ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor4172118800 <...> Warning: Permanently added '10.128.1.77' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor4172118800", ["ci2-android-5-15/syz-executor4172118800"], 0x7fff2d7efc70 /* 10 vars */) = 0 brk(NULL) = 0x55555714e000 brk(0x55555714ed40) = 0x55555714ed40 arch_prctl(ARCH_SET_FS, 0x55555714e3c0) = 0 set_tid_address(0x55555714e690) = 303 set_robust_list(0x55555714e6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor4172118800", 4096) = 45 getrandom("\x23\x7c\xf6\x37\x7e\xa2\x36\xfb", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555714ed40 brk(0x55555716fd40) = 0x55555716fd40 brk(0x555557170000) = 0x555557170000 mprotect(0x7fc2287a6000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 executing program openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 3 ioctl(3, TUNSETIFF, 0x200000000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 4 socket(AF_UNIX, SOCK_STREAM, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=56, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|0x6540, nlmsg_seq=7388458, nlmsg_pid=-1}, "\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x02\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x03\x00"], iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 20.650093][ T30] audit: type=1400 audit(1791262835.417:64): avc: denied { execmem } for pid=303 comm="syz-executor417" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.668548][ T303] ================================================================== [ 20.670974][ T30] audit: type=1400 audit(1791262835.417:65): avc: denied { module_request } for pid=301 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.677612][ T303] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 20.708800][ T303] Read of size 8 at addr ffff88810ad2fec0 by task syz-executor417/303 [ 20.716932][ T303] [ 20.719257][ T303] CPU: 0 PID: 303 Comm: syz-executor417 Not tainted syzkaller #0 [ 20.719699][ T30] audit: type=1400 audit(1791262835.477:66): avc: denied { read } for pid=140 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 20.726961][ T303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 20.757721][ T303] Call Trace: [ 20.760986][ T303] [ 20.763895][ T303] __dump_stack+0x21/0x30 [ 20.768202][ T303] dump_stack_lvl+0x110/0x170 [ 20.772871][ T303] ? show_regs_print_info+0x20/0x20 [ 20.778046][ T303] ? load_image+0x3f0/0x3f0 [ 20.782523][ T303] print_address_description+0x7f/0x2c0 [ 20.788049][ T303] ? tc_setup_flow_action+0x88e/0x3200 [ 20.793501][ T303] kasan_report+0x10f/0x150 [ 20.797982][ T303] ? tc_setup_flow_action+0x88e/0x3200 [ 20.803437][ T303] __asan_report_load8_noabort+0x14/0x20 [ 20.809071][ T303] tc_setup_flow_action+0x88e/0x3200 [ 20.814361][ T303] mall_replace_hw_filter+0x2db/0x8d0 [ 20.819718][ T303] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 20.825778][ T303] ? mall_set_parms+0x520/0x520 [ 20.830626][ T303] ? tcf_exts_destroy+0xb0/0xb0 [ 20.835559][ T303] ? pcpu_alloc+0x1118/0x16f0 [ 20.840216][ T303] ? mall_set_parms+0x1e4/0x520 [ 20.845059][ T303] mall_change+0x544/0x760 [ 20.849450][ T303] ? __kasan_check_write+0x14/0x20 [ 20.854539][ T303] ? mall_get+0xa0/0xa0 [ 20.858669][ T303] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 20.864541][ T303] ? mall_get+0xa0/0xa0 [ 20.868677][ T303] tc_new_tfilter+0x13df/0x1990 [ 20.873504][ T303] ? tcf_gate_entry_destructor+0x20/0x20 [ 20.879127][ T303] ? security_capable+0x87/0xb0 [ 20.883973][ T303] ? ns_capable+0x8c/0xf0 [ 20.888279][ T303] ? netlink_net_capable+0x125/0x160 [ 20.893539][ T303] ? tcf_gate_entry_destructor+0x20/0x20 [ 20.899159][ T303] rtnetlink_rcv_msg+0x83c/0xcb0 [ 20.904075][ T303] ? rtnetlink_bind+0x80/0x80 [ 20.908726][ T303] ? avc_has_perm_noaudit+0x390/0x490 [ 20.914073][ T303] ? memcpy+0x56/0x70 [ 20.918042][ T303] ? avc_has_perm_noaudit+0x30a/0x490 [ 20.923387][ T303] ? arch_stack_walk+0xee/0x140 [ 20.928219][ T303] ? avc_denied+0x1b0/0x1b0 [ 20.932711][ T303] ? stack_trace_save+0xa6/0xf0 [ 20.937539][ T303] ? avc_has_perm+0x163/0x250 [ 20.942209][ T303] ? avc_has_perm_noaudit+0x490/0x490 [ 20.947560][ T303] ? x64_sys_call+0x4b/0x9a0 [ 20.952130][ T303] ? selinux_nlmsg_lookup+0x39d/0x440 [ 20.957480][ T303] netlink_rcv_skb+0x1e9/0x430 [ 20.962236][ T303] ? rtnetlink_bind+0x80/0x80 [ 20.966890][ T303] ? netlink_ack+0xb10/0xb10 [ 20.971456][ T303] ? _copy_from_iter+0x4a4/0x10a0 [ 20.976476][ T303] ? __netlink_lookup+0x387/0x3b0 [ 20.981496][ T303] rtnetlink_rcv+0x1c/0x20 [ 20.985892][ T303] netlink_unicast+0x86c/0xa30 [ 20.990650][ T303] netlink_sendmsg+0x879/0xb80 [ 20.995399][ T303] ? netlink_getsockopt+0x530/0x530 [ 21.000571][ T303] ? security_socket_sendmsg+0x82/0xa0 [ 21.006006][ T303] ? netlink_getsockopt+0x530/0x530 [ 21.011183][ T303] ____sys_sendmsg+0x5be/0x8f0 [ 21.015922][ T303] ? __sys_sendmsg_sock+0x40/0x40 [ 21.020922][ T303] ? import_iovec+0x7c/0xb0 [ 21.025411][ T303] ___sys_sendmsg+0x236/0x2e0 [ 21.030101][ T303] ? __sys_sendmsg+0x280/0x280 [ 21.034856][ T303] ? __schedule+0xbd7/0x14a0 [ 21.039426][ T303] ? __kasan_check_write+0x14/0x20 [ 21.044530][ T303] ? _raw_spin_lock_irq+0x95/0xf0 [ 21.049531][ T303] ? ptrace_stop+0x6d8/0xa70 [ 21.054096][ T303] ? __kasan_check_read+0x11/0x20 [ 21.059110][ T303] ? __fdget+0x15b/0x230 [ 21.063353][ T303] __x64_sys_sendmsg+0x201/0x2d0 [ 21.068268][ T303] ? ___sys_sendmsg+0x2e0/0x2e0 [ 21.073103][ T303] ? __kasan_check_write+0x14/0x20 [ 21.078292][ T303] ? switch_fpu_return+0x15d/0x2c0 [ 21.083401][ T303] x64_sys_call+0x4b/0x9a0 [ 21.087795][ T303] do_syscall_64+0x4c/0xa0 [ 21.092189][ T303] ? clear_bhb_loop+0x50/0xa0 [ 21.096859][ T303] ? clear_bhb_loop+0x50/0xa0 [ 21.101528][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 21.107398][ T303] RIP: 0033:0x7fc228716079 [ 21.111789][ T303] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 21.131388][ T303] RSP: 002b:00007ffc276ae888 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 21.139806][ T303] RAX: ffffffffffffffda RBX: 00007ffc276ae9b8 RCX: 00007fc228716079 [ 21.147776][ T303] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 21.155725][ T303] RBP: 0000000000000001 R08: 0000000000000003 R09: 00007ffc276ae9b8 [ 21.163675][ T303] R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffc276ae9a8 [ 21.171642][ T303] R13: 0000000000000002 R14: 00007fc2287a6ca0 R15: 0000000000000002 [ 21.179599][ T303] [ 21.182613][ T303] [ 21.184917][ T303] Allocated by task 303: [ 21.189131][ T303] __kasan_kmalloc+0xd4/0x100 [ 21.193785][ T303] __kmalloc+0x13d/0x2c0 [ 21.198004][ T303] tcf_idr_create+0x5f/0x790 [ 21.202569][ T303] tcf_idr_create_from_flags+0x61/0x70 [ 21.208015][ T303] tcf_gact_init+0x342/0x570 [ 21.212704][ T303] tcf_action_init_1+0x3fd/0x6b0 [ 21.217620][ T303] tcf_action_init+0x233/0x7a0 [ 21.222359][ T303] tcf_exts_validate+0x24a/0x580 [ 21.227271][ T303] mall_set_parms+0x48/0x520 [ 21.231834][ T303] mall_change+0x478/0x760 [ 21.236247][ T303] tc_new_tfilter+0x13df/0x1990 [ 21.241088][ T303] rtnetlink_rcv_msg+0x83c/0xcb0 [ 21.246005][ T303] netlink_rcv_skb+0x1e9/0x430 [ 21.250835][ T303] rtnetlink_rcv+0x1c/0x20 [ 21.255243][ T303] netlink_unicast+0x86c/0xa30 [ 21.259981][ T303] netlink_sendmsg+0x879/0xb80 [ 21.264722][ T303] ____sys_sendmsg+0x5be/0x8f0 [ 21.269475][ T303] ___sys_sendmsg+0x236/0x2e0 [ 21.274125][ T303] __x64_sys_sendmsg+0x201/0x2d0 [ 21.279034][ T303] x64_sys_call+0x4b/0x9a0 [ 21.283423][ T303] do_syscall_64+0x4c/0xa0 [ 21.287814][ T303] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 21.293682][ T303] [ 21.295999][ T303] The buggy address belongs to the object at ffff88810ad2fe00 [ 21.295999][ T303] which belongs to the cache kmalloc-192 of size 192 [ 21.310028][ T303] The buggy address is located 0 bytes to the right of [ 21.310028][ T303] 192-byte region [ffff88810ad2fe00, ffff88810ad2fec0) [ 21.323641][ T303] The buggy address belongs to the page: [ 21.329273][ T303] page:ffffea00042b4bc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ad2f [ 21.339501][ T303] flags: 0x4000000000000200(slab|zone=1) [ 21.345149][ T303] raw: 4000000000000200 ffffea00042b4ac0 0000000300000003 ffff888100042c00 [ 21.353710][ T303] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 21.362276][ T303] page dumped because: kasan: bad access detected [ 21.368660][ T303] page_owner tracks the page as allocated [ 21.374353][ T303] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1956450146, free_ts 0 [ 21.388996][ T303] post_alloc_hook+0x192/0x1b0 [ 21.393753][ T303] prep_new_page+0x1c/0x110 [ 21.398228][ T303] get_page_from_freelist+0x2c3a/0x2cd0 [ 21.403768][ T303] __alloc_pages+0x1a2/0x460 [ 21.408348][ T303] new_slab+0xa0/0x4d0 [ 21.412393][ T303] ___slab_alloc+0x3ac/0x840 [ 21.416955][ T303] __slab_alloc+0x49/0x90 [ 21.421258][ T303] __kmalloc+0x16a/0x2c0 [ 21.425476][ T303] sbitmap_init_node+0x2b7/0x720 [ 21.430388][ T303] blk_mq_realloc_hw_ctxs+0x717/0x1660 [ 21.435823][ T303] blk_mq_init_allocated_queue+0x3ea/0x1770 [ 21.441692][ T303] blk_mq_init_queue+0x6c/0xd0 [ 21.446431][ T303] scsi_alloc_sdev+0x66c/0x9c0 [ 21.451173][ T303] scsi_probe_and_add_lun+0x180/0x35d0 [ 21.456605][ T303] __scsi_scan_target+0x1d2/0xb70 [ 21.461629][ T303] scsi_scan_host_selected+0x34e/0x600 [ 21.467064][ T303] page_owner free stack trace missing [ 21.472407][ T303] [ 21.474706][ T303] Memory state around the buggy address: [ 21.480318][ T303] ffff88810ad2fd80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 21.488383][ T303] ffff88810ad2fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=140, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_MULTI|NLM_F_ACK|NLM_F_DUMP_FILTERED|0xd00, nlmsg_seq=7388456, nlmsg_pid=635427840}, "\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf3\xff\x00\x00\x00\x00\x0b\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x58\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x02\x00\x00\x00\xa4\x8b\x00\x00\x00\x00\x00\x10\x0a\x00\x00\x01\x08\x00\x00\x00\x04\x00\x06\x00\x0c\x00\x07\x00\x00\x00\x00\x00"...], iov_len=140}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 140 exit_group(0) = ? [ 21.496443][ T303] >ffff88810ad2fe80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 21.504496][ T303] ^ [ 21.510648][ T303] ffff88810ad2ff00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.518682][ T303] ffff88810ad2ff80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 21.526718][ T303] ================================================================== [ 21.534846][ T303] Disabling lock debugging due to kernel taint +++ exited with 0 +++ [ 21.547528][ T30] audit: type=1400 audit(1791262836.307:67): avc: deni