ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor4005518027 <...> Warning: Permanently added '10.128.0.54' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor4005518027", ["ci2-android-5-10/syz-executor4005518027"], 0x7ffe7d5eed60 /* 10 vars */) = 0 brk(NULL) = 0x55557a52c000 brk(0x55557a52cd40) = 0x55557a52cd40 arch_prctl(ARCH_SET_FS, 0x55557a52c3c0) = 0 set_tid_address(0x55557a52c690) = 297 set_robust_list(0x55557a52c6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor4005518027", 4096) = 45 getrandom("\x02\x75\xef\xfe\x7c\x0b\xdb\x52", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557a52cd40 brk(0x55557a54dd40) = 0x55557a54dd40 brk(0x55557a54e000) = 0x55557a54e000 mprotect(0x7fedeaf22000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fede2a74000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 8388608) = 8388608 munmap(0x7fede2a74000, 138412032) = 0 lseek(3, 0, SEEK_END) = 8388608 ftruncate(3, 25165824) = 0 [ 25.168437][ T24] audit: type=1400 audit(1794561411.990:64): avc: denied { execmem } for pid=297 comm="syz-executor400" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 25.221142][ T24] audit: type=1400 audit(1794561412.040:65): avc: denied { read write } for pid=297 comm="syz-executor400" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.245439][ T24] audit: type=1400 audit(1794561412.040:66): avc: denied { open } for pid=297 comm="syz-executor400" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 close(4) = 0 mkdir("./sys", 0777) = 0 [ 25.269568][ T24] audit: type=1400 audit(1794561412.050:67): avc: denied { ioctl } for pid=297 comm="syz-executor400" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.312723][ T24] audit: type=1400 audit(1794561412.140:68): avc: denied { mounton } for pid=297 comm="syz-executor400" path="/root/sys" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 mount("/dev/loop0", "./sys", "ext4", MS_NOSUID|MS_SYNCHRONOUS|MS_DIRSYNC, "dioread_nolock,auto_da_alloc=0x00000000000000b7,nojournal_checksum,i_version,,errors=continue") = 0 openat(AT_FDCWD, "./sys", O_RDONLY|O_DIRECTORY) = 3 chdir("./sys") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 25.374721][ T297] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 25.386831][ T297] EXT4-fs (loop0): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 [ 25.400052][ T297] EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: dioread_nolock,auto_da_alloc=0x00000000000000b7,nojournal_checksum,i_version,,errors=continue [ 25.416737][ T24] audit: type=1400 audit(1794561412.240:69): avc: denied { mount } for pid=297 comm="syz-executor400" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 25.438764][ T24] audit: type=1400 audit(1794561412.240:70): avc: denied { write } for pid=297 comm="syz-executor400" name="file1" dev="loop0" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 25.440371][ T297] general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN [ 25.461306][ T24] audit: type=1400 audit(1794561412.240:71): avc: denied { open } for pid=297 comm="syz-executor400" name="file1" dev="loop0" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 25.472829][ T297] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 25.472841][ T297] CPU: 1 PID: 297 Comm: syz-executor400 Not tainted syzkaller #0 [ 25.472865][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 25.508105][ T24] audit: type=1400 audit(1794561412.330:72): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 25.511406][ T297] RIP: 0010:jbd2_journal_file_inode+0x143/0x580 [ 25.521551][ T24] audit: type=1400 audit(1794561412.330:73): avc: denied { search } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.543021][ T297] Code: 03 48 89 45 c0 48 8d b8 08 04 00 00 48 89 7d b8 e8 02 17 a0 02 49 8d 7e 28 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 05 e8 32 4d bc ff 4d 09 66 28 4d 8d 66 38 4d 89 e7 [ 25.543029][ T297] RSP: 0018:ffffc90000af7778 EFLAGS: 00010206 [ 25.543041][ T297] RAX: 0000000000000005 RBX: ffff88810936ac80 RCX: dffffc0000000000 [ 25.543048][ T297] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000028 [ 25.543055][ T297] RBP: ffffc90000af77c0 R08: 0000000000000003 R09: 0000000000000004 [ 25.543061][ T297] R10: dffffc0000000000 R11: fffff5200015eee0 R12: 0000000000000006 [ 25.543067][ T297] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff1102126d590 [ 25.543111][ T297] FS: 000055557a52c3c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.644914][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.651506][ T297] CR2: 00007f5850a45000 CR3: 000000011f6de000 CR4: 00000000003506a0 [ 25.659482][ T297] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.667462][ T297] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.675447][ T297] Call Trace: [ 25.678769][ T297] jbd2_journal_inode_ranged_write+0x34/0x40 [ 25.684779][ T297] ext4_map_blocks+0x11a6/0x1b10 [ 25.689727][ T297] ? ext4_issue_zeroout+0x1a0/0x1a0 [ 25.694951][ T297] ? memcpy+0x56/0x70 [ 25.698942][ T297] ext4_convert_inline_data_nolock+0x435/0xcc0 [ 25.705108][ T297] ? ext4_add_dirent_to_inline+0x460/0x460 [ 25.710917][ T297] ? down_write+0xb2/0x120 [ 25.715346][ T297] ext4_convert_inline_data+0x470/0x5b0 [ 25.720897][ T297] ? ext4_inline_data_truncate+0xb40/0xb40 [ 25.726717][ T297] ? selinux_inode_setattr+0x5f7/0x810 [ 25.732190][ T297] ext4_setattr+0xdf4/0x1980 [ 25.736787][ T297] ? ext4_write_inode+0x5a0/0x5a0 [ 25.741815][ T297] notify_change+0xab5/0xe40 [ 25.746406][ T297] do_truncate+0x1a3/0x240 [ 25.750824][ T297] ? __kasan_check_write+0x14/0x20 [ 25.755938][ T297] ? page_reporting_drain+0x1c0/0x1c0 [ 25.761314][ T297] ? locks_verify_truncate+0xb3/0x170 [ 25.766686][ T297] ? vfs_truncate+0x1ce/0x2d0 [ 25.771366][ T297] vfs_truncate+0x235/0x2d0 [ 25.775871][ T297] do_sys_truncate+0xf2/0x1c0 [ 25.780552][ T297] ? fpu__clear_all+0x20/0x20 [ 25.785230][ T297] ? locks_verify_truncate+0x170/0x170 [ 25.790697][ T297] __x64_sys_truncate+0x5b/0x70 [ 25.795568][ T297] do_syscall_64+0x31/0x40 [ 25.799986][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.805894][ T297] RIP: 0033:0x7fedeae975a9 [ 25.810327][ T297] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.829930][ T297] RSP: 002b:00007ffe8d4db588 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 25.838353][ T297] RAX: ffffffffffffffda RBX: 00007ffe8d4db6c8 RCX: 00007fedeae975a9 [ 25.846332][ T297] RDX: 00007ffe8d4db410 RSI: 0000000000003c4c RDI: 0000200000000800 [ 25.854304][ T297] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 25.862274][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe8d4db6b8 [ 25.870244][ T297] R13: 0000000000000002 R14: 00007fedeaf22c80 R15: 0000000000000002 [ 25.878211][ T297] Modules linked in: [ 25.882232][ T297] ---[ end trace aae39205f9529b2b ]--- [ 25.887725][ T297] RIP: 0010:jbd2_journal_file_inode+0x143/0x580 [ 25.894276][ T297] Code: 03 48 89 45 c0 48 8d b8 08 04 00 00 48 89 7d b8 e8 02 17 a0 02 49 8d 7e 28 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 05 e8 32 4d bc ff 4d 09 66 28 4d 8d 66 38 4d 89 e7 [ 25.913948][ T297] RSP: 0018:ffffc90000af7778 EFLAGS: 00010206 [ 25.920055][ T297] RAX: 0000000000000005 RBX: ffff88810936ac80 RCX: dffffc0000000000 [ 25.928059][ T297] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000028 [ 25.936056][ T297] RBP: ffffc90000af77c0 R08: 0000000000000003 R09: 0000000000000004 [ 25.944090][ T297] R10: dffffc0000000000 R11: fffff5200015eee0 R12: 0000000000000006 [ 25.952089][ T297] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff1102126d590 [ 25.960056][ T297] FS: 000055557a52c3c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.969242][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.975907][ T297] CR2: 00007f5850a45000 CR3: 000000011f6de000 CR4: 00000000003506a0 [ 25.983895][ T297] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.991904][ T297] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.999908][ T297] Kernel panic - not syncing: Fatal exception [ 26.006242][ T297] Kernel Offset: disabled [ 26.010569][ T297] Rebooting in 86400 seconds..