./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2609147806 <...> syzkaller syzkaller login: [ 13.330072][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 13.330084][ T28] audit: type=1400 audit(1755170742.045:59): avc: denied { transition } for pid=225 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.334115][ T28] audit: type=1400 audit(1755170742.045:60): avc: denied { noatsecure } for pid=225 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.336787][ T28] audit: type=1400 audit(1755170742.055:61): avc: denied { write } for pid=225 comm="sh" path="pipe:[12890]" dev="pipefs" ino=12890 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.339771][ T28] audit: type=1400 audit(1755170742.055:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.342375][ T28] audit: type=1400 audit(1755170742.055:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.992619][ T274] sshd-session (274) used greatest stack depth: 22048 bytes left Warning: Permanently added '10.128.1.42' (ED25519) to the list of known hosts. execve("./syz-executor2609147806", ["./syz-executor2609147806"], 0x7ffd7f1e3020 /* 10 vars */) = 0 brk(NULL) = 0x55557922f000 brk(0x55557922fd40) = 0x55557922fd40 arch_prctl(ARCH_SET_FS, 0x55557922f3c0) = 0 set_tid_address(0x55557922f690) = 290 set_robust_list(0x55557922f6a0, 24) = 0 rseq(0x55557922fce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2609147806", 4096) = 28 getrandom("\x76\xa4\x7c\xc4\xd9\x9a\xf1\xa0", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557922fd40 brk(0x555579250d40) = 0x555579250d40 brk(0x555579251000) = 0x555579251000 mprotect(0x7f272aea8000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557922f690) = 291 ./strace-static-x86_64: Process 291 attached [pid 291] set_robust_list(0x55557922f6a0, 24) = 0 [pid 291] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 291] getppid() = 0 [pid 291] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 291] dup2(3, 201) = 201 [pid 291] close(3) = 0 [pid 291] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 291] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 291] unshare(CLONE_NEWNS) = 0 [pid 291] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 291] unshare(CLONE_NEWIPC) = -1 EINVAL (Invalid argument) [pid 291] unshare(CLONE_NEWCGROUP) = 0 [pid 291] unshare(CLONE_NEWUTS) = 0 [pid 291] unshare(CLONE_SYSVSEM) = 0 [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 291] getpid() = 1 [pid 291] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< {parent_tid=[3]}, 88) = 3 [pid 292] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 292] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 293 attached [pid 293] set_robust_list(0x7f272ade49a0, 24) = 0 [pid 293] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 293] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3 [pid 293] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 292] <... futex resumed>) = 0 [pid 292] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] <... futex resumed>) = 1 [pid 293] ioctl(3, TIOCSETD, [15]) = 0 [pid 293] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 292] <... futex resumed>) = 0 [pid 292] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] <... futex resumed>) = 1 [pid 293] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0 [pid 293] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 292] <... futex resumed>) = 0 [pid 292] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] <... futex resumed>) = 1 [pid 293] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4 [pid 293] setns(201, 0) = 0 [pid 293] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5 [pid 293] setns(4, 0) = 0 [pid 293] close(4) = 0 [pid 293] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000 [pid 