./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2298009127

<...>
Warning: Permanently added '10.128.1.15' (ED25519) to the list of known hosts.
execve("./syz-executor2298009127", ["./syz-executor2298009127"], 0x7ffdbdbbd460 /* 10 vars */) = 0
brk(NULL)                               = 0x55555c043000
brk(0x55555c043e00)                     = 0x55555c043e00
arch_prctl(ARCH_SET_FS, 0x55555c043480) = 0
set_tid_address(0x55555c043750)         = 289
set_robust_list(0x55555c043760, 24)     = 0
rseq(0x55555c043da0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2298009127", 4096) = 28
getrandom("\x42\xa5\x92\xa9\xb8\x0d\x4a\x6a", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55555c043e00
brk(0x55555c064e00)                     = 0x55555c064e00
brk(0x55555c065000)                     = 0x55555c065000
mprotect(0x7ffbf2404000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3
write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3
write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24
close(3)                                = 0
rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x7ffbf2359330, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7ffbf2361180}, NULL, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x7ffbf2359330, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7ffbf2361180}, NULL, 8) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 290
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 291
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 292
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 293
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 294
./strace-static-x86_64: Process 294 attached
[pid   294] set_robust_list(0x55555c043760, 24) = 0
[pid   294] mkdir("./syzkaller.TTmdCA", 0700) = 0
[pid   294] chmod("./syzkaller.TTmdCA", 0777) = 0
[pid   294] chdir("./syzkaller.TTmdCA") = 0
[pid   294] unshare(CLONE_NEWPID)       = 0
[pid   294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 293 attached
 <unfinished ...>
[pid   293] set_robust_list(0x55555c043760, 24) = 0
[pid   293] mkdir("./syzkaller.ZyFqgy", 0700./strace-static-x86_64: Process 290 attached
 <unfinished ...>
[pid   294] <... clone resumed>, child_tidptr=0x55555c043750) = 295
[pid   293] <... mkdir resumed>)        = 0
[pid   293] chmod("./syzkaller.ZyFqgy", 0777) = 0
[pid   293] chdir("./syzkaller.ZyFqgy") = 0
[pid   293] unshare(CLONE_NEWPID)       = 0
[pid   293] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 296
./strace-static-x86_64: Process 296 attached
[pid   296] set_robust_list(0x55555c043760, 24) = 0
[pid   296] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   296] getppid()                   = 0
[pid   296] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid   296] dup2(3, 201)                = 201
[pid   296] close(3)                    = 0
[pid   296] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   296] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   296] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   296] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   296] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   296] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   296] unshare(CLONE_NEWNS)        = 0
[pid   296] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   296] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   296] unshare(CLONE_NEWCGROUP)    = 0
[pid   296] unshare(CLONE_NEWUTS)       = 0
[pid   296] unshare(CLONE_SYSVSEM)      = 0
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[   27.959091][   T28] audit: type=1400 audit(1755163891.970:64): avc:  denied  { execmem } for  pid=289 comm="syz-executor229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   296] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   296] getpid()                    = 1
[pid   296] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   296] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   296] unshare(CLONE_NEWNET)       = 0
[pid   296] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
./strace-static-x86_64: Process 295 attached
./strace-static-x86_64: Process 292 attached
./strace-static-x86_64: Process 291 attached
[pid   290] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   296] write(3, "0 65535", 7)      = 7
[pid   296] close(3)                    = 0
[pid   296] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid   296] dup2(3, 200)                = 200
[pid   296] close(3)                    = 0
[pid   296] ioctl(200, TUNSETIFF, 0x7fff6de7d930) = 0
[pid   296] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   296] write(3, "0", 1)            = 1
[pid   296] close(3)                    = 0
[pid   296] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid   296] write(3, "0", 1)            = 1
[pid   296] close(3)                    = 0
[pid   296] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid   296] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   296] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   296] close(4)                    = 0
[pid   296] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid   296] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   296] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   296] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   296] close(4)                    = 0
[pid   296] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid   296] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   296] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   296] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   296] close(4)                    = 0
[pid   296] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid   296] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   296] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   296] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   296] close(4)                    = 0
[pid   296] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 60
[pid   295] set_robust_list(0x55555c043760, 24) = 0
[pid   295] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   295] getppid()                   = 0
[pid   295] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3
[pid   295] dup2(3, 201)                = 201
[pid   295] close(3)                    = 0
[pid   295] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   295] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   295] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   295] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   295] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   295] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   295] unshare(CLONE_NEWNS)        = 0
[pid   295] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   295] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   295] unshare(CLONE_NEWCGROUP)    = 0
[pid   295] unshare(CLONE_NEWUTS)       = 0
[pid   295] unshare(CLONE_SYSVSEM)      = 0
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   295] getpid()                    = 1
[pid   295] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   295] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   295] unshare(CLONE_NEWNET <unfinished ...>
[pid   292] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   291] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   290] <... set_robust_list resumed>) = 0
[pid   296] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   292] <... set_robust_list resumed>) = 0
[pid   291] <... set_robust_list resumed>) = 0
[pid   290] mkdir("./syzkaller.sUuBtB", 0700 <unfinished ...>
[pid   296] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   296] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   296] close(4)                    = 0
[pid   296] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
[pid   296] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   296] close(3)                    = 0
[pid   296] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
[pid   296] write(3, "100000", 6)       = 6
[pid   296] close(3)                    = 0
[pid   296] mkdir("./syz-tmp", 0777)    = 0
[pid   296] mount("", "./syz-tmp", "tmpfs", 0, NULL) = 0
[pid   296] mkdir("./syz-tmp/newroot", 0777) = 0
[pid   296] mkdir("./syz-tmp/newroot/dev", 0700) = 0
[pid   296] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid   296] mkdir("./syz-tmp/newroot/proc", 0700) = 0
[pid   296] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid   296] mkdir("./syz-tmp/newroot/selinux", 0700) = 0
[pid   296] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid   296] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid   296] mkdir("./syz-tmp/newroot/sys", 0700) = 0
[pid   296] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid   296] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[   27.983209][   T28] audit: type=1400 audit(1755163891.990:65): avc:  denied  { mounton } for  pid=289 comm="syz-executor229" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[   28.012129][   T28] audit: type=1400 audit(1755163891.990:66): avc:  denied  { mount } for  pid=289 comm="syz-executor229" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[pid   296] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid   296] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid   296] mkdir("./syz-tmp/newroot/syz-inputs", 0700) = 0
[pid   296] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid   296] mkdir("./syz-tmp/pivot", 0777) = 0
[pid   296] pivot_root("./syz-tmp", "./syz-tmp/pivot") = 0
[pid   296] chdir("/")                  = 0
[pid   296] umount2("./pivot", MNT_DETACH) = 0
[pid   292] mkdir("./syzkaller.fDtBnS", 0700 <unfinished ...>
[pid   291] mkdir("./syzkaller.1nB8xm", 0700 <unfinished ...>
[pid   296] chroot("./newroot")         = 0
[pid   296] chdir("/")                  = 0
[pid   296] mkdir("/dev/gadgetfs", 0777 <unfinished ...>
[pid   290] <... mkdir resumed>)        = 0
[pid   296] <... mkdir resumed>)        = 0
[pid   291] <... mkdir resumed>)        = 0
[pid   296] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid   292] <... mkdir resumed>)        = 0
[pid   291] chmod("./syzkaller.1nB8xm", 0777 <unfinished ...>
[pid   290] chmod("./syzkaller.sUuBtB", 0777 <unfinished ...>
[pid   292] chmod("./syzkaller.fDtBnS", 0777) = 0
[pid   291] <... chmod resumed>)        = 0
[pid   290] <... chmod resumed>)        = 0
[pid   292] chdir("./syzkaller.fDtBnS" <unfinished ...>
[pid   291] chdir("./syzkaller.1nB8xm" <unfinished ...>
[pid   290] chdir("./syzkaller.sUuBtB" <unfinished ...>
[pid   292] <... chdir resumed>)        = 0
[pid   291] <... chdir resumed>)        = 0
[pid   292] unshare(CLONE_NEWPID <unfinished ...>
[pid   290] <... chdir resumed>)        = 0
[pid   291] unshare(CLONE_NEWPID <unfinished ...>
[pid   292] <... unshare resumed>)      = 0
[pid   290] unshare(CLONE_NEWPID <unfinished ...>
[pid   292] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   291] <... unshare resumed>)      = 0
[pid   290] <... unshare resumed>)      = 0
[pid   291] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   290] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   292] <... clone resumed>, child_tidptr=0x55555c043750) = 297
[pid   291] <... clone resumed>, child_tidptr=0x55555c043750) = 298
[pid   290] <... clone resumed>, child_tidptr=0x55555c043750) = 299
./strace-static-x86_64: Process 298 attached
[pid   298] set_robust_list(0x55555c043760, 24./strace-static-x86_64: Process 297 attached
) = 0
[pid   298] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   297] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   298] <... prctl resumed>)        = 0
[pid   297] <... set_robust_list resumed>) = 0
[pid   298] getppid(./strace-static-x86_64: Process 299 attached
 <unfinished ...>
[pid   299] set_robust_list(0x55555c043760, 24) = 0
[pid   299] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   298] <... getppid resumed>)      = 0
[pid   299] <... prctl resumed>)        = 0
[pid   299] getppid()                   = 0
[pid   299] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid   298] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid   295] <... unshare resumed>)      = 0
[pid   297] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   295] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   297] <... prctl resumed>)        = 0
[pid   295] write(3, "0 65535", 7)      = 7
[pid   295] close(3 <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   295] <... close resumed>)        = 0
[pid   299] dup2(3, 201)                = 201
[pid   295] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   299] close(3 <unfinished ...>
[pid   295] <... openat resumed>)       = 3
[pid   299] <... close resumed>)        = 0
[pid   299] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   295] dup2(3, 200 <unfinished ...>
[pid   299] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid   299] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid   299] unshare(CLONE_NEWNS <unfinished ...>
[pid   295] <... dup2 resumed>)         = 200
[pid   297] getppid( <unfinished ...>
[pid   295] close(3)                    = 0
[pid   295] ioctl(200, TUNSETIFF, 0x7fff6de7d930 <unfinished ...>
[pid   297] <... getppid resumed>)      = 0
[pid   299] <... unshare resumed>)      = 0
[pid   297] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid   299] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid   299] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   299] unshare(CLONE_NEWCGROUP)    = 0
[pid   299] unshare(CLONE_NEWUTS <unfinished ...>
[pid   297] <... openat resumed>)       = 3
[pid   298] <... openat resumed>)       = 3
[pid   299] <... unshare resumed>)      = 0
[pid   299] unshare(CLONE_SYSVSEM)      = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] dup2(3, 201 <unfinished ...>
[pid   298] dup2(3, 201 <unfinished ...>
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   299] getpid()                    = 1
[pid   299] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   297] <... dup2 resumed>)         = 201
[pid   298] <... dup2 resumed>)         = 201
[pid   299] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   298] close(3 <unfinished ...>
[pid   297] close(3 <unfinished ...>
[pid   299] <... capset resumed>)       = 0
[pid   299] unshare(CLONE_NEWNET <unfinished ...>
[pid   295] <... ioctl resumed>)        = 0
[pid   298] <... close resumed>)        = 0
[pid   297] <... close resumed>)        = 0
[pid   297] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024},  <unfinished ...>
[pid   298] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024},  <unfinished ...>
[pid   297] <... prlimit64 resumed>NULL) = 0
[pid   298] <... prlimit64 resumed>NULL) = 0
[pid   297] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024},  <unfinished ...>
[pid   298] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024},  <unfinished ...>
[pid   295] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   297] <... prlimit64 resumed>NULL) = 0
[pid   298] <... prlimit64 resumed>NULL) = 0
[pid   297] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024},  <unfinished ...>
[pid   298] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024},  <unfinished ...>
[pid   297] <... prlimit64 resumed>NULL) = 0
[pid   298] <... prlimit64 resumed>NULL) = 0
[   28.042432][   T28] audit: type=1400 audit(1755163892.000:67): avc:  denied  { read } for  pid=296 comm="syz-executor229" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[   28.068286][   T28] audit: type=1400 audit(1755163892.000:68): avc:  denied  { open } for  pid=296 comm="syz-executor229" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[   28.068634][  T296] request_module fs-gadgetfs succeeded, but still no fs?
