ci2-android-6-1/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1/syz-executor1392639585 <...> cess permissive=1 [ 15.333168][ T28] audit: type=1400 audit(1785668765.958:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 20.114521][ T298] sshd-session (298) used greatest stack depth: 21216 bytes left Warning: Permanently added '10.128.0.60' (ED25519) to the list of known hosts. execve("ci2-android-6-1/syz-executor1392639585", ["ci2-android-6-1/syz-executor1392639585"], 0x7ffd7df81410 /* 10 vars */) = 0 brk(NULL) = 0x555559de6000 brk(0x555559de6e00) = 0x555559de6e00 arch_prctl(ARCH_SET_FS, 0x555559de6480) = 0 set_tid_address(0x555559de6750) = 305 set_robust_list(0x555559de6760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1/syz-executor1392639585", 4096) = 44 getrandom("\x98\x85\x67\xe6\x14\x7d\x4a\x5e", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555559de6e00 brk(0x555559e07e00) = 0x555559e07e00 brk(0x555559e08000) = 0x555559e08000 mprotect(0x7fbcc2529000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7fbcc247f600, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fbcc24833b0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7fbcc247f600, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fbcc24833b0}, NULL, 8) = 0 write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcba077000 executing program write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 munmap(0x7fbcba077000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file1", 0777) = 0 [ 25.561903][ T28] audit: type=1400 audit(1785668776.178:64): avc: denied { execmem } for pid=305 comm="syz-executor139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 25.573106][ T305] loop0: detected capacity change from 0 to 1024 [ 25.582454][ T28] audit: type=1400 audit(1785668776.188:65): avc: denied { read write } for pid=305 comm="syz-executor139" name="loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.591019][ T305] EXT4-fs: Ignoring removed bh option [ 25.618479][ T28] audit: type=1400 audit(1785668776.188:66): avc: denied { open } for pid=305 comm="syz-executor139" path="/dev/loop0" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 mount("/dev/loop0", "./file1", "ext4", MS_DIRSYNC|MS_POSIXACL|MS_RELATIME, "nodelalloc,noblock_validity,noauto_da_alloc,nolazytime,errors=continue,lazytime,inlinecrypt,stripe=0"...) = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, "./file1", O_RDWR|O_CREAT|O_SYNC, 0221) = 4 quotactl(QCMD(Q_QUOTAON, PRJQUOTA), "/dev/loop0", 0xffffffff /* QFMT_??? */, NULL) = -1 EFAULT (Bad address) mprotect(0x200000000000, 12288, PROT_READ|PROT_SEM) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x200000000180} --- openat(-1, "/dev/loop0", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 mmap(0x200000000000, 11755520, PROT_WRITE|PROT_SEM, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 5, 0) = 0x200000000000 memfd_create("syzkaller", 0) = 6 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcba077000 [ 25.643061][ T28] audit: type=1400 audit(1785668776.188:67): avc: denied { ioctl } for pid=305 comm="syz-executor139" path="/dev/loop0" dev="devtmpfs" ino=118 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 25.669402][ T305] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 25.677089][ T28] audit: type=1400 audit(1785668776.218:68): avc: denied { mounton } for pid=305 comm="syz-executor139" path="/root/file1" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 25.708798][ T28] audit: type=1400 audit(1785668776.298:69): avc: denied { mount } for pid=305 comm="syz-executor139" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 25.730703][ T28] audit: type=1400 audit(1785668776.298:70): avc: denied { write } for pid=305 comm="syz-executor139" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.753915][ T28] audit: type=1400 audit(1785668776.298:71): avc: denied { add_name } for pid=305 