292] <... futex resumed>) = 0 [pid 292] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 293] <... futex resumed>) = 1 [ 29.768045][ T28] audit: type=1400 audit(1755170758.445:66): avc: denied { open } for pid=291 comm="syz-executor260" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.770389][ T291] request_module fs-gadgetfs succeeded, but still no fs? [ 29.791519][ T28] audit: type=1400 audit(1755170758.445:67): avc: denied { mounton } for pid=291 comm="syz-executor260" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [pid 293] ioctl(5, HCISETAUTH [pid 292] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 292] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [ 29.820712][ T28] audit: type=1400 audit(1755170758.465:68): avc: denied { mounton } for pid=291 comm="syz-executor260" path="/root/syz-tmp" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 29.843586][ T28] audit: type=1400 audit(1755170758.465:69): avc: denied { mount } for pid=291 comm="syz-executor260" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 29.865651][ T28] audit: type=1400 audit(1755170758.465:70): avc: denied { mounton } for pid=291 comm="syz-executor260" path="/root/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 29.889473][ T28] audit: type=1400 audit(1755170758.465:71): avc: denied { mount } for pid=291 comm="syz-executor260" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 29.911423][ T28] audit: type=1400 audit(1755170758.465:72): avc: denied { mounton } for pid=291 comm="syz-executor260" path="/root/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 29.936628][ T28] audit: type=1400 audit(1755170758.465:73): avc: denied { mounton } for pid=291 comm="syz-executor260" path="/root/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=13026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [pid 292] close(3 [pid 293] <... ioctl resumed>, 0x200000000440) = -1 ETIMEDOUT (Connection timed out) [pid 293] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 292] <... close resumed>) = 0 [pid 293] futex(0x7f272aeae328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 292] close(4) = -1 EBADF (Bad file descriptor) [pid 292] close(5) = 0 [pid 292] close(6) = -1 EBADF (Bad file descriptor) [pid 292] close(7) = -1 EBADF (Bad file descriptor) [pid 292] close(8) = -1 EBADF (Bad file descriptor) [pid 292] close(9) = -1 EBADF (Bad file descriptor) [pid 292] close(10) = -1 EBADF (Bad file descriptor) [pid 292] close(11) = -1 EBADF (Bad file descriptor) [pid 292] close(12) = -1 EBADF (Bad file descriptor) [pid 292] close(13) = -1 EBADF (Bad file descriptor) [pid 292] close(14) = -1 EBADF (Bad file descriptor) [pid 292] close(15) = -1 EBADF (Bad file descriptor) [pid 292] close(16) = -1 EBADF (Bad file descriptor) [pid 292] close(17) = -1 EBADF (Bad file descriptor) [pid 292] close(18) = -1 EBADF (Bad file descriptor) [pid 292] close(19) = -1 EBADF (Bad file descriptor) [pid 292] close(20) = -1 EBADF (Bad file descriptor) [pid 292] close(21) = -1 EBADF (Bad file descriptor) [pid 292] close(22) = -1 EBADF (Bad file descriptor) [pid 292] close(23) = -1 EBADF (Bad file descriptor) [pid 292] close(24) = -1 EBADF (Bad file descriptor) [pid 292] close(25) = -1 EBADF (Bad file descriptor) [pid 292] close(26) = -1 EBADF (Bad file descriptor) [pid 292] close(27) = -1 EBADF (Bad file descriptor) [pid 292] close(28) = -1 EBADF (Bad file descriptor) [pid 292] close(29) = -1 EBADF (Bad file descriptor) [pid 292] exit_group(0 [pid 293] <... futex resumed>) = ? [pid 292] <... exit_group resumed>) = ? [pid 293] +++ exited with 0 +++ [pid 292] +++ exited with 0 +++ [pid 291] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 291] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 291] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557922f690) = 4 ./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x55557922f6a0, 24) = 0 [pid 297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] setpgid(0, 0) = 0 [pid 297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 297] write(3, "1000", 4) = 4 [pid 297] close(3executing program ) = 0 [pid 297] write(1, "executing program\n", 18) = 18 [pid 297] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] rt_sigaction(SIGRT_1, {sa_handler=0x7f272ae49ae0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f272ae3b160}, NULL, 8) = 0 [pid 297] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 297] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f272adc4000 [pid 297] mprotect(0x7f272adc5000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 297] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f272ade4990, parent_tid=0x7f272ade4990, exit_signal=0, stack=0x7f272adc4000, stack_size=0x20300, tls=0x7f272ade46c0}./strace-static-x86_64: Process 298 attached => {parent_tid=[5]}, 88) = 5 [pid 297] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 297] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] set_robust_list(0x7f272ade49a0, 24) = 0 [pid 298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY) = 3 [pid 298] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 297] <... futex resumed>) = 0 [pid 298] futex(0x7f272aeae328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... futex resumed>) = 0 [pid 298] ioctl(3, TIOCSETD, [15]) = 0 [pid 298] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 297] <... futex resumed>) = 0 [pid 297] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4) [pid 297] <... futex resumed>) = 0 [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... ioctl resumed>, 0) = 0 [pid 298] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 297] <... futex resumed>) = 0 [pid 297] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4 [pid 298] setns(201, 0) = 0 [pid 298] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5 [pid 298] setns(4, 0) = 0 [pid 298] close(4) = 0 [pid 298] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 297] <... futex resumed>) = 0 [pid 297] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] ioctl(5, HCISETAUTH [pid 297] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 297] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [ 31.830531][ T293] Bluetooth: hci0: Opcode 0x0c20 failed: -110 [ 31.858292][ T43] Bluetooth: hci0: Frame reassembly failed (-84) [pid 297] close(3) = 0 [pid 297] close(4) = -1 EBADF (Bad file descriptor) [pid 297] close(5) = 0 [pid 297] close(6) = -1 EBADF (Bad file descriptor) [pid 297] close(7) = -1 EBADF (Bad file descriptor) [pid 297] close(8) = -1 EBADF (Bad file descriptor) [pid 297] close(9) = -1 EBADF (Bad file descriptor) [pid 297] close(10) = -1 EBADF (Bad file descriptor) [pid 297] close(11) = -1 EBADF (Bad file descriptor) [pid 297] close(12) = -1 EBADF (Bad file descriptor) [pid 297] close(13) = -1 EBADF (Bad file descriptor) [pid 297] close(14) = -1 EBADF (Bad file descriptor) [pid 297] close(15) = -1 EBADF (Bad file descriptor) [pid 297] close(16) = -1 EBADF (Bad file descriptor) [pid 297] close(17) = -1 EBADF (Bad file descriptor) [pid 297] close(18) = -1 EBADF (Bad file descriptor) [pid 297] close(19) = -1 EBADF (Bad file descriptor) [pid 297] close(20) = -1 EBADF (Bad file descriptor) [pid 297] close(21) = -1 EBADF (Bad file descriptor) [pid 297] close(22) = -1 EBADF (Bad file descriptor) [pid 297] close(23) = -1 EBADF (Bad file descriptor) [pid 297] close(24) = -1 EBADF (Bad file descriptor) [pid 297] close(25) = -1 EBADF (Bad file descriptor) [pid 297] close(26) = -1 EBADF (Bad file descriptor) [pid 297] close(27) = -1 EBADF (Bad file