ci2-android-5-10/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-5-10/syz-executor185294614 <...> Warning: Permanently added '10.128.0.54' (ED25519) to the list of known hosts. execve("ci2-android-5-10/syz-executor185294614", ["ci2-android-5-10/syz-executor185294614"], 0x7ffe0dded8d0 /* 10 vars */) = 0 brk(NULL) = 0x55556c305000 brk(0x55556c305d40) = 0x55556c305d40 arch_prctl(ARCH_SET_FS, 0x55556c3053c0) = 0 set_tid_address(0x55556c305690) = 297 set_robust_list(0x55556c3056a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-5-10/syz-executor185294614", 4096) = 44 getrandom("\xfa\x0c\x85\x2e\x71\x6e\xc5\xb9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556c305d40 brk(0x55556c326d40) = 0x55556c326d40 brk(0x55556c327000) = 0x55556c327000 mprotect(0x7f0d09404000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0d00f58000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 munmap(0x7f0d00f58000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 [ 26.104093][ T24] audit: type=1400 audit(1785905590.990:64): avc: denied { execmem } for pid=297 comm="syz-executor185" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 26.123887][ T24] audit: type=1400 audit(1785905591.010:65): avc: denied { read write } for pid=297 comm="syz-executor185" name="loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 close(4) = 0 mkdir("./file2", 0777) = 0 [ 26.148103][ T24] audit: type=1400 audit(1785905591.010:66): avc: denied { open } for pid=297 comm="syz-executor185" path="/dev/loop0" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.172214][ T24] audit: type=1400 audit(1785905591.010:67): avc: denied { ioctl } for pid=297 comm="syz-executor185" path="/dev/loop0" dev="devtmpfs" ino=115 ioctlcmd=0x4c00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 26.183937][ T297] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 26.198207][ T24] audit: type=1400 audit(1785905591.070:68): avc: denied { mounton } for pid=297 comm="syz-executor185" path="/root/file2" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 26.233967][ T297] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 26.245104][ T297] EXT4-fs (loop0): revision level too high, forcing read-only mode mount("/dev/loop0", "./file2", "ext4", MS_NODEV|MS_NOATIME, "block_validity,,errors=continue") = 0 openat(AT_FDCWD, "./file2", O_RDONLY|O_DIRECTORY) = 3 chdir("./file2") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 chdir("./file0") = 0 openat(AT_FDCWD, ".", O_RDONLY) = 4 lseek(4, -4, SEEK_END) = 56 [ 26.253678][ T297] EXT4-fs (loop0): orphan cleanup on readonly fs [ 26.260402][ T297] EXT4-fs (loop0): 1 truncate cleaned up [ 26.266043][ T297] EXT4-fs (loop0): mounted filesystem without journal. Opts: block_validity,,errors=continue [ 26.276506][ T24] audit: type=1400 audit(1785905591.170:69): avc: denied { mount } for pid=297 comm="syz-executor185" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.289732][ T297] ================================================================== [ 26.306407][ T297] BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry+0x7e3/0x990 [ 26.314669][ T297] Read of size 2 at addr ffff88810c50933c by task syz-executor185/297 [ 26.322911][ T297] [ 26.325249][ T297] CPU: 0 PID: 297 Comm: syz-executor185 Not tainted syzkaller #0 [ 26.332958][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.343006][ T297] Call Trace: [ 26.346293][ T297] __dump_stack+0x21/0x24 [ 26.350621][ T297] dump_stack_lvl+0x1a7/0x208 [ 26.355296][ T297] ? show_regs_print_info+0x18/0x18 [ 26.360766][ T297] ? thaw_kernel_threads+0x220/0x220 [ 26.366060][ T297] print_address_description+0x7f/0x2c0 [ 26.371605][ T297] ? __ext4_check_dir_entry+0x7e3/0x990 [ 26.377144][ T297] kasan_report+0x100/0x140 [ 26.381643][ T297] ? __ext4_check_dir_entry+0x7e3/0x990 [ 26.387359][ T297] __asan_report_load2_noabort+0x14/0x20 [ 26.392987][ T297] __ext4_check_dir_entry+0x7e3/0x990 [ 26.398358][ T297] ext4_read_inline_dir+0x851/0xd00 [ 26.403553][ T297] ? ext4_inlinedir_to_tree+0x1010/0x1010 [ 26.409268][ T297] ? __kasan_check_write+0x14/0x20 [ 26.414370][ T297] ? __switch_to+0x53e/0x10a0 [ 26.419042][ T297] ext4_readdir+0x3a0/0x3a80 [ 26.423627][ T297] ? __kasan_check_read+0x11/0x20 [ 26.428663][ T297] ? psi_group_change+0x7cb/0xe00 [ 26.433704][ T297] ? compat_start_thread+0x80/0x80 [ 26.438809][ T297] ? memset+0x35/0x40 [ 26.442805][ T297] ? fsnotify+0x19ce/0x1a90 [ 26.447308][ T297] ? switch_mm_irqs_off+0x752/0x990 [ 26.452505][ T297] ? ext4_dir_llseek+0x480/0x480 [ 