./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor848784059 <...> [ 4.117046][ T24] audit: type=1400 audit(1741241090.520:9): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 4.123209][ T24] audit: type=1400 audit(1741241090.520:10): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 4.394295][ T94] udevd[94]: starting version 3.2.11 [ 4.528102][ T95] udevd[95]: starting eudev-3.2.11 [ 11.949725][ T24] kauditd_printk_skb: 50 callbacks suppressed [ 11.949737][ T24] audit: type=1400 audit(1741241098.380:61): avc: denied { transition } for pid=216 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.959960][ T24] audit: type=1400 audit(1741241098.380:62): avc: denied { noatsecure } for pid=216 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.966720][ T24] audit: type=1400 audit(1741241098.380:63): avc: denied { write } for pid=216 comm="sh" path="pipe:[14351]" dev="pipefs" ino=14351 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 11.973807][ T24] audit: type=1400 audit(1741241098.380:64): avc: denied { rlimitinh } for pid=216 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.981011][ T24] audit: type=1400 audit(1741241098.380:65): avc: denied { siginh } for pid=216 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.156' (ED25519) to the list of known hosts. execve("./syz-executor848784059", ["./syz-executor848784059"], 0x7ffca08c0ef0 /* 10 vars */) = 0 brk(NULL) = 0x55556ec46000 brk(0x55556ec46d00) = 0x55556ec46d00 arch_prctl(ARCH_SET_FS, 0x55556ec46380) = 0 set_tid_address(0x55556ec46650) = 287 set_robust_list(0x55556ec46660, 24) = 0 rseq(0x55556ec46ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor848784059", 4096) = 27 getrandom("\x4e\x40\x61\xc8\x18\xa9\xd3\x78", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ec46d00 brk(0x55556ec67d00) = 0x55556ec67d00 brk(0x55556ec68000) = 0x55556ec68000 mprotect(0x7f8574d57000, 16384, PROT_READ) = 0 mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000 mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000 mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556ec46650) = 288 ./strace-static-x86_64: Process 288 attached [pid 288] set_robust_list(0x55556ec46660, 24) = 0 [pid 288] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 287] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 288] <... clone resumed>, child_tidptr=0x55556ec46650) = 289 ./strace-static-x86_64: Process 289 attached [pid 289] set_robust_list(0x55556ec46660, 24) = 0 [pid 289] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 289] setpgid(0, 0) = 0 [pid 289] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 289] write(3, "1000", 4) = 4 [pid 289] close(3) = 0 [pid 289] write(1, "executing program\n", 18executing program ) = 18 [pid 289] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x4000000002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148./strace-static-x86_64: Process 290 attached [pid 287] <... clone resumed>, child_tidptr=0x55556ec46650) = 290 [pid 287] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 290] set_robust_list(0x55556ec46660, 24./strace-static-x86_64: Process 291 attached ) = 0 [pid 289] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 287] <... clone resumed>, child_tidptr=0x55556ec46650) = 291 [pid 287] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556ec46650) = 292 ./strace-static-x86_64: Process 292 attached [pid 287] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 292] set_robust_list(0x55556ec46660, 24 [pid 287] <... clone resumed>, child_tidptr=0x55556ec46650) = 293 [pid 290] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 293 attached [pid 292] <... set_robust_list resumed>) = 0 [pid 290] <... clone resumed>, child_tidptr=0x55556ec46650) = 294 [pid 291] set_robust_list(0x55556ec46660, 24./strace-static-x86_64: Process 294 attached [pid 293] set_robust_list(0x55556ec46660, 24 [pid 292] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 291] <... set_robust_list resumed>) = 0 [pid 289] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x400000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=0x35 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 291] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 292] <... clone resumed>, child_tidptr=0x55556ec46650) = 295 [pid 293] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 295 attached [pid 294] set_robust_list(0x55556ec46660, 24 [pid 293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDexecuting program [pid 291] <... clone resumed>, child_tidptr=0x55556ec46650) = 297 ./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x55556ec46660, 24) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] setpgid(0, 0) = 0 [pid 297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 297] write(3, "1000", 4) = 4 [pid 297] close(3) = 0 [pid 297] write(1, "executing program\n", 18) = 18 [pid 297] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x4000000002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148) = -1 EFAULT (Bad address) [pid 297] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x400000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=0x35 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 294] <... set_robust_list resumed>) = 0 [pid 293] <... clone resumed>, child_tidptr=0x55556ec46650) = 296 [pid 294] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] set_robust_list(0x55556ec46660, 24./strace-static-x86_64: Process 296 attached ) = 0 [pid 294] <... prctl resumed>) = 0 [pid 296] set_robust_list(0x55556ec46660, 24 [pid 295] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... set_robust_list resumed>) = 0 [pid 294] setpgid(0, 0 [pid 296] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 294] <... setpgid resumed>) = 0 [pid 295] <... prctl resumed>) = 0 [ 21.414807][ T24] audit: type=1400 audit(1741241107.840:66): avc: denied { execmem } for pid=287 comm="syz-executor848" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.423971][ T24] audit: type=1400 audit(1741241107.850:67): avc: denied { prog_load } for pid=289 comm="syz-executor848" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 21.433174][ T24] audit: type=1400 audit(1741241107.860:68): avc: denied { bpf } for pid=289 comm="syz-executor848" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 294] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... prctl resumed>) = 0 [pid 295] setpgid(0, 0 [pid 296] setpgid(0, 0 [pid 295] <... setpgid resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 296] <... setpgid resumed>) = 0 [pid 295] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... openat resumed>) = 3 [pid 294] write(3, "1000", 4 [pid 296] <... openat resumed>) = 3 [pid 295] write(3, "1000", 4 [pid 294] <... write resumed>) = 4 [pid 294] close(3 [pid 296] write(3, "1000", 4 [pid 295] <... write resumed>) = 4 [pid 294] <... close resumed>) = 0 [pid 296] <... write resumed>) = 4 [pid 295] close(3 [pid 296] close(3 [pid 295] <... close resumed>) = 0 [pid 294] write(1, "executing program\n", 18 [pid 296] <... close resumed>) = 0 [pid 295] write(1, "executing program\n", 18executing program executing program [pid 294] <... write resumed>) = 18 [pid 296] write(1, "executing program\n", 18 [pid 295] <... write resumed>) = 18 [pid 294] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x4000000002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148executing program [pid 296] <... write resumed>) = 18 [pid 295] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x4000000002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 294] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 296] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=20, insns=0x4000000002c0, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 295] <... bpf resumed>) = -1 EFAULT (Bad address) [pid 294] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x400000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=0x35 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 295] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x400000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=0x35 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 296] <... bpf resumed>) = -1 EFAULT (Bad address) [ 21.451498][ T24] audit: type=1400 audit(1741241107.860:69): avc: denied { perfmon } for pid=289 comm="syz-executor848" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [pid 296] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_RAW_TRACEPOINT, insn_cnt=12, insns=0x400000000300, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=0x35 /* BPF_??? */, prog_btf_fd=-1, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL}, 148 [pid 297] <... bpf resumed>) = 3 [pid 294] <... bpf resumed>) = 3 [pid 297] bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name="kfree", prog_fd=3}}, 16 [pid 295] <... bpf resumed>) = 3 [pid 296] <... bpf resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... bpf resumed>) = 4 [pid 296] --- SIGILL {si_signo=SIGILL, si_code=SI_KERNEL, si_addr=NULL} --- executing program executing program executing program executing program executing program executing program executing program [ 21.606177][ T24] audit: type=1400 audit(1741241108.030:70): avc: denied { prog_run } for pid=294 comm="syz-executor848" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 23.214926][ T1] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004 [ 23.223269][ T1] CPU: 0 PID: 1 Comm: init Not tainted 5.10.234-syzkaller-00023-g3f5f2283d684 #0 [ 23.232341][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 23.242780][ T1] Call Trace: [ 23.246337][ T1] dump_stack_lvl+0x1e2/0x24b [ 23.251033][ T1] ? panic+0x22b/0x812 [ 23.255051][ T1] ? bfq_pos_tree_add_move+0x43b/0x43b [ 23.260332][ T1] dump_stack+0x15/0x17 [ 23.264316][ T1] panic+0x2cf/0x812 [ 23.268053][ T1] ? do_exit+0x239a/0x2a50 [ 23.272287][ T1] ? fb_is_primary_device+0xd4/0xd4 [ 23.277332][ T1] ? __kasan_check_write+0x14/0x20 [ 23.282286][ T1] ? sync_mm_rss+0x28a/0x2e0 [ 23.286800][ T1] do_exit+0x23b4/0x2a50 [ 23.290973][ T1] ? sched_group_set_shares+0x490/0x490 [ 23.296539][ T1] ? put_task_struct+0x80/0x80 [ 23.301104][ T1] ? schedule+0x154/0x1d0 [ 23.305425][ T1] ? schedule_timeout+0xa9/0x360 [ 23.310188][ T1] ? __kasan_check_write+0x14/0x20 [ 23.315141][ T1] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 23.320089][ T1] do_group_exit+0x141/0x310 [ 23.324549][ T1] get_signal+0x10a0/0x1410 [ 23.328839][ T1] arch_do_signal_or_restart+0xbd/0x17c0 [ 23.334421][ T1] ? put_pid+0xd7/0x110 [ 23.338427][ T1] ? kernel_clone+0x6ca/0x9e0 [ 23.342950][ T1] ? create_io_thread+0x1e0/0x1e0 [ 23.347786][ T1] ? get_timespec64+0x197/0x270 [ 23.352490][ T1] ? timespec64_add_safe+0x220/0x220 [ 23.357606][ T1] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 23.362985][ T1] ? __do_sys_vfork+0xcd/0x130 [ 23.367720][ T1] exit_to_user_mode_loop+0x9b/0xd0 [ 23.373097][ T1] syscall_exit_to_user_mode+0xa2/0x1a0 [ 23.378457][ T1] do_syscall_64+0x40/0x70 [ 23.382856][ T1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.389250][ T1] RIP: 0033:0x7f28497d2a68 [ 23.393588][ T1] Code: 00 48 8d b8 e0 02 00 00 48 89 b8 d8 02 00 00 48 89 b8 e0 02 00 00 b8 11 01 00 00 0f 05 44 89 c0 c3 90 5f b8 3a 00 00 00 0f 05 <57> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 90 43 0f 00 f7 d8 64 89 01 48 [ 23.413413][ T1] RSP: 002b:00007ffdb0a28610 EFLAGS: 00000246 ORIG_RAX: 000000000000003a [ 23.421660][ T1] RAX: 00000000000001c4 RBX: 00005617c1661ab0 RCX: 00007f28497d2a68 [ 23.429471][ T1] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 00007f284995dbed [ 23.437280][ T1] RBP: 00007f2849998528 R08: 0000000000000007 R09: 122aabaf8b2f5a46 [ 23.445090][ T1] R10: 00007ffdb0a28650 R11: 0000000000000246 R12: 0000000000000000 [ 23.452899][ T1] R13: 0000000000000018 R14: 00005617acd32169 R15: 00007f28499c9a80 [ 23.461187][ T1] Kernel Offset: disabled [ 23.465346][ T1] Rebooting in 86400 seconds..