./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3168386982

<...>
Warning: Permanently added '10.128.1.70' (ED25519) to the list of known hosts.
execve("./syz-executor3168386982", ["./syz-executor3168386982"], 0x7fff2c8bc480 /* 10 vars */) = 0
brk(NULL)                               = 0x5555806ba000
brk(0x5555806bae00)                     = 0x5555806bae00
arch_prctl(ARCH_SET_FS, 0x5555806ba480) = 0
set_tid_address(0x5555806ba750)         = 313
set_robust_list(0x5555806ba760, 24)     = 0
rseq(0x5555806bada0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor3168386982", 4096) = 28
getrandom("\xb8\xc9\x35\x47\x42\x40\x4e\xf9", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555806bae00
brk(0x5555806dbe00)                     = 0x5555806dbe00
brk(0x5555806dc000)                     = 0x5555806dc000
mprotect(0x7f4b31012000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7f4b30f56b40, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4b30f5fb50}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7f4b30f56b40, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f4b30f5fb50}, NULL, 8) = 0
write(1, "executing program\n", 18executing program
)     = 18
futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7f4b30fb4ba0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f4b30f5fb50}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4b30f2c000
mprotect(0x7f4b30f2d000, 131072, PROT_READ|PROT_WRITE) = 0
rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0
clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4b30f4c990, parent_tid=0x7f4b30f4c990, exit_signal=0, stack=0x7f4b30f2c000, stack_size=0x20240, tls=0x7f4b30f4c6c0} => {parent_tid=[314]}, 88) = 314
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
futex(0x7f4b310183e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 314 attached
 <unfinished ...>
[pid   314] set_robust_list(0x7f4b30f4c9a0, 24) = 0
[pid   314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   314] mkdir("./file0", 0777)      = 0
[pid   314] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid   314] futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... futex resumed>)        = 0
[pid   313] futex(0x7f4b310183e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   314] <... futex resumed>)        = 1
[pid   314] openat(AT_FDCWD, "/dev/fuse", O_RDWR|O_CREAT, 000) = 3
[pid   314] futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... futex resumed>)        = 0
[pid   313] futex(0x7f4b310183e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   314] <... futex resumed>)        = 1
[pid   314] mount(NULL, "./file0", "fuse", 0, "fd=00000000000000000000003,rootmode=0000000000000000040000,user_id=00000000000000000000,group_id=000"...) = 0
[pid   314] futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... futex resumed>)        = 0
[pid   313] futex(0x7f4b310183e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   314] <... futex resumed>)        = 1
[pid   314] read(3, "\x68\x00\x00\x00\x1a\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x24\x00\x00\x00\x00\x00\x02\x00\xfb\xff\xff\x73\x01\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 8224) = 104
[pid   314] futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... futex resumed>)        = 0
[pid   313] futex(0x7f4b310183e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   314] <... futex resumed>)        = 1
[pid   314] write(3, "\x50\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 80) = 80
[pid   314] futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000 <unfinished ...>
[pid   313] <... futex resumed>)        = 0
[pid   313] futex(0x7f4b310183e8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} <unfinished ...>
[pid   314] <... futex resumed>)        = 1
[   42.923684][   T30] audit: type=1400 audit(1735258323.704:66): avc:  denied  { execmem } for  pid=313 comm="syz-executor316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   42.944959][   T30] audit: type=1400 audit(1735258323.724:67): avc:  denied  { read write } for  pid=313 comm="syz-executor316" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[pid   314] read(3,  <unfinished ...>
[pid   313] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[pid   313] futex(0x7f4b310183ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out)
[pid   313] futex(0x7f4b310183fc, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f4b30f0b000
[pid   313] mprotect(0x7f4b30f0c000, 131072, PROT_READ|PROT_WRITE) = 0
[pid   313] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid   313] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f4b30f2b990, parent_tid=0x7f4b30f2b990, exit_signal=0, stack=0x7f4b30f0b000, stack_size=0x20240, tls=0x7f4b30f2b6c0} => {parent_tid=[316]}, 88) = 316
[pid   313] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   313] futex(0x7f4b310183f8, FUTEX_WAKE_PRIVATE, 1000000) = 0
[pid   313] futex(0x7f4b310183fc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 316 attached
 <unfinished ...>
[pid   316] set_robust_list(0x7f4b30f2b9a0, 24) = 0
[pid   316] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid   316] rmdir("./file0/../file0/file0" <unfinished ...>
[pid   314] <... read resumed>"\x2e\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3c\x01\x00\x00\x00\x00\x00\x00\x66\x69\x6c\x65\x30\x00", 8192) = 46
[pid   314] write(3, "\x96\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 150) = 150
[pid   314] futex(0x7f4b310183ec, FUTEX_WAKE_PRIVATE, 1000000) = 0
[   42.968290][   T30] audit: type=1400 audit(1735258323.724:68): avc:  denied  { open } for  pid=313 comm="syz-executor316" path="/dev/fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1
[   42.991479][   T30] audit: type=1400 audit(1735258323.724:69): avc:  denied  { mounton } for  pid=313 comm="syz-executor316" path="/root/file0" dev="sda1" ino=1927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[   43.002026][  T316] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
[   43.014185][   T30] audit: type=1400 audit(1735258323.724:70): avc:  denied  { mount } for  pid=313 comm="syz-executor316" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1
[   43.025415][  T316] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[   43.025430][  T316] CPU: 0 PID: 316 Comm: syz-executor316 Not tainted 5.15.173-syzkaller-00161-gb4bd207b0380 #0
[   43.025451][  T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
[   43.025462][  T316] RIP: 0010:do_rmdir+0x33f/0x630
[   43.080357][  T316] Code: ff 4c 89 64 24 50 72 0d e8 be 12 b2 ff 45 89 fc e9 99 00 00 00 49 8d 5f 30 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 c3 6a f4 ff 48 83 3b 00 74 5d e8 88
[   43.099887][  T316] RSP: 0018:ffffc90000997dc0 EFLAGS: 00010207
[   43.105784][  T316] RAX: 0000000000000006 RBX: 0000000000000036 RCX: dffffc0000000000
[   43.113612][  T316] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000
[   43.121429][  T316] RBP: ffffc90000997ef8 R08: ffffffff81c0e588 R09: ffffed10241ca694
[   43.129216][  T316] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888120e53470
[   43.137029][  T316] R13: ffffc90000997e40 R14: 1ffff110241ca68e R15: 0000000000000006
[   43.144838][  T316] FS:  00007f4b30f2b6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[   43.153606][  T316] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.160038][  T316] CR2: 00007f4b30f2bd58 CR3: 000000010cc25000 CR4: 00000000003506b0
[   43.167841][  T316] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   43.175650][  T316] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   43.183462][  T316] Call Trace:
[   43.186595][  T316]  <TASK>
[   43.189366][  T316]  ? __die_body+0x62/0xb0
[   43.193529][  T316]  ? die_addr+0x9f/0xd0
[   43.197523][  T316]  ? exc_general_protection+0x311/0x4b0
[   43.202910][  T316]  ? __kasan_check_write+0x14/0x20
[   43.207856][  T316]  ? asm_exc_general_protection+0x27/0x30
[   43.213412][  T316]  ? fast_dput+0x78/0x2a0
[   43.217576][  T316]  ? do_rmdir+0x33f/0x630
[   43.221741][  T316]  ? d_delete_notify+0x160/0x160
[   43.226519][  T316]  ? strncpy_from_user+0x18e/0x2d0
[   43.231466][  T316]  ? getname_flags+0x1fd/0x520
[   43.236063][  T316]  __x64_sys_rmdir+0x49/0x50
[   43.240494][  T316]  x64_sys_call+0x274/0x9a0
[   43.244830][  T316]  do_syscall_64+0x3b/0xb0
[   43.249076][  T316]  ? clear_bhb_loop+0x35/0x90
[   43.253592][  T316]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[   43.259517][  T316] RIP: 0033:0x7f4b30f8ef69
[   43.263786][  T316] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[   43.283210][  T316] RSP: 002b:00007f4b30f2b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[   43.291569][  T316] RAX: ffffffffffffffda RBX: 00007f4b310183f8 RCX: 00007f4b30f8ef69
[   43.299379][  T316] RDX: 00007f4b30f69886 RSI: 4bd5f9eb68057d60 RDI: 0000000020000200
[   43.307191][  T316] RBP: 00007f4b310183f0 R08: 00007ffcb64be847 R09: 00007f4b310183f8
[   43.315087][  T316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4b310183fc
[pid   314] futex(0x7f4b310183e8, FUTEX_WAIT_PRIVATE, 0, NULL <unfinished ...>
[pid   313] <... futex resumed>)        = -1 ETIMEDOUT (Connection timed out)
[   43.322898][  T316] R13: 000000000000006e R14: 00007ffcb64be760 R15: 00007ffcb64be848
[   43.330715][  T316]  </TASK>
[   43.333576][  T316] Modules linked in:
[   43.338203][  T316] ---[ end trace 8cb192bafbe5dcfd ]---
[   43.343699][  T316] RIP: 0010:do_rmdir+0x33f/0x630
[   43.348643][  T316] Code: ff 4c 89 64 24 50 72 0d e8 be 12 b2 ff 45 89 fc e9 99 00 00 00 49 8d 5f 30 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 c3 6a f4 ff 48 83 3b 00 74 5d e8 88
[   43.368237][  T316] RSP: 0018:ffffc90000997dc0 EFLAGS: 00010207
[   43.374163][  T316] RAX: 0000000000000006 RBX: 0000000000000036 RCX: dffffc0000000000
[   43.382024][  T316] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000
[   43.389949][  T316] RBP: ffffc90000997ef8 R08: ffffffff81c0e588 R09: ffffed10241ca694
[   43.397858][  T316] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888120e53470
[   43.405856][  T316] R13: ffffc90000997e40 R14: 1ffff110241ca68e R15: 0000000000000006
[   43.413716][  T316] FS:  00007f4b30f2b6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
[   43.422528][  T316] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   43.429004][  T316] CR2: 00007f387c2cfae0 CR3: 000000010cc25000 CR4: 00000000003506a0
[   43.436836][  T316] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   43.444625][  T316] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   43.452431][  T316] Kernel panic - not syncing: Fatal exception
[   43.458400][  T316] Kernel Offset: disabled
[   43.462489][  T316] Rebooting in 86400 seconds..