descriptor) [pid 297] close(28) = -1 EBADF (Bad file descriptor) [pid 297] close(29) = -1 EBADF (Bad file descriptor) [pid 297] exit_group(0) = ? [pid 298] <... ioctl resumed> ) = ? [pid 298] +++ exited with 0 +++ [pid 297] +++ exited with 0 +++ [pid 291] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 291] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 291] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55557922f690) = 6 ./strace-static-x86_64: Process 300 attached [pid 300] set_robust_list(0x55557922f6a0, 24) = 0 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] write(3, "1000", 4) = 4 [pid 300] close(3executing program ) = 0 [pid 300] write(1, "executing program\n", 18) = 18 [pid 300] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] rt_sigaction(SIGRT_1, {sa_handler=0x7f272ae49ae0, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f272ae3b160}, NULL, 8) = 0 [pid 300] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f272adc4000 [pid 300] mprotect(0x7f272adc5000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f272ade4990, parent_tid=0x7f272ade4990, exit_signal=0, stack=0x7f272adc4000, stack_size=0x20300, tls=0x7f272ade46c0}./strace-static-x86_64: Process 301 attached [pid 301] set_robust_list(0x7f272ade49a0, 24 [pid 300] <... clone3 resumed> => {parent_tid=[7]}, 88) = 7 [pid 301] <... set_robust_list resumed>) = 0 [pid 300] rt_sigprocmask(SIG_SETMASK, [], [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] openat(AT_FDCWD, "/dev/ptmx", O_RDONLY [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... openat resumed>) = 3 [pid 301] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 301] futex(0x7f272aeae328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... futex resumed>) = 0 [pid 301] ioctl(3, TIOCSETD, [15]) = 0 [pid 301] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 301] futex(0x7f272aeae328, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... futex resumed>) = 0 [pid 301] ioctl(3, _IOC(_IOC_WRITE, 0x55, 0xc8, 0x4), 0) = 0 [pid 301] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 4 [pid 301] setns(201, 0) = 0 [pid 301] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 5 [pid 301] setns(4, 0) = 0 [pid 301] close(4) = 0 [pid 301] futex(0x7f272aeae32c, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f272aeae328, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 33.910567][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 33.910640][ T296] Bluetooth: hci0: command 0x1003 tx timeout [ 33.922940][ T298] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 33.944887][ T45] ================================================================== [ 33.952966][ T45] BUG: KASAN: use-after-free in enqueue_timer+0xae/0x480 [pid 301] ioctl(5, HCISETAUTH [pid 300] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 300] futex(0x7f272aeae32c, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [ 33.959983][ T45] Write of size 8 at addr ffff888111718a00 by task kworker/u5:0/45 [ 33.967845][ T45] [ 33.970151][ T45] CPU: 0 PID: 45 Comm: kworker/u5:0 Not tainted 6.1.145-syzkaller-00002-gc750dc582629 #0 [ 33.979927][ T45] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 33.989955][ T45] Workqueue: hci0 hci_cmd_work [ 33.994721][ T45] Call Trace: [ 33.997982][ T45] [ 34.000895][ T45] __dump_stack+0x21/0x24 [ 34.005211][ T45] dump_stack_lvl+0xee/0x150 [ 34.009780][ T45] ? __cfi_dump_stack_lvl+0x8/0x8 [ 34.014782][ T45] ? enqueue_timer+0xae/0x480 [ 34.019439][ T45] print_address_description+0x71/0x210 [ 34.024962][ T45] print_report+0x4a/0x60 [ 34.029272][ T45] kasan_report+0x122/0x150 [ 34.033768][ T45] ? enqueue_timer+0xae/0x480 [ 34.038440][ T45] ? __kasan_check_write+0x14/0x20 [ 34.043529][ T45] __asan_report_store8_noabort+0x17/0x20 [ 34.049225][ T45] enqueue_timer+0xae/0x480 [ 34.053704][ T45] __mod_timer+0x79f/0xb30 [ 34.058100][ T45] add_timer+0x68/0x80 [ 34.062144][ T45] __queue_delayed_work+0x173/0x200 [ 34.067326][ T45] queue_delayed_work_on+0xdb/0x150 [ 34.072504][ T45] ? __cfi_queue_delayed_work_on+0x10/0x10 [ 34.078654][ T45] ? hci_send_frame+0x231/0x2e0 [ 34.083496][ T45] hci_cmd_work+0x2c8/0x320 [ 34.087978][ T45] process_one_work+0x71f/0xc40 [ 34.092821][ T45] worker_thread+0xa29/0x11f0 [ 34.097476][ T45] kthread+0x281/0x320 [ 34.101540][ T45] ? __cfi_worker_thread+0x10/0x10 [ 34.106624][ T45] ? __cfi_kthread+0x10/0x10 [ 34.111190][ T45] ret_from_fork+0x1f/0x30 [ 34.115587][ T45] [ 34.118579][ T45] [ 34.120884][ T45] Allocated by task 298: [ 34.125091][ T45] kasan_set_track+0x4b/0x70 [ 34.129653][ T45] kasan_save_alloc_info+0x25/0x30 [ 34.134735][ T45] __kasan_kmalloc+0x95/0xb0 [ 34.139294][ T45] __kmalloc+0xb1/0x1e0 [ 34.143424][ T45] hci_alloc_dev_priv+0x27/0x1bd0 [ 34.148420][ T45] hci_uart_tty_ioctl+0x3d6/0xa20 [ 34.153414][ T45] tty_ioctl+0x8ef/0xc60 [ 34.157627][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 34.162274][ T45] __x64_sys_ioctl+0x7b/0x90 [ 34.166831][ T45] x64_sys_call+0x58b/0x9a0 [ 34.171305][ T45] do_syscall_64+0x4c/0xa0 [ 34.175694][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.181557][ T45] [ 34.183851][ T45] Freed by task 298: [ 34.187709][ T45] kasan_set_track+0x4b/0x70 [ 34.192266][ T45] kasan_save_free_info+0x31/0x50 [ 34.197279][ T45] ____kasan_slab_free+0x132/0x180 [ 34.202361][ T45] __kasan_slab_free+0x11/0x20 [ 34.207093][ T45] slab_free_freelist_hook+0xc2/0x190 [ 34.212437][ T45] __kmem_cache_free+0xb7/0x1b0 [ 34.217257][ T45] kfree+0x6f/0xf0 [ 34.220955][ T45] hci_release_dev+0x12a3/0x13b0 [ 34.225860][ T45] bt_host_release+0x82/0x90 [ 34.230421][ T45] device_release+0xa4/0x1d0 [ 34.234980][ T45] kobject_put+0x19d/0x280 [ 34.239383][ T45] put_device+0x1f/0x30 [ 34.243510][ T45] hci_dev_cmd+0x265/0x720 [ 34.247901][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 34.252547][ T45] sock_do_ioctl+0x101/0x310 [ 34.257109][ T45] sock_ioctl+0x4d8/0x6e0 [ 34.261409][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 34.266052][ T45] __x64_sys_ioctl+0x7b/0x90 [ 34.270612][ T45] x64_sys_call+0x58b/0x9a0 [ 34.275084][ T45] do_syscall_64+0x4c/0xa0 [ 34.279472][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.285337][ T45] [ 34.287650][ T45] Last potentially related work creation: [ 34.293333][ T45] kasan_save_stack+0x3a/0x60 [ 34.297979][ T45] __kasan_record_aux_stack+0xb6/0xc0 [ 34.303321][ T45] kasan_record_aux_stack_noalloc+0xb/0x10 [ 34.309099][ T45] insert_work+0x51/0x300 [ 34.313406][ T45] __queue_work+0x9b1/0xd30 [ 34.317881][ T45] queue_work_on+0xd2/0x140 [ 34.322354][ T45] __hci_cmd_sync_sk+0xa3e/0xcf0 [ 34.327436][ T45] hci_cmd_sync_status+0x53/0x120 [ 34.332430][ T45] hci_dev_cmd+0x628/0x720 [ 34.336818][ T45] hci_sock_ioctl+0x41e/0x7f0 [ 34.341465][ T45] sock_do_ioctl+0x101/0x310 [ 34.346025][ T45] sock_ioctl+0x4d8/0x6e0 [ 34.350322][ T45] __se_sys_ioctl+0x12f/0x1b0 [ 34.354965][ T45] __x64_sys_ioctl+0x7b/0x90 [ 34.359523][ T45] x64_sys_call+0x58b/0x9a0 [ 34.364004][ T45] do_syscall_64+0x4c/0xa0 [ 34.368407][ T45] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.374276][ T45] [ 34.376574][ T45] Second to last potentially related work creation: [ 34.383124][ T45] kasan_save_stack+0x3a/0x60 [ 34.387770][ T45] __kasan_record_aux_stack+0xb6/0xc0 [ 34.393113][ T45] kasan_record_aux_stack_noalloc+0xb/0x10 [ 34.398895][ T45] insert_work+0x51/0x300 [ 34.403199][ T45] __queue_work+0x9b1/0xd30 [ 34.407678][ T45] queue_work_on+0xd2/0x140 [ 34.412151][ T45] hci_cmd_timeout+0x191/0x200 [ 34.416882][ T45] process_one_work+0x71f/0xc40 [ 34.421701][ T45] worker_thread+0xa29/0x11f0 [ 34.426365][ T45] kthread+0x281/0x320 [ 34.430404][ T45] ret_from_fork+0x1f/0x30 [ 34.434790][ T45] [ 34.437087][ T45] The buggy address belongs to the object at ffff888111718000 [ 34.437087][ T45] which belongs to the cache kmalloc-8k of size 8192 [ 34.451123][ T45] The buggy address is located 2560 bytes inside of [ 34.451123][ T45] 8192-byte region [ffff888111718000, ffff88811171a000) [ 34.464538][ T45] [ 34.466832][ T45] The buggy address belongs to the physical page: [ 34.473210][ T45] page:ffffea000445c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111718 [ 34.483424][ T45] head:ffffea000445c600 order:3 compound_mapcount:0 compound_pincount:0 [ 34.491716][ T45] flags: 0x4000000000010200(slab|head|zone=1) [ 34.497762][ T45] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043500 [ 34.506313][ T45] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 34.514862][ T45] page dumped because: kasan: bad access detected [ 34.521245][ T45] page_owner tracks the page as allocated [ 34.526925][ T45] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 10, tgid 10 (kworker/u4:1), ts 1657248730, free_ts 0 [ 34.546945][ T45] post_alloc_hook+0x1f5/0x210 [ 34.551685][ T45] prep_new_page+0x1c/0x110 [ 34.556160][ T45] get_page_from_freelist+0x2c7b/0x2cf0 [ 34.561674][ T45] __alloc_pages+0x1c3/0x450 [ 34.566232][ T45] alloc_slab_page+0x6e/0xf0 [ 34.570792][ T45] new_slab+0x98/0x3d0 [ 34.574831][ T45] ___slab_alloc+0x6f6/0xb50 [ 34.579393][ T45] __slab_alloc+0x5e/0xa0 [ 34.583694][ T45] __kmem_cache_alloc_node+0x203/0x2c0 [ 34.589124][ T45] kmalloc_trace+0x29/0xb0 [ 34.593514][ T45] unpack_to_rootfs+0x101/0x4a2 [ 34.598335][ T45] do_populate_rootfs+0x47/0x213 [ 34.603239][ T45] async_run_entry_fn+0x9d/0x2d0 [ 34.608147][ T45] process_one_work+0x71f/0xc40 [ 34.612965][ T45] worker_thread+0xa29/0x11f0 [ 34.617608][ T45] kthread+0x281/0x320 [ 34.621647][ T45] page_owner free stack trace missing [ 34.626979][ T45] [ 34.629275][ T45] Memory state around the buggy address: [ 34.634869][ T45] ffff888111718900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.642895][ T45] ffff888111718980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.650922][ T45] >ffff888111718a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.658959][ T45] ^ [ 34.663006][ T45] ffff888111718a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.671040][ T45] ffff888111718b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.679434][ T45] ================================================================== [ 34.687465][ T45] Disabling lock debugging due to kernel taint [ 35.990526][ T296] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 35.990565][ C0] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 36.008303][ C0] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 36.016690][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 6.1.145-syzkaller-00002-gc750dc582629 #0 [ 36.027596][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 36.037628][ C0] RIP: 0010:__queue_work+0x575/0xd30 [ 36.042889][ C0] Code: 39 2b 0f 84 b9 00 00 00 e8 28 d7 28 00 4c 89 ff e8 50 60 ac 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 4c 3a 6d 00 49 8b 7d 00 e8 33 5c [ 36.062467][ C0] RSP: 0018:ffffc90000007c70 EFLAGS: 00010046 [ 36.068505][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff86e1c500 [ 36.076449][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 36.084391][ C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007 [ 36.092335][ C0] R10: ffffed10222e3139 R11: 1ffff110222e3139 R12: dffffc0000000000 [ 36.100280][ C0] R13: 0000000000000000 R14: ffff8881117189c8 R15: 0000000000000008 [ 36.108224][ C0] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.117121][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.123676][ C0] CR2: 00007ffc3afe8750 CR3: 000000010758e000 CR4: 00000000003506b0 [ 36.131626][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.139575][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.147518][ C0] Call Trace: [ 36.150770][ C0] [ 36.153590][ C0] delayed_work_timer_fn+0x61/0x80 [ 36.158679][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 36.164460][ C0] call_timer_fn+0x46/0x2a0 [ 36.168939][ C0] ? __cfi_delayed_work_timer_fn+0x10/0x10 [ 36.174718][ C0] __run_timers+0x667/0x9a0 [ 36.179212][ C0] ? calc_index+0x200/0x200 [ 36.183700][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 36.188886][ C0] run_timer_softirq+0x6a/0xf0 [ 36.193628][ C0] handle_softirqs+0x1d7/0x600 [ 36.198371][ C0] ? irqtime_account_irq+0xc4/0x240 [ 36.203551][ C0] __irq_exit_rcu+0x52/0xf0 [ 36.208030][ C0] irq_exit_rcu+0x9/0x10 [ 36.212247][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 36.217860][ C0] [ 36.220771][ C0] [ 36.223680][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 36.229638][ C0] RIP: 0010:default_idle+0xf/0x20 [ 36.234648][ C0] Code: e9 47 ff ff ff 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 53 d2 52 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 [ 36.254234][ C0] RSP: 0018:ffffffff86e07d58 EFLAGS: 00000257 [ 36.260278][ C0] RAX: ffff8881f7000000 RBX: ffffffff86e1c500 RCX: 4b8cd16490964600 [ 36.268225][ C0] RDX: 0000000000000001 RSI: ffffffff85aa0bc0 RDI: ffffffff85aa0b80 [ 36.276173][ C0] RBP: ffffffff86e07d58 R08: dffffc0000000000 R09: ffffed103ee06917 [ 36.284120][ C0] R10: 0000000000000000 R11: ffffffff84f36120 R12: 0000000000000000 [ 36.292067][ C0] R13: 0000000000000000 R14: ffffffff86e1c500 R15: dffffc0000000000 [ 36.300016][ C0] ? __cfi_default_idle+0x10/0x10 [ 36.305027][ C0] arch_cpu_idle+0x1c/0x20 [ 36.309420][ C0] default_idle_call+0x71/0x1d0 [ 36.314250][ C0] do_idle+0x1a7/0x520 [ 36.318297][ C0] ? ct_irq_exit+0x9/0x10 [ 36.322612][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 36.327789][ C0] cpu_startup_entry+0x43/0x60 [ 36.332533][ C0] rest_init+0x10a/0x130 [ 36.336760][ C0] ? __cfi_x86_late_time_init+0x8/0x8 [ 36.342108][ C0] arch_call_rest_init+0xe/0x10 [ 36.346934][ C0] start_kernel+0x482/0x4f0 [ 36.351411][ C0] x86_64_start_reservations+0x2a/0x2c [ 36.356853][ C0] x86_64_start_kernel+0x7c/0x81 [ 36.361774][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 36.367646][ C0] [ 36.370649][ C0] Modules linked in: [ 36.374536][ C0] ---[ end trace 0000000000000000 ]--- [ 36.379963][ C0] RIP: 0010:__queue_work+0x575/0xd30 [ 36.385233][ C0] Code: 39 2b 0f 84 b9 00 00 00 e8 28 d7 28 00 4c 89 ff e8 50 60 ac 03 49 bc 00 00 00 00 00 fc ff df 4c 8b 6d d0 4c 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ef e8 4c 3a 6d 00 49 8b 7d 00 e8 33 5c [ 36.404813][ C0] RSP: 0018:ffffc90000007c70 EFLAGS: 00010046 [ 36.410855][ C0] RAX: 0000000000000000 RBX: 000000007fffffff RCX: ffffffff86e1c500 [ 36.418803][ C0] RDX: 0000000000000100 RSI: 000000007fffffff RDI: 000000007fffffff [ 36.426749][ C0] RBP: ffffc90000007d08 R08: fffffffffffffffb R09: 0000000000000007 [ 36.434696][ C0] R10: ffffed10222e3139 R11: 1ffff110222e3139 R12: dffffc0000000000 [ 36.442644][ C0] R13: 0000000000000000 R14: ffff8881117189c8 R15: 0000000000000008 [ 36.450598][ C0] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.459505][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.466067][ C0] CR2: 00007ffc3afe8750 CR3: 000000010758e000 CR4: 00000000003506b0 [ 36.474016][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.481963][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.489912][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 36.497271][ C0] Kernel Offset: disabled [ 36.501573][ C0] Rebooting in 86400 seconds..