26.457467][ T297] ? __kasan_check_write+0x14/0x20 [ 26.462583][ T297] ? avc_policy_seqno+0x1b/0x70 [ 26.467463][ T297] ? fsnotify_perm+0x311/0x4a0 [ 26.472253][ T297] ? __kasan_check_write+0x14/0x20 [ 26.477369][ T297] iterate_dir+0x25c/0x560 [ 26.481797][ T297] ? ext4_dir_llseek+0x480/0x480 [ 26.486728][ T297] __se_sys_getdents+0xf2/0x250 [ 26.491590][ T297] ? __x64_sys_getdents+0x90/0x90 [ 26.496610][ T297] ? switch_fpu_return+0x19c/0x330 [ 26.501716][ T297] ? fillonedir+0x430/0x430 [ 26.506211][ T297] ? fpu__clear_all+0x20/0x20 [ 26.510900][ T297] __x64_sys_getdents+0x7b/0x90 [ 26.515747][ T297] do_syscall_64+0x31/0x40 [ 26.520158][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.526039][ T297] RIP: 0033:0x7f0d0937b2c9 [ 26.530536][ T297] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 26.550136][ T297] RSP: 002b:00007ffc7bf38378 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 26.558543][ T297] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f0d0937b2c9 [ 26.566514][ T297] RDX: 0000000000000054 RSI: 0000000000000000 RDI: 0000000000000004 [ 26.574492][ T297] RBP: 0000000000000001 R08: 00007ffc7bf384a8 R09: 00007ffc7bf384a8 [ 26.582462][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7bf38498 [ 26.590457][ T297] R13: 0000000000000002 R14: 00007f0d09404c80 R15: 0000000000000002 [ 26.598683][ T297] [ 26.601013][ T297] Allocated by task 297: [ 26.605478][ T297] __kasan_kmalloc+0xd4/0x100 [ 26.610156][ T297] __kmalloc+0x19f/0x330 [ 26.614395][ T297] ext4_read_inline_dir+0x24d/0xd00 [ 26.619583][ T297] ext4_readdir+0x3a0/0x3a80 [ 26.624166][ T297] iterate_dir+0x25c/0x560 [ 26.628573][ T297] __se_sys_getdents+0xf2/0x250 [ 26.633424][ T297] __x64_sys_getdents+0x7b/0x90 [ 26.638268][ T297] do_syscall_64+0x31/0x40 [ 26.642681][ T297] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.648558][ T297] [ 26.650882][ T297] The buggy address belongs to the object at ffff88810c509300 [ 26.650882][ T297] which belongs to the cache kmalloc-64 of size 64 [ 26.664754][ T297] The buggy address is located 60 bytes inside of [ 26.664754][ T297] 64-byte region [ffff88810c509300, ffff88810c509340) [ 26.677842][ T297] The buggy address belongs to the page: [ 26.683500][ T297] page:ffffea0004314240 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c509 [ 26.693834][ T297] flags: 0x4000000000000200(slab) [ 26.698861][ T297] raw: 4000000000000200 ffffea0004307b00 0000001a0000001a ffff888100043800 [ 26.707494][ T297] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 26.716091][ T297] page dumped because: kasan: bad access detected [ 26.722546][ T297] page_owner tracks the page as allocated [ 26.728275][ T297] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 15, ts 3778927220, free_ts 0 [ 26.743190][ T297] prep_new_page+0x176/0x190 [ 26.747793][ T297] get_page_from_freelist+0x225f/0x23f0 [ 26.753333][ T297] __alloc_pages_nodemask+0x29a/0x640 [ 26.758712][ T297] new_slab+0x84/0x3f0 [ 26.762776][ T297] ___slab_alloc+0x2f8/0x4c0 [ 26.767354][ T297] __slab_alloc+0x63/0xa0 [ 26.771679][ T297] __kmalloc+0x1f9/0x330 [ 26.775912][ T297] kobject_get_path+0xbf/0x1f0 [ 26.780670][ T297] kobject_uevent_env+0x28a/0x700 [ 26.785699][ T297] kobject_uevent+0x1d/0x30 [ 26.790206][ T297] device_add+0x7d2/0xc00 [ 26.794545][ T297] input_register_device+0x9c9/0xfa0 [ 26.799834][ T297] atkbd_connect+0x735/0x990 [ 26.804434][ T297] serio_driver_probe+0x7a/0xa0 [ 26.809293][ T297] really_probe+0x373/0xa60 [ 26.813806][ T297] driver_probe_device+0xe1/0x190 [ 26.818835][ T297] page_owner free stack trace missing [ 26.824205][ T297] [ 26.826547][ T297] Memory state around the buggy address: [ 26.832187][ T297] ffff88810c509200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.840253][ T297] ffff88810c509280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.848327][ T297] >ffff88810c509300: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc [ 26.856394][ T297] ^ [ 26.862287][ T297] ffff88810c509380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.870354][ T297] ffff88810c509400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.878420][ T297] ================================================================== [ 26.886482][ T297] Disabling lock debugging due to kernel taint getdents(4, NULL /* 0 entries */, 84) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 26.893163][ T297] EXT4-fs error (device loop0): ext4_read_inline_dir:1622: inode #12: block 7: comm syz-executor185: path /root/file2/file0: bad entry in directory: