ci2-android-5-15/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-15/syz-executor3863544731 <...> Warning: Permanently added '10.128.0.10' (ED25519) to the list of known hosts. execve("ci2-android-5-15/syz-executor3863544731", ["ci2-android-5-15/syz-executor3863544731"], 0x7fff0f30e3f0 /* 10 vars */) = 0 brk(NULL) = 0x55556c87c000 brk(0x55556c87cd40) = 0x55556c87cd40 arch_prctl(ARCH_SET_FS, 0x55556c87c3c0) = 0 set_tid_address(0x55556c87c690) = 303 set_robust_list(0x55556c87c6a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-15/syz-executor3863544731", 4096) = 45 getrandom("\x19\x50\x29\xcc\xde\x87\x65\x7d", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556c87cd40 brk(0x55556c89dd40) = 0x55556c89dd40 brk(0x55556c89e000) = 0x55556c89e000 mprotect(0x7ff079c52000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55556c87c690) = 304 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ci2-android-5-15/strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x55556c87c6a0, 24) = 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 304] getppid() = 0 [pid 304] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 304] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 304] unshare(CLONE_NEWNS) = 0 [pid 304] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 304] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 304] unshare(CLONE_NEWCGROUP) = 0 [pid 304] unshare(CLONE_NEWUTS) = 0 [pid 304] unshare(CLONE_SYSVSEM) = 0 [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 304] getpid() = 1 [pid 304] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 12]) = 0 [pid 309] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=[{nlmsg_len=88, nlmsg_type=0x24 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_MULTI|NLM_F_ECHO|0xe00, nlmsg_seq=0, nlmsg_pid=-4}, "\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\x01\x00\x00\x00\x0a\x00\x01\x00\x6e\x65\x74\x65\x6d\x00\x00\x00\x28\x00\x02\x00\x01\x00\x00\x00\x06\x00\x00\x00\x00\x0a\x00\x00\x03\x00\x00\x00\xff\xff\xff\xff\x02\x01\x02\x00\x0c\x00\x04\x00\xff\xff\xff\x7f\x55\x01\x00\x00"], iov_len=88}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, MSG_EOR|MSG_ZEROCOPY) = 88 [pid 309] socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) = 5 [pid 309] bind(5, {sa_family=AF_PACKET, sll_protocol=htons(0 /* ETH_P_??? */), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_ETHER, sll_pkttype=PACKET_HOST, sll_halen=6, sll_addr=[00, 0x11, 0x22, 0x33, 0x44, 0x55]}, 20) = 0 [pid 309] setsockopt(5, SOL_PACKET, PACKET_TX_RING, {tp_block_size=4096, tp_block_nr=4, tp_frame_size=2048, tp_frame_nr=8}, 16) = 0 [pid 309] mmap(0x200000000000, 16384, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 5, 0) = 0x200000000000 [ 22.610733][ T30] audit: type=1400 audit(1787145716.033:72): avc: denied { mounton } for pid=304 comm="syz-executor386" path="/root/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 22.614542][ T304] request_module fs-gadgetfs succeeded, but still no fs? [ 22.635778][ T30] audit: type=1400 audit(1787145716.033:73): avc: denied { mount } for pid=304 comm="syz-executor386" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 22.671058][ T309] divide error: 0000 [#1] PREEMPT SMP KASAN [ 22.676980][ T309] CPU: 0 PID: 309 Comm: syz-executor386 Not tainted syzkaller #0 [ 22.684702][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 22.694943][ T309] RIP: 0010:netem_enqueue+0x17f8/0x3750 [ 22.700524][ T309] Code: 00 4c 89 e9 45 8b 6d 70 48 89 4c 24 28 4c 8d 61 74 4c 89 e1 48 c1 e9 03 0f b6 0c 31 84 c9 0f 85 34 19 00 00 45 2b 2c 24 31 d2 <41> f7 f5 48 01 d3 48 89 d8 48 c1 e8 03 0f b6 04 30 84 c0 0f 85 45 [ 22.720147][ T309] RSP: 0018:ffffc900009f7520 EFLAGS: 00010246 [ 22.726222][ T309] RAX: 0000000054c8a236 RBX: ffff888120427880 RCX: 0000000000000000 [ 22.734305][ T309] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff88810fc8a7f0 [ 22.742289][ T309] RBP: ffffc900009f7650 R08: 0000000000000003 R09: 0000000000000004 [ 22.750270][ T309] R10: dffffc0000000000 R11: fffff5200013ee0c R12: ffff88810fc8a7f4 [ 22.758255][ T309] R13: 0000000000000000 R14: 0000000000000008 R15: 0000000000000000 [ 22.766240][ T309] FS: 000055556c87c3c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 22.775174][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.781764][ T309] CR2: 000000000069fee0 CR3: 000000010def6000 CR4: 00000000003506b0 [ 22.789744][ T309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.797723][ T309] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.805702][ T309] Call Trace: [ 22.808990][ T309] [ 22.811927][ T309] ? __kasan_check_write+0x14/0x20 [ 22.817048][ T309] ? _raw_spin_lock+0x94/0xf0 [ 22.821731][ T309] ? qdisc_purge_queue+0x3d0/0x3d0 [ 22.826856][ T309] __dev_queue_xmit+0xc35/0x2d60 [ 22.831804][ T309] ? dev_queue_xmit+0x20/0x20 [ 22.836491][ T309] ? packet_parse_headers+0x845/0xab0 [ 22.841874][ T309] ? sock_kzfree_s+0x60/0x60 [ 22.846472][ T309] ? skb_setup_tx_timestamp+0x200/0x200 [ 22.852026][ T309] ? mutex_lock+0x9b/0x1c0 [ 22.856450][ T309] ? wait_for_completion_killable_timeout+0x10/0x10 [ 22.863052][ T309] dev_queue_xmit+0x17/0x20 [ 22.867561][ T309] packet_sendmsg+0x224d/0x5060 [ 22.872429][ T309] ? packet_getsockopt+0x900/0x900 [ 22.877583][ T309] ? security_socket_sendmsg+0x82/0xa0 [ 22.883050][ T309] sock_write_iter+0x2a6/0x3a0 [ 22.887827][ T309] ? sock_read_iter+0x380/0x380 [ 22.892802][ T309] ? memset+0x35/0x40 [ 22.896790][ T309] ? iov_iter_init+0xbc/0x180 [ 22.901475][ T309] vfs_write+0x831/0xfd0 [ 22.905729][ T309] ? file_end_write+0x1b0/0x1b0 [ 22.910589][ T309] ? _raw_spin_unlock_irq+0x4e/0x70 [ 22.915799][ T309] ? cgroup_leave_frozen+0x165/0x2a0 [ 22.921113][ T309] ? __kasan_check_read+0x11/0x20 [ 22.926165][ T309] ? __fdget_pos+0x1f7/0x380 [ 22.930784][ T309] ksys_write+0x14a/0x260 [ 22.935142][ T309] ? __ia32_sys_read+0x90/0x90 [ 22.939918][ T309] __x64_sys_write+0x7b/0x90 [ 22.944519][ T309] x64_sys_call+0x8ef/0x9a0 [ 22.949037][ T309] do_syscall_64+0x4c/0xa0 [ 22.953466][ T309] ? clear_bhb_loop+0x50/0xa0 [ 22.958150][ T309] ? clear_bhb_loop+0x50/0xa0 [ 22.962838][ T309] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.968736][ T309] RIP: 0033:0x7ff079bbaa89 [ 22.973161][ T309] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 22.992779][ T309] RSP: 002b:00007ffce31c8a18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 23.001210][ T309] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff079bbaa89 [ 23.009194][ T309] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000005 [ 23.017527][ T309] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 23.025506][ T309] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 23.033480][ T309] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffce31c8a60 [ 23.041459][ T309] [ 23.044487][ T309] Modules linked in: [ 23.048449][ T309] ---[ end trace 4c573c6ac00d01ca ]--- [ 23.053935][ T309] RIP: 0010:netem_enqueue+0x17f8/0x3750 [ 23.059509][ T309] Code: 00 4c 89 e9 45 8b 6d 70 48 89 4c 24 28 4c 8d 61 74 4c 89 e1 48 c1 e9 03 0f b6 0c 31 84 c9 0f 85 34 19 00 00 45 2b 2c 24 31 d2 <41> f7 f5 48 01 d3 48 89 d8 48 c1 e8 03 0f b6 04 30 84 c0 0f 85 45 [ 23.079148][ T309] RSP: 0018:ffffc900009f7520 EFLAGS: 00010246 [ 23.085257][ T309] RAX: 0000000054c8a236 RBX: ffff888120427880 RCX: 0000000000000000 [ 23.093254][ T309] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff88810fc8a7f0 [ 23.101243][ T309] RBP: ffffc900009f7650 R08: 0000000000000003 R09: 0000000000000004 [ 23.109248][ T309] R10: dffffc0000000000 R11: fffff5200013ee0c R12: ffff88810fc8a7f4 [ 23.117252][ T309] R13: 0000000000000000 R14: 0000000000000008 R15: 0000000000000000 [ 23.125252][ T309] FS: 000055556c87c3c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 23.134213][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 23.140791][ T309] CR2: 000000000069fee0 CR3: 000000010def6000 CR4: 00000000003506b0 [ 23.148795][ T309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 23.156792][ T309] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 23.164797][ T309] Kernel panic - not syncing: Fatal exception in interrupt [ 23.172271][ T309] Kernel Offset: disabled [ 23.176627][ T309] Rebooting in 86400 seconds..