[pid   295] write(3, "0", 1 <unfinished ...>
[pid   298] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024},  <unfinished ...>
[pid   297] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid   295] <... write resumed>)        = 1
[pid   298] <... prlimit64 resumed>NULL) = 0
[pid   295] close(3 <unfinished ...>
[pid   298] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024},  <unfinished ...>
[pid   295] <... close resumed>)        = 0
[pid   298] <... prlimit64 resumed>NULL) = 0
[pid   295] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   297] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024},  <unfinished ...>
[pid   298] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   297] <... prlimit64 resumed>NULL) = 0
[pid   295] <... openat resumed>)       = 3
[pid   298] <... prlimit64 resumed>NULL) = 0
[pid   295] write(3, "0", 1 <unfinished ...>
[pid   298] unshare(CLONE_NEWNS <unfinished ...>
[pid   295] <... write resumed>)        = 1
[pid   297] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256},  <unfinished ...>
[pid   295] close(3 <unfinished ...>
[pid   297] <... prlimit64 resumed>NULL) = 0
[pid   295] <... close resumed>)        = 0
[pid   295] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid   297] unshare(CLONE_NEWNS <unfinished ...>
[pid   295] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   295] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   295] close(4)                    = 0
[pid   298] <... unshare resumed>)      = 0
[pid   295] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   297] <... unshare resumed>)      = 0
[pid   298] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   297] <... mount resumed>)        = 0
[pid   297] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   298] unshare(CLONE_NEWIPC)       = -1 EINVAL (Invalid argument)
[pid   297] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid   298] unshare(CLONE_NEWCGROUP <unfinished ...>
[pid   297] <... unshare resumed>)      = 0
[pid   298] <... unshare resumed>)      = 0
[pid   297] unshare(CLONE_NEWUTS <unfinished ...>
[pid   298] unshare(CLONE_NEWUTS <unfinished ...>
[pid   297] <... unshare resumed>)      = 0
[pid   298] <... unshare resumed>)      = 0
[pid   298] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   297] unshare(CLONE_SYSVSEM <unfinished ...>
[pid   298] <... unshare resumed>)      = 0
[pid   297] <... unshare resumed>)      = 0
[pid   295] <... sendto resumed>)       = 40
[pid   295] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] <... unshare resumed>)      = 0
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] <... openat resumed>)       = -1 ENOENT (No such file or directory)
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   298] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid   297] getpid( <unfinished ...>
[pid   298] getpid( <unfinished ...>
[pid   297] <... getpid resumed>)       = 1
[pid   297] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1},  <unfinished ...>
[pid   298] <... getpid resumed>)       = 1
[pid   297] <... capget resumed>{effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   298] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid   297] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   298] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0} <unfinished ...>
[pid   297] <... capset resumed>)       = 0
[pid   298] <... capset resumed>)       = 0
[pid   297] unshare(CLONE_NEWNET <unfinished ...>
[pid   298] unshare(CLONE_NEWNET <unfinished ...>
[pid   299] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   295] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   296] <... mount resumed>)        = -1 ENODEV (No such device)
[pid   298] <... unshare resumed>)      = 0
[pid   297] <... unshare resumed>)      = 0
[pid   297] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   297] write(3, "0 65535", 7)      = 7
[pid   297] close(3)                    = 0
[pid   297] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid   297] dup2(3, 200)                = 200
[pid   297] close(3)                    = 0
[pid   297] ioctl(200, TUNSETIFF, 0x7fff6de7d930) = 0
[pid   298] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid   298] write(3, "0 65535", 7)      = 7
[pid   298] close(3)                    = 0
[pid   298] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK) = 3
[pid   298] dup2(3, 200)                = 200
[pid   298] close(3)                    = 0
[pid   298] ioctl(200, TUNSETIFF, 0x7fff6de7d930) = 0
[pid   297] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   297] write(3, "0", 1)            = 1
[pid   297] close(3)                    = 0
[pid   297] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid   297] write(3, "0", 1)            = 1
[   28.133416][   T28] audit: type=1400 audit(1755163892.010:69): avc:  denied  { mounton } for  pid=296 comm="syz-executor229" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[pid   297] close(3)                    = 0
[pid   297] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid   297] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   299] write(3, "0 65535", 7 <unfinished ...>
[pid   296] mkdir("/dev/binderfs", 0777 <unfinished ...>
[pid   295] <... socket resumed>)       = 4
[pid   297] <... socket resumed>)       = 4
[pid   297] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   297] close(4)                    = 0
[pid   297] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid   297] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   297] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   297] close(4)                    = 0
[pid   297] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC) = 3
[pid   297] <... sendto resumed>)       = 64
[pid   297] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   297] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   298] write(3, "0", 1 <unfinished ...>
[pid   297] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] <... write resumed>)        = 1
[pid   297] close(4 <unfinished ...>
[pid   298] close(3 <unfinished ...>
[pid   297] <... close resumed>)        = 0
[pid   298] <... close resumed>)        = 0
[pid   298] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC) = 3
[pid   297] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 48
[pid   297] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] write(3, "0", 1 <unfinished ...>
[pid   297] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   298] <... write resumed>)        = 1
[pid   297] <... socket resumed>)       = 4
[pid   298] close(3)                    = 0
[pid   298] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid   297] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   297] close(4)                    = 0
[pid   298] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   297] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] <... socket resumed>)       = 4
[pid   297] <... sendto resumed>)       = 60
[pid   298] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   298] close(4)                    = 0
[pid   297] recvfrom(3,  <unfinished ...>
[pid   298] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   297] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   297] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   298] <... sendto resumed>)       = 40
[pid   297] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   297] close(4)                    = 0
[pid   297] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   298] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   298] close(4)                    = 0
[pid   298] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid   297] <... sendto resumed>)       = 44
[pid   298] recvfrom(3,  <unfinished ...>
[pid   297] recvfrom(3,  <unfinished ...>
[pid   298] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   297] close(3 <unfinished ...>
[pid   298] <... socket resumed>)       = 4
[pid   298] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   297] <... close resumed>)        = 0
[pid   298] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] close(4 <unfinished ...>
[pid   297] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   298] <... close resumed>)        = 0
[pid   298] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   297] <... openat resumed>)       = 3
[pid   298] <... sendto resumed>)       = 48
[pid   297] write(3, "100000", 6 <unfinished ...>
[pid   299] <... write resumed>)        = 7
[pid   298] recvfrom(3,  <unfinished ...>
[pid   297] <... write resumed>)        = 6
[pid   296] <... mkdir resumed>)        = 0
[pid   295] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   299] close(3 <unfinished ...>
[pid   298] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] close(3 <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   297] <... close resumed>)        = 0
[pid   299] openat(AT_FDCWD, "/dev/net/tun", O_RDWR|O_NONBLOCK <unfinished ...>
[pid   298] <... socket resumed>)       = 4
[pid   297] mkdir("./syz-tmp", 0777 <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   298] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] dup2(3, 200 <unfinished ...>
[pid   298] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   297] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid   299] <... dup2 resumed>)         = 200
[pid   298] close(4 <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[pid   299] close(3 <unfinished ...>
[pid   298] <... close resumed>)        = 0
[pid   297] mkdir("./syz-tmp/newroot", 0777 <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] ioctl(200, TUNSETIFF, 0x7fff6de7d930 <unfinished ...>
[pid   298] <... sendto resumed>)       = 60
[pid   297] mkdir("./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid   299] <... ioctl resumed>)        = 0
[pid   298] recvfrom(3,  <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/accept_dad", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   298] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   298] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[pid   299] write(3, "0", 1 <unfinished ...>
[pid   298] <... socket resumed>)       = 4
