ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor220313245 <...> Warning: Permanently added '10.128.1.48' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor220313245", ["ci2-android-5-10/syz-executor220313245"], 0x7ffd11f16310 /* 10 vars */) = 0 brk(NULL) = 0x555587eeb000 brk(0x555587eebd40) = 0x555587eebd40 arch_prctl(ARCH_SET_FS, 0x555587eeb3c0) = 0 set_tid_address(0x555587eeb690) = 297 set_robust_list(0x555587eeb6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor220313245", 4096) = 44 getrandom("\x92\x67\x3d\x31\x7b\x55\x41\x3f", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555587eebd40 brk(0x555587f0cd40) = 0x555587f0cd40 brk(0x555587f0d000) = 0x555587f0d000 mprotect(0x7fb53202b000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 socket(AF_PPPOX, SOCK_STREAM, 1) = 3 socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP) = 4 connect(3, {sa_family=AF_PPPOX, sa_data="\x01\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x02\x00\x00\x00\xe0\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00"}, 38) = 0 ioctl(3, NILFS_IOCTL_CHANGE_CPMODE, 0) = -1 ENOTTY (Inappropriate ioctl for device) exit_group(0) = ? [ 25.148079][ T24] audit: type=1400 audit(1786451817.600:64): avc: denied { execmem } for pid=297 comm="syz-executor220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.170976][ T24] audit: type=1400 audit(1786451817.620:65): avc: denied { create } for pid=297 comm="syz-executor220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 25.193016][ T24] audit: type=1400 audit(1786451817.620:66): avc: denied { connect } for pid=297 comm="syz-executor220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 25.214327][ T297] ================================================================== [ 25.215482][ T24] audit: type=1400 audit(1786451817.650:67): avc: denied { ioctl } for pid=297 comm="syz-executor220" path="socket:[1555]" dev="sockfs" ino=1555 ioctlcmd=0x6e80 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 25.222718][ T297] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 25.222728][ T297] Write of size 8 at addr ffff8881009c9950 by task syz-executor220/297 [ 25.222739][ T297] [ 25.266074][ T297] CPU: 1 PID: 297 Comm: syz-executor220 Not tainted syzkaller #0 [ 25.273906][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.284083][ T297] Call Trace: [ 25.287395][ T297] __dump_stack+0x21/0x24 [ 25.291726][ T297] dump_stack_lvl+0x1a7/0x208 [ 25.296427][ T297] ? show_regs_print_info+0x18/0x18 [ 25.301658][ T297] ? thaw_kernel_threads+0x220/0x220 [ 25.307161][ T297] print_address_description+0x7f/0x2c0 [ 25.312783][ T297] ? mutex_lock+0x85/0xf0 [ 25.317135][ T297] kasan_report+0x100/0x140 [ 25.321675][ T297] ? mutex_lock+0x85/0xf0 [ 25.326192][ T297] kasan_check_range+0x249/0x2a0 [ 25.332070][ T297] __kasan_check_write+0x14/0x20 [ 25.337064][ T297] mutex_lock+0x85/0xf0 [ 25.341250][ T297] ? mutex_trylock+0xb0/0xb0 [ 25.345841][ T297] ? l2tp_session_put+0xb2/0x1a0 [ 25.350949][ T297] ? l2tp_session_delete+0x3a9/0x4a0 [ 25.356230][ T297] pppol2tp_release+0x178/0x2b0 [ 25.361103][ T297] sock_close+0xb8/0x200 [ 25.365567][ T297] ? sock_mmap+0xa0/0xa0 [ 25.369815][ T297] __fput+0x2dc/0x730 [ 25.373823][ T297] ? _raw_spin_lock+0x94/0xf0 [ 25.378500][ T297] ____fput+0x15/0x20 [ 25.382577][ T297] task_work_run+0x127/0x190 [ 25.387182][ T297] do_exit+0xa7c/0x24e0 [ 25.391348][ T297] ? ptrace_notify+0x1ea/0x270 [ 25.396107][ T297] ? put_task_struct+0x90/0x90 [ 25.401059][ T297] ? do_notify_parent+0x810/0x810 [ 25.406084][ T297] do_group_exit+0x149/0x310 [ 25.410874][ T297] __x64_sys_exit_group+0x3f/0x40 [ 25.415904][ T297] do_syscall_64+0x31/0x40 [ 25.420349][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.426642][ T297] RIP: 0033:0x7fb531f9a305 [ 25.431386][ T297] Code: Unable to access opcode bytes at RIP 0x7fb531f9a2db. [ 25.438756][ T297] RSP: 002b:00007fffb5d1e908 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 [ 25.447544][ T297] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fb531f9a305 [ 25.455596][ T297] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000000 [ 25.463926][ T297] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fffb5d1ea98 [ 25.471920][ T297] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 25.480003][ T297] R13: 00007fb532030110 R14: 00007fb5320323a8 R15: 00007fb5320323c0 [ 25.488178][ T297] [ 25.490625][ T297] Allocated by task 297: [ 25.494887][ T297] __kasan_kmalloc+0xd4/0x100 [ 25.499591][ T297] __kmalloc+0x19f/0x330 [ 25.503846][ T297] l2tp_session_create+0x39/0xb60 [ 25.508970][ T297] pppol2tp_connect+0xbf5/0x1640 [ 25.513917][ T297] __sys_connect+0x3ce/0x450 [ 25.518533][ T297] __x64_sys_connect+0x7a/0x90 [ 25.523302][ T297] do_syscall_64+0x31/0x40 [ 25.527751][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.533747][ T297] [ 25.536079][ T297] Freed by task 297: [ 25.540064][ T297] kasan_set_track+0x4a/0x70 [ 25.544754][ T297] kasan_set_free_info+0x23/0x40 [ 25.549818][ T297] ____kasan_slab_free+0x125/0x160 [ 25.554933][ T297] __kasan_slab_free+0x11/0x20 [ 25.559789][ T297] slab_free_freelist_hook+0xc5/0x190 [ 25.565170][ T297] kfree+0xc0/0x270 [ 25.568986][ T297] l2tp_session_put+0xb2/0x1a0 [ 25.573759][ T297] l2tp_session_delete+0x3a9/0x4a0 [ 25.578872][ T297] pppol2tp_release+0x169/0x2b0 [ 25.584069][ T297] sock_close+0xb8/0x200 [ 25.588323][ T297] __fput+0x2dc/0x730 [ 25.592363][ T297] ____fput+0x15/0x20 [ 25.596617][ T297] task_work_run+0x127/0x190 [ 25.601404][ T297] do_exit+0xa7c/0x24e0 [ 25.605563][ T297] do_group_exit+0x149/0x310 [ 25.610513][ T297] __x64_sys_exit_group+0x3f/0x40 [ 25.615638][ T297] do_syscall_64+0x31/0x40 [ 25.620233][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.626210][ T297] [ 25.628548][ T297] The buggy address belongs to the object at ffff8881009c9800 [ 25.628548][ T297] which belongs to the cache kmalloc-512 of size 512 [ 25.642967][ T297] The buggy address is located 336 bytes inside of [ 25.642967][ T297] 512-byte region [ffff8881009c9800, ffff8881009c9a00) [ 25.656264][ T297] The buggy address belongs to the page: [ 25.661931][ T297] page:ffffea0004027200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009c8 [ 25.672961][ T297] head:ffffea0004027200 order:2 compound_mapcount:0 compound_pincount:0 [ 25.681429][ T297] flags: 0x4000000000010200(slab|head) [ 25.686908][ T297] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 25.696577][ T297] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.705249][ T297] page dumped because: kasan: bad access detected [ 25.712126][ T297] page_owner tracks the page as allocated [ 25.718252][ T297] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 294, ts 25077450616, free_ts 19305645094 [ 25.737832][ T297] prep_new_page+0x176/0x190 [ 25.742539][ T297] get_page_from_freelist+0x225f/0x23f0 [ 25.748183][ T297] __alloc_pages_nodemask+0x29a/0x640 [ 25.753567][ T297] new_slab+0x84/0x3f0 [ 25.757660][ T297] ___slab_alloc+0x2f8/0x4c0 [ 25.762290][ T297] __slab_alloc+0x63/0xa0 [ 25.766639][ T297] __kmalloc_track_caller+0x1e4/0x310 [ 25.772054][ T297] __alloc_skb+0xdc/0x520 [ 25.776431][ T297] sock_wmalloc+0xb5/0x130 [ 25.780869][ T297] unix_stream_connect+0x2f8/0xf90 [ 25.786185][ T297] __sys_connect+0x3ce/0x450 [ 25.790785][ T297] __x64_sys_connect+0x7a/0x90 [ 25.795557][ T297] do_syscall_64+0x31/0x40 [ 25.799986][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.805886][ T297] page last free stack trace: [ 25.810666][ T297] __free_pages_ok+0x80b/0x830 [ 25.815442][ T297] __free_pages+0xd8/0x390 [ 25.819866][ T297] __free_slab+0xcf/0x190 [ 25.824212][ T297] unfreeze_partials+0x150/0x180 [ 25.829159][ T297] put_cpu_partial+0xc1/0x180 [ 25.833844][ T297] __slab_free+0x2c9/0x3a0 [ 25.838275][ T297] ___cache_free+0x10e/0x130 [ 25.842875][ T297] qlink_free+0x50/0x90 [ 25.847133][ T297] qlist_free_all+0x5f/0xb0 [ 25.851651][ T297] kasan_quarantine_reduce+0x14a/0x160 [ 25.857114][ T297] __kasan_slab_alloc+0x2f/0xe0 [ 25.862600][ T297] slab_post_alloc_hook+0x5d/0x2f0 [ 25.867722][ T297] kmem_cache_alloc+0x15a/0x2d0 [ 25.872591][ T297] getname_flags+0xba/0x510 [ 25.877114][ T297] getname+0x19/0x20 [ 25.881020][ T297] do_sys_openat2+0xde/0x750 [ 25.885622][ T297] [ 25.887965][ T297] Memory state around the buggy address: [ 25.893784][ T297] ffff8881009c9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.901948][ T297] ffff8881009c9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.910028][ T297] >ffff8881009c9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.918532][ T297] ^ [ 25.925314][ T297] ffff8881009c9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.933696][ T297] ffff8881009c9a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.941778][ T297] ================================================================== +++ exited with 0 +++ [ 25.949962][ T297