 23.549479][ T306] RSP: 002b:00007fff402d2cb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 23.557970][ T306] RAX: ffffffffffffffda RBX: 0000200000000300 RCX: 00007fb3f8f20ef9 [ 23.565960][ T306] RDX: 0000000000000012 RSI: 0000200000000300 RDI: 0000000000000003 [ 23.573922][ T306] RBP: 6769666e6f632f2e R08: 000000000000000f R09: 00007fff402d2df8 [ 23.581884][ T306] R10: 0000000000000001 R11: 0000000000000246 R12: 00007fff402d2de8 [ 23.589886][ T306] R13: 0000000000000002 R14: 0000200000000008 R15: 0000000000000002 [ 23.597895][ T306] [ 23.600922][ T306] Modules linked in: [ 23.605182][ T306] ---[ end trace 0000000000000000 ]--- [ 23.610682][ T306] RIP: 0010:fsg_common_set_num_buffers+0x60/0x2a0 [ 23.617115][ T306] Code: 9a 01 00 00 49 89 c6 49 bd 00 00 00 00 00 fc ff df bf 00 40 00 00 be c0 0c 00 00 e8 da 0e 57 fe 48 89 c3 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 11 49 66 fe 49 89 1e 48 85 db 0f [ 23.636772][ T306] RSP: 0018:ffffc90000f27b28 EFLAGS: 00010202 [ 23.642992][ T306] RAX: 0000000000000002 RBX: ffff8881241a4000 RCX: 0000000000000002 [ 23.651022][ T306] RDX: 0000000000000000 RSI: ffffffff8350c626 RDI: ffffed1024835000 [ 23.659054][ T306] RBP: ffffc90000f27b70 R08: 0000000000004000 R09: ffffed1024835000 [ 23.667052][ T306] R10: dffffc0000000000 R11: fffff94000920d2c R12: ffff88810db05000 [ 23.675261][ T306] R13: dffffc0000000000 R14: 0000000000000010 R15: 0000000000000000 [ 23.683364][ T306] FS: 00005555825393c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 23.692327][ T306] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.698938][ T306] CR2: 00007fb3f8fbd008 CR3: 00000001224b3000 CR4: 00000000003506b0 [ 23.707104][ T306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.715289][ T306] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.723288][ T306] Kernel panic - not syncing: Fatal exception [ 23.729716][ T306] Kernel Offset: disabled [ 23.734404][ T306] Rebooting in 86400 seconds..