[pid   297] mkdir("./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid   299] <... write resumed>)        = 1
[pid   298] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] close(3 <unfinished ...>
[pid   298] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   297] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] close(4 <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[   28.158624][   T28] audit: type=1400 audit(1755163892.040:70): avc:  denied  { module_request } for  pid=286 comm="strace-static-x" kmod="net-pf-16-proto-4-type-16" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[   28.185866][   T28] audit: type=1400 audit(1755163892.070:71): avc:  denied  { mounton } for  pid=296 comm="syz-executor229" path="/root/syzkaller.ZyFqgy/syz-tmp" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[pid   299] openat(AT_FDCWD, "/proc/sys/net/ipv6/conf/syz_tun/router_solicitations", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   298] <... close resumed>)        = 0
[pid   297] mkdir("./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   298] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] write(3, "0", 1 <unfinished ...>
[pid   298] <... sendto resumed>)       = 44
[pid   297] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... write resumed>)        = 1
[pid   298] recvfrom(3,  <unfinished ...>
[pid   297] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   299] close(3 <unfinished ...>
[pid   298] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] close(3 <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[pid   299] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE <unfinished ...>
[pid   298] <... close resumed>)        = 0
[pid   297] mkdir("./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid   299] <... socket resumed>)       = 3
[pid   298] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   298] <... openat resumed>)       = 3
[pid   297] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... socket resumed>)       = 4
[pid   298] write(3, "100000", 6 <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   298] <... write resumed>)        = 6
[pid   297] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] close(3 <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[pid   299] close(4 <unfinished ...>
[pid   298] <... close resumed>)        = 0
[pid   297] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] mkdir("./syz-tmp", 0777 <unfinished ...>
[pid   297] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   299] sendto(3, [{nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x18\x00\x00\x0b\x00\x00\x00\x08\x00\x02\x00\xac\x14\x14\xaa\x08\x00\x01\x00\xac\x14\x14\xaa"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   297] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... sendto resumed>)       = 40
[pid   298] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid   297] <... mount resumed>)        = 0
[pid   299] recvfrom(3,  <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   297] mkdir("./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid   299] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] mkdir("./syz-tmp/newroot", 0777 <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   297] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   296] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid   295] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   299] <... socket resumed>)       = 4
[pid   298] mkdir("./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid   297] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   297] mkdir("./syz-tmp/pivot", 0777 <unfinished ...>
[pid   299] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] <... mkdir resumed>)        = 0
[pid   299] close(4 <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   297] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] mkdir("./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid   297] <... pivot_root resumed>)   = 0
[pid   299] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   297] chdir("/" <unfinished ...>
[pid   299] <... sendto resumed>)       = 64
[pid   298] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid   297] <... chdir resumed>)        = 0
[pid   299] recvfrom(3,  <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   297] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid   299] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] mkdir("./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   299] <... socket resumed>)       = 4
[pid   298] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   298] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   297] <... umount2 resumed>)      = 0
[pid   296] <... mount resumed>)        = 0
[pid   295] close(4 <unfinished ...>
[pid   296] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   295] <... close resumed>)        = 0
[pid   299] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] chroot("./newroot" <unfinished ...>
[pid   296] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   295] sendto(3, [{nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x78\x00\x00\x0b\x00\x00\x00\x14\x00\x02\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   299] close(4 <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   297] <... chroot resumed>)       = 0
[pid   296] mkdir("./0", 0777 <unfinished ...>
[pid   295] <... sendto resumed>)       = 64
[pid   299] <... close resumed>)        = 0
[pid   298] mkdir("./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid   297] chdir("/" <unfinished ...>
[pid   296] <... mkdir resumed>)        = 0
[pid   295] recvfrom(3,  <unfinished ...>
[pid   296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   295] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x14 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x500, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
./strace-static-x86_64: Process 300 attached
[pid   299] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   297] <... chdir resumed>)        = 0
[pid   295] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   300] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   296] <... clone resumed>, child_tidptr=0x55555c043750) = 2
[pid   295] <... socket resumed>)       = 4
[pid   295] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   299] <... sendto resumed>)       = 48
[pid   298] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] mkdir("/dev/gadgetfs", 0777 <unfinished ...>
[pid   295] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   295] close(4)                    = 0
[pid   295] sendto(3, [{nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x08\x00\x01\x00\xac\x14\x14\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 48, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   297] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   295] <... sendto resumed>)       = 48
[pid   299] recvfrom(3,  <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   297] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid   295] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   300] <... set_robust_list resumed>) = 0
[pid   299] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=48, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] <... mount resumed>)        = -1 ENODEV (No such device)
[pid   295] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   300] chdir("./0" <unfinished ...>
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   297] mkdir("/dev/binderfs", 0777 <unfinished ...>
[pid   295] <... socket resumed>)       = 4
[pid   299] <... socket resumed>)       = 4
[pid   298] <... mount resumed>)        = 0
[pid   295] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   297] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   295] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   295] close(4)                    = 0
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   298] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid   295] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   300] <... chdir resumed>)        = 0
[pid   295] <... sendto resumed>)       = 60
[pid   295] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   297] <... mount resumed>)        = 0
[pid   295] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid   295] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun", ifr_ifindex=11}) = 0
[pid   299] close(4 <unfinished ...>
[pid   298] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   297] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   295] close(4)                    = 0
[pid   295] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   300] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] <... mount resumed>)        = 0
[pid   297] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   295] <... sendto resumed>)       = 44
[pid   299] sendto(3, [{nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}, "\x0a\x00\x00\x00\x0b\x00\x00\x00\x80\x00\x00\x00\x14\x00\x01\x00\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbb\x0a\x00\x02\x00\xbb\xaa\xaa\xaa\xaa\xaa\x00\x00"], 60, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   295] recvfrom(3,  <unfinished ...>
[pid   300] <... prctl resumed>)        = 0
[pid   298] mkdir("./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid   297] mkdir("./0", 0777 <unfinished ...>
[pid   295] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   299] <... sendto resumed>)       = 60
[pid   298] <... mkdir resumed>)        = 0
[pid   295] close(3)                    = 0
[pid   297] <... mkdir resumed>)        = 0
[pid   299] recvfrom(3,  <unfinished ...>
[pid   295] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   298] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   299] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=60, nlmsg_type=0x1c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|0x600, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   295] <... openat resumed>)       = 3
[pid   300] setpgid(0, 0 <unfinished ...>
[pid   298] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   295] write(3, "100000", 6 <unfinished ...>
[pid   299] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0 <unfinished ...>
