ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor4282916150 <...> Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor4282916150", ["ci2-android-5-15/syz-executor4282916150"], 0x7ffe9a7407e0 /* 10 vars */) = 0 brk(NULL) = 0x55556ee23000 brk(0x55556ee23d40) = 0x55556ee23d40 arch_prctl(ARCH_SET_FS, 0x55556ee233c0) = 0 set_tid_address(0x55556ee23690) = 303 set_robust_list(0x55556ee236a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor4282916150", 4096) = 45 getrandom("\xe4\xd5\x05\x88\x3c\x40\x4d\x20", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ee23d40 brk(0x55556ee44d40) = 0x55556ee44d40 brk(0x55556ee45000) = 0x55556ee45000 mprotect(0x7f0d6ca80000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0 bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_SOCKMAP, key_size=4, value_size=4, max_entries=4, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0}, 72) = 5 [ 24.417609][ T30] audit: type=1400 audit(1793428629.781:64): avc: denied { execmem } for pid=303 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.437064][ T30] audit: type=1400 audit(1793428629.781:65): avc: denied { map_create } for pid=303 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.456422][ T30] audit: type=1400 audit(1793428629.781:66): avc: denied { map_read map_write } for pid=303 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.477019][ T30] audit: type=1400 audit(1793428629.781:67): avc: denied { prog_load } for pid=303 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.496276][ T30] audit: type=1400 audit(1793428629.781:68): avc: denied { bpf } for pid=303 comm="syz-executor428" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=6, insns=0x200000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_SK_SKB_STREAM_VERDICT, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 6 bpf(BPF_PROG_ATTACH, {target_fd=5, attach_bpf_fd=6, attach_type=BPF_SK_SKB_STREAM_VERDICT, attach_flags=0, replace_bpf_fd=0, relative_fd=0, expected_revision=0}, 32) = 0 bpf(BPF_MAP_UPDATE_ELEM, {map_fd=5, key=0x200000000640, value=0x200000000680, flags=BPF_ANY}, 32) = 0 [ 24.557266][ T30] audit: type=1400 audit(1793428629.921:69): avc: denied { perfmon } for pid=303 comm="syz-executor428" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 24.578499][ T30] audit: type=1400 audit(1793428629.951:70): avc: denied { prog_run } for pid=303 comm="syz-executor428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.580638][ T303] ================================================================== [ 24.605642][ T303] BUG: KASAN: slab-out-of-bounds in sk_skb_adjust_room+0x389/0x5c0 [ 24.613526][ T303] Read of size 8 at addr ffff88812177fee8 by task syz-executor428/303 [ 24.621653][ T303] [ 24.623970][ T303] CPU: 1 PID: 303 Comm: syz-executor428 Not tainted syzkaller #0 [ 24.631668][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 24.641769][ T303] Call Trace: [ 24.645034][ T303] [ 24.647946][ T303] __dump_stack+0x21/0x30 [ 24.652254][ T303] dump_stack_lvl+0x110/0x170 [ 24.656926][ T303] ? show_regs_print_info+0x20/0x20 [ 24.662098][ T303] ? load_image+0x3f0/0x3f0 [ 24.666578][ T303] ? skb_release_data+0x1b5/0xa20 [ 24.671574][ T303] print_address_description+0x7f/0x2c0 [ 24.677099][ T303] ? sk_skb_adjust_room+0x389/0x5c0 [ 24.682288][ T303] kasan_report+0x10f/0x150 [ 24.686766][ T303] ? sk_skb_adjust_room+0x389/0x5c0 [ 24.691945][ T303] __asan_report_load8_noabort+0x14/0x20 [ 24.697552][ T303] sk_skb_adjust_room+0x389/0x5c0 [ 24.702551][ T303] bpf_prog_e15ab8bd9cea3c06+0x19/0x650 [ 24.708067][ T303] sk_psock_verdict_recv+0x245/0x7f0 [ 24.713327][ T303] unix_read_sock+0x108/0x2d0 [ 24.717979][ T303] ? sk_psock_skb_redirect+0x440/0x440 [ 24.723412][ T303] ? unix_stream_splice_actor+0x120/0x120 [ 24.729111][ T303] ? copy_mc_pipe_to_iter+0x7e0/0x7e0 [ 24.734458][ T303] ? sk_psock_skb_redirect+0x440/0x440 [ 24.739917][ T303] unix_stream_read_sock+0x61/0x90 [ 24.745036][ T303] sk_psock_verdict_data_ready+0x167/0x1d0 [ 24.750852][ T303] ? sk_psock_start_verdict+0xc0/0xc0 [ 24.756219][ T303] ? _raw_spin_lock+0x94/0xf0 [ 24.760875][ T303] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 24.766656][ T303] ? skb_queue_tail+0xcb/0xf0 [ 24.771308][ T303] unix_stream_sendmsg+0x7d1/0xc90 [ 24.776403][ T303] ? unix_show_fdinfo+0xa0/0xa0 [ 24.781315][ T303] ? __schedule+0xbd7/0x14a0 [ 24.785891][ T303] ? security_socket_sendmsg+0x82/0xa0 [ 24.791345][ T303] __sys_sendto+0x46d/0x620 [ 24.795832][ T303] ? __ia32_sys_getpeername+0x90/0x90 [ 24.801189][ T303] ? __kasan_check_write+0x14/0x20 [ 24.806283][ T303] __x64_sys_sendto+0xe5/0x100 [ 24.811030][ T303] x64_sys_call+0x178/0x9a0 [ 24.815513][ T303] do_syscall_64+0x4c/0xa0 [ 24.819909][ T303] ? clear_bhb_loop+0x50/0xa0 [ 24.824570][ T303] ? clear_bhb_loop+0x50/0xa0 [ 24.829226][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.835101][ T303] RIP: 0033:0x7f0d6c9efe79 [ 24.839495][ T303] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.859088][ T303] RSP: 002b:00007ffc19175318 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 24.867792][ T303] RAX: ffffffffffffffda RBX: 00007ffc19175458 RCX: 00007f0d6c9efe79 [ 24.875754][ T303] RDX: 0000000000000004 RSI: 0000200000000800 RDI: 0000000000000004 [ 24.883711][ T303] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 24.892561][ T303] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc19175448 [ 24.900624][ T303] R13: 0000000000000002 R14: 00007f0d6ca80ca0 R15: 0000000000000002 [ 24.908610][ T303] [ 24.911621][ T303] [ 24.913924][ T303] Allocated by task 303: [ 24.918142][ T303] __kasan_slab_alloc+0xb7/0xe0 [ 24.923112][ T303] slab_post_alloc_hook+0x4f/0x2b0 [ 24.928222][ T303] kmem_cache_alloc+0xf7/0x260 [ 24.932981][ T303] sk_prot_alloc+0x5f/0x320 [ 24.937468][ T303] sk_alloc+0x38/0x430 [ 24.941522][ T303] unix_create1+0xb4/0x610 [ 24.945920][ T303] unix_create+0x149/0x200 [ 24.950317][ T303] __sock_create+0x38d/0x7a0 [ 24.954890][ T303] __sys_socketpair+0x1a1/0x590 [ 24.959718][ T303] __x64_sys_socketpair+0x9b/0xb0 [ 24.964754][ T303] x64_sys_call+0x36/0x9a0 [ 24.969149][ T303] do_syscall_64+0x4c/0xa0 [ 24.973543][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.979420][ T303] [ 24.981725][ T303] The buggy address belongs to the object at ffff88812177f9c0 [ 24.981725][ T303] which belongs to the cache UNIX-STREAM of size 1216 [ 24.995850][ T303] The buggy address is located 104 bytes to the right of [ 24.995850][ T303] 1216-byte region [ffff88812177f9c0, ffff88812177fe80) [ 25.009821][ T303] The buggy address belongs to the page: [ 25.015440][ T303] page:ffffea000485df00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12177c [ 25.025663][ T303] head:ffffea000485df00 order:2 compound_mapcount:0 compound_pincount:0 [ 25.033969][ T303] flags: 0x4000000000010200(slab|head|zone=1) [ 25.040036][ T303] raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881003e6780 [ 25.048600][ T303] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 25.057193][ T303] page dumped because: kasan: bad access detected [ 25.063587][ T303] page_owner tracks the page as allocated [ 25.069297][ T303] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 303, ts 24419535734, free_ts 0 [ 25.087431][ T303] post_alloc_hook+0x192/0x1b0 [ 25.092194][ T303] prep_new_page+0x1c/0x110 [ 25.096683][ T303] get_page_from_freelist+0x2d42/0x2dd0 [ 25.102646][ T303] __alloc_pages+0x1a2/0x460 [ 25.107215][ T303] new_slab+0xa0/0x4d0 [ 25.111294][ T303] ___slab_alloc+0x3ac/0x840 [ 25.116212][ T303] __slab_alloc+0x49/0x90 [ 25.120526][ T303] kmem_cache_alloc+0x138/0x260 [ 25.125359][ T303] sk_prot_alloc+0x5f/0x320 [ 25.129852][ T303] sk_alloc+0x38/0x430 [ 25.133907][ T303] unix_create1+0xb4/0x610 [ 25.138305][ T303] unix_create+0x149/0x200 [ 25.142707][ T303] __sock_create+0x38d/0x7a0 [ 25.147276][ T303] __sys_socketpair+0x1a1/0x590 [ 25.152114][ T303] __x64_sys_socketpair+0x9b/0xb0 [ 25.157119][ T303] x64_sys_call+0x36/0x9a0 [ 25.161528][ T303] page_owner free stack trace missing [ 25.166874][ T303] [ 25.169177][ T303] Memory state around the buggy address: [ 25.174786][ T303] ffff88812177fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.182828][ T303] ffff88812177fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.190873][ T303] >ffff88812177fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.198912][ T303] ^ sendto(4, "\x01\x02\x03\x04", 4, 0, NULL, 0) = 4 exit_group(0) = ? +++ exited with 0 +++ [ 25.206346][ T303] ffff88812177ff00: fc f