comm="syz-executor139" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 25.774808][ T28] audit: type=1400 audit(1785668776.298:72): avc: denied { create } for pid=305 comm="syz-executor139" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 25.795245][ T28] audit: type=1400 audit(1785668776.298:73): avc: denied { read write } for pid=305 comm="syz-executor139" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 20699119) = 20699119 munmap(0x7fbcba077000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 7 ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) ioctl(7, LOOP_CLR_FD) = 0 ioctl(7, LOOP_SET_FD, 6) = -1 EBUSY (Device or resource busy) close(7) = 0 close(6) = 0 [ 25.905322][ T305] ================================================================== [ 25.913423][ T305] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0xb02/0x2230 [ 25.921197][ T305] Read of size 18446744073709551600 at addr ffff8881251302b8 by task syz-executor139/305 [ 25.931013][ T305] [ 25.933346][ T305] CPU: 0 PID: 305 Comm: syz-executor139 Not tainted syzkaller #0 [ 25.941071][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.951140][ T305] Call Trace: [ 25.954426][ T305] [ 25.957363][ T305] __dump_stack+0x21/0x24 [ 25.961723][ T305] dump_stack_lvl+0x110/0x170 [ 25.966407][ T305] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.971446][ T305] ? cgroup_rstat_updated+0xf0/0x360 [ 25.976755][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 25.982224][ T305] print_address_description+0x71/0x200 [ 25.987776][ T305] print_report+0x4a/0x60 [ 25.992109][ T305] kasan_report+0x122/0x150 [ 25.996621][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 26.002093][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 26.007571][ T305] kasan_check_range+0x249/0x2a0 [ 26.012543][ T305] ? ext4_xattr_set_entry+0xb02/0x2230 [ 26.018022][ T305] memmove+0x2d/0x70 [ 26.021928][ T305] ext4_xattr_set_entry+0xb02/0x2230 [ 26.027234][ T305] ext4_xattr_ibody_set+0x25b/0x720 [ 26.032450][ T305] ext4_destroy_inline_data_nolock+0x234/0x5e0 [ 26.038633][ T305] ? ext4_destroy_inline_data+0xe0/0xe0 [ 26.044192][ T305] ? ext4_readpage_inline+0x210/0x210 [ 26.049572][ T305] ? __kasan_check_read+0x11/0x20 [ 26.054688][ T305] ? pagecache_get_page+0xb7/0x110 [ 26.059811][ T305] ext4_try_to_write_inline_data+0x764/0x1330 [ 26.065891][ T305] ? __cfi_ext4_try_to_write_inline_data+0x10/0x10 [ 26.072398][ T305] ? __kasan_check_read+0x11/0x20 [ 26.077428][ T305] ? mark_buffer_dirty+0x1d5/0x380 [ 26.082551][ T305] ? ext4_inode_journal_mode+0x19a/0x470 [ 26.088193][ T305] ? ext4_writepage_trans_blocks+0x2b3/0x330 [ 26.094202][ T305] ext4_write_begin+0x1f8/0xfc0 [ 26.099074][ T305] ? _raw_spin_lock+0x94/0xf0 [ 26.103767][ T305] ? __cfi__raw_spin_lock+0x10/0x10 [ 26.108981][ T305] ? __cfi_ext4_write_begin+0x10/0x10 [ 26.114366][ T305] generic_perform_write+0x32d/0x740 [ 26.119680][ T305] ? __mark_inode_dirty+0x60c/0x9c0 [ 26.124890][ T305] ? __cfi_generic_perform_write+0x10/0x10 [ 26.130706][ T305] ext4_buffered_write_iter+0x38f/0x690 [ 26.136266][ T305] ext4_file_write_iter+0x4b2/0x1540 [ 26.141578][ T305] ? __cfi___switch_to+0x10/0x10 [ 26.146531][ T305] ? avc_policy_seqno+0x1b/0x70 [ 26.151392][ T305] ? __cfi_ext4_file_write_iter+0x10/0x10 [ 26.157128][ T305] ? fsnotify_perm+0x67/0x5b0 [ 26.161822][ T305] ? security_file_permission+0x8a/0xb0 [ 26.167386][ T305] vfs_write+0x5ef/0xd00 [ 26.171641][ T305] ? __kasan_check_write+0x14/0x20 [ 26.176766][ T305] ? __cfi_vfs_write+0x10/0x10 [ 26.181540][ T305] ? ptrace_stop+0x6dc/0x8e0 [ 26.186151][ T305] ? __kasan_check_read+0x11/0x20 [ 26.191184][ T305] ? __fdget+0x15b/0x220 [ 26.195430][ T305] __x64_sys_pwrite64+0x194/0x220 [ 26.200482][ T305] ? __cfi___x64_sys_pwrite64+0x10/0x10 [ 26.206042][ T305] ? fpregs_restore_userregs+0x128/0x260 [ 26.211685][ T305] x64_sys_call+0x36/0x9a0 [ 26.216110][ T305] do_syscall_64+0x4c/0xa0 [ 26.220539][ T305] ? clear_bhb_loop+0x30/0x80 [ 26.225222][ T305] ? clear_bhb_loop+0x30/0x80 [ 26.229919][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.235827][ T305] RIP: 0033:0x7fbcc249bf19 [ 26.240258][ T305] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.259867][ T305] RSP: 002b:00007ffc418ed938 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 26.268297][ T305] RAX: ffffffffffffffda RBX: 6f6f6c2f7665642f RCX: 00007fbcc249bf19 [ 26.276278][ T305] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 [ 26.284272][ T305] RBP: 00007ffc418ed948 R08: 0000000000000000 R09: 00007fbcc247f600 [ 26.292247][ T305] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000 [ 26.300224][ T305] R13: 0000000000000002 R14: 00007fbcc2529c80 R15: 0000000000000002 [ 26.308207][ T305] [ 26.311238][ T305] [ 26.313570][ T305] The buggy address belongs to the physical page: [ 26.319994][ T305] page:ffffea0004944c00 refcount:3 mapcount:1 mapping:ffff88810b7185d0 index:0x2 pfn:0x125130 [ 26.330248][ T305] memcg:ffff88810023a700 [ 26.334490][ T305] aops:def_blk_aops ino:700000 [ 26.339260][ T305] flags: 0x560000000002205e(referenced|uptodate|dirty|lru|workingset|private|mappedtodisk|zone=1) [ 26.349861][ T305] raw: 560000000002205e ffffea00044281c8 ffff888100285950 ffff88810b7185d0 [ 26.358450][ T305] raw: 0000000000000002 ffff888124128930 0000000300000000 ffff88810023a700 [ 26.367037][ T305] page dumped because: kasan: bad access detected [ 26.373461][ T305] page_owner tracks the page as allocated [ 26.379185][ T305] page last allocated via order 0, migratetype Movable, gfp_mask 0x148c48(GFP_NOFS|__GFP_NOFAIL|__GFP_COMP|__GFP_HARDWALL|__GFP_MOVABLE), pid 305, tgid 305 (syz-executor139), ts 25688845568, free_ts 20110427668 [ 26.399592][ T305] post_alloc_hook+0x1f5/0x210 [ 26.404370][ T305] prep_new_page+0x1c/0x110 [ 26.408883][ T305] get_page_from_freelist+0x2ca9/0x2d20 [ 26.414441][ T305] __alloc_pages+0x1fa/0x610 [ 26.419049][ T305] __folio_alloc+0x12/0x40 [ 26.423476][ T305] __filemap_get_folio+0x6fe/0xa70 [ 26.428591][ T305] pagecache_get_page+0x2b/0x110 [ 26.433540][ T305] __getblk_gfp+0x211/0x7c0 [ 26.438073][ T305] __ext4_get_inode_loc+0x45f/0xd60 [ 26.443319][ T305] __ext4_iget+0x448/0x3e70 [ 26.447846][ T305] ext4_lookup+0x28e/0x710 [ 26.452286][ T305] path_openat+0x13fe/0x2f30 [ 26.456890][ T305] do_filp_open+0x1ee/0x420 [ 26.461418][ T305] do_sys_openat2+0x15e/0x820 [ 26.466120][ T305] __x64_sys_openat+0x136/0x160 [ 26.470990][ T305] x64_sys_call+0x783/0x9a0 [ 26.475515][ T305] page last free stack trace: [ 26.480194][ T305] free_unref_page_prepare+0x80c/0x820 [ 26.485671][ T305] free_unref_page_list+0x117/0x8d0 [ 26.490886][ T305] release_pages+0xc7e/0xce0 [ 26.495483][ T305] free_pages_and_swap_cache+0x86/0xa0 [ 26.500959][ T305] tlb_finish_mmu+0x1b2/0x380 [ 26.505651][ T305] exit_mmap+0x41d/0xc10 [ 26.509902][ T305] __mmput+0x92/0x340 [ 26.513908][ T305] mmput+0x4b/0x150 [ 26.517732][ T305] do_exit+0xa51/0x2850 [ 26.521901][ T305] do_group_exit+0x21b/0x2e0 [ 26.526503][ T305] __x64_sys_exit_group+0x3f/0x40 [ 26.531547][ T305] x64_sys_call+0x7b4/0x9a0 [ 26.536174][ T305] do_syscall_64+0x4c/0xa0 [ 26.540618][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.546547][ T305] [ 26.548893][ T305] Memory state around the buggy address: [ 26.554527][ T305] ffff888125130180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.562595][ T305] ffff888125130200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.570663][ T305] >ffff888125130280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.578727][ T305] ^ [ 26.584629][ T305] ffff888125130300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.592695][ T305] ffff888125130380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 pwrite64(4, 0x200000000140, 65007, 3708) = 65007 exit_group(0) = ? +++ exited with 0 +++ [ 26.600764][ T305] =================================================================