[pid   295] <... write resumed>)        = 6
[pid   295] close(3)                    = 0
[pid   295] mkdir("./syz-tmp", 0777 <unfinished ...>
[pid   299] <... socket resumed>)       = 4
[pid   298] mkdir("./syz-tmp/pivot", 0777 <unfinished ...>
[pid   295] <... mkdir resumed>)        = 0
[pid   299] ioctl(4, SIOCGIFINDEX, {ifr_name="syz_tun" <unfinished ...>
[pid   295] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid   300] <... setpgid resumed>)      = 0
[pid   299] <... ioctl resumed>, ifr_ifindex=11}) = 0
[pid   298] <... mkdir resumed>)        = 0
[pid   297] <... clone resumed>, child_tidptr=0x55555c043750) = 2
[pid   295] <... mount resumed>)        = 0
[pid   299] close(4 <unfinished ...>
[pid   298] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid   295] mkdir("./syz-tmp/newroot", 0777 <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   295] <... mkdir resumed>)        = 0
[pid   299] sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\xaa\x00\x00"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...>
[pid   298] <... pivot_root resumed>)   = 0
[pid   295] mkdir("./syz-tmp/newroot/dev", 0700) = 0
[pid   295] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid   295] mkdir("./syz-tmp/newroot/proc", 0700) = 0
[pid   295] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL) = 0
[pid   295] mkdir("./syz-tmp/newroot/selinux", 0700) = 0
[pid   295] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid   295] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL./strace-static-x86_64: Process 301 attached
) = 0
[pid   301] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   295] mkdir("./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid   301] <... set_robust_list resumed>) = 0
[pid   299] <... sendto resumed>)       = 44
[pid   298] chdir("/" <unfinished ...>
[pid   295] <... mkdir resumed>)        = 0
[pid   301] chdir("./0" <unfinished ...>
[pid   299] recvfrom(3,  <unfinished ...>
[pid   298] <... chdir resumed>)        = 0
[pid   295] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   301] <... chdir resumed>)        = 0
[pid   299] <... recvfrom resumed>[{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid   298] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid   295] <... mount resumed>)        = 0
[pid   301] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid   300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   295] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   301] <... prctl resumed>)        = 0
[pid   300] <... openat resumed>)       = 3
[pid   299] close(3 <unfinished ...>
[pid   298] <... umount2 resumed>)      = 0
[pid   295] <... mount resumed>)        = 0
[pid   301] setpgid(0, 0 <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] chroot("./newroot" <unfinished ...>
[pid   295] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   301] <... setpgid resumed>)      = 0
[pid   299] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   298] <... chroot resumed>)       = 0
[pid   295] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   298] chdir("/" <unfinished ...>
[pid   295] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   301] <... openat resumed>)       = 3
[pid   299] write(3, "100000", 6 <unfinished ...>
[pid   298] <... chdir resumed>)        = 0
[pid   295] <... mount resumed>)        = 0
[pid   301] write(3, "1000", 4 <unfinished ...>
[pid   299] <... write resumed>)        = 6
[pid   295] mkdir("./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid   301] <... write resumed>)        = 4
[pid   300] write(3, "1000", 4 <unfinished ...>
[pid   299] close(3 <unfinished ...>
[pid   298] mkdir("/dev/gadgetfs", 0777 <unfinished ...>
[pid   295] <... mkdir resumed>)        = 0
[pid   301] close(3 <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   295] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   301] <... close resumed>)        = 0
[pid   299] mkdir("./syz-tmp", 0777 <unfinished ...>
[pid   298] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   295] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   301] read(200,  <unfinished ...>
[pid   295] mkdir("./syz-tmp/pivot", 0777 <unfinished ...>
[pid   301] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   295] <... mkdir resumed>)        = 0
[pid   301] read(200,  <unfinished ...>
[pid   295] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid   301] <... read resumed>0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
executing program
[pid   299] <... mkdir resumed>)        = 0
[pid   298] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid   295] <... pivot_root resumed>)   = 0
[pid   301] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid   299] mount("", "./syz-tmp", "tmpfs", 0, NULL <unfinished ...>
[pid   295] chdir("/" <unfinished ...>
[pid   301] <... symlink resumed>)      = 0
[pid   295] <... chdir resumed>)        = 0
[pid   301] write(1, "executing program\n", 18 <unfinished ...>
[pid   295] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid   301] <... write resumed>)        = 18
[pid   301] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY <unfinished ...>
[pid   298] <... mount resumed>)        = -1 ENODEV (No such device)
[pid   295] <... umount2 resumed>)      = 0
[pid   301] <... openat resumed>)       = 3
[pid   300] <... write resumed>)        = 4
[pid   299] <... mount resumed>)        = 0
[pid   295] chroot("./newroot" <unfinished ...>
[pid   301] ioctl(3, TIOCSETD, [15] <unfinished ...>
[pid   300] close(3 <unfinished ...>
[pid   299] mkdir("./syz-tmp/newroot", 0777 <unfinished ...>
[pid   298] mkdir("/dev/binderfs", 0777 <unfinished ...>
[pid   295] <... chroot resumed>)       = 0
[pid   301] <... ioctl resumed>)        = 0
[pid   295] chdir("/" <unfinished ...>
[pid   301] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) <unfinished ...>
[pid   299] <... mkdir resumed>)        = 0
[pid   298] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   295] <... chdir resumed>)        = 0
[pid   301] <... ioctl resumed>, 0)     = 0
[pid   300] <... close resumed>)        = 0
[pid   295] mkdir("/dev/gadgetfs", 0777 <unfinished ...>
[pid   301] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid   295] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   301] <... openat resumed>)       = 4
[pid   295] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL <unfinished ...>
[pid   301] setns(201, 0 <unfinished ...>
[pid   295] <... mount resumed>)        = -1 ENODEV (No such device)
[pid   301] <... setns resumed>)        = 0
[pid   295] mkdir("/dev/binderfs", 0777 <unfinished ...>
[pid   301] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI <unfinished ...>
[pid   295] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid   301] <... socket resumed>)       = 5
[pid   295] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid   301] setns(4, 0 <unfinished ...>
[pid   295] <... mount resumed>)        = 0
[pid   301] <... setns resumed>)        = 0
[pid   295] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   301] close(4 <unfinished ...>
[pid   295] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   301] <... close resumed>)        = 0
[pid   295] mkdir("./0", 0777 <unfinished ...>
[pid   301] ioctl(5, HCISETAUTH <unfinished ...>
[pid   295] <... mkdir resumed>)        = 0
[pid   295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   300] read(200,  <unfinished ...>
[pid   299] mkdir("./syz-tmp/newroot/dev", 0700 <unfinished ...>
[pid   298] mount("binder", "/dev/binderfs", "binder", 0, NULL <unfinished ...>
[pid   295] <... clone resumed>, child_tidptr=0x55555c043750) = 2
[pid   299] <... mkdir resumed>)        = 0
./strace-static-x86_64: Process 304 attached
[pid   304] set_robust_list(0x55555c043760, 24) = 0
[pid   304] chdir("./0")                = 0
[pid   304] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   304] setpgid(0, 0)               = 0
[pid   304] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[   28.218475][   T28] audit: type=1400 audit(1755163892.070:72): avc:  denied  { mount } for  pid=296 comm="syz-executor229" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[   28.250119][   T28] audit: type=1400 audit(1755163892.070:73): avc:  denied  { mounton } for  pid=296 comm="syz-executor229" path="/root/syzkaller.ZyFqgy/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[pid   300] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   299] mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   298] <... mount resumed>)        = 0
[pid   304] <... openat resumed>)       = 3
[pid   299] <... mount resumed>)        = 0
[pid   298] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL <unfinished ...>
[pid   300] read(200,  <unfinished ...>
[pid   299] mkdir("./syz-tmp/newroot/proc", 0700 <unfinished ...>
[pid   304] write(3, "1000", 4 <unfinished ...>
[pid   298] <... mount resumed>)        = -1 EBUSY (Device or resource busy)
[pid   304] <... write resumed>)        = 4
[pid   299] <... mkdir resumed>)        = 0
[pid   304] close(3 <unfinished ...>
[pid   299] mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL <unfinished ...>
[pid   298] mkdir("./0", 0777 <unfinished ...>
[pid   300] <... read resumed>0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   304] <... close resumed>)        = 0
[pid   304] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   304] symlink("/dev/binderfs", "./binderfs") = 0
[pid   299] <... mount resumed>)        = 0
[pid   304] write(1, "executing program\n", 18 <unfinished ...>
[pid   298] <... mkdir resumed>)        = 0
[pid   300] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
executing program
[pid   299] mkdir("./syz-tmp/newroot/selinux", 0700 <unfinished ...>
[pid   298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   304] <... write resumed>)        = 18
[pid   299] <... mkdir resumed>)        = 0
[pid   304] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3
[pid   304] ioctl(3, TIOCSETD, [15] <unfinished ...>
[pid   299] mount("/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   300] <... symlink resumed>)      = 0
./strace-static-x86_64: Process 306 attached
executing program
[pid   304] <... ioctl resumed>)        = 0
