./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1913209157 <...> Warning: Permanently added '10.128.1.34' (ED25519) to the list of known hosts. execve("./syz-executor1913209157", ["./syz-executor1913209157"], 0x7ffd18c21960 /* 10 vars */) = 0 brk(NULL) = 0x555555851000 brk(0x555555851d00) = 0x555555851d00 arch_prctl(ARCH_SET_FS, 0x555555851380) = 0 set_tid_address(0x555555851650) = 5037 set_robust_list(0x555555851660, 24) = 0 rseq(0x555555851ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1913209157", 4096) = 28 getrandom("\x7d\xc5\x01\xa2\xe0\xb8\xd7\x49", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555851d00 brk(0x555555872d00) = 0x555555872d00 brk(0x555555873000) = 0x555555873000 mprotect(0x7f8e3eed9000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mkdir("./syzkaller.gmM77g", 0700) = 0 chmod("./syzkaller.gmM77g", 0777) = 0 chdir("./syzkaller.gmM77g") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555851650) = 5038 ./strace-static-x86_64: Process 5038 attached [pid 5038] set_robust_list(0x555555851660, 24) = 0 [pid 5038] chdir("./0") = 0 [pid 5038] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5038] setpgid(0, 0) = 0 [pid 5038] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5038] write(3, "1000", 4) = 4 [pid 5038] close(3) = 0 [pid 5038] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5038] memfd_create("syzkaller", 0) = 3 [pid 5038] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8e36a06000 [pid 5038] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576 [pid 5038] munmap(0x7f8e36a06000, 138412032) = 0 [pid 5038] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5038] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5038] close(3) = 0 [pid 5038] mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0777) = 0 [ 75.663733][ T5038] syz-executor191[5038]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 75.703227][ T5038] loop0: detected capacity change from 0 to 2048 [pid 5038] mount("/dev/loop0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "udf", MS_NODIRATIME, "") = 0 [pid 5038] openat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_DIRECTORY) = 3 [pid 5038] chdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [pid 5038] ioctl(4, LOOP_CLR_FD) = 0 [pid 5038] close(4) = 0 [pid 5038] memfd_create("syzkaller", 0) = 4 [pid 5038] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8e36a06000 [ 75.721376][ T5038] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [pid 5038] write(4, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\xff\x01\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\xbb\x02\x87\x1c\xc7\xbb\xb3\x5e\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 [pid 5038] munmap(0x7f8e36a06000, 138412032) = 0 [pid 5038] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 5038] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 5038] ioctl(5, LOOP_CLR_FD) = 0 [pid 5038] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 5038] close(5) = 0 [pid 5038] close(4) = 0 [pid 5038] creat("./bus", 000) = 4 [pid 5038] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 5038] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 5038] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x2f\x62\x75\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 1048576 [pid 5038] exit_group(0) = ? [pid 5038] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5038, si_uid=0, si_status=0, si_utime=0, si_stime=19 /* 0.19 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555558526f0 /* 4 entries */, 32768) = 352 [ 75.993154][ T5037] BUG: unable to handle page fault for address: ffffed1018e3f8b3 [ 76.000915][ T5037] #PF: supervisor read access in kernel mode [ 76.006879][ T5037] #PF: error_code(0x0000) - not-present page [ 76.012844][ T5037] PGD 23ffee067 P4D 23ffee067 PUD 13fff5067 PMD 0 [ 76.019356][ T5037] Oops: 0000 [#1] PREEMPT SMP KASAN [ 76.024542][ T5037] CPU: 1 PID: 5037 Comm: syz-executor191 Not tainted 6.6.0-rc5-syzkaller-00055-g1c8b86a3799f #0 [ 76.034961][ T5037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 76.045008][ T5037] RIP: 0010:udf_close_lvid+0x14c/0x9a0 [ 76.050489][ T5037] Code: dc 49 83 c4 50 0f 84 f3 00 00 00 49 8d bf c0 00 00 00 48 89 7c 24 40 31 f6 e8 80 fc ce 07 49 8d 7c 24 18 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3d 05 00 00 4c 89 7c 24 18 4c 89 74 24 [ 76.070088][ T5037] RSP: 0018:ffffc90003aafb00 EFLAGS: 00010a02 [ 76.076153][ T5037] RAX: 1ffff11018e3f8b3 RBX: ffff88807486a000 RCX: 0000000000000001 [ 76.084134][ T5037] RDX: 0000000000000000 RSI: ffffffff8b5982c0 RDI: ffff8880c71fc598 [ 76.092127][ T5037] RBP: ffffc90003aafbf8 R08: ffffffff8e9a322f R09: 1ffffffff1d34645 [ 76.100118][ T5037] R10: dffffc0000000000 