ci-upstream-kasan-gce-selinux-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-kasan-gce-selinux-root/syz-executor83764795 <...> Warning: Permanently added '10.128.1.134' (ED25519) to the list of known hosts. execve("ci-upstream-kasan-gce-selinux-root/syz-executor83764795", ["ci-upstream-kasan-gce-selinux-root/syz-executor83764795"], 0x7ffd1efe6450 /* 10 vars */) = 0 brk(NULL) = 0x55557b752000 brk(0x55557b752d80) = 0x55557b752d80 arch_prctl(ARCH_SET_FS, 0x55557b752400) = 0 set_tid_address(0x55557b7526d0) = 5607 set_robust_list(0x55557b7526e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-kasan-gce-selinux-root/syz-executor83764795", 4096) = 61 getrandom("\x7e\x18\xa0\x0d\xa0\xd6\x44\x46", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557b752d80 brk(0x55557b773d80) = 0x55557b773d80 brk(0x55557b774000) = 0x55557b774000 mprotect(0x7fac39bff000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\x64\x50\x60\x21\xf0\x9a\x55\x39", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.uewmW1", 0700) = 0 chmod("./syzkaller.uewmW1", 0777) = 0 chdir("./syzkaller.uewmW1") = 0 mkdir("./0", 0777) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 64.734217][ T29] kauditd_printk_skb: 8 callbacks suppressed [ 64.734245][ T29] audit: type=1400 audit(1786890016.333:129): avc: denied { execmem } for pid=5607 comm="syz-executor837" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-kasan-gce-selinux-root/strace-static-x86_64: Process 5608 attached , child_tidptr=0x55557b7526d0) = 5608 [pid 5608] set_robust_list(0x55557b7526e0, 24) = 0 [pid 5607] rt_sigprocmask(SIG_SETMASK, [] [pid 5608] rt_sigprocmask(SIG_SETMASK, [] [pid 5607] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5608] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5608] chdir("./0") = 0 [pid 5608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5608] setpgid(0, 0) = 0 [pid 5608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5608] write(3, "1000", 4) = 4 [pid 5608] close(3) = 0 [pid 5608] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5608] write(1, "executing program\n", 18) = 18 [pid 5608] mkdirat(AT_FDCWD, "./file0", 0777) = 0 [pid 5608] mount("mtd0", "./file0", "jffs2", MS_I_VERSION, NULL) = 0 [ 64.928431][ T29] audit: type=1400 audit(1786890016.523:130): avc: denied { mounton } for pid=5608 comm="syz-executor837" path="/root/syzkaller.uewmW1/0/file0" dev="sda1" ino=2028 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 64.929637][ T5608] jffs2: notice: (5608) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [pid 5608] setxattr("./file0", "security.ima", "\x01\xca\x21\x68\x91\xe2\x20\xec\xfc\x0c\x1d\x3a\xe6\xce\x7c\x38\x42\x77\x59\x54\x7c", 21, XATTR_CREATE) = 0 [pid 5608] exit_group(0) = ? [pid 5608] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5608, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x55557b7537b0 /* 4 entries */, 32768) = 112 [ 64.972043][ T29] audit: type=1400 audit(1786890016.573:131): avc: denied { mount } for pid=5608 comm="syz-executor837" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 64.994091][ T29] audit: type=1400 audit(1786890016.573:132): avc: denied { setattr } for pid=5608 comm="syz-executor837" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 65.041094][ T29] audit: type=1400 audit(1786890016.643:133): avc: denied { unmount } for pid=5607 comm="syz-executor837" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 65.062131][ T5607] ------------[ cut here ]------------ [ 65.067961][ T5607] kernel BUG at fs/jffs2/nodelist.c:462! [ 65.074307][ T5607] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 65.080718][ T5607] CPU: 0 UID: 0 PID: 5607 Comm: syz-executor837 Not tainted syzkaller #0 PREEMPT(full) [ 65.090404][ T5607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 65.100429][ T5607] RIP: 0010:jffs2_del_ino_cache+0x24f/0x2c0 [ 65.106311][ T5607] Code: 4c 89 e2 49 8b 5e 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 71 49 89 1c 24 e9 42 ff ff ff e8 82 89 89 fe 90 <0f> 0b e8 4a 18 fa fe e9 5b fe ff ff e8 10 18 fa fe e9 59 ff ff ff [ 65.125887][ T5607] RSP: 0018:ffffc9000363faa8 EFLAGS: 00010293 [ 65.131927][ T5607] RAX: 0000000000000000 RBX: ffff88807b0bc000 RCX: 0000000000000000 [ 65.139876][ T5607] RDX: ffff88807b78ca80 RSI: ffffffff8380e9fe RDI: ffff888076d17ee0 [ 65.147828][ T5607] RBP: 0000000000000006 R08: 0000000000000000 R09: ffffed100f61786c [ 65.155779][ T5607] R10: ffff88807b0bc363 R11: 0000000000000000 R12: ffff88823bef4b00 [ 65.163728][ T5607] R13: dffffc0000000000 R14: ffff888076d17ec0 R15: ffff88823bef4bb0 [ 65.171678][ T5607] FS: 000055557b752400(0000) GS:ffff888123bde000(0000) knlGS:0000000000000000 [ 65.180588][ T5607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.187151][ T5607] CR2: 00007fffba3afdec CR3: 0000000076f1d000 CR4: 00000000003526f0 [ 65.195105][ T5607] Call Trace: [ 65.198362][ T5607] [ 65.201274][ T5607] jffs2_do_clear_inode+0x3ca/0x470 [ 65.206460][ T5607] ? __pfx_jffs2_evict_inode+0x10/0x10 [ 65.211906][ T5607] evict+0x3c2/0xad0 [ 65.215787][ T5607] ? list_lru_del+0xba/0x2f0 [ 65.220357][ T5607] ? list_lru_del+0xba/0x2f0 [ 65.224925][ T5607] ? __pfx_evict+0x10/0x10 [ 65.229324][ T5607] ? do_raw_spin_unlock+0x145/0x1e0 [ 65.234511][ T5607] ? find_held_lock+0x2b/0x80 [ 65.239166][ T5607] ? find_held_lock+0x2b/0x80 [ 65.243824][ T5607] dispose_list+0x117/0x1e0 [ 65.248311][ T5607] evict_inodes+0x582/0x6f0 [ 65.252800][ T5607] ? __pfx_evict_inodes+0x10/0x10 [ 65.257808][ T5607] ? sync_blockdev+0x51/0x70 [ 65.262382][ T5607] generic_shutdown_super+0xc8/0x360 [ 65.267653][ T5607] kill_mtd_super+0x1d/0x80 [ 65.272148][ T5607] jffs2_kill_sb+0x7c/0xb0 [ 65.276564][ T5607] deactivate_locked_super+0xc1/0x1b0 [ 65.281924][ T5607] deactivate_super+0xe7/0x110 [ 65.286676][ T5607] cleanup_mnt+0x21f/0x450 [ 65.291071][ T5607] task_work_run+0x150/0x240 [ 65.295642][ T5607] ? __pfx_task_work_run+0x10/0x10 [ 65.300736][ T5607] ? __x64_sys_umount+0x124/0x1a0 [ 65.305741][ T5607] ? __pfx___x64_sys_umount+0x10/0x10 [ 65.311093][ T5607] ptrace_notify+0xf3/0x120 [ 65.315580][ T5607] do_syscall_64+0x6c0/0x870 [ 65.320178][ T5607] ? clear_bhb_loop+0x70/0xc0 [ 65.324837][ T5607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.330709][ T5607] RIP: 0033:0x7fac39b6beb7 [ 65.335103][ T5607] Code: bf 41 4d 56 53 b8 9d 00 00 00 0f 05 83 f8 ea 75 a2 c7 05 d4 8b 09 00 00 00 00 00 eb 96 e8 61 05 00 00 90 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8 [ 65.354689][ T5607] RSP: 002b:00007fffba3afdd8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 [ 65.363092][ T5607] RAX: 0000000000000000 RBX: 000000000000fd2d RCX: 00007fac39b6beb7 [ 65.371056][ T5607] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffba3afe90 [ 65.379019][ T5607] RBP: 00007fffba3afe90 R08: 00007fffba3b0e90 R09: 00000000ffffffff [ 65.386969][ T5607] R10: 0000000000000000 R11: 0000000000000206 R12: 00007fffba3b0f00 [ 65.394917][ T5607] R13: 000055557b753780 R14: 00007fffba3b0f00 R15: 0000000000000001 [ 65.402870][ T5607] [ 65.405879][ T5607] Modules linked in: [ 65.409927][ T5607] ---[ end trace 0000000000000000 ]--- [ 65.415444][ T5607] RIP: 0010:jffs2_del_ino_cache+0x24f/0x2c0 [ 65.421368][ T5607] Code: 4c 89 e2 49 8b 5e 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 71 49 89 1c 24 e9 42 ff ff ff e8 82 89 89 fe 90 <0f> 0b e8 4a 18 fa fe e9 5b fe ff ff e8 10 18 fa fe e9 59 ff ff ff [ 65.440982][ T5607] RSP: 0018:ffffc9000363faa8 EFLAGS: 00010293 [ 65.447035][ T5607] RAX: 0000000000000000 RBX: ffff88807b0bc000 RCX: 0000000000000000 [ 65.455013][ T5607] RDX: ffff88807b78ca80 RSI: ffffffff8380e9fe RDI: ffff888076d17ee0 [ 65.462985][ T5607] RBP: 0000000000000006 R08: 0000000000000000 R09: ffffed100f61786c [ 65.470982][ T5607] R10: ffff88807b0bc363 R11: 0000000000000000 R12: ffff88823bef4b00 [ 65.478989][ T5607] R13: dffffc0000000000 R14: ffff888076d17ec0 R15: ffff88823bef4bb0 [ 65.486951][ T5607] FS: 000055557b752400(0000) GS:ffff888123bde000(0000) knlGS:0000000000000000 [ 65.495927][ T5607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.502524][ T5607] CR2: 00007fffba3afdec CR3: 0000000076f1d000 CR4: 00000000003526f0 [ 65.510498][ T5607] Kernel panic - not syncing: Fatal exception [ 65.516761][ T5607] Kernel Offset: disabled [ 65.521072][ T5607] Rebooting in 86400 seconds..