[pid   300] write(1, "executing program\n", 18 <unfinished ...>
[pid   299] <... mount resumed>)        = -1 ENOENT (No such file or directory)
[pid   298] <... clone resumed>, child_tidptr=0x55555c043750) = 2
[pid   300] <... write resumed>)        = 18
[pid   299] mount("/sys/fs/selinux", "./syz-tmp/newroot/selinux", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   304] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) <unfinished ...>
[pid   299] <... mount resumed>)        = 0
[pid   306] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   304] <... ioctl resumed>, 0)     = 0
[pid   300] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY <unfinished ...>
[pid   299] mkdir("./syz-tmp/newroot/sys", 0700 <unfinished ...>
[pid   304] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   299] <... mkdir resumed>)        = 0
[pid   304] setns(201, 0)               = 0
[pid   304] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   300] <... openat resumed>)       = 3
[pid   299] mount("/sys", "./syz-tmp/newroot/sys", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   304] setns(4, 0)                 = 0
[pid   304] close(4)                    = 0
[pid   304] ioctl(5, HCISETAUTH <unfinished ...>
[pid   300] ioctl(3, TIOCSETD, [15] <unfinished ...>
[pid   299] <... mount resumed>)        = 0
[pid   299] mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = 0
[pid   300] <... ioctl resumed>)        = 0
[pid   299] mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid   300] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) <unfinished ...>
[pid   299] mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, MS_BIND|MS_REC|MS_PRIVATE, NULL <unfinished ...>
[pid   306] <... set_robust_list resumed>) = 0
[pid   300] <... ioctl resumed>, 0)     = 0
[pid   299] <... mount resumed>)        = 0
[pid   300] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY <unfinished ...>
[pid   299] mkdir("./syz-tmp/newroot/syz-inputs", 0700 <unfinished ...>
[pid   306] chdir("./0" <unfinished ...>
[pid   299] <... mkdir resumed>)        = 0
[pid   300] <... openat resumed>)       = 4
[pid   299] mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, MS_RDONLY|MS_BIND|MS_REC|MS_PRIVATE, NULL) = -1 ENOENT (No such file or directory)
[pid   300] setns(201, 0 <unfinished ...>
[pid   306] <... chdir resumed>)        = 0
[pid   300] <... setns resumed>)        = 0
[pid   299] mkdir("./syz-tmp/pivot", 0777 <unfinished ...>
[pid   300] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI <unfinished ...>
[pid   299] <... mkdir resumed>)        = 0
[pid   300] <... socket resumed>)       = 5
[pid   299] pivot_root("./syz-tmp", "./syz-tmp/pivot" <unfinished ...>
[pid   300] setns(4, 0 <unfinished ...>
[pid   299] <... pivot_root resumed>)   = 0
[pid   300] <... setns resumed>)        = 0
[pid   299] chdir("/" <unfinished ...>
[pid   300] close(4 <unfinished ...>
[pid   299] <... chdir resumed>)        = 0
[pid   300] <... close resumed>)        = 0
[pid   299] umount2("./pivot", MNT_DETACH <unfinished ...>
[pid   300] ioctl(5, HCISETAUTH <unfinished ...>
[pid   299] <... umount2 resumed>)      = 0
[pid   299] chroot("./newroot")         = 0
[pid   299] chdir("/")                  = 0
[pid   299] mkdir("/dev/gadgetfs", 0777) = -1 EEXIST (File exists)
[pid   299] mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL) = -1 ENODEV (No such device)
[pid   299] mkdir("/dev/binderfs", 0777) = -1 EEXIST (File exists)
[pid   299] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid   299] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid   299] mkdir("./0", 0777)          = 0
[pid   299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 2
./strace-static-x86_64: Process 310 attached
[pid   310] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   306] setpgid(0, 0)               = 0
[pid   306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   310] <... set_robust_list resumed>) = 0
[pid   306] <... openat resumed>)       = 3
[pid   306] write(3, "1000", 4)         = 4
[pid   306] close(3)                    = 0
[pid   306] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   306] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   306] symlink("/dev/binderfs", "./binderfs"executing program
) = 0
[pid   306] write(1, "executing program\n", 18) = 18
[pid   306] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY <unfinished ...>
[pid   310] chdir("./0" <unfinished ...>
[pid   306] <... openat resumed>)       = 3
[pid   306] ioctl(3, TIOCSETD, [15] <unfinished ...>
[pid   310] <... chdir resumed>)        = 0
[pid   306] <... ioctl resumed>)        = 0
[pid   306] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) <unfinished ...>
[pid   310] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   306] <... ioctl resumed>, 0)     = 0
[pid   306] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   306] setns(201, 0)               = 0
[pid   306] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   306] setns(4, 0)                 = 0
[pid   306] close(4)                    = 0
[pid   306] ioctl(5, HCISETAUTH <unfinished ...>
[pid   310] setpgid(0, 0)               = 0
[pid   310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   310] write(3, "1000", 4)         = 4
[pid   310] close(3)                    = 0
[pid   310] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   310] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   310] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid   310] write(1, "executing program\n", 18) = 18
[pid   310] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3
[pid   310] ioctl(3, TIOCSETD, [15])    = 0
[pid   310] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0
[pid   310] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   310] setns(201, 0)               = 0
[pid   310] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   310] setns(4, 0)                 = 0
[pid   310] close(4)                    = 0
[   28.335411][    T8] Bluetooth: hci1: Frame reassembly failed (-84)
[   28.343003][   T43] Bluetooth: hci2: Frame reassembly failed (-84)
[   28.359924][    T8] Bluetooth: hci3: Frame reassembly failed (-84)
[   28.372453][   T43] Bluetooth: hci4: Frame reassembly failed (-84)
[   28.380023][   T43] Bluetooth: hci4: Frame reassembly failed (-84)
[   28.387956][   T43] Bluetooth: hci4: Frame reassembly failed (-84)
[pid   310] ioctl(5, HCISETAUTH <unfinished ...>
[pid   301] <... ioctl resumed>, 0x200000000440) = -1 ETIMEDOUT (Connection timed out)
[   30.389310][  T303] Bluetooth: hci2: Opcode 0x1003 failed: -110
[   30.389310][  T311] Bluetooth: hci4: Opcode 0x1003 failed: -110
[   30.389369][  T303] Bluetooth: hci4: command 0x1003 tx timeout
[   30.395665][  T305] Bluetooth: hci1: Opcode 0x1003 failed: -110
[   30.401900][  T309] Bluetooth: hci3: Opcode 0x1003 failed: -110
[   30.407879][  T307] Bluetooth: hci3: command 0x1003 tx timeout
[   30.413959][  T301] Bluetooth: hci0: Opcode 0x0c20 failed: -110
[   30.433102][   T43] Bluetooth: hci0: Frame reassembly failed (-84)
[pid   301] close(3)                    = 0
[pid   301] close(4)                    = -1 EBADF (Bad file descriptor)
[pid   301] close(5)                    = 0
[pid   301] close(6)                    = -1 EBADF (Bad file descriptor)
[pid   301] close(7)                    = -1 EBADF (Bad file descriptor)
[pid   301] close(8)                    = -1 EBADF (Bad file descriptor)
[pid   301] close(9)                    = -1 EBADF (Bad file descriptor)
[pid   301] close(10)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(11)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(12)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(13)                   = -1 EBADF (Bad file descriptor)
[pid   304] <... ioctl resumed>, 0x200000000440) = -1 EINVAL (Invalid argument)
[pid   301] close(14 <unfinished ...>
[pid   304] close(3 <unfinished ...>
[pid   301] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   301] close(15 <unfinished ...>
[pid   300] <... ioctl resumed>, 0x200000000440) = -1 EINVAL (Invalid argument)
[pid   301] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   301] close(16)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(17 <unfinished ...>
[pid   300] close(3 <unfinished ...>
[pid   301] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   301] close(18)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(19)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(20)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(21)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(22)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(23)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(24)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(25)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(26)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(27)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(28)                   = -1 EBADF (Bad file descriptor)
[pid   301] close(29)                   = -1 EBADF (Bad file descriptor)
[pid   301] exit_group(0)               = ?
[pid   301] +++ exited with 0 +++
[pid   297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
[   32.469368][  T314] Bluetooth: hci0: command 0x0c20 tx timeout
[   32.469368][   T45] Bluetooth: hci0: Opcode 0x1003 failed: -110
[   32.485649][  T304] Bluetooth: hci0: Opcode 0x0c20 failed: -22
[   32.492927][  T300] Bluetooth: hci0: Opcode 0x0c20 failed: -22
[   32.500396][  T306] Bluetooth: hci0: Opcode 0x0c20 failed: -22
[pid   297] restart_syscall(<... resuming interrupted clone ...> <unfinished ...>
[pid   306] <... ioctl resumed>, 0x200000000440) = -1 EINVAL (Invalid argument)
[pid   297] <... restart_syscall resumed>) = 0
[pid   297] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid   297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid   297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0
[pid   297] getdents64(3, 0x55555c0447f0 /* 3 entries */, 32768) = 80
[pid   297] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   306] close(3 <unfinished ...>
[pid   297] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   297] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid   297] unlink("./0/binderfs")      = 0