R11: fffffbfff1d34646 R12: ffff8880c71fc580 [ 76.108106][ T5037] R13: dffffc0000000000 R14: 1ffff92000755f6c R15: ffff888022395000 [ 76.116085][ T5037] FS: 0000555555851380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 76.125018][ T5037] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.131623][ T5037] CR2: ffffed1018e3f8b3 CR3: 0000000028938000 CR4: 00000000003506e0 [ 76.139598][ T5037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 76.147564][ T5037] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 76.155535][ T5037] Call Trace: [ 76.158815][ T5037] [ 76.161749][ T5037] ? __die_body+0x8b/0xe0 [ 76.166106][ T5037] ? page_fault_oops+0x802/0xaa0 [ 76.171095][ T5037] ? kernelmode_fixup_or_oops+0x2a0/0x2a0 [ 76.176829][ T5037] ? page_fault_oops+0xaa0/0xaa0 [ 76.181775][ T5037] ? kernelmode_fixup_or_oops+0x225/0x2a0 [ 76.187494][ T5037] ? __mutex_trylock_common+0x182/0x2e0 [ 76.193067][ T5037] ? __bad_area_nosemaphore+0x12a/0x730 [ 76.198621][ T5037] ? rcu_is_watching+0x15/0xb0 [ 76.203401][ T5037] ? spurious_kernel_fault_check+0x130/0x130 [ 76.209380][ T5037] ? spurious_kernel_fault+0x11b/0x510 [ 76.214836][ T5037] ? do_kern_addr_fault+0x30/0x80 [ 76.219863][ T5037] ? exc_page_fault+0x5ae/0x860 [ 76.224721][ T5037] ? udf_close_lvid+0x140/0x9a0 [ 76.229573][ T5037] ? __might_sleep+0xc0/0xc0 [ 76.234167][ T5037] ? asm_exc_page_fault+0x26/0x30 [ 76.239196][ T5037] ? udf_close_lvid+0x14c/0x9a0 [ 76.244057][ T5037] ? udf_open_lvid+0x5b0/0x5b0 [ 76.248820][ T5037] ? iput+0x37e/0x8f0 [ 76.252802][ T5037] ? clear_inode+0x150/0x150 [ 76.257400][ T5037] udf_put_super+0xcd/0x160 [ 76.261920][ T5037] ? udf_free_in_core_inode+0x30/0x30 [ 76.267326][ T5037] generic_shutdown_super+0x13a/0x2c0 [ 76.272707][ T5037] kill_block_super+0x41/0x70 [ 76.277401][ T5037] deactivate_locked_super+0xa4/0x110 [ 76.282793][ T5037] cleanup_mnt+0x426/0x4c0 [ 76.287240][ T5037] ? _raw_spin_unlock_irq+0x23/0x50 [ 76.292461][ T5037] task_work_run+0x24a/0x300 [ 76.297066][ T5037] ? task_work_cancel+0x2b0/0x2b0 [ 76.302099][ T5037] ? __x64_sys_umount+0x126/0x170 [ 76.307131][ T5037] ptrace_notify+0x2cd/0x380 [ 76.311732][ T5037] ? do_notify_parent+0x1100/0x1100 [ 76.316974][ T5037] ? user_path_at_empty+0x12f/0x180 [ 76.322197][ T5037] ? __x64_sys_umount+0x126/0x170 [ 76.327223][ T5037] ? path_umount+0xf40/0xf40 [ 76.331813][ T5037] ? syscall_enter_from_user_mode+0x32/0x230 [ 76.337808][ T5037] syscall_exit_to_user_mode+0x15c/0x280 [ 76.343528][ T5037] do_syscall_64+0x4d/0xc0 [ 76.347946][ T5037] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 76.353840][ T5037] RIP: 0033:0x7f8e3ee46547 [ 76.358255][ T5037] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 [ 76.377860][ T5037] RSP: 002b:00007ffc93bc1cc8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 76.386275][ T5037] RAX: 0000000000000000 RBX: 0000000000012769 RCX: 00007f8e3ee46547 [ 76.394267][ T5037] RDX: 0000000000000000 RSI: 000000000000000a RDI: 00007ffc93bc1d80 [ 76.402255][ T5037] RBP: 00007ffc93bc1d80 R08: 0000000000000000 R09: 0000000000000000 [ 76.410231][ T5037] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffc93bc2df0 [ 76.418204][ T5037] R13: 00005555558526c0 R14: 431bde82d7b634db R15: 00007ffc93bc2e10 [ 76.426186][ T5037] [ 76.429204][ T5037] Modules linked in: [ 76.433093][ T5037] CR2: ffffed1018e3f8b3 [ 76.437237][ T5037] ---[ end trace 0000000000000000 ]--- [ 76.442685][ T5037] RIP: 0010:udf_close_lvid+0x14c/0x9a0 [ 76.448149][ T5037] Code: dc 49 83 c4 50 0f 84 f3 00 00 00 49 8d bf c0 00 00 00 48 89 7c 24 40 31 f6 e8 80 fc ce 07 49 8d 7c 24 18 48 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 3d 05 00 00 4c 89 7c 24 18 4c 89 74 24 [ 76.467756][ T5037] RSP: 0018:ffffc90003aafb00 EFLAGS: 00010a02 [ 76.473825][ T5037] RAX: 1ffff11018e3f8b3 RBX: ffff88807486a000 RCX: 0000000000000001 [ 76.481815][ T5037] RDX: 0000000000000000 RSI: ffffffff8b5982c0 RDI: ffff8880c71fc598 [ 76.489785][ T5037] RBP: ffffc90003aafbf8 R08: ffffffff8e9a322f R09: 1ffffffff1d34645 [ 76.497755][ T5037] R10: dffffc0000000000 R11: fffffbfff1d34646 R12: ffff8880c71fc580 [ 76.505724][ T5037] R13: dffffc0000000000 R14: 1ffff92000755f6c R15: ffff888022395000 [ 76.513699][ T5037] FS: 0000555555851380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 76.522636][ T5037] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.529218][ T5037] CR2: ffffed1018e3f8b3 CR3: 0000000028938000 CR4: 00000000003506e0 [ 76.537194][ T5037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 76.545168][ T5037] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 76.553140][ T5037] Kernel panic - not syncing: Fatal exception [ 76.559455][ T5037] Kernel Offset: disabled [ 76.563772][ T5037] Rebooting in 86400 seconds..