ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor2288946615 <...> syzkaller syzkaller login: [ 15.600952][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 15.600964][ T24] audit: type=1400 audit(1785587628.410:59): avc: denied { transition } for pid=217 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.612913][ T24] audit: type=1400 audit(1785587628.410:60): avc: denied { noatsecure } for pid=217 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.621722][ T24] audit: type=1400 audit(1785587628.410:61): avc: denied { write } for pid=217 comm="sh" path="pipe:[1340]" dev="pipefs" ino=1340 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.643901][ T24] audit: type=1400 audit(1785587628.420:62): avc: denied { rlimitinh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.663261][ T24] audit: type=1400 audit(1785587628.420:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.217' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor2288946615", ["ci2-android-5-10/syz-executor2288946615"], 0x7ffcbc28b0f0 /* 10 vars */) = 0 brk(NULL) = 0x55558fa9a000 brk(0x55558fa9ad40) = 0x55558fa9ad40 arch_prctl(ARCH_SET_FS, 0x55558fa9a3c0) = 0 set_tid_address(0x55558fa9a690) = 297 set_robust_list(0x55558fa9a6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor2288946615", 4096) = 45 getrandom("\x09\x73\xcc\x6a\xd5\xe6\xbf\x14", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558fa9ad40 brk(0x55558fabbd40) = 0x55558fabbd40 brk(0x55558fabc000) = 0x55558fabc000 mprotect(0x7f6cf49c3000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558fa9a690) = 298 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-10/strace-static-x86_64: Process 298 attached [pid 298] set_robust_list(0x55558fa9a6a0, 24) = 0 [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 298] setpgid(0, 0) = 0 [pid 298] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 298] write(3, "1000", 4) = 4 [pid 298] close(3) = 0 [pid 298] write(1, "executing program\n", 18) = 18 executing program [pid 298] mkdir("./my_config", 0777) = 0 [pid 298] mount(NULL, "./my_config", "configfs", 0, NULL) = 0 [pid 298] mkdir("./my_config/usb_gadget/g1", 0777) = 0 [pid 298] openat(AT_FDCWD, "./my_config/usb_gadget/g1/UDC", O_WRONLY) = 3 [ 25.148658][ T24] audit: type=1400 audit(1785587637.950:64): avc: denied { execmem } for pid=297 comm="syz-executor228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.171067][ T24] audit: type=1400 audit(1785587637.980:65): avc: denied { mounton } for pid=298 comm="syz-executor228" path="/root/my_config" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 298] write(3, "dummy_udc.0\n", 12) = -1 EINVAL (Invalid argument) [pid 298] mkdirat(AT_FDCWD, "./sys", 0777) = 0 [pid 298] mount(NULL, "./sys", "sysfs", 0, NULL) = 0 [pid 298] openat(AT_FDCWD, "./sys/bus/platform/drivers/dummy_hcd/unbind", O_WRONLY) = 4 [ 25.195665][ T298] Need at least one configuration in g1. [ 25.198515][ T24] audit: type=1400 audit(1785587637.980:66): avc: denied { mount } for pid=298 comm="syz-executor228" name="/" dev="configfs" ino=1124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 25.202185][ T298] udc dummy_udc.0: failed to start g1: -22 [ 25.231808][ T24] audit: type=1400 audit(1785587638.000:67): avc: denied { search } for pid=298 comm="syz-executor228" name="/" dev="configfs" ino=1124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 25.246739][ T298] dummy_hcd dummy_hcd.0: remove, state 4 [ 25.255199][ T24] audit: type=1400 audit(1785587638.000:68): avc: denied { write } for pid=298 comm="syz-executor228" name="usb_gadget" dev="configfs" ino=1125 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 25.259973][ T298] usb usb1: USB disconnect, device number 1 [pid 298] write(4, "\x64\x75\x6d\x6d\x79\x5f\x68\x63\x64\x2e\x30\x00", 12) = 12 [pid 298] exit_group(0) = ? [ 25.283541][ T24] audit: type=1400 audit(1785587638.000:69): avc: denied { add_name } for pid=298 comm="syz-executor228" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 25.304722][ T298] dummy_hcd dummy_hcd.0: stopped [ 25.310092][ T24] audit: type=1400 audit(1785587638.000:70): avc: denied { create } for pid=298 comm="syz-executor228" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 25.314838][ T298] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [pid 298] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=298, si_uid=0, si_status=0, si_utime=0, si_stime=10 /* 0.10 s */} --- restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558fa9a690) = 300 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-10/strace-static-x86_64: Process 300 attached [pid 300] set_robust_list(0x55558fa9a6a0, 24) = 0 [pid 300] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] write(3, "1000", 4) = 4 [pid 300] close(3) = 0 executing program [pid 300] write(1, "executing program\n", 18) = 18 [pid 300] mkdir("./my_config", 0777) = -1 EEXIST (File exists) [pid 300] mount(NULL, "./my_config", "configfs", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 300] mkdir("./my_config/usb_gadget/g1", 0777) = -1 EEXIST (File exists) [pid 300] openat(AT_FDCWD, "./my_config/usb_gadget/g1/UDC", O_WRONLY) = 3 [ 25.334618][ T24] audit: type=1400 audit(1785587638.000:71): avc: denied { write } for pid=298 comm="syz-executor228" name="UDC" dev="configfs" ino=1537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 25.363223][ T24] audit: type=1400 audit(1785587638.000:72): avc: denied { open } for pid=298 comm="syz-executor228" path="/root/my_config/usb_gadget/g1/UDC" dev="configfs" ino=1537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 25.388864][ T24] audit: type=1400 audit(1785587638.040:73): avc: denied { mount } for pid=298 comm="syz-executor228" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 25.392108][ T300] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 25.422642][ T300] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 25.431048][ T300] CPU: 0 PID: 300 Comm: syz-executor228 Not tainted syzkaller #0 [ 25.438750][ T300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.448826][ T300] RIP: 0010:dummy_set_selfpowered+0xbc/0x150 [ 25.454798][ T300] Code: 94 c0 4d 8d b4 c6 f0 04 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 0e 64 92 fe 4d 8b 3e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 f5 63 92 fe 41 be 78 11 00 00 4d [ 25.474397][ T300] RSP: 0018:ffffc90000bd79f0 EFLAGS: 00010246 [ 25.480471][ T300] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 25.488450][ T300] RDX: ffff88810ab493c0 RSI: 0000000000000003 RDI: 0000000000000005 [ 25.496414][ T300] RBP: ffffc90000bd7a10 R08: ffff888100059e6f R09: 1ffff1102000b3cd [ 25.504381][ T300] R10: dffffc0000000000 R11: ffffed102000b3ce R12: dffffc0000000000 [ 25.512347][ T300] R13: ffff88810aab7478 R14: ffff88810b81d180 R15: 0000000000000000 [ 25.520319][ T300] FS: 000055558fa9a3c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 25.529237][ T300] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.535901][ T300] CR2: 0000200000001000 CR3: 000000010ac6e000 CR4: 00000000003506b0 [ 25.543867][ T300] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.551833][ T300] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.559927][ T300] Call Trace: [ 25.563251][ T300] ? dummy_wakeup+0x270/0x270 [ 25.567926][ T300] usb_gadget_set_selfpowered+0x6c/0x180 [ 25.573571][ T300] composite_dev_prepare+0x2e7/0x310 [ 25.578868][ T300] configfs_composite_bind+0xb4/0x13a0 [ 25.584330][ T300] ? __kasan_check_write+0x14/0x20 [ 25.589436][ T300] ? os_desc_qw_sign_store+0x140/0x140 [ 25.594892][ T300] udc_bind_to_driver+0x24e/0x6d0 [ 25.599910][ T300] ? mutex_lock+0x92/0xf0 [ 25.604247][ T300] usb_gadget_probe_driver+0x1fc/0x380 [ 25.609703][ T300] gadget_dev_desc_UDC_store+0x217/0x330 [ 25.615329][ T300] ? gadget_dev_desc_UDC_show+0x80/0x80 [ 25.620880][ T300] configfs_write_file+0x320/0x3d0 [ 25.626039][ T300] ? configfs_read_file+0x400/0x400 [ 25.631246][ T300] vfs_write+0x344/0xd70 [ 25.635498][ T300] ? kernel_write+0x3c0/0x3c0 [ 25.640172][ T300] ? cgroup_leave_frozen+0x165/0x2a0 [ 25.645458][ T300] ? ptrace_stop+0x687/0x9c0 [ 25.650047][ T300] ? __kasan_check_read+0x11/0x20 [ 25.655066][ T300] ? __fdget_pos+0x2d9/0x380 [ 25.659674][ T300] ksys_write+0x14a/0x260 [ 25.664028][ T300] ? __ia32_sys_read+0x90/0x90 [ 25.668782][ T300] ? asm_sysvec_apic_timer_interrupt+0xa/0x20 [ 25.674844][ T300] ? debug_smp_processor_id+0x17/0x20 [ 25.680205][ T300] __x64_sys_write+0x7b/0x90 [ 25.684786][ T300] do_syscall_64+0x31/0x40 [ 25.689211][ T300] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.695098][ T300] RIP: 0033:0x7f6cf4930689 [ 25.699507][ T300] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.719109][ T300] RSP: 002b:00007ffc5c91bb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 25.727523][ T300] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f6cf4930689 [ 25.735494][ T300] RDX: 000000000000000c RSI: 0000200000001100 RDI: 0000000000000003 [ 25.743460][ T300] RBP: 0000000000006231 R08: 0000000000000006 R09: 0000000000000006 [ 25.751538][ T300] R10: 0000000000000006 R11: 0000000000000246 R12: 00007ffc5c91bb3c [ 25.759534][ T300] R13: 0000200000000004 R14: 00007f6cf49c3c40 R15: 0000000000000002 [ 25.767512][ T300] Modules linked in: [ 25.771720][ T300] ---[ end trace b83287a43bae14c1 ]--- [ 25.777272][ T300] RIP: 0010:dummy_set_selfpowered+0xbc/0x150 [ 25.783339][ T300] Code: 94 c0 4d 8d b4 c6 f0 04 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 0e 64 92 fe 4d 8b 3e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 f5 63 92 fe 41 be 78 11 00 00 4d [ 25.802997][ T300] RSP: 0018:ffffc90000bd79f0 EFLAGS: 00010246 [ 25.809087][ T300] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [ 25.817190][ T300] RDX: ffff88810ab493c0 RSI: 0000000000000003 RDI: 0000000000000005 [ 25.825192][ T300] RBP: ffffc90000bd7a10 R08: ffff888100059e6f R09: 1ffff1102000b3cd [ 25.833311][ T300] R10: dffffc0000000000 R11: ffffed102000b3ce R12: dffffc0000000000 [ 25.841307][ T300] R13: ffff88810aab7478 R14: ffff88810b81d180 R15: 0000000000000000 [ 25.849275][ T300] FS: 000055558fa9a3c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 25.858265][ T300] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.864884][ T300] CR2: 0000200000001000 CR3: 000000010ac6e000 CR4: 00000000003506b0 [ 25.872904][ T300] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.880916][ T300] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.888897][ T300] Kernel panic - not syncing: Fatal exception [ 25.895167][ T300] Kernel Offset: disabled [ 25.899497][ T300] Rebooting in 86400 seconds..