[pid   297] getdents64(3, 0x55555c0447f0 /* 0 entries */, 32768) = 0
[pid   297] close(3)                    = 0
[pid   297] rmdir("./0")                = 0
[pid   297] mkdir("./1", 0777)          = 0
[pid   297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 3
./strace-static-x86_64: Process 317 attached
[pid   317] set_robust_list(0x55555c043760, 24) = 0
[pid   317] chdir("./1" <unfinished ...>
[pid   310] <... ioctl resumed>, 0x200000000440) = -1 EINVAL (Invalid argument)
[pid   317] <... chdir resumed>)        = 0
[pid   310] close(3 <unfinished ...>
[pid   317] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   317] setpgid(0, 0)               = 0
[pid   317] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   317] write(3, "1000", 4)         = 4
[pid   317] close(3)                    = 0
[pid   317] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   317] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   317] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   317] symlink("/dev/binderfs", "./binderfs") = 0
[pid   317] write(1, "executing program\n", 18executing program
) = 18
[pid   317] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3
[pid   317] ioctl(3, TIOCSETD, [15])    = 0
[pid   317] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0
[pid   317] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   317] setns(201, 0)               = 0
[pid   317] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   317] setns(4, 0)                 = 0
[pid   317] close(4)                    = 0
[   32.514412][  T310] Bluetooth: hci0: Opcode 0x0c20 failed: -22
[   32.537167][  T312] ==================================================================
[   32.537280][  T313] Bluetooth: hci0: Frame reassembly failed (-84)
[   32.546761][  T312] BUG: KASAN: use-after-free in enqueue_timer+0xae/0x480
[   32.546817][  T312] Write of size 8 at addr ffff8881218e8a00 by task kworker/u5:6/312
[   32.546832][  T312] 
[   32.546838][  T312] CPU: 0 PID: 312 Comm: kworker/u5:6 Not tainted 6.1.145-syzkaller-00002-gc750dc582629 #0
[   32.546869][  T312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[   32.546881][  T312] Workqueue: hci0 hci_power_on
[   32.600247][  T312] Call Trace:
[   32.603814][  T312]  <TASK>
[   32.606947][  T312]  __dump_stack+0x21/0x24
[   32.611770][  T312]  dump_stack_lvl+0xee/0x150
[   32.617695][  T312]  ? __cfi_dump_stack_lvl+0x8/0x8
[   32.623248][  T312]  ? select_task_rq_fair+0x56f/0x3490
[   32.629031][  T312]  ? enqueue_timer+0xae/0x480
[   32.634118][  T312]  print_address_description+0x71/0x210
[   32.640335][  T312]  print_report+0x4a/0x60
[   32.645230][  T312]  kasan_report+0x122/0x150
[   32.650026][  T312]  ? enqueue_timer+0xae/0x480
[   32.655822][  T312]  ? try_to_wake_up+0x613/0x1220
[   32.661428][  T312]  __asan_report_store8_noabort+0x17/0x20
[   32.668573][  T312]  enqueue_timer+0xae/0x480
[   32.673502][  T312]  __mod_timer+0x79f/0xb30
[   32.678120][  T312]  schedule_timeout+0x127/0x2e0
[   32.684057][  T312]  ? __cfi_schedule_timeout+0x10/0x10
[   32.689968][  T312]  ? queue_work_on+0xf8/0x140
[   32.695104][  T312]  ? __cfi_process_timeout+0x10/0x10
[   32.701100][  T312]  ? prepare_to_wait_event+0x40b/0x440
[   32.707378][  T312]  __hci_cmd_sync_sk+0x396/0xcf0
[   32.713044][  T312]  ? __cfi___hci_cmd_sync_sk+0x10/0x10
[   32.719494][  T312]  ? __cfi_autoremove_wake_function+0x10/0x10
[   32.726285][  T312]  ? __kasan_check_read+0x11/0x20
[   32.732090][  T312]  ? kvm_sched_clock_read+0x18/0x40
[   32.738304][  T312]  hci_dev_open_sync+0x13a7/0x3260
[   32.744237][  T312]  ? xfd_validate_state+0x70/0x150
[   32.749726][  T312]  ? save_fpregs_to_fpstate+0x192/0x220
[   32.755738][  T312]  ? __cfi_hci_dev_open_sync+0x10/0x10
[   32.761229][  T312]  ? __kasan_check_write+0x14/0x20
[   32.766635][  T312]  ? __switch_to+0x51f/0xe30
[   32.772081][  T312]  ? psi_group_change+0xb73/0x12b0
[   32.777710][  T312]  ? __kasan_check_write+0x14/0x20
[   32.783283][  T312]  ? mutex_lock+0x8d/0x1a0
[   32.788780][  T312]  ? __cfi_mutex_lock+0x10/0x10
[   32.794604][  T312]  ? kthread_data+0x50/0xc0
[   32.800004][  T312]  ? _raw_spin_unlock+0x4c/0x70
[   32.806011][  T312]  hci_power_on+0x195/0x5c0
[   32.811577][  T312]  ? __cfi_hci_power_on+0x10/0x10
[   32.817567][  T312]  ? __schedule+0xb8f/0x14e0
[   32.822539][  T312]  ? __cfi__raw_spin_lock_irq+0x10/0x10
[   32.830243][  T312]  process_one_work+0x71f/0xc40
[   32.835916][  T312]  worker_thread+0xa29/0x11f0
[   32.841963][  T312]  kthread+0x281/0x320
[   32.861107][  T312]  ? __cfi_worker_thread+0x10/0x10
[   32.868172][  T312]  ? __cfi_kthread+0x10/0x10
[   32.873104][  T312]  ret_from_fork+0x1f/0x30
[   32.878531][  T312]  </TASK>
[   32.882823][  T312] 
[   32.885440][  T312] Allocated by task 301:
[   32.889886][  T312]  kasan_set_track+0x4b/0x70
[   32.895065][  T312]  kasan_save_alloc_info+0x25/0x30
[   32.900731][  T312]  __kasan_kmalloc+0x95/0xb0
[   32.906089][  T312]  __kmalloc+0xb1/0x1e0
[   32.911521][  T312]  hci_alloc_dev_priv+0x27/0x1bd0
[   32.917014][  T312]  hci_uart_tty_ioctl+0x3d6/0xa20
[   32.922764][  T312]  tty_ioctl+0x8ef/0xc60
[   32.927674][  T312]  __se_sys_ioctl+0x12f/0x1b0
[   32.933065][  T312]  __x64_sys_ioctl+0x7b/0x90
[   32.937883][  T312]  x64_sys_call+0x58b/0x9a0
[   32.943031][  T312]  do_syscall_64+0x4c/0xa0
[   32.949090][  T312]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   32.955530][  T312] 
[   32.958131][  T312] Freed by task 310:
[   32.963206][  T312]  kasan_set_track+0x4b/0x70
[   32.968490][  T312]  kasan_save_free_info+0x31/0x50
[   32.974343][  T312]  ____kasan_slab_free+0x132/0x180
[   32.980080][  T312]  __kasan_slab_free+0x11/0x20
[   32.985072][  T312]  slab_free_freelist_hook+0xc2/0x190
[   32.991004][  T312]  __kmem_cache_free+0xb7/0x1b0
[   32.996175][  T312]  kfree+0x6f/0xf0
[   33.000342][  T312]  hci_release_dev+0x12a3/0x13b0
[   33.005475][  T312]  bt_host_release+0x82/0x90
[   33.010891][  T312]  device_release+0xa4/0x1d0
[   33.015959][  T312]  kobject_put+0x19d/0x280
[   33.020708][  T312]  put_device+0x1f/0x30
[   33.025390][  T312]  hci_dev_cmd+0x265/0x720
[   33.030352][  T312]  hci_sock_ioctl+0x41e/0x7f0
[   33.035468][  T312]  sock_do_ioctl+0x101/0x310
[   33.040336][  T312]  sock_ioctl+0x4d8/0x6e0
[   33.046326][  T312]  __se_sys_ioctl+0x12f/0x1b0
[   33.051023][  T312]  __x64_sys_ioctl+0x7b/0x90
[   33.057561][  T312]  x64_sys_call+0x58b/0x9a0
[   33.064044][  T312]  do_syscall_64+0x4c/0xa0
[   33.069173][  T312]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   33.076260][  T312] 
[   33.078921][  T312] Last potentially related work creation:
[   33.085181][  T312]  kasan_save_stack+0x3a/0x60
[   33.090480][  T312]  __kasan_record_aux_stack+0xb6/0xc0
[   33.097093][  T312]  kasan_record_aux_stack_noalloc+0xb/0x10
[   33.103787][  T312]  insert_work+0x51/0x300
[   33.108757][  T312]  __queue_work+0x9b1/0xd30
[   33.113827][  T312]  queue_work_on+0xd2/0x140
[   33.118961][  T312]  __hci_cmd_sync_sk+0xa3e/0xcf0
[   33.124249][  T312]  hci_cmd_sync_status+0x53/0x120
[   33.129609][  T312]  hci_dev_cmd+0x628/0x720
[   33.134142][  T312]  hci_sock_ioctl+0x41e/0x7f0
[   33.139428][  T312]  sock_do_ioctl+0x101/0x310
[   33.144289][  T312]  sock_ioctl+0x4d8/0x6e0
[   33.149162][  T312]  __se_sys_ioctl+0x12f/0x1b0
[   33.154193][  T312]  __x64_sys_ioctl+0x7b/0x90
[   33.158871][  T312]  x64_sys_call+0x58b/0x9a0
[   33.163556][  T312]  do_syscall_64+0x4c/0xa0
[   33.168423][  T312]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   33.174505][  T312] 
[   33.176827][  T312] Second to last potentially related work creation:
[   33.184182][  T312]  kasan_save_stack+0x3a/0x60
[   33.189066][  T312]  __kasan_record_aux_stack+0xb6/0xc0
[   33.195167][  T312]  kasan_record_aux_stack_noalloc+0xb/0x10
[   33.201615][  T312]  insert_work+0x51/0x300
[   33.205975][  T312]  __queue_work+0x9b1/0xd30
[   33.210852][  T312]  queue_work_on+0xd2/0x140
[   33.215534][  T312]  __hci_cmd_sync_sk+0xa3e/0xcf0
[   33.220813][  T312]  hci_cmd_sync_status+0x53/0x120
[   33.226449][  T312]  hci_dev_cmd+0x628/0x720
[   33.231221][  T312]  hci_sock_ioctl+0x41e/0x7f0
[   33.235999][  T312]  sock_do_ioctl+0x101/0x310
[   33.240593][  T312]  sock_ioctl+0x4d8/0x6e0
[   33.244923][  T312]  __se_sys_ioctl+0x12f/0x1b0
[   33.249595][  T312]  __x64_sys_ioctl+0x7b/0x90
[   33.254190][  T312]  x64_sys_call+0x58b/0x9a0
[   33.258698][  T312]  do_syscall_64+0x4c/0xa0
[   33.263115][  T312]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   33.269027][  T312] 
[   33.271425][  T312] The buggy address belongs to the object at ffff8881218e8000
[   33.271425][  T312]  which belongs to the cache kmalloc-8k of size 8192
[   33.285938][  T312] The buggy address is located 2560 bytes inside of
[   33.285938][  T312]  8192-byte region [ffff8881218e8000, ffff8881218ea000)
[   33.299686][  T312] 
[   33.302012][  T312] The buggy address belongs to the physical page:
[   33.308550][  T312] page:ffffea0004863a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1218e8
[   33.319043][  T312] head:ffffea0004863a00 order:3 compound_mapcount:0 compound_pincount:0
[   33.327374][  T312] flags: 0x4000000000010200(slab|head|zone=1)
[   33.333469][  T312] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043500
[   33.342080][  T312] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000
[   33.350842][  T312] page dumped because: kasan: bad access detected
[   33.357339][  T312] page_owner tracks the page as allocated
[   33.363137][  T312] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 295, tgid 295 (syz-executor229), ts 28293313661, free_ts 20514309329
[   33.385105][  T312]  post_alloc_hook+0x1f5/0x210
[   33.389889][  T312]  prep_new_page+0x1c/0x110
[   33.394686][  T312]  get_page_from_freelist+0x2c7b/0x2cf0
[   33.400332][  T312]  __alloc_pages+0x1c3/0x450
[   33.404963][  T312]  alloc_slab_page+0x6e/0xf0
[   33.409703][  T312]  new_slab+0x98/0x3d0
[   33.414000][  T312]  ___slab_alloc+0x6f6/0xb50
[   33.419046][  T312]  __slab_alloc+0x5e/0xa0
[   33.423478][  T312]  __kmem_cache_alloc_node+0x203/0x2c0
[   33.428960][  T312]  __kmalloc_node+0xa1/0x1e0
[   33.433917][  T312]  kvmalloc_node+0x294/0x480
[   33.438603][  T312]  pfifo_fast_init+0x3af/0x7a0
[   33.443687][  T312]  qdisc_create_dflt+0x150/0x3b0
[   33.448742][  T312]  dev_activate+0x2cf/0x1040
[   33.453431][  T312]  __dev_open+0x3ce/0x4f0
[   33.457853][  T312]  __dev_change_flags+0x21b/0x6b0
[   33.462976][  T312] page last free stack trace:
[   33.467746][  T312]  free_unref_page_prepare+0x742/0x750
[   33.473204][  T312]  free_unref_page+0x8f/0x530
[   33.478054][  T312]  free_compound_page+0x99/0xd0
[   33.482901][  T312]  destroy_large_folio+0x68/0xa0
[   33.487842][  T312]  __folio_put+0xd1/0xe0
[   33.492084][  T312]  skb_release_data+0x47f/0x890
[   33.496969][  T312]  skb_attempt_defer_free+0x10e/0x410
[   33.502360][  T312]  tcp_recvmsg_locked+0x126f/0x23b0
[   33.507553][  T312]  tcp_recvmsg+0x20e/0x810
[   33.512049][  T312]  inet_recvmsg+0x13b/0x470
[   33.516638][  T312]  sock_read_iter+0x2d3/0x380
[   33.521412][  T312]  vfs_read+0x41e/0x8c0
[   33.525746][  T312]  ksys_read+0x140/0x240
[   33.530005][  T312]  __x64_sys_read+0x7b/0x90
[   33.534597][  T312]  x64_sys_call+0x2f/0x9a0
[   33.539016][  T312]  do_syscall_64+0x4c/0xa0
[   33.543711][  T312] 
[   33.546129][  T312] Memory state around the buggy address:
[   33.552030][  T312]  ffff8881218e8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   33.560260][  T312]  ffff8881218e8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[pid   317] ioctl(5, HCISETAUTH <unfinished ...>
[pid   295] kill(-2, SIGKILL)           = 0
[pid   299] kill(-2, SIGKILL <unfinished ...>
[pid   298] kill(-2, SIGKILL <unfinished ...>
[pid   296] kill(-2, SIGKILL <unfinished ...>
[pid   295] kill(2, SIGKILL <unfinished ...>
[pid   299] <... kill resumed>)         = 0
[pid   298] <... kill resumed>)         = 0
[pid   296] <... kill resumed>)         = 0
[pid   295] <... kill resumed>)         = 0
[pid   299] kill(2, SIGKILL <unfinished ...>
[pid   296] kill(2, SIGKILL <unfinished ...>
[pid   299] <... kill resumed>)         = 0
[pid   298] kill(2, SIGKILL <unfinished ...>
[pid   296] <... kill resumed>)         = 0
[pid   298] <... kill resumed>)         = 0
[   33.568317][  T312] >ffff8881218e8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   33.576370][  T312]                    ^
[   33.580549][  T312]  ffff8881218e8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   33.588701][  T312]  ffff8881218e8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   33.596858][  T312] ==================================================================
[   33.605257][  T312] Disabling lock debugging due to kernel taint
[   33.619028][   T28] kauditd_printk_skb: 10 callbacks suppressed
[pid   304] <... close resumed>)        = ?
[pid   304] +++ killed by SIGKILL +++
[pid   295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=2, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=2} ---
[pid   295] restart_syscall(<... resuming interrupted kill ...>) = 0
[pid   295] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid   295] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
[pid   295] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0
[pid   295] getdents64(3, 0x55555c0447f0 /* 3 entries */, 32768) = 80
[pid   295] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[pid   295] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid   295] unlink("./0/binderfs")      = 0
[pid   295] getdents64(3, 0x55555c0447f0 /* 0 entries */, 32768) = 0
[pid   295] close(3)                    = 0
[pid   295] rmdir("./0")                = 0
[pid   295] mkdir("./1", 0777)          = 0
[   33.619043][   T28] audit: type=1400 audit(1755163897.630:84): avc:  denied  { read } for  pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[   33.648041][   T28] audit: type=1400 audit(1755163897.630:85): avc:  denied  { search } for  pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[pid   295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555c043750) = 3
./strace-static-x86_64: Process 318 attached
[pid   318] set_robust_list(0x55555c043760, 24) = 0
[pid   318] chdir("./1")                = 0
[pid   318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   318] setpgid(0, 0)               = 0
[pid   318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   318] write(3, "1000", 4)         = 4
[pid   318] close(3)                    = 0
[pid   318] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   318] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
executing program
[pid   318] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   318] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   318] symlink("/dev/binderfs", "./binderfs") = 0
[pid   318] write(1, "executing program\n", 18) = 18
[pid   318] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3
[pid   318] ioctl(3, TIOCSETD, [15])    = 0
[pid   318] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0
[pid   318] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   318] setns(201, 0)               = 0
[pid   318] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   318] setns(4, 0)                 = 0
[pid   318] close(4)                    = 0
[pid   318] ioctl(5, HCISETAUTH <unfinished ...>
[pid   310] <... close resumed>)        = ?
[pid   306] <... close resumed>)        = ?
[pid   300] <... close resumed>)        = ?
[pid   310] +++ killed by SIGKILL +++
[pid   306] +++ killed by SIGKILL +++
[pid   300] +++ killed by SIGKILL +++
[pid   299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=2, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid   298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=2, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid   296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=2, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} ---
[pid   299] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   298] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   296] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   299] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   298] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   296] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   299] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid   298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid   296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY <unfinished ...>
[pid   299] <... openat resumed>)       = 3
[pid   298] <... openat resumed>)       = 3
[pid   296] <... openat resumed>)       = 3
[   33.669840][   T28] audit: type=1400 audit(1755163897.640:86): avc:  denied  { write } for  pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   33.691559][  T313] Bluetooth: hci1: Frame reassembly failed (-84)
[   33.692244][   T28] audit: type=1400 audit(1755163897.640:87): avc:  denied  { add_name } for  pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[pid   299] newfstatat(3, "",  <unfinished ...>
[pid   298] newfstatat(3, "",  <unfinished ...>
[pid   296] newfstatat(3, "",  <unfinished ...>
[pid   299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0
[pid   298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0
[pid   296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=60, ...}, AT_EMPTY_PATH) = 0
[pid   299] getdents64(3,  <unfinished ...>
[pid   298] getdents64(3,  <unfinished ...>
[pid   296] getdents64(3,  <unfinished ...>
[pid   299] <... getdents64 resumed>0x55555c0447f0 /* 3 entries */, 32768) = 80
[pid   298] <... getdents64 resumed>0x55555c0447f0 /* 3 entries */, 32768) = 80
[pid   296] <... getdents64 resumed>0x55555c0447f0 /* 3 entries */, 32768) = 80
[pid   299] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   298] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   296] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW <unfinished ...>
[pid   299] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   298] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   296] <... umount2 resumed>)      = -1 EINVAL (Invalid argument)
[pid   299] newfstatat(AT_FDCWD, "./0/binderfs",  <unfinished ...>
[pid   298] newfstatat(AT_FDCWD, "./0/binderfs",  <unfinished ...>
[pid   296] newfstatat(AT_FDCWD, "./0/binderfs",  <unfinished ...>
[pid   299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid   298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid   296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[pid   299] unlink("./0/binderfs" <unfinished ...>
[pid   298] unlink("./0/binderfs" <unfinished ...>
[pid   296] unlink("./0/binderfs" <unfinished ...>
[pid   299] <... unlink resumed>)       = 0
[pid   298] <... unlink resumed>)       = 0
[pid   296] <... unlink resumed>)       = 0
[pid   299] getdents64(3,  <unfinished ...>
[pid   298] getdents64(3,  <unfinished ...>
[pid   296] getdents64(3,  <unfinished ...>
[pid   299] <... getdents64 resumed>0x55555c0447f0 /* 0 entries */, 32768) = 0
[pid   298] <... getdents64 resumed>0x55555c0447f0 /* 0 entries */, 32768) = 0
[pid   296] <... getdents64 resumed>0x55555c0447f0 /* 0 entries */, 32768) = 0
[pid   299] close(3 <unfinished ...>
[pid   298] close(3 <unfinished ...>
[pid   296] close(3 <unfinished ...>
[pid   299] <... close resumed>)        = 0
[pid   298] <... close resumed>)        = 0
[pid   296] <... close resumed>)        = 0
[pid   299] rmdir("./0" <unfinished ...>
[pid   298] rmdir("./0" <unfinished ...>
[pid   296] rmdir("./0" <unfinished ...>
[pid   299] <... rmdir resumed>)        = 0
[pid   298] <... rmdir resumed>)        = 0
[pid   296] <... rmdir resumed>)        = 0
[pid   299] mkdir("./1", 0777 <unfinished ...>
[pid   298] mkdir("./1", 0777executing program
 <unfinished ...>
[pid   296] mkdir("./1", 0777 <unfinished ...>
[pid   299] <... mkdir resumed>)        = 0
[pid   298] <... mkdir resumed>)        = 0
[pid   296] <... mkdir resumed>)        = 0
[pid   299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid   299] <... clone resumed>, child_tidptr=0x55555c043750) = 3
[pid   298] <... clone resumed>, child_tidptr=0x55555c043750) = 3
[pid   296] <... clone resumed>, child_tidptr=0x55555c043750) = 3
./strace-static-x86_64: Process 321 attached
[pid   321] set_robust_list(0x55555c043760, 24) = 0
[pid   321] chdir("./1")                = 0
[pid   321] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   321] setpgid(0, 0)               = 0
[pid   321] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   321] write(3, "1000", 4)         = 4
[pid   321] close(3)                    = 0
[pid   321] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
./strace-static-x86_64: Process 320 attached
[pid   321] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   320] set_robust_list(0x55555c043760, 24 <unfinished ...>
[pid   321] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   321] symlink("/dev/binderfs", "./binderfs" <unfinished ...>
[pid   320] <... set_robust_list resumed>) = 0
[pid   321] <... symlink resumed>)      = 0
[pid   320] chdir("./1")                = 0
[pid   320] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   321] write(1, "executing program\n", 18 <unfinished ...>
[pid   320] setpgid(0, 0 <unfinished ...>
[pid   321] <... write resumed>)        = 18
[pid   321] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY <unfinished ...>
[pid   320] <... setpgid resumed>)      = 0
[pid   320] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid   321] <... openat resumed>)       = 3
[pid   320] <... openat resumed>)       = 3
[pid   320] write(3, "1000", 4)         = 4
./strace-static-x86_64: Process 319 attached
[pid   319] set_robust_list(0x55555c043760, 24) = 0
[pid   319] chdir("./1")                = 0
[pid   319] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   319] setpgid(0, 0)               = 0
[pid   319] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   319] write(3, "1000", 4)         = 4
[pid   319] close(3)                    = 0
[pid   319] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   319] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   319] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   319] symlink("/dev/binderfs", "./binderfs"executing program
) = 0
[pid   319] write(1, "executing program\n", 18) = 18
[pid   319] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3
[pid   319] ioctl(3, TIOCSETD, [15])    = 0
[pid   319] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0
[pid   319] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   319] setns(201, 0)               = 0
[pid   319] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   319] setns(4, 0)                 = 0
[pid   319] close(4 <unfinished ...>
[pid   320] close(3 <unfinished ...>
[pid   319] <... close resumed>)        = 0
[pid   321] ioctl(3, TIOCSETD, [15] <unfinished ...>
[pid   320] <... close resumed>)        = 0
[pid   319] ioctl(5, HCISETAUTH <unfinished ...>
[pid   320] read(200,  <unfinished ...>
[pid   321] <... ioctl resumed>)        = 0
[pid   320] <... read resumed>"\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   321] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) <unfinished ...>
[pid   320] read(200, "\x33\x33\x00\x00\x00\x16\xaa\xaa\xaa\xaa\xaa\xaa\x86\xdd\x60\x00\x00\x00\x00\x38\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaa\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\xc2\x46\x00\x00\x00\x02\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xff\xaa\xaa\xaa\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00"..., 1000) = 110
[pid   320] read(200, 0x7fff6de7d310, 1000) = -1 EAGAIN (Resource temporarily unavailable)
[pid   320] symlink("/dev/binderfs", "./binderfs"executing program
) = 0
[pid   320] write(1, "executing program\n", 18) = 18
[pid   320] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3
[pid   320] ioctl(3, TIOCSETD, [15])    = 0
[pid   320] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) <unfinished ...>
[pid   321] <... ioctl resumed>, 0)     = 0
[pid   321] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   321] setns(201, 0)               = 0
[pid   321] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   321] setns(4, 0)                 = 0
[pid   321] close(4)                    = 0
[pid   321] ioctl(5, HCISETAUTH <unfinished ...>
[pid   320] <... ioctl resumed>, 0)     = 0
[pid   320] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4
[pid   320] setns(201, 0)               = 0
[pid   320] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5
[pid   320] setns(4, 0)                 = 0
[pid   320] close(4)                    = 0
[   33.720061][   T28] audit: type=1400 audit(1755163897.640:88): avc:  denied  { create } for  pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[   33.742312][   T28] audit: type=1400 audit(1755163897.640:89): avc:  denied  { append open } for  pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[   33.766991][   T28] audit: type=1400 audit(1755163897.640:90): avc:  denied  { getattr } for  pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[   33.767216][  T313] Bluetooth: hci2: Frame reassembly failed (-84)
[   33.798928][   T10] Bluetooth: hci3: Frame reassembly failed (-84)
[   33.798987][   T43] Bluetooth: hci4: Frame reassembly failed (-84)
[   34.549329][    C0] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
[   34.561587][    C0] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[   34.570186][    C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B              6.1.145-syzkaller-00002-gc750dc582629 #0
[   34.581825][    C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[   34.592132][    C0] RIP: 0010:__queue_work+0x575/0xd30
[   34.597597][    C0] Code: 39 2b 0f 84 b9 00 00 00 e8 28 d7 28 00 4c 89 ff e8 50 60 ac 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 4c 3a 6d 00 49 8b 7d 00 e8 33 5c
[   34.617288][    C0] RSP: 0018:ffffc90000007c70 EFLAGS: 00010046
[   34.623344][    C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff86e1c500
[   34.629349][  T312] Bluetooth: hci0: Opcode 0x1003 failed: -110
[   34.631312][    C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff
[   34.645556][    C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007
[   34.653793][    C0] R10: ffffed102431d139 R11: 1ffff1102431d139 R12: dffffc0000000000
[   34.661834][    C0] R13: 0000000000000000 R14: ffff8881218e89c8 R15: 0000000000000008
[   34.669910][    C0] FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[   34.678890][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   34.685658][    C0] CR2: 000055555c043750 CR3: 000000010a0be000 CR4: 00000000003506b0
[   34.693997][    C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   34.702352][    C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   34.712548][    C0] Call Trace:
[   34.715947][    C0]  <IRQ>
[   34.718999][    C0]  delayed_work_timer_fn+0x61/0x80
[   34.724509][    C0]  ? __cfi_delayed_work_timer_fn+0x10/0x10
[   34.730323][    C0]  call_timer_fn+0x46/0x2a0
[   34.734925][    C0]  ? __cfi_delayed_work_timer_fn+0x10/0x10
[   34.741181][    C0]  __run_timers+0x667/0x9a0
[   34.745859][    C0]  ? calc_index+0x200/0x200
[   34.750448][    C0]  ? kvm_sched_clock_read+0x18/0x40
[   34.755752][    C0]  run_timer_softirq+0x6a/0xf0
[   34.760564][    C0]  handle_softirqs+0x1d7/0x600
[   34.765601][    C0]  ? irqtime_account_irq+0xc4/0x240
[   34.771012][    C0]  __irq_exit_rcu+0x52/0xf0
[   34.775528][    C0]  irq_exit_rcu+0x9/0x10
[   34.779908][    C0]  sysvec_apic_timer_interrupt+0xa9/0xc0
[   34.785542][    C0]  </IRQ>
[   34.788601][    C0]  <TASK>
[   34.791798][    C0]  asm_sysvec_apic_timer_interrupt+0x1b/0x20
[   34.798144][    C0] RIP: 0010:default_idle+0xf/0x20
[   34.803463][    C0] Code: e9 47 ff ff ff 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 d2 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
[   34.823854][    C0] RSP: 0018:ffffffff86e07d58 EFLAGS: 00000257
[   34.830222][    C0] RAX: ffff8881f7000000 RBX: ffffffff86e1c500 RCX: 1c9d18ac5b8f5500
[   34.838380][    C0] RDX: 0000000000000001 RSI: ffffffff85aa0bc0 RDI: ffffffff85aa0b80
[   34.846358][    C0] RBP: ffffffff86e07d58 R08: dffffc0000000000 R09: ffffed103ee06917
[   34.854673][    C0] R10: 0000000000000000 R11: ffffffff84f36120 R12: 0000000000000000
[   34.863020][    C0] R13: 0000000000000000 R14: ffffffff86e1c500 R15: dffffc0000000000
[   34.871440][    C0]  ? __cfi_default_idle+0x10/0x10
[   34.876478][    C0]  arch_cpu_idle+0x1c/0x20
[   34.880898][    C0]  default_idle_call+0x71/0x1d0
[   34.885851][    C0]  do_idle+0x1a7/0x520
[   34.889911][    C0]  ? idle_inject_timer_fn+0x60/0x60
[   34.895211][    C0]  ? debug_smp_processor_id+0x17/0x20
[   34.900705][    C0]  cpu_startup_entry+0x43/0x60
[   34.906043][    C0]  rest_init+0x10a/0x130
[   34.910287][    C0]  ? __cfi_x86_late_time_init+0x8/0x8
[   34.915710][    C0]  arch_call_rest_init+0xe/0x10
[   34.920570][    C0]  start_kernel+0x482/0x4f0
[   34.925269][    C0]  x86_64_start_reservations+0x2a/0x2c
[   34.930875][    C0]  x86_64_start_kernel+0x7c/0x81
[   34.935844][    C0]  secondary_startup_64_no_verify+0xce/0xdb
[   34.941750][    C0]  </TASK>
[   34.944885][    C0] Modules linked in:
[   34.949061][    C0] ---[ end trace 0000000000000000 ]---
[   34.954512][    C0] RIP: 0010:__queue_work+0x575/0xd30
[   34.959965][    C0] Code: 39 2b 0f 84 b9 00 00 00 e8 28 d7 28 00 4c 89 ff e8 50 60 ac 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 4c 3a 6d 00 49 8b 7d 00 e8 33 5c
[   34.980022][    C0] RSP: 0018:ffffc90000007c70 EFLAGS: 00010046
[   34.986287][    C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff86e1c500
[   34.994385][    C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff
[   35.002446][    C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007
[   35.010520][    C0] R10: ffffed102431d139 R11: 1ffff1102431d139 R12: dffffc0000000000
[   35.018599][    C0] R13: 0000000000000000 R14: ffff8881218e89c8 R15: 0000000000000008
[   35.026602][    C0] FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[   35.035704][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   35.042476][    C0] CR2: 000055555c043750 CR3: 000000010a0be000 CR4: 00000000003506b0
[   35.050746][    C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   35.058972][    C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   35.067311][    C0] Kernel panic - not syncing: Fatal exception in interrupt
[   35.075630][    C0] Kernel Offset: disabled
[   35.080161][    C0] Rebooting